| name: Code Review Runner | |
| on: | |
| issue_comment: | |
| types: [created] | |
| workflow_dispatch: | |
| inputs: | |
| runtime_canary: | |
| description: Test the staged Codex package without submitting a review. | |
| required: false | |
| type: boolean | |
| default: false | |
| pr_number: | |
| required: false | |
| type: string | |
| head_sha: | |
| required: false | |
| type: string | |
| base_sha: | |
| required: false | |
| type: string | |
| review_focus: | |
| required: false | |
| type: string | |
| default: '' | |
| manage_status: | |
| description: Update the code-review commit status from this run. | |
| required: false | |
| type: boolean | |
| default: true | |
| permissions: | |
| statuses: write | |
| pull-requests: write | |
| contents: read | |
| issues: write | |
| # One review-step budget for helper download, all attempts, and final verification. | |
| env: | |
| REVIEW_TIMEOUT_MINUTES: 120 | |
| jobs: | |
| runtime-canary: | |
| if: ${{ github.event_name == 'workflow_dispatch' && inputs.runtime_canary == true }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 25 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Install ossutil | |
| run: | | |
| tmp_dir="$(mktemp -d)" | |
| trap 'rm -rf "$tmp_dir"' EXIT | |
| curl -fsSL -o "$tmp_dir/ossutil.zip" https://gosspublic.alicdn.com/ossutil/1.7.19/ossutil-v1.7.19-linux-amd64.zip | |
| unzip -q "$tmp_dir/ossutil.zip" -d "$tmp_dir" | |
| sudo install -m 0755 "$tmp_dir/ossutil-v1.7.19-linux-amd64/ossutil" /usr/local/bin/ossutil | |
| - name: Install staged Codex package | |
| env: | |
| OSS_AK: ${{ secrets.OSS_AK }} | |
| OSS_SK: ${{ secrets.OSS_SK }} | |
| OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com | |
| run: | | |
| set -euo pipefail | |
| archive="$RUNNER_TEMP/codex-exec-goal.tar.gz" | |
| package="$RUNNER_TEMP/codex-exec-goal" | |
| ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \ | |
| cp -f oss://doris-community-ci/codex/releases/codex-exec-goal-0.162.1-3547e9086675-x86_64-unknown-linux-gnu.tar.gz "$archive" | |
| echo "51304e4f9c343ae84e00a304344df41c2fd32821c83bdbf5be68b0f0c25ddae1 $archive" | sha256sum --check | |
| mkdir -p "$package" | |
| tar -xzf "$archive" -C "$package" | |
| (cd "$package" && sha256sum --check SHA256SUMS) | |
| test "$(jq -r .version "$package/codex-package.json")" = 0.162.1 | |
| "$package/bin/codex" --version | |
| "$package/bin/codex" exec --help | grep -q -- '--goal' | |
| echo "CODEX_CANARY_BIN=$package/bin/codex" >> "$GITHUB_ENV" | |
| - name: Load one review auth snapshot | |
| id: auth | |
| env: | |
| OSS_AK: ${{ secrets.OSS_AK }} | |
| OSS_SK: ${{ secrets.OSS_SK }} | |
| OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com | |
| run: | | |
| set -euo pipefail | |
| umask 077 | |
| home="$RUNNER_TEMP/codex-canary-home" | |
| install -m 700 -d "$home" | |
| ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \ | |
| cp -f oss://doris-community-ci/codex/auth.json.4 "$home/auth.json" >/dev/null | |
| jq -e ' | |
| .auth_mode == "chatgpt" | |
| and (.tokens.access_token | type == "string" and length > 0) | |
| and (.tokens.refresh_token | type == "string" and length > 0) | |
| ' "$home/auth.json" >/dev/null | |
| sha256sum "$home/auth.json" | awk '{print $1}' \ | |
| > "$RUNNER_TEMP/codex-canary-auth-original.sha256" | |
| cat > "$home/config.toml" <<'EOF' | |
| cli_auth_credentials_store = "file" | |
| approval_policy = "never" | |
| [features] | |
| memories = true | |
| [memories] | |
| use_memories = true | |
| generate_memories = true | |
| [otel] | |
| environment = "github-actions" | |
| exporter = "none" | |
| trace_exporter = "none" | |
| metrics_exporter = "none" | |
| EOF | |
| echo "CODEX_HOME=$home" >> "$GITHUB_ENV" | |
| - name: Test ChatGPT model access and goal mode without GitHub writes | |
| timeout-minutes: 18 | |
| run: | | |
| set -uo pipefail | |
| run_model() { | |
| local label="$1" model="$2" goal="$3" effort="${4:-low}" | |
| local events="$RUNNER_TEMP/codex-canary-$label.jsonl" | |
| local final="$RUNNER_TEMP/codex-canary-$label.txt" | |
| local args=(exec --skip-git-repo-check --json --model "$model" | |
| --config "model_reasoning_effort=$effort" --sandbox read-only | |
| --color never --output-last-message "$final") | |
| if [ "$goal" = true ]; then | |
| args+=(--goal) | |
| fi | |
| local prompt="Reply with exactly OK. Do not access files or external services." | |
| if [ "$goal" = true ]; then | |
| prompt="Create a goal to reply OK, mark it complete, then reply OK. Do not access files or external services." | |
| fi | |
| timeout --signal=INT --kill-after=10s 180s \ | |
| env -u GH_TOKEN -u GITHUB_TOKEN "$CODEX_CANARY_BIN" \ | |
| "${args[@]}" "$prompt" > "$events" 2> "$RUNNER_TEMP/codex-canary-$label.stderr" | |
| local status=$? | |
| echo "$label: exit_status=$status" | |
| jq -r 'select(.type == "turn.failed" or .type == "error") | | |
| .error.message // .message // empty' "$events" | tail -n 2 || true | |
| if [ "$status" -ne 0 ] || | |
| ! jq -e 'select(.type == "turn.completed")' "$events" >/dev/null; then | |
| return 1 | |
| fi | |
| return 0 | |
| } | |
| run_model sol gpt-6-sol false | |
| sol_status=$? | |
| run_model prior-sol gpt-5.6-sol false | |
| prior_status=$? | |
| goal_status=1 | |
| if [ "$sol_status" -eq 0 ]; then | |
| run_model sol-goal gpt-6-sol true | |
| goal_status=$? | |
| fi | |
| run_model sol61 gpt-6.1-sol false xhigh | |
| sol61_status=$? | |
| sol61_goal_status=1 | |
| if [ "$sol61_status" -eq 0 ]; then | |
| run_model sol61-goal gpt-6.1-sol true xhigh | |
| sol61_goal_status=$? | |
| fi | |
| echo "model_canary: gpt-6-sol=$sol_status gpt-5.6-sol=$prior_status gpt-6-sol-goal=$goal_status gpt-6.1-sol-xhigh=$sol61_status gpt-6.1-sol-xhigh-goal=$sol61_goal_status" | |
| test "$sol_status" -eq 0 && test "$goal_status" -eq 0 && \ | |
| test "$sol61_status" -eq 0 && test "$sol61_goal_status" -eq 0 | |
| - name: Sync refreshed canary auth | |
| if: ${{ always() && steps.auth.outcome == 'success' }} | |
| env: | |
| OSS_AK: ${{ secrets.OSS_AK }} | |
| OSS_SK: ${{ secrets.OSS_SK }} | |
| OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com | |
| run: | | |
| set -euo pipefail | |
| auth_object=oss://doris-community-ci/codex/auth.json.4 | |
| jq -e ' | |
| .auth_mode == "chatgpt" | |
| and (.tokens.access_token | type == "string" and length > 0) | |
| and (.tokens.refresh_token | type == "string" and length > 0) | |
| ' "$CODEX_HOME/auth.json" >/dev/null | |
| original_hash="$(cat "$RUNNER_TEMP/codex-canary-auth-original.sha256")" | |
| local_hash="$(sha256sum "$CODEX_HOME/auth.json" | awk '{print $1}')" | |
| if [ "$local_hash" = "$original_hash" ]; then | |
| echo "Canary auth was unchanged." | |
| exit 0 | |
| fi | |
| remote_auth="$(mktemp "$RUNNER_TEMP/codex-canary-current.XXXXXX")" | |
| trap 'rm -f "$remote_auth"' EXIT | |
| ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \ | |
| cp -f "$auth_object" "$remote_auth" >/dev/null | |
| remote_hash="$(sha256sum "$remote_auth" | awk '{print $1}')" | |
| if [ "$remote_hash" != "$original_hash" ]; then | |
| echo "::error::Auth changed concurrently; refusing to overwrite it." | |
| exit 1 | |
| fi | |
| ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \ | |
| cp -f "$CODEX_HOME/auth.json" "$auth_object" >/dev/null | |
| echo "Synced refreshed canary auth." | |
| code-review: | |
| runs-on: ubuntu-24.04 | |
| # Serialize actual reviews of a PR, including comment and dispatch triggers. | |
| # Keep every pending request rather than replacing the previous queued job. | |
| concurrency: | |
| group: code-review-pr-${{ github.event.issue.number || inputs.pr_number || github.run_id }} | |
| cancel-in-progress: false | |
| queue: max | |
| outputs: | |
| base_sha: ${{ steps.review_inputs.outputs.base_sha }} | |
| head_sha: ${{ steps.review_inputs.outputs.head_sha }} | |
| manage_status: ${{ steps.review_inputs.outputs.manage_status }} | |
| review_state: ${{ steps.review.outputs.review_state }} | |
| pr_number: ${{ steps.review_inputs.outputs.pr_number }} | |
| # Pre-finalization steps can use 220 minutes and auth sync can use 8 more, | |
