Codex plan: refresh reusable release source pin #3085
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Codex branch controller | |
| on: | |
| workflow_call: | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| concurrency: | |
| group: codex-branch-refresh | |
| cancel-in-progress: false | |
| jobs: | |
| prepare: | |
| name: Rebase topics and assemble Codex branches | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Check out the pinned controller | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| with: | |
| repository: ${{ job.workflow_repository }} | |
| ref: ${{ job.workflow_sha }} | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Fetch and pin all inputs | |
| env: | |
| READ_TOKEN: ${{ github.token }} | |
| WORKFLOW_REPOSITORY: ${{ job.workflow_repository }} | |
| WORKFLOW_SHA: ${{ job.workflow_sha }} | |
| run: | | |
| set -euo pipefail | |
| test "$GITHUB_REPOSITORY" = openai/git | |
| test "$WORKFLOW_REPOSITORY" = openai/git | |
| basic=$(printf 'x-access-token:%s' "$READ_TOKEN" | base64 | tr -d '\n') | |
| git -c http.extraheader="AUTHORIZATION: basic $basic" \ | |
| fetch --force --prune origin \ | |
| '+refs/heads/*:refs/remotes/origin/*' | |
| test "$(git rev-parse refs/remotes/origin/meta)" = "$WORKFLOW_SHA" | |
| test "$(git rev-parse HEAD)" = "$WORKFLOW_SHA" | |
| test "$(git rev-parse refs/remotes/origin/codex)" = "$GITHUB_SHA" | |
| - name: Rebase topics and assemble the enabled Codex branches | |
| id: rewrite | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| WORKFLOW_SHA: ${{ job.workflow_sha }} | |
| run: | | |
| set -euo pipefail | |
| helper="$GITHUB_WORKSPACE/codex" | |
| sh "$helper" rewrite \ | |
| --base master \ | |
| --codex codex \ | |
| --rerere-from codex \ | |
| --require-automation \ | |
| --result "$RUNNER_TEMP/codex-candidate" \ | |
| --updates "$RUNNER_TEMP/codex-updates" \ | |
| --inputs "$RUNNER_TEMP/codex-inputs" \ | |
| --bundle "$RUNNER_TEMP/codex.bundle" \ | |
| --failure "$RUNNER_TEMP/codex-conflict.md" | |
| candidate=$(cat "$RUNNER_TEMP/codex-candidate") | |
| unstable_candidate=$(awk -F '\t' \ | |
| '$1 == "refs/heads/codex-unstable" { print $3 }' \ | |
| "$RUNNER_TEMP/codex-updates") | |
| case "$unstable_candidate" in | |
| '') ;; | |
| *[!0]*) | |
| test "$unstable_candidate" != "$candidate" | |
| git merge-base --is-ancestor "$candidate" "$unstable_candidate" | |
| echo "unstable-candidate=$unstable_candidate" >>"$GITHUB_OUTPUT" | |
| ;; | |
| *) ;; | |
| esac | |
| artifact_name="codex-candidate-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" | |
| { | |
| printf 'repository\t%s\n' "$GITHUB_REPOSITORY" | |
| printf 'run-id\t%s\n' "$GITHUB_RUN_ID" | |
| printf 'run-attempt\t%s\n' "$GITHUB_RUN_ATTEMPT" | |
| printf 'event\t%s\n' "$GITHUB_EVENT_NAME" | |
| printf 'caller-ref\t%s\n' "$GITHUB_REF" | |
| printf 'caller-sha\t%s\n' "$GITHUB_SHA" | |
| printf 'workflow-path\t%s\n' '.github/workflows/codex.yml' | |
| printf 'controller-oid\t%s\n' "$WORKFLOW_SHA" | |
| printf 'candidate\t%s\n' "$candidate" | |
| printf 'artifact-name\t%s\n' "$artifact_name" | |
| } >"$RUNNER_TEMP/codex-run" | |
| echo "artifact-name=$artifact_name" >>"$GITHUB_OUTPUT" | |
| echo "candidate=$candidate" >>"$GITHUB_OUTPUT" | |
| echo "controller-oid=$WORKFLOW_SHA" >>"$GITHUB_OUTPUT" | |
| - name: Summarize candidate | |
| env: | |
| CONTROLLER_OID: ${{ steps.rewrite.outputs.controller-oid }} | |
| run: | | |
| old_codex=$(awk -F '\t' '$1 == "codex" { print $3 }' \ | |
| "$RUNNER_TEMP/codex-inputs") | |
| candidate=$(cat "$RUNNER_TEMP/codex-candidate") | |
| unstable_candidate=$(awk -F '\t' \ | |
| '$1 == "refs/heads/codex-unstable" { print $3 }' \ | |
| "$RUNNER_TEMP/codex-updates") | |
| { | |
| echo '## Codex candidate' | |
| echo | |
| echo "Old codex: \`$old_codex\`" | |
| echo "Candidate: \`$candidate\`" | |
| case "$unstable_candidate" in | |
| '') ;; | |
| *[!0]*) | |
| echo "Unstable candidate: \`$unstable_candidate\`" | |
| ;; | |
| *) | |
| echo 'Unstable candidate: branch will be removed' | |
| ;; | |
| esac | |
| echo "Controller: \`$CONTROLLER_OID\`" | |
| echo | |
| echo 'Publish this exact prepared run from a clean local clone:' | |
| echo | |
| echo '```sh' | |
| echo "Meta/publish $GITHUB_RUN_ID" | |
| echo '```' | |
| echo | |
| echo '| Ref | Old | New |' | |
| echo '| --- | --- | --- |' | |
| awk -F '\t' \ | |
| '{ printf "| `%s` | `%s` | `%s` |\n", $1, $2, $3 }' \ | |
| "$RUNNER_TEMP/codex-updates" | |
| echo | |
| echo '```' | |
| git --no-pager diff --no-ext-diff --no-textconv \ | |
| --stat "$old_codex" "$candidate" | |
| echo '```' | |
| } >>"$GITHUB_STEP_SUMMARY" | |
| - name: Freeze the immutable candidate | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: ${{ steps.rewrite.outputs.artifact-name }} | |
| path: | | |
| ${{ runner.temp }}/codex.bundle | |
| ${{ runner.temp }}/codex-candidate | |
| ${{ runner.temp }}/codex-inputs | |
| ${{ runner.temp }}/codex-run | |
| ${{ runner.temp }}/codex-updates | |
| if-no-files-found: error | |
| retention-days: 7 | |
| - name: Explain how to resolve a conflict | |
| if: failure() | |
| run: | | |
| if test -f "$RUNNER_TEMP/codex-conflict.md" | |
| then | |
| cat "$RUNNER_TEMP/codex-conflict.md" >>"$GITHUB_STEP_SUMMARY" | |
| fi |