| # leaving 10 minutes for runner setup and post-job cleanup. | |
| timeout-minutes: 238 | |
| if: >- | |
| inputs.runtime_canary != true && | |
| ( | |
| inputs.pr_number != '' || | |
| ( | |
| github.event_name == 'issue_comment' && | |
| github.event.issue.pull_request && | |
| startsWith(github.event.comment.body, '/review') && | |
| ( | |
| github.event.comment.author_association == 'MEMBER' || | |
| github.event.comment.author_association == 'OWNER' || | |
| github.event.comment.author_association == 'COLLABORATOR' | |
| ) | |
| ) | |
| ) | |
| steps: | |
| - name: Resolve review inputs | |
| id: review_inputs | |
| timeout-minutes: 2 | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| ISSUE_NUMBER: ${{ github.event.issue.number }} | |
| COMMENT_BODY: ${{ github.event.comment.body }} | |
| INPUT_PR_NUMBER: ${{ inputs.pr_number }} | |
| INPUT_HEAD_SHA: ${{ inputs.head_sha }} | |
| INPUT_BASE_SHA: ${{ inputs.base_sha }} | |
| INPUT_REVIEW_FOCUS: ${{ inputs.review_focus }} | |
| INPUT_MANAGE_STATUS: ${{ inputs.manage_status }} | |
| REPO: ${{ github.repository }} | |
| run: | | |
| if [ -n "$INPUT_PR_NUMBER" ]; then | |
| PR_NUMBER="$INPUT_PR_NUMBER" | |
| HEAD_SHA="$INPUT_HEAD_SHA" | |
| BASE_SHA="$INPUT_BASE_SHA" | |
| REVIEW_FOCUS="$INPUT_REVIEW_FOCUS" | |
| MANAGE_STATUS="$INPUT_MANAGE_STATUS" | |
| elif [ "$EVENT_NAME" = "issue_comment" ]; then | |
| PR_NUMBER="$ISSUE_NUMBER" | |
| PR_JSON="$(gh api "repos/${REPO}/pulls/${PR_NUMBER}")" | |
| HEAD_SHA="$(jq -er '.head.sha' <<<"$PR_JSON")" | |
| BASE_SHA="$(jq -er '.base.sha' <<<"$PR_JSON")" | |
| REVIEW_FOCUS="$(printf '%s' "${COMMENT_BODY#'/review'}" | | |
| python3 -c 'import sys; sys.stdout.write(sys.stdin.read().lstrip())')" | |
| MANAGE_STATUS=true | |
| else | |
| echo "Review inputs are unavailable for event '$EVENT_NAME'." >&2 | |
| exit 1 | |
| fi | |
| test -n "$PR_NUMBER" | |
| test -n "$HEAD_SHA" | |
| test -n "$BASE_SHA" | |
| if [ "$MANAGE_STATUS" = "true" ]; then | |
| PR_JSON="${PR_JSON:-$(gh api "repos/${REPO}/pulls/${PR_NUMBER}")}" | |
| LIVE_HEAD_SHA="$(jq -er '.head.sha' <<<"$PR_JSON")" | |
| LIVE_BASE_SHA="$(jq -er '.base.sha' <<<"$PR_JSON")" | |
| if [ "$LIVE_HEAD_SHA" != "$HEAD_SHA" ] || [ "$LIVE_BASE_SHA" != "$BASE_SHA" ]; then | |
| echo "Refusing to update status for a PR/head/base mismatch." >&2 | |
| echo "Declared base/head: $BASE_SHA $HEAD_SHA" >&2 | |
| echo "Current base/head: $LIVE_BASE_SHA $LIVE_HEAD_SHA" >&2 | |
| exit 1 | |
| fi | |
| fi | |
| echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT" | |
| echo "head_sha=$HEAD_SHA" >> "$GITHUB_OUTPUT" | |
| echo "base_sha=$BASE_SHA" >> "$GITHUB_OUTPUT" | |
| echo "manage_status=$MANAGE_STATUS" >> "$GITHUB_OUTPUT" | |
| focus_delimiter="review_focus_${RANDOM}_${RANDOM}" | |
| { | |
| echo "review_focus<<${focus_delimiter}" | |
| printf '%s\n' "$REVIEW_FOCUS" | |
| echo "${focus_delimiter}" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Mark Code Review status as pending | |
| if: ${{ steps.review_inputs.outputs.manage_status == 'true' }} | |
| timeout-minutes: 2 | |
| env: | |
| BASE_SHA: ${{ steps.review_inputs.outputs.base_sha }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| HEAD_SHA: ${{ steps.review_inputs.outputs.head_sha }} | |
| PR_NUMBER: ${{ steps.review_inputs.outputs.pr_number }} | |
| REPO: ${{ github.repository }} | |
| run: | | |
| gh api "repos/${REPO}/statuses/${HEAD_SHA}" \ | |
| -X POST \ | |
| -f state='pending' \ | |
| -f context='code-review' \ | |
| -f description="Automated review is running for PR #${PR_NUMBER}." \ | |
| -f target_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" | |
| source_context="code-review/source/automated/pr-${PR_NUMBER}/base-${BASE_SHA}" | |
| gh api "repos/${REPO}/statuses/${HEAD_SHA}" \ | |
| -X POST \ | |
| -f state='pending' \ | |
| -f context="$source_context" \ | |
| -f description="Automated review is running for PR #${PR_NUMBER} at ${BASE_SHA:0:12}." \ | |
| -f target_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" | |
| - name: Checkout repository | |
| timeout-minutes: 10 | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ steps.review_inputs.outputs.head_sha }} | |
| fetch-depth: 0 | |
| - name: Install ripgrep | |
| timeout-minutes: 5 | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y ripgrep | |
| - name: Install ossutil | |
| timeout-minutes: 5 | |
| run: | | |
| tmp_dir="$(mktemp -d)" | |
| trap 'rm -rf "$tmp_dir"' EXIT | |
| curl -fsSL -o "$tmp_dir/ossutil.zip" https://gosspublic.alicdn.com/ossutil/1.7.19/ossutil-v1.7.19-linux-amd64.zip | |
| unzip -q "$tmp_dir/ossutil.zip" -d "$tmp_dir" | |
| sudo install -m 0755 "$tmp_dir/ossutil-v1.7.19-linux-amd64/ossutil" /usr/local/bin/ossutil | |
| - name: Install pinned Codex package | |
| timeout-minutes: 10 | |
| run: | | |
| set -euo pipefail | |
| archive="$RUNNER_TEMP/codex-exec-goal.tar.gz" | |
| package="$RUNNER_TEMP/codex-exec-goal" | |
| ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \ | |
| cp -f "$OSS_CODEX_PACKAGE_OBJECT" "$archive" | |
| echo "51304e4f9c343ae84e00a304344df41c2fd32821c83bdbf5be68b0f0c25ddae1 $archive" | sha256sum --check | |
| mkdir -p "$package" | |
| tar -xzf "$archive" -C "$package" | |
| (cd "$package" && sha256sum --check SHA256SUMS) | |
| test "$(jq -r .version "$package/codex-package.json")" = 0.162.1 | |
| echo "$package/bin" >> "$GITHUB_PATH" | |
| env: | |
| OSS_AK: ${{ secrets.OSS_AK }} | |
| OSS_SK: ${{ secrets.OSS_SK }} | |
| OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com | |
| OSS_CODEX_PACKAGE_OBJECT: oss://doris-community-ci/codex/releases/codex-exec-goal-0.162.1-3547e9086675-x86_64-unknown-linux-gnu.tar.gz | |
| - name: Verify pinned Codex runtime | |
| timeout-minutes: 2 | |
| run: | | |
| set -euo pipefail | |
| codex_cmd="$(command -v codex)" | |
| test "$(readlink -f "$codex_cmd")" = "$RUNNER_TEMP/codex-exec-goal/bin/codex" | |
| echo "a0d5ec053074d66570aa967129d350541f344f76671a199b5a7bc0d45366cdf7 $codex_cmd" | sha256sum --check | |
| codex --version | |
| codex exec --help | grep -q -- '--goal' | |
| codex exec --goal resume --help >/dev/null | |
| - name: Configure Codex auth | |
| id: auth | |
| timeout-minutes: 5 | |
| run: | | |
| set -o pipefail | |
| install -m 700 -d "$RUNNER_TEMP/codex-home" | |
| printf 'CODEX_HOME=%s\n' "$RUNNER_TEMP/codex-home" >> "$GITHUB_ENV" | |
| auth_prefix='oss://doris-community-ci/codex/auth.json.' | |
| auth_listing="$(mktemp "$RUNNER_TEMP/codex-auth-objects.XXXXXX")" | |
| if ! ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" ls "$auth_prefix" -s > "$auth_listing"; then | |
| auth_failure_reason="Failed to list Codex review auth objects from OSS." | |
| echo "failure_reason=$auth_failure_reason" >> "$GITHUB_OUTPUT" | |
| echo "::error::$auth_failure_reason" | |
| exit 1 | |
| fi | |
| auth_candidates="$(mktemp "$RUNNER_TEMP/codex-auth-candidates.XXXXXX")" | |
| awk '$0 ~ /^oss:\/\/doris-community-ci\/codex\/auth\.json\.[0-9]+$/ { print }' \ | |
| "$auth_listing" > "$auth_candidates" | |
| if [ ! -s "$auth_candidates" ]; then | |
| auth_failure_reason="No numbered Codex review auth objects were found in OSS." | |
| echo "failure_reason=$auth_failure_reason" >> "$GITHUB_OUTPUT" | |
| echo "::error::$auth_failure_reason" | |
| exit 1 | |
| fi | |
| auth_object="" | |
| earliest_retry_after_epoch="" | |
| now_epoch="$(date +%s)" | |
| while IFS= read -r candidate; do | |
| context_file="$(mktemp "$RUNNER_TEMP/codex-auth-context.XXXXXX")" | |
| if ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \ | |
| cp -f "${candidate}.context" "$context_file" >/dev/null 2>&1; then | |
| if raw_retry_after_epoch="$(jq -ser ' | |
| select(length == 1) | |
| | .[0] | |
| | select(type == "object" | |
| and .version == 1 | |
| and .state == "usage_limited" | |
| and (.retry_after_epoch | type == "number" and floor == .)) | |
| | .retry_after_epoch | |
| ' "$context_file" 2>/dev/null)" && \ | |
| retry_after_epoch="$(date -u -d "@$raw_retry_after_epoch" +%s 2>/dev/null)"; then | |
| if [ "$retry_after_epoch" -gt "$now_epoch" ]; then | |
| retry_at="$(date -u -d "@$retry_after_epoch" +%Y-%m-%dT%H:%M:%SZ)" | |
| echo "Skipping usage-limited Codex auth ${candidate##*/} until $retry_at." | |
| if [ -z "$earliest_retry_after_epoch" ] || \ | |
| [ "$retry_after_epoch" -lt "$earliest_retry_after_epoch" ]; then | |
| earliest_retry_after_epoch="$retry_after_epoch" | |
| fi | |
| continue | |
| fi | |
| else | |
| echo "::warning::Ignoring unusable Codex auth context for ${candidate##*/}; the account remains eligible." | |
| fi | |
| fi | |
| candidate_auth="$(mktemp "$RUNNER_TEMP/codex-home/candidate-auth.XXXXXX")" | |
| ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" cp -f "$candidate" "$candidate_auth" | |
| jq -e ' | |
| .auth_mode == "chatgpt" | |
| and (.tokens.access_token | type == "string" and length > 0) | |
| and (.tokens.refresh_token | type == "string" and length > 0) | |
| ' "$candidate_auth" >/dev/null | |
| refresh_token_hash="$(jq -rj '.tokens.refresh_token' "$candidate_auth" | sha256sum | awk '{print $1}')" | |
| # Quarantine the refresh token, not the slot or the entire auth file: | |
| # replacing the token restores eligibility; changing metadata does not. | |
| invalid_object="${candidate}.invalid.${refresh_token_hash}" | |
| invalid_listing="$(mktemp "$RUNNER_TEMP/codex-auth-invalid.XXXXXX")" | |
| if ! ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \ | |
| ls "$invalid_object" -s > "$invalid_listing"; then | |
| auth_failure_reason="Failed to check invalid-token marker for ${candidate##*/}." | |
| echo "failure_reason=$auth_failure_reason" >> "$GITHUB_OUTPUT" | |
| echo "::error::$auth_failure_reason" | |
| exit 1 | |
| fi | |
| if grep -Fxq "$invalid_object" "$invalid_listing"; then | |
| echo "Skipping Codex auth ${candidate##*/}: refresh token was already used." | |
| rm -f "$candidate_auth" | |
| continue | |
| fi | |
| auth_object="$candidate" | |
| # Use the checked snapshot; downloading it again could select a different token. | |
| mv "$candidate_auth" "$RUNNER_TEMP/codex-home/auth.json" | |
| printf '%s\n' "$refresh_token_hash" > "$RUNNER_TEMP/codex-auth-refresh-token.sha256" | |
| break | |
| done < <(shuf "$auth_candidates") | |
| if [ -z "$auth_object" ]; then | |
| auth_failure_reason="No eligible Codex review credentials: all are usage-limited or have a reused refresh token." | |
| if [ -n "$earliest_retry_after_epoch" ]; then | |
| retry_at="$(date -u -d "@$earliest_retry_after_epoch" +%Y-%m-%dT%H:%M:%SZ)" | |
| auth_failure_reason="$auth_failure_reason Earliest usage-limit retry is $retry_at." | |
| fi | |
| auth_failure_reason="$auth_failure_reason Credentials with reused refresh tokens must be replaced." | |
| echo "failure_reason=$auth_failure_reason" >> "$GITHUB_OUTPUT" | |
| echo "::error::$auth_failure_reason" | |
| exit 1 | |
| fi | |
| printf 'CODEX_AUTH_OSS_OBJECT=%s\n' "$auth_object" >> "$GITHUB_ENV" | |
| echo "Selected Codex auth object: ${auth_object##*/}" | |
| chmod 600 "$RUNNER_TEMP/codex-home/auth.json" | |
| sha256sum "$RUNNER_TEMP/codex-home/auth.json" \ | |
| | awk '{print $1}' \ | |
| > "$RUNNER_TEMP/codex-auth-original.sha256" | |
| cat > "$RUNNER_TEMP/codex-home/config.toml" <<EOF | |
| cli_auth_credentials_store = "file" | |
| approval_policy = "never" | |
| [features] | |
| memories = true | |
| [memories] | |
| use_memories = true | |
| generate_memories = true | |
| [shell_environment_policy] | |
| inherit = "all" | |
| [otel] | |
| environment = "github-actions" | |
| exporter = "none" | |
| metrics_exporter = "none" | |
| trace_exporter = "none" | |
| EOF | |
| chmod 600 "$RUNNER_TEMP/codex-home/config.toml" | |
| env: | |
| OSS_AK: ${{ secrets.OSS_AK }} | |
| OSS_SK: ${{ secrets.OSS_SK }} | |
| OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com | |
| - name: Sync Codex memories from OSS | |
| timeout-minutes: 5 | |
| run: | | |
| install -m 700 -d "$CODEX_HOME/memories" | |
| archive="$RUNNER_TEMP/codex-memories.tar.gz" | |
| listing="$RUNNER_TEMP/codex-memories.list" | |
| if ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" cp -f "$OSS_CODEX_MEMORIES_OBJECT" "$archive"; then | |
| if [ -s "$archive" ]; then | |
| tar -tzf "$archive" > "$listing" | |
| if [ -s "$listing" ]; then | |
| awk ' | |
| $0 != "memories" && $0 != "memories/" && $0 !~ /^memories\// { bad = 1 } | |
| END { exit bad } | |
| ' "$listing" | |
| tar -xzf "$archive" -C "$CODEX_HOME" | |
| else | |
| echo "Codex memories archive is empty; continuing with empty memories." | |
| fi | |
| else | |
| echo "Codex memories archive is empty; continuing with empty memories." | |
| fi | |
| else | |
| echo "No Codex memories archive could be downloaded; continuing with empty memories." | |
| fi | |
| install -m 700 -d "$CODEX_HOME/memories" | |
| touch "$CODEX_HOME/memories/memory_summary.md" | |
| chmod -R go-rwx "$CODEX_HOME/memories" || true | |
| env: | |
| OSS_AK: ${{ secrets.OSS_AK }} | |
| OSS_SK: ${{ secrets.OSS_SK }} | |
| OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com | |
| OSS_CODEX_MEMORIES_OBJECT: oss://doris-community-ci/memories.tar.gz | |
| - name: Prepare review context directory | |
| timeout-minutes: 2 | |
| run: | | |
| review_context_dir="$(mktemp -d "$GITHUB_WORKSPACE/.code-review.XXXXXX")" | |
| review_context_rel="$(basename "$review_context_dir")" | |
| printf 'REVIEW_CONTEXT_DIR=%s\n' "$review_context_dir" >> "$GITHUB_ENV" | |
| printf 'REVIEW_CONTEXT_REL=%s\n' "$review_context_rel" >> "$GITHUB_ENV" | |
| - name: Fetch existing PR review threads | |
| timeout-minutes: 5 | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| REPO: ${{ github.repository }} | |
| PR_NUMBER: ${{ steps.review_inputs.outputs.pr_number }} | |
| run: | | |
| MAX_THREADS=30 | |
| MAX_BODY_CHARS=1200 | |
| if gh api --paginate --slurp repos/${REPO}/pulls/${PR_NUMBER}/comments > "$REVIEW_CONTEXT_DIR/pr_review_comments_pages.json" 2>"$REVIEW_CONTEXT_DIR/pr_review_comments_error.log" \ | |
| && jq 'add | sort_by((.in_reply_to_id // .id), .id)' "$REVIEW_CONTEXT_DIR/pr_review_comments_pages.json" > "$REVIEW_CONTEXT_DIR/pr_review_comments.json" 2>>"$REVIEW_CONTEXT_DIR/pr_review_comments_error.log" \ | |
| && jq -r ' | |
| def shorten($limit): | |
| if (. // "" | length) > $limit then | |
| .[0:$limit] + "...(truncated)" | |
| else | |
| . // "" | |
| end; | |
| if length == 0 then | |
| "No existing inline review comments or replies were found for this PR." | |
| else | |
| group_by(.in_reply_to_id // .id) | |
| | sort_by(.[0].created_at // "") | |
| | reverse | |
| | .[:$max_threads] | |
| | map( | |
| . as $thread | |
| | $thread[0] as $root | |
| | "### " + ($root.path // "(unknown path)") + ":" + (($root.line // $root.original_line // "n/a") | tostring) | |
| + "\nURL: " + ($root.html_url // "") | |
| + "\nComments:\n" | |
| + ( | |
| $thread | |
| | map( | |
| "- " + (.user.login // "unknown") | |
| + " at " + (.created_at // "") | |
| + (if .in_reply_to_id then " (reply):" else " (original comment):" end) | |
| + "\n" | |
| + ((.body | shorten($max_body_chars)) | split("\n") | map(" " + .) | join("\n")) | |
| ) | |
| | join("\n") | |
| ) | |
| ) | |
| | join("\n\n") | |
| end | |
| ' --argjson max_threads "$MAX_THREADS" --argjson max_body_chars "$MAX_BODY_CHARS" "$REVIEW_CONTEXT_DIR/pr_review_comments.json" > "$REVIEW_CONTEXT_DIR/pr_review_threads.md" 2>>"$REVIEW_CONTEXT_DIR/pr_review_comments_error.log"; then | |
| echo "Fetched existing PR review threads successfully." | |
| else | |
| printf '%s\n\n' \ | |
| 'Existing PR review threads could not be fetched or formatted for this run.' \ | |
| 'Proceed with the automated review without this auxiliary context.' \ | |
| > "$REVIEW_CONTEXT_DIR/pr_review_threads.md" | |
| if [ -s "$REVIEW_CONTEXT_DIR/pr_review_comments_error.log" ]; then | |
| { | |
| printf '\n%s\n' 'Fetch/format error details:' | |
| sed 's/^/ /' "$REVIEW_CONTEXT_DIR/pr_review_comments_error.log" | |
| } >> "$REVIEW_CONTEXT_DIR/pr_review_threads.md" | |
| fi | |
| fi | |
| - name: Prepare user review focus | |
| timeout-minutes: 2 | |
| env: | |
| REVIEW_FOCUS: ${{ steps.review_inputs.outputs.review_focus }} | |
| run: | | |
| if [ -n "$(printf '%s' "$REVIEW_FOCUS" | tr -d '[:space:]')" ]; then | |
| printf '%s\n' "$REVIEW_FOCUS" > "$REVIEW_CONTEXT_DIR/review_focus.txt" | |
| else | |
| printf 'No additional user-provided review focus.\n' > "$REVIEW_CONTEXT_DIR/review_focus.txt" | |
| fi | |
| - name: Prepare authoritative PR context and required AGENTS guides | |
| id: review_context | |
| timeout-minutes: 10 | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| REPO: ${{ github.repository }} | |
| PR_NUMBER: ${{ steps.review_inputs.outputs.pr_number }} | |
| HEAD_SHA: ${{ steps.review_inputs.outputs.head_sha }} | |
| BASE_SHA: ${{ steps.review_inputs.outputs.base_sha }} | |
| HELPER_REF: ${{ github.workflow_sha || github.sha }} | |
| run: | | |
| checkout_head_sha="$(git rev-parse HEAD)" | |
| if [ "$checkout_head_sha" != "$HEAD_SHA" ]; then | |
| echo "Checked-out HEAD $checkout_head_sha does not match expected PR head $HEAD_SHA" | |
| exit 1 | |
| fi | |
| live_pr="$(gh api "repos/${REPO}/pulls/${PR_NUMBER}")" | |
| live_head_sha="$(jq -r '.head.sha' <<<"$live_pr")" | |
| live_base_sha="$(jq -r '.base.sha' <<<"$live_pr")" | |
| live_base_ref="$(jq -er '.base.ref' <<<"$live_pr")" | |
| if [ "$live_head_sha" != "$HEAD_SHA" ] || [ "$live_base_sha" != "$BASE_SHA" ]; then | |
| echo "PR changed while review context was being prepared; restart the review" | |
| echo "Expected base/head: $BASE_SHA $HEAD_SHA" | |
| echo "Current base/head: $live_base_sha $live_head_sha" | |
| exit 1 | |
| fi | |
| if [ "$(git rev-parse --is-shallow-repository)" != "false" ]; then | |
| echo "Full history is required to generate an authoritative three-dot PR diff" | |
| exit 1 | |
| fi | |
| diff_range="${BASE_SHA}...${HEAD_SHA}" | |
| merge_base_sha="$(git merge-base "$BASE_SHA" "$HEAD_SHA")" | |
| echo "Generating review context from $diff_range (merge base: $merge_base_sha)" | |
| git rev-list --count "${merge_base_sha}..${HEAD_SHA}" | |
| changed_files_tmp="$(mktemp "$REVIEW_CONTEXT_DIR/pr_changed_files.txt.tmp.XXXXXX")" | |
| git diff --name-only --no-ext-diff "$diff_range" > "$changed_files_tmp" | |
| mv "$changed_files_tmp" "$REVIEW_CONTEXT_DIR/pr_changed_files.txt" | |
| diff_tmp="$(mktemp "$REVIEW_CONTEXT_DIR/pr.diff.tmp.XXXXXX")" | |
| git diff --no-ext-diff --no-color "$diff_range" > "$diff_tmp" | |
| mv "$diff_tmp" "$REVIEW_CONTEXT_DIR/pr.diff" | |
| git diff --shortstat "$diff_range" | |
| helper="$RUNNER_TEMP/prepare_review_agents.py" | |
| gh api \ | |
| -H "Accept: application/vnd.github.raw" \ | |
| "repos/${REPO}/contents/.github/scripts/prepare_review_agents.py?ref=${HELPER_REF}" \ | |
| > "$helper" | |
| chmod 700 "$helper" | |
| python3 "$helper" \ | |
| --changed-files "$REVIEW_CONTEXT_DIR/pr_changed_files.txt" \ | |
| --required-agents "$REVIEW_CONTEXT_DIR/required_agents.txt" \ | |
| --prompt-block "$REVIEW_CONTEXT_DIR/required_agents_prompt.txt" \ | |
| --base-ref "$live_base_ref" \ | |
| --trusted-ref "$HELPER_REF" \ | |
| --skill-prompt-block "$REVIEW_CONTEXT_DIR/review_skill_prompt.txt" | |
| echo "Required AGENTS.md files for this review:" | |
| sed 's/^/ /' "$REVIEW_CONTEXT_DIR/required_agents.txt" | |
| - name: Prepare review prompt | |
| timeout-minutes: 5 | |
| run: | | |
| cat > "$REVIEW_CONTEXT_DIR/review_prompt.txt" <<'PROMPT' | |
| You are performing an automated code review inside a GitHub Actions runner. The gh CLI is available and authenticated via GH_TOKEN. | |
| The current directory is the code repository for the PR to be reviewed. | |
| This environment is only used for review operations, so do not attempt any builds or code modifications. However, temporary scripts you use for review purposes are exceptions. | |
| You MUST NOT attempt to access any files outside the current directory. and you DO NOT need to. But this does not prevent you from normally using any skill or web fetch tools. | |
| You can comment on the pull request. | |
| This review task is executed in Codex goal mode. The goal is to deliver one verified GitHub review within at most 3 review rounds, with an explicit convergence result. Delivery and convergence are separate: a review that reaches the round limit MUST still deliver its verified findings and describe its remaining limits. Follow this bounded delivery contract for stopping and submission. | |
| A review is converged only when all assigned subagents in the latest round return NO_NEW_VALUABLE_FINDINGS, the required coverage is complete, and every candidate and risk focus has been verified and accepted, deduplicated, or dismissed with evidence. Otherwise continue until round 3. At round 3, perform the final sweep and submit with converged=false if any of these conditions still fail; do not start a fourth round, wait for an override, or mark the goal blocked solely because convergence was not reached. | |
| Context: | |
| - Repository: PLACEHOLDER_REPO | |
| - PR number: PLACEHOLDER_PR_NUMBER | |
| - PR Head SHA: PLACEHOLDER_HEAD_SHA | |
| - PR Base SHA: PLACEHOLDER_BASE_SHA | |
| - Existing inline review threads: PLACEHOLDER_CONTEXT_DIR/pr_review_threads.md | |
| - Raw inline review comments JSON: PLACEHOLDER_CONTEXT_DIR/pr_review_comments.json | |
| - User review focus: PLACEHOLDER_CONTEXT_DIR/review_focus.txt | |
| - PR changed files: PLACEHOLDER_CONTEXT_DIR/pr_changed_files.txt | |
| - Authoritative aggregate PR diff: PLACEHOLDER_CONTEXT_DIR/pr.diff | |
| - PR diff range: merge-base(PLACEHOLDER_BASE_SHA, PLACEHOLDER_HEAD_SHA) to PLACEHOLDER_HEAD_SHA | |
| - Required AGENTS.md files: PLACEHOLDER_CONTEXT_DIR/required_agents.txt | |
| - Shared subagent review ledger: PLACEHOLDER_CONTEXT_DIR/subagent_review_findings.md | |
| PR diff and path-reading (for all subagents and the main agent): | |
| - PLACEHOLDER_CONTEXT_DIR/pr.diff and PLACEHOLDER_CONTEXT_DIR/pr_changed_files.txt were both generated locally with `git diff PLACEHOLDER_BASE_SHA...PLACEHOLDER_HEAD_SHA` after the live PR base/head were verified. They are the authoritative PR diff and changed-path list: they contain changes from the computed merge base to the PR head. The listed PR Base SHA identifies the target-branch snapshot and is not necessarily the diff's left endpoint. Do not obtain the PR diff or changed-path list through other means. | |
| - Before reading any file whose exact path is not already confirmed by this prompt, the selected skill's AGENTS.md references, PLACEHOLDER_CONTEXT_DIR/pr_changed_files.txt, PLACEHOLDER_CONTEXT_DIR/pr.diff, or a previous successful command output, you MUST first run `rg --files` to confirm the actual path of the target file. | |
| PLACEHOLDER_REVIEW_SKILL_BLOCK | |
| The active review goal's progress tracking MUST include, and must stay current throughout the review: | |
| 1. Read the review prompt, code-review skill, required AGENTS.md files, existing review threads, user focus, changed-file list, and the shared subagent review ledger. | |
| 2. Perform a main-agent initial risk scan before spawning review subagents. You must thoroughly read all the changes in this PR and understand all the involved mechanisms, pointing out: if there is a problem with this PR, where is the problem most likely to be? Or are there any points you suspect to be risky? write the result under `## Main Initial Risk Scan` in the shared ledger. | |
| 3. Based on the requirements of the code-review skill regarding the coverage points of the review spawn 1-3 subagents (depends on the complexity of the PR), each focusing on certain aspects. The sum of their focus points must fully cover the entire content of PR, as well as the points required in skill and any additional review points you consider necessary. Each subagent must investigate its assigned scope within the bounded review process, report every substantiated finding, and explicitly identify any remaining uncertainty or coverage gaps. You need assign each subagent a dedicated section in the shared ledger. | |
| 4. If the main initial risk scan identifies one or more suspicious mechanisms, spawn additional risk-focused subagent(s), separate from the normal complete-review subagents, to specially investigate those specific mechanisms and their upstream/downstream interactions. | |
| 5. Read the shared ledger after every subagent result, independently verify and deduplicate candidates, and classify each as accepted, already covered, dismissed with evidence, or unresolved with a concrete remaining question. Keep unresolved candidates out of the inline findings until verified. | |
| 6. After each round, evaluate the convergence conditions above. If they hold, or if 3 rounds have executed, perform the final sweep and deliver the review using the trusted submission helper. At the round limit, publish all verified findings even if the review did not converge, and explicitly describe unresolved candidates or coverage limits. Otherwise continue the next round without resetting the shared ledger or round count. | |
| 7. Submit the GitHub review and verify that all accepted findings landed before marking the bounded delivery goal complete. Address the required skill checkpoints and user concerns, and report convergence separately. A verified non-converged delivery completes this execution while leaving the review check blocked. | |
| Subagent Constraints: | |
| - Every subagent appends only to its assigned ledger section, while reading the whole ledger to avoid duplicate candidates. | |
| - Follow the principles indicated in the code-review skill. | |
| - The shared subagent review ledger is PLACEHOLDER_CONTEXT_DIR/subagent_review_findings.md. Subagents must read the whole ledger before reviewing, avoid duplicating existing candidates, and append their findings only under their assigned subagent section. They must not rewrite the whole ledger, edit another subagent section, edit the main merged sections, edit repository source files, or submit GitHub comments. | |
| - Each subagent must record candidate findings in its own ledger section with stable IDs, path/line, claim, evidence, duplicate relationship if any, and recommendation. Do not add duplicates of existing items. This section-owned append-only rule is mandatory to avoid concurrent patch conflicts. | |
| - Before returning, a further thought must be made—what problem, if any, might I have missed just now, and where? Then a thorough recheck should be conducted to confirm whether this potential issue is real and whether it needs to be reported. | |
| Main-agent Constraints: | |
| - Before delivery, every suspicious point must have an explicit disposition in the ledger: a verified finding, already covered by an existing review, dismissed with concrete evidence, or unresolved. At round 3, disclose unresolved points as remaining questions in the summary and incomplete_reason; they prevent convergence but MUST NOT prevent delivery of verified findings. | |
| - The main initial risk scan MUST be written under `## Main Initial Risk Scan` in the shared ledger before any subagent is spawned. For every risk focus item, include: ID, changed files/lines involved, related mechanisms to inspect, why it is suspicious, required upstream/downstream files or paths, and the exact question the risk-focused subagent must answer. | |
| - The shared subagent review ledger is PLACEHOLDER_CONTEXT_DIR/subagent_review_findings.md. Before spawning any subagent, the main agent MUST read this ledger. Every subagent prompt MUST include this ledger path and the exact ledger section assigned to that subagent. | |
| - The main agent must read the shared ledger after each subagent result, merge duplicate candidates into the main merged section, update candidate statuses, and keep a proposed final comment set in the main-owned ledger sections. It must also update the status of every main risk focus item. | |
| - Before submitting, do one final sweep over the changed-file list, candidate dispositions, and risk focus items. Confirm the evidence and anchors for every accepted finding and record any remaining coverage gaps. This sweep must respect the three-round limit. Remaining uncertainty at the cap sets converged=false and must be disclosed; do not claim it has been resolved or withhold the verified review. | |
| Any agent MUST NOT stop after finding the first blocking issue. Within the three-round limit, keep reviewing changed files, related control flow, tests, and parallel/special-case paths. Publish every verified bug and explicitly disclose remaining uncertainty at the limit. | |
| Before inspecting the PR diff or related code, you MUST read the contents of every AGENTS.md file listed below. These paths are computed from the PR changed file ancestors in this checkout. Searching for or listing paths is not sufficient; read each listed file directly. | |
| Required AGENTS.md files for this PR: | |
| PLACEHOLDER_REQUIRED_AGENTS_BLOCK | |
| Before proposing any new issue, you MUST read PLACEHOLDER_CONTEXT_DIR/pr_review_threads.md and treat every existing inline comment thread and reply as already-known review context. | |
| Do NOT submit the same or substantially similar issue again if it has already been raised in the existing review threads, even if you would phrase it differently. Only raise a similar concern when the PR introduces a genuinely different instance in another location that is not already covered by the existing thread, and explain why it is distinct. | |
| You MUST also read PLACEHOLDER_CONTEXT_DIR/review_focus.txt. Perform a complete review of the whole PR as usual, and additionally pay special attention to the user-provided focus points from that file. In the final summary, include a short response to the user focus points, including when no additional issue was found for them. | |
| In addition, you can perform any desired review operations to observe suspicious code and details in order to identify issues as much as possible. | |
| ## Final response format | |
| - On delivery, provide a final summary opinion addressing every applicable critical checkpoint, user concerns, and any remaining coverage limits. State whether the review converged. | |
| - After convergence or the third round and final sweep, declare the full set of verified findings for this invocation in a JSON file with exactly these fields: | |
| {"body":"<comprehensive summary>","comments":[{"path":"<file>","position":<diff_position>,"body":"[P1] <finding title and explanation>"}],"existing_blocking_comment_ids":[],"converged":true,"rounds":1,"incomplete_reason":""} | |
| - Every new finding must be inline and start with [P0], [P1], [P2] or [P3]. Suggested changes are welcome for precise, self-contained fixes. | |
| - Include ALL accepted new findings in comments. Use an empty array when there are none. In existing_blocking_comment_ids, list the numeric IDs of every already-reported P0/P1 inline finding you independently confirmed still applies to this head. Do not duplicate those findings. Explain their disposition in the summary; use an empty array only if none still apply. | |
| - Set rounds to the actual total (1 through 3), never reset it on resume. Set converged=true only when all convergence conditions hold and use an empty incomplete_reason. At the cap without convergence, set converged=false, rounds=3, and a nonempty incomplete_reason explaining which conditions failed, remaining questions, and uncovered scope. Deliver in either case using the trusted helper: python3 "$RUNNER_TEMP/submit_review.py" --context-dir PLACEHOLDER_CONTEXT_DIR --input-file <json_file> | |
| - The helper pins the head, adds this invocation's delivery marker and convergence statement, and verifies the summary and inline set. P0/P1 results request changes; other deliveries are comments. A non-converged delivery blocks the review check even with zero P0/P1. This is the ONLY GitHub submission path; do not submit reviews or inline comments directly with gh. | |
| - If the helper reports an error, inspect it and verify the outcome before proceeding. Do not change or delete its review-run.json or review-submission.json files. A retry with the identical JSON reads back a submitted review instead of posting it again. | |
| - Mark the bounded delivery goal complete only after the helper reports the verified review ID, including a non-converged delivery after round 3. The workflow applies the separate blocking verdict. A changed PR head, an unverified submission, or a helper error still prevents successful delivery. | |
| PROMPT | |
| sed -i "s|PLACEHOLDER_REPO|${REPO}|g" "$REVIEW_CONTEXT_DIR/review_prompt.txt" | |
| sed -i "s|PLACEHOLDER_PR_NUMBER|${PR_NUMBER}|g" "$REVIEW_CONTEXT_DIR/review_prompt.txt" | |
| sed -i "s|PLACEHOLDER_HEAD_SHA|${HEAD_SHA}|g" "$REVIEW_CONTEXT_DIR/review_prompt.txt" | |
| sed -i "s|PLACEHOLDER_BASE_SHA|${BASE_SHA}|g" "$REVIEW_CONTEXT_DIR/review_prompt.txt" | |
| sed -i "s|PLACEHOLDER_CONTEXT_DIR|${REVIEW_CONTEXT_REL}|g" "$REVIEW_CONTEXT_DIR/review_prompt.txt" | |
| python3 - "$REVIEW_CONTEXT_DIR/review_prompt.txt" "$REVIEW_CONTEXT_DIR/required_agents_prompt.txt" "$REVIEW_CONTEXT_DIR/review_skill_prompt.txt" <<'PY' | |
| import sys | |
| from pathlib import Path | |
| prompt_path = Path(sys.argv[1]) | |
| required_agents_path = Path(sys.argv[2]) | |
| prompt = prompt_path.read_text() | |
| required_agents = required_agents_path.read_text().rstrip() | |
| skill_instructions = Path(sys.argv[3]).read_text().rstrip() | |
| prompt = prompt.replace("PLACEHOLDER_REQUIRED_AGENTS_BLOCK", required_agents) | |
| prompt_path.write_text(prompt.replace("PLACEHOLDER_REVIEW_SKILL_BLOCK", skill_instructions)) | |
| PY | |
| cat > "$REVIEW_CONTEXT_DIR/subagent_review_findings.md" <<'LEDGER' | |
| # Shared Subagent Review Ledger | |
| This is the shared source of truth for subagent-assisted review. | |
| Rules: | |
| - Subagents must read this whole file before reviewing. | |
| - Each subagent may append only to its assigned section under `Subagent Candidate Sections`. | |
| - Subagents must not rewrite this file, edit another subagent section, edit main-owned sections, edit repository source files, or submit GitHub comments. | |
| - Avoid duplicates. If a candidate overlaps an existing candidate, add a duplicate note in your own section that references the existing candidate ID. | |
| - The main agent owns final status, final deduplication, GitHub review submission, and GitHub API verification. | |
| ## Main Initial Risk Scan | |
| Main-owned format: | |
| - ID: | |
| Status: | |
| Changed files/lines: | |
| Related mechanisms to inspect: | |
| Why suspicious: | |
| Required upstream/downstream files or paths: | |
| Question for risk-focused subagent: | |
| Final conclusion: | |
| Candidate statuses: | |
| - proposed_by_subagent | |
| - accepted_for_inline_comment | |
| - dismissed_with_evidence | |
| - duplicated | |
| Candidate format: | |
| - ID: | |
| Owner: | |
| Status: | |
| Path: | |
| Line: | |
| Claim: | |
| Evidence: | |
| Duplicate relationship: | |
| Recommendation: | |
| ## Main Merged Findings | |
| Main-owned format: | |
| - ID: | |
| Source IDs: | |
| Owner: main | |
| Status: | |
| Path: | |
| Line: | |
| Claim: | |
| Evidence: | |
| Duplicate relationship: | |
| Main verification: | |
| Proposed inline body: | |
| ## Dismissed Or Duplicate Points | |
| ## Proposed Final Comment Set | |
| ## Convergence Rounds | |
| LEDGER | |
| cat > "$REVIEW_CONTEXT_DIR/codex_goal_prompt.txt" <<EOF | |
| You are performing an automated code review inside a GitHub Actions runner. | |
| This invocation is already running in Codex goal mode. Before inspecting the PR diff or related code, read ${REVIEW_CONTEXT_REL}/review_prompt.txt verbatim and follow that file as the complete review instruction set. | |
| This document outlines the complete process, cyclic procedures, and exit agreements you need to follow. Please read it seriously and reconfirm the requirements at the end of each cycle. Complete the review according to the stipulations in this document. | |
| EOF | |
| env: | |
| REPO: ${{ github.repository }} | |
| PR_NUMBER: ${{ steps.review_inputs.outputs.pr_number }} | |
| HEAD_SHA: ${{ steps.review_inputs.outputs.head_sha }} | |
| BASE_SHA: ${{ steps.review_inputs.outputs.base_sha }} | |
| - name: Run automated code review | |
| id: review | |
| timeout-minutes: ${{ fromJSON(env.REVIEW_TIMEOUT_MINUTES) }} | |
| continue-on-error: true | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| REPO: ${{ github.repository }} | |
| PR_NUMBER: ${{ steps.review_inputs.outputs.pr_number }} | |
| HEAD_SHA: ${{ steps.review_inputs.outputs.head_sha }} | |
| BASE_SHA: ${{ steps.review_inputs.outputs.base_sha }} | |
| HELPER_REF: ${{ github.workflow_sha || github.sha }} | |
| run: | | |
| review_step_started_at=$SECONDS | |
| for script in run_review_with_resume.py submit_review.py; do | |
| gh api \ | |
| -H "Accept: application/vnd.github.raw" \ | |
| "repos/${REPO}/contents/.github/scripts/${script}?ref=${HELPER_REF}" \ | |
| > "$RUNNER_TEMP/$script" | |
| done | |
| helper="$RUNNER_TEMP/run_review_with_resume.py" | |
| # Share the step's budget; reserve two minutes for process cleanup and | |
| # GitHub review verification. Both helper downloads count too. | |
| budget_seconds=$((REVIEW_TIMEOUT_MINUTES * 60 - (SECONDS - review_step_started_at) - 120)) | |
| set +e | |
| # GitHub-hosted runners are ephemeral. Avoid workspace-write here because | |
| # Codex uses bubblewrap for that mode and uid maps can be unavailable. | |
| python3 "$helper" \ | |
| --context-dir "$REVIEW_CONTEXT_DIR" \ | |
| --cwd "$GITHUB_WORKSPACE" \ | |
| --repository "$REPO" \ | |
| --pr-number "$PR_NUMBER" \ | |
| --head-sha "$HEAD_SHA" \ | |
| --base-sha "$BASE_SHA" \ | |
| --model "gpt-6.1-sol" \ | |
| --fallback-model "gpt-6-sol" \ | |
| --effort xhigh \ | |
| --budget-seconds "$budget_seconds" | |
| status=$? | |
| set -e | |
| # The runner has stopped Codex and reaped descendants. Treat an | |
| # obsolete head as a handled outcome, without publishing a verdict. | |
| if [ "$status" -eq 75 ]; then | |
| jq -e --arg repo "$REPO" --arg pr "$PR_NUMBER" --arg head "$HEAD_SHA" ' | |
| .state == "superseded" and .repository == $repo and | |
| (.pr_number | tostring) == $pr and .head_sha == $head and | |
| (.superseding_head_sha | test("^[0-9a-f]{40}$")) and | |
| .superseding_head_sha != $head' \ | |
| "$REVIEW_CONTEXT_DIR/review-result.json" > /dev/null | |
| echo "review_state=superseded" >> "$GITHUB_OUTPUT" | |
| jq -r '.message' "$REVIEW_CONTEXT_DIR/review-result.json" | tee -a "$GITHUB_STEP_SUMMARY" | |
| exit 0 | |
| fi | |
| failure_reason="" | |
| if [ "$status" -ne 0 ]; then | |
| if [ -s "$REVIEW_CONTEXT_DIR/codex-events.jsonl" ]; then | |
| failure_reason="$(jq -r 'select(.type == "turn.failed") | .error.message // empty' "$REVIEW_CONTEXT_DIR/codex-events.jsonl" | tail -n 1)" | |
| if [ -z "$failure_reason" ]; then | |
| failure_reason="$(jq -r 'select(.type == "error") | .message // .error.message // empty' "$REVIEW_CONTEXT_DIR/codex-events.jsonl" | tail -n 1)" | |
| fi | |
| fi | |
| if [ -z "$failure_reason" ] && [ -s "$REVIEW_CONTEXT_DIR/codex-stderr.log" ]; then | |
| failure_reason="$(awk 'NF { line = $0 } END { print line }' "$REVIEW_CONTEXT_DIR/codex-stderr.log")" | |
| fi | |
| if [ -z "$failure_reason" ]; then | |
| failure_reason="Codex exited with status $status" | |
| fi | |
| # Only terminal auth errors and Codex's own stderr identify an invalid | |
| # token. A tool result quoting this error must not quarantine credentials. | |
| if grep -Fqi "Your access token could not be refreshed because your refresh token was already used." <<<"$failure_reason" || \ | |
| grep -Fxq "refresh_token_reused" <<<"$failure_reason" || \ | |
| { jq -r 'select(.type == "turn.failed" or .type == "error") | .error.code // .code // empty' \ | |
| "$REVIEW_CONTEXT_DIR/codex-events.jsonl" | grep -Fx "refresh_token_reused" >/dev/null; } || \ | |
| grep -Eq '"code"[[:space:]]*:[[:space:]]*"refresh_token_reused"' "$REVIEW_CONTEXT_DIR/codex-stderr.log"; then | |
| echo "auth_invalid_reason=refresh_token_reused" >> "$GITHUB_OUTPUT" | |
| echo "::warning::Codex refresh token was already used; recording this credential version as invalid." | |
| fi | |
| usage_limit_retry_after_epoch="" | |
| if grep -Fqi "You've hit your usage limit" <<<"$failure_reason"; then | |
| now_epoch="$(date +%s)" | |
| retry_at_text="$(sed -nE \ | |
| 's/.*[Tt]ry again at (([A-Za-z]{3} [0-9]{1,2}(st|nd|rd|th)?, [0-9]{4} )?[0-9]{1,2}:[0-9]{2} (AM|PM)).*/\1/p' \ | |
| <<<"$failure_reason")" | |
| if [ -n "$retry_at_text" ]; then | |
| retry_at_text="$(sed -E 's/([0-9])(st|nd|rd|th),/\1,/' <<<"$retry_at_text")" | |
| usage_limit_retry_after_epoch="$(date -u -d "$retry_at_text" +%s 2>/dev/null || true)" | |
| fi | |
| if [ -z "$usage_limit_retry_after_epoch" ] || \ | |
| [ "$usage_limit_retry_after_epoch" -le "$now_epoch" ]; then | |
| usage_limit_retry_after_epoch="$((now_epoch + 30 * 60))" | |
| echo "::warning::Codex usage limit had no usable future retry time; using the explicit 30-minute fallback." | |
| fi | |
| retry_at="$(date -u -d "@$usage_limit_retry_after_epoch" +%Y-%m-%dT%H:%M:%SZ)" | |
| echo "Codex usage limit detected; account retry time is $retry_at." | |
| echo "usage_limit_retry_after_epoch=$usage_limit_retry_after_epoch" >> "$GITHUB_OUTPUT" | |
| fi | |
| fi | |
| if [ -n "$failure_reason" ]; then | |
| { | |
| echo "failure_reason<<EOF" | |
| printf '%s\n' "$failure_reason" | |
| echo "EOF" | |
| } >> "$GITHUB_OUTPUT" | |
| exit 1 | |
| fi | |
| # Execution succeeded even when verified findings block the PR check. | |
| # This result is written only after the runner's own API readback. | |
| jq -er 'select(.state == "success" or .state == "failure") | | |
| "review_state=\(.state)\np0=\(.p0)\np1=\(.p1)\nconverged=\(.converged)\nrounds=\(.rounds)"' \ | |
| "$REVIEW_CONTEXT_DIR/review-result.json" >> "$GITHUB_OUTPUT" | |
| - name: Preserve rejected final review | |
| if: ${{ always() && steps.review_context.outcome == 'success' && steps.review.outcome == 'failure' }} | |
| continue-on-error: true | |
| timeout-minutes: 2 | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: rejected-code-review-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: ${{ env.REVIEW_CONTEXT_DIR }}/review-submission-rejected.json | |
| # The context directory is hidden; include only the explicit JSON above. | |
| include-hidden-files: true | |
| if-no-files-found: ignore | |
| retention-days: 14 | |
| - name: Record invalid Codex auth | |
| id: auth_invalid_record | |
| if: ${{ always() && steps.auth.outcome == 'success' && steps.review.outputs.auth_invalid_reason == 'refresh_token_reused' }} | |
| timeout-minutes: 5 | |
| env: | |
| OSS_AK: ${{ secrets.OSS_AK }} | |
| OSS_SK: ${{ secrets.OSS_SK }} | |
| OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com | |
| run: | | |
| # Bind the marker to the selected snapshot, so a late failing job cannot | |
| # invalidate a replacement uploaded by another job or an operator. | |
| refresh_token_hash="$(<"$RUNNER_TEMP/codex-auth-refresh-token.sha256")" | |
| [[ "$refresh_token_hash" =~ ^[0-9a-f]{64}$ ]] | |
| invalid_file="$(mktemp "$RUNNER_TEMP/codex-auth-invalid.XXXXXX")" | |
| jq -n --arg refresh_token_sha256 "$refresh_token_hash" \ | |
| '{version: 1, state: "auth_invalid", reason: "refresh_token_reused", refresh_token_sha256: $refresh_token_sha256}' \ | |
| > "$invalid_file" | |
| # A separate object per token is idempotent and cannot be overwritten by | |
| # concurrent usage-limit context writes or failures of older tokens. | |
| if ! ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \ | |
| --retry-times=3 --connect-timeout=10 --read-timeout=30 \ | |
| cp -f "$invalid_file" "${CODEX_AUTH_OSS_OBJECT}.invalid.${refresh_token_hash}"; then | |
| echo "::error::Could not record the invalid Codex refresh token; it may still be selected." | |
| exit 1 | |
| fi | |
| echo "Recorded invalid refresh token for ${CODEX_AUTH_OSS_OBJECT##*/}; this credential version will be skipped." | |
| - name: Record Codex usage limit | |
| id: usage_limit_record | |
| if: ${{ always() && steps.review.outputs.usage_limit_retry_after_epoch != '' }} | |
| timeout-minutes: 5 | |
| env: | |
| OSS_AK: ${{ secrets.OSS_AK }} | |
| OSS_SK: ${{ secrets.OSS_SK }} | |
| OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com | |
| RETRY_AFTER_EPOCH: ${{ steps.review.outputs.usage_limit_retry_after_epoch }} | |
| run: | | |
| context_file="$(mktemp "$RUNNER_TEMP/codex-auth-context.XXXXXX")" | |
| jq -n \ | |
| --argjson retry_after_epoch "$RETRY_AFTER_EPOCH" \ | |
| '{version: 1, state: "usage_limited", retry_after_epoch: $retry_after_epoch}' \ | |
| > "$context_file" | |
| ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \ | |
| cp -f "$context_file" "${CODEX_AUTH_OSS_OBJECT}.context" | |
| retry_at="$(date -u -d "@$RETRY_AFTER_EPOCH" +%Y-%m-%dT%H:%M:%SZ)" | |
| echo "Recorded usage limit for ${CODEX_AUTH_OSS_OBJECT##*/} until $retry_at." | |
| - name: Comment PR on review failure | |
| if: ${{ always() && (steps.review_context.outcome != 'success' || steps.review.outcome != 'success') }} | |
| timeout-minutes: 2 | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| AUTH_FAILURE_REASON: ${{ steps.auth.outputs.failure_reason }} | |
| AUTH_INVALID_REASON: ${{ steps.review.outputs.auth_invalid_reason }} | |
| AUTH_INVALID_RECORD_OUTCOME: ${{ steps.auth_invalid_record.outcome }} | |
| USAGE_LIMIT_RECORD_OUTCOME: ${{ steps.usage_limit_record.outcome }} | |
| USAGE_LIMIT_RETRY_AFTER_EPOCH: ${{ steps.review.outputs.usage_limit_retry_after_epoch }} | |
| REVIEW_CONTEXT_OUTCOME: ${{ steps.review_context.outcome }} | |
| REVIEW_FAILURE_REASON: ${{ steps.review.outputs.failure_reason }} | |
| REVIEW_OUTCOME: ${{ steps.review.outcome }} | |
| PR_NUMBER: ${{ steps.review_inputs.outputs.pr_number }} | |
| RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| run: | | |
| recovery_msg="Please inspect the workflow logs and rerun the review after the underlying issue is resolved." | |
| if [ -n "$AUTH_FAILURE_REASON" ]; then | |
| error_msg="$AUTH_FAILURE_REASON" | |
| elif [ "$AUTH_INVALID_REASON" = "refresh_token_reused" ]; then | |
| error_msg="${REVIEW_FAILURE_REASON:-The selected Codex refresh token was already used.}" | |
| if [ "$AUTH_INVALID_RECORD_OUTCOME" = "success" ]; then | |
| recovery_msg="This credential version is excluded from future reviews. Replace its refresh token to restore eligibility. Please trigger /review again; another configured account may be available." | |
| else | |
| recovery_msg="The workflow failed to record the invalid credential, so it may still be selected. Please inspect the recording step before retrying." | |
| fi | |
| elif [ -n "$USAGE_LIMIT_RETRY_AFTER_EPOCH" ] && \ | |
| [ "$USAGE_LIMIT_RECORD_OUTCOME" = "success" ]; then | |
| retry_at="$(date -u -d "@$USAGE_LIMIT_RETRY_AFTER_EPOCH" +%Y-%m-%dT%H:%M:%SZ)" | |
| error_msg="${REVIEW_FAILURE_REASON:-The selected Codex account reached its usage limit.}" | |
| recovery_msg="The selected account is excluded until $retry_at. Please trigger /review again; another configured account may be available." | |
| elif [ -n "$USAGE_LIMIT_RETRY_AFTER_EPOCH" ]; then | |
| error_msg="Codex reached its usage limit, but the workflow failed to record the account context." | |
| recovery_msg="Please inspect the workflow logs and trigger /review again after the recording problem is resolved." | |
| elif [ "$REVIEW_CONTEXT_OUTCOME" != "success" ]; then | |
| error_msg="Review context preparation failed before Codex ran; inspect the 'Prepare authoritative PR context and required AGENTS guides' step." | |
| else | |
| error_msg="${REVIEW_FAILURE_REASON:-Review step was $REVIEW_OUTCOME (possibly timeout or cancelled)}" | |
| fi | |
| gh pr comment "$PR_NUMBER" --body "$(cat <<EOF | |
| Codex automated review failed and did not complete. | |
| Error: ${error_msg} | |
| Workflow run: ${RUN_URL} | |
| ${recovery_msg} | |
| EOF | |
| )" | |
| - name: Fail workflow if review failed | |
| if: ${{ always() && (steps.review_context.outcome != 'success' || steps.review.outcome != 'success') }} | |
| timeout-minutes: 1 | |
| env: | |
| AUTH_FAILURE_REASON: ${{ steps.auth.outputs.failure_reason }} | |
| REVIEW_CONTEXT_OUTCOME: ${{ steps.review_context.outcome }} | |
| REVIEW_FAILURE_REASON: ${{ steps.review.outputs.failure_reason }} | |
| REVIEW_OUTCOME: ${{ steps.review.outcome }} | |
| run: | | |
| if [ -n "$AUTH_FAILURE_REASON" ]; then | |
| error_msg="$AUTH_FAILURE_REASON" | |
| elif [ "$REVIEW_CONTEXT_OUTCOME" != "success" ]; then | |
| error_msg="Review context preparation failed before Codex ran; inspect the 'Prepare authoritative PR context and required AGENTS guides' step." | |
| else | |
| error_msg="${REVIEW_FAILURE_REASON:-Review step was $REVIEW_OUTCOME (possibly timeout or cancelled)}" | |
| fi | |
| echo "Codex automated review failed: ${error_msg}" | |
| exit 1 | |
| - name: Sync Code Review check for current head | |
| if: >- | |
| ${{ | |
| always() && | |
| steps.review_inputs.outcome == 'success' && | |
| steps.review_inputs.outputs.manage_status == 'true' && | |
| steps.review.outputs.review_state != 'superseded' | |
| }} | |
| timeout-minutes: 2 | |
| env: | |
| BASE_SHA: ${{ steps.review_inputs.outputs.base_sha }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| HEAD_SHA: ${{ steps.review_inputs.outputs.head_sha }} | |
| JOB_STATUS: ${{ job.status }} | |
| PR_NUMBER: ${{ steps.review_inputs.outputs.pr_number }} | |
| REPO: ${{ github.repository }} | |
| REVIEW_CONTEXT_OUTCOME: ${{ steps.review_context.outcome }} | |
| REVIEW_OUTCOME: ${{ steps.review.outcome }} | |
| REVIEW_STATE: ${{ steps.review.outputs.review_state }} | |
| REVIEW_P0: ${{ steps.review.outputs.p0 }} | |
| REVIEW_P1: ${{ steps.review.outputs.p1 }} | |
| REVIEW_CONVERGED: ${{ steps.review.outputs.converged }} | |
| REVIEW_ROUNDS: ${{ steps.review.outputs.rounds }} | |
| run: | | |
| state="pending" | |
| summary="Automated review did not pass for PR #${PR_NUMBER} at ${BASE_SHA:0:12}." | |
| if [ "$JOB_STATUS" = "success" ] && \ | |
| [ "$REVIEW_CONTEXT_OUTCOME" = "success" ] && \ | |
| [ "$REVIEW_OUTCOME" = "success" ]; then | |
| case "$REVIEW_STATE" in | |
| success|failure) | |
| state="$REVIEW_STATE" | |
| summary="Review completed for PR #${PR_NUMBER}: P0=${REVIEW_P0}, P1=${REVIEW_P1}." | |
| if [ "$REVIEW_CONVERGED" = "false" ]; then | |
| summary="Review did not converge after ${REVIEW_ROUNDS} rounds for PR #${PR_NUMBER}: P0=${REVIEW_P0}, P1=${REVIEW_P1}." | |
| fi | |
| ;; | |
| *) echo "::error::Missing verified review verdict"; exit 1 ;; | |
| esac | |
| fi | |
| source_context="code-review/source/automated/pr-${PR_NUMBER}/base-${BASE_SHA}" | |
| gh api "repos/${REPO}/statuses/${HEAD_SHA}" \ | |
| -X POST \ | |
| -f state="${state}" \ | |
| -f context="$source_context" \ | |
| -f description="${summary}" \ | |
| -f target_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" | |
| - name: Record review I/O to Litefuse | |
| if: ${{ always() }} | |
| # Telemetry errors must not change the code review result. | |
| continue-on-error: true | |
| timeout-minutes: 5 | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| LANGFUSE_PUBLIC_KEY: ${{ secrets.LANGFUSE_PK }} | |
| LANGFUSE_SECRET_KEY: ${{ secrets.LANGFUSE_SK }} | |
| REVIEW_STATE: ${{ steps.review.outputs.review_state }} | |
| REPO: ${{ github.repository }} | |
| PR_NUMBER: ${{ steps.review_inputs.outputs.pr_number }} | |
| HEAD_SHA: ${{ steps.review_inputs.outputs.head_sha }} | |
| BASE_SHA: ${{ steps.review_inputs.outputs.base_sha }} | |
| HELPER_REF: ${{ github.workflow_sha || github.sha }} | |
| run: | | |
| if [ ! -s "$REVIEW_CONTEXT_DIR/codex_goal_prompt.txt" ] || [ ! -s "$REVIEW_CONTEXT_DIR/codex-events.jsonl" ]; then | |
| echo "Goal prompt or Codex JSONL event stream is missing; skipping Litefuse I/O recording." | |
| exit 0 | |
| fi | |
| helper="$RUNNER_TEMP/emit_litefuse_otel_io.py" | |
| gh api \ | |
| -H "Accept: application/vnd.github.raw" \ | |
| "repos/${REPO}/contents/.github/scripts/emit_litefuse_otel_io.py?ref=${HELPER_REF}" \ | |
| > "$helper" | |
| chmod 700 "$helper" | |
| min_observations=4 | |
| min_step_observations=2 | |
| if [ "$REVIEW_STATE" = "superseded" ]; then | |
| # The head may have changed before the first model/tool request. | |
| min_observations=1 | |
| min_step_observations=0 | |
| fi | |
| python3 "$helper" \ | |
| --input-file "$REVIEW_CONTEXT_DIR/codex_goal_prompt.txt" \ | |
| --events-file "$REVIEW_CONTEXT_DIR/codex-events.jsonl" \ | |
| --output-file "$REVIEW_CONTEXT_DIR/codex-final-message.txt" \ | |
| --trace-name "doris-ai-review" \ | |
| --subagent-trace-name "doris-ai-review-subagent" \ | |
| --subagent-sessions-dir "$CODEX_HOME/sessions" \ | |
| --session-id "$GITHUB_RUN_ID" \ | |
| --repository "$REPO" \ | |
| --workflow "$GITHUB_WORKFLOW" \ | |
| --run-id "$GITHUB_RUN_ID" \ | |
| --pr-number "$PR_NUMBER" \ | |
| --head-sha "$HEAD_SHA" \ | |
| --base-sha "$BASE_SHA" \ | |
| --model "$(cat "$REVIEW_CONTEXT_DIR/codex-review-model.txt")" \ | |
| --reasoning-effort "xhigh" \ | |
| --environment "github-actions" \ | |
| --max-payload-bytes 4000000 \ | |
| --gzip \ | |
| --min-observations "$min_observations" \ | |
| --min-step-observations "$min_step_observations" \ | |
| --verify-attempts 24 \ | |
| --verify-sleep-seconds 5 \ | |
| --verify-timeout-seconds 120 \ | |
| --verify | |
| - name: Sync Codex sessions back to OSS | |
| if: ${{ always() }} | |
| continue-on-error: true | |
| timeout-minutes: 5 | |
| run: | | |
| if [ ! -d "$CODEX_HOME/sessions" ]; then | |
| echo "No Codex sessions directory found; skipping session sync." | |
| exit 0 | |
| fi | |
| uploaded=0 | |
| skipped=0 | |
| while IFS= read -r -d '' session_file; do | |
| rel="${session_file#"$CODEX_HOME/sessions/"}" | |
| remote="${OSS_CODEX_SESSION_PREFIX%/}/$rel" | |
| if ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" stat "$remote" >/dev/null 2>&1; then | |
| skipped=$((skipped + 1)) | |
| continue | |
| fi | |
| ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" cp -f "$session_file" "$remote" | |
| uploaded=$((uploaded + 1)) | |
| done < <(find "$CODEX_HOME/sessions" -type f -name '*.jsonl' -print0) | |
| echo "Uploaded $uploaded new Codex session file(s); skipped $skipped existing file(s)." | |
| env: | |
| OSS_AK: ${{ secrets.OSS_AK }} | |
| OSS_SK: ${{ secrets.OSS_SK }} | |
| OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com | |
| OSS_CODEX_SESSION_PREFIX: oss://doris-community-ci/session | |
| - name: Sync refreshed Codex auth back to OSS | |
| if: ${{ always() && steps.auth.outcome == 'success' }} | |
| timeout-minutes: 8 | |
| run: | | |
| set -o pipefail | |
| if ! jq -e ' | |
| .auth_mode == "chatgpt" | |
| and (.tokens.access_token | type == "string" and length > 0) | |
| and (.tokens.refresh_token | type == "string" and length > 0) | |
| ' "$CODEX_HOME/auth.json" >/dev/null; then | |
| echo "::error::Refreshed Codex auth is invalid; refusing OSS auth sync." | |
| exit 1 | |
| fi | |
| original_hash="$(<"$RUNNER_TEMP/codex-auth-original.sha256")" | |
| local_hash="$(sha256sum "$CODEX_HOME/auth.json" | awk '{print $1}')" | |
| if [ "$local_hash" = "$original_hash" ]; then | |
| echo "Codex auth was not refreshed; skipping OSS auth sync." | |
| exit 0 | |
| fi | |
| umask 077 | |
| remote_auth="$(mktemp "$RUNNER_TEMP/codex-auth-current.XXXXXX")" | |
| trap 'rm -f "$remote_auth" "${remote_auth}.temp"' EXIT | |
| if ! ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \ | |
| --retry-times=3 --connect-timeout=10 --read-timeout=30 \ | |
| cp -f "$CODEX_AUTH_OSS_OBJECT" "$remote_auth"; then | |
| echo "::error::Could not verify the current OSS auth after 3 attempts." | |
| exit 1 | |
| fi | |
| remote_hash="$(sha256sum "$remote_auth" | awk '{print $1}')" | |
| if [ "$remote_hash" != "$original_hash" ]; then | |
| echo "::warning::OSS auth changed during this job; skipping stale auth sync." | |
| exit 0 | |
| fi | |
| if ! ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \ | |
| --retry-times=3 --connect-timeout=10 --read-timeout=30 \ | |
| cp -f "$CODEX_HOME/auth.json" "$CODEX_AUTH_OSS_OBJECT"; then | |
| echo "::error::Could not persist the refreshed Codex auth after 3 attempts." | |
| exit 1 | |
| fi | |
| echo "Uploaded refreshed Codex auth: ${CODEX_AUTH_OSS_OBJECT##*/}" | |
| env: | |
| OSS_AK: ${{ secrets.OSS_AK }} | |
| OSS_SK: ${{ secrets.OSS_SK }} | |
| OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com | |
| aggregate-status: | |
| needs: code-review | |
| if: >- | |
| always() && | |
| needs.code-review.outputs.manage_status == 'true' && | |
| needs.code-review.outputs.head_sha != '' && | |
| needs.code-review.outputs.review_state != 'superseded' | |
| uses: ./.github/workflows/code-review-aggregate-status.yml | |
| with: | |
| head_sha: ${{ needs.code-review.outputs.head_sha }} | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| statuses: write |