From 84f598395dfce228b68aba2e1b63b35fac9bf1d3 Mon Sep 17 00:00:00 2001
From: Taylor Blau <ttaylorr@openai.com>
Date: Mon, 7 Sep 2026 20:17:22 -0500
Subject: [PATCH] codex: allow the reviewed Debian CI image update

The CI workflow pins still select Debian 11. Moving its failed job to
Debian 12 changes the exact workflow blob checked by the controller.

Allow the reviewed image update from either the inherited workflow or
its pinned version. Retain the existing pin transition so current plans
stay valid until the source update is admitted. Keep rejecting other
contents, mode changes, deletions, and a rollback to the older image.

Exercise both image-update paths and the unchanged pin transition, and
check that an unreviewed source or destination still fails.

Signed-off-by: Taylor Blau <ttaylorr@openai.com>
---
 .github/workflows/codex-branch.sh | 14 +++++++------
 t/t9905-codex-branch.sh           | 33 +++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/codex-branch.sh b/.github/workflows/codex-branch.sh
index c725d0f7cc37da..f3845237be7d61 100755
--- a/.github/workflows/codex-branch.sh
+++ b/.github/workflows/codex-branch.sh
@@ -377,20 +377,22 @@ ci_workflow_pins_are_reviewed () (
 	base_oid=$1
 	head_oid=$2
 
-	# Permit only the reviewed full-SHA replacements of the inherited CI
-	# workflows. Comparing tree entries also rejects mode changes, symlinks,
+	# Permit only the reviewed CI pins and optional image update.
+	# Comparing tree entries also rejects mode changes, symlinks,
 	# and deletions. New upstream workflow contents need a new review.
-	while read -r path old_blob new_blob
+	while read -r path old_blob new_blob updated_blob
 	do
 		old=$(git ls-tree "$base_oid" -- "$path") || return 1
 		new=$(git ls-tree "$head_oid" -- "$path") || return 1
 		test "$old" = "$new" && continue
-		test "$old" = "100644 blob $old_blob$tab$path" &&
-		test "$new" = "100644 blob $new_blob$tab$path" || return 1
+		{ test "$old" = "100644 blob $old_blob$tab$path" ||
+		  test "$old" = "100644 blob $new_blob$tab$path"; } &&
+		{ test "$new" = "100644 blob $new_blob$tab$path" ||
+		  test "$new" = "100644 blob $updated_blob$tab$path"; } || return 1
 	done <<-\EOF
 	.github/workflows/check-style.yml 108a2de903310cfd0f6327353ee700d99d54edc3 b265fe35cbfc51db4cd53729e602de5d36b6632e
 	.github/workflows/check-whitespace.yml ea6f49f742108e27812decc666e6839ab84080f1 3379f89a814abd439ac13efaa572264be5b75080
-	.github/workflows/main.yml 205325eb33b06444f24a11271a9e669841e29cb9 485e3be66581518bca55b62d97ebd2217be194b1
+	.github/workflows/main.yml 205325eb33b06444f24a11271a9e669841e29cb9 485e3be66581518bca55b62d97ebd2217be194b1 09dbf0c59a288b752c9a41a2c8ed749e3af1a1e8
 	EOF
 )
 
diff --git a/t/t9905-codex-branch.sh b/t/t9905-codex-branch.sh
index 9521c22048bde6..064eb0a78375b9 100755
--- a/t/t9905-codex-branch.sh
+++ b/t/t9905-codex-branch.sh
@@ -10870,4 +10870,37 @@ test_expect_success 'both release lanes start CI before either lane waits' '
 	)
 '
 
+test_expect_success SHA1 'reviewed CI image updates retain exact workflow entries' '
+	test_create_repo ci-image-policy &&
+	(
+		cd ci-image-policy &&
+		tab=$(printf "\t") &&
+		sed -n "/^ci_workflow_pins_are_reviewed () ($/,/^)/p" \
+			"$codex_branch" >policy.sh &&
+		. ./policy.sh &&
+		ci_tree () {
+			workflow=$(printf "%s blob %s\tmain.yml\n" \
+				"${2:-100644}" "$1" | git mktree --missing) &&
+			github=$(printf "040000 tree %s\tworkflows\n" \
+				"$workflow" | git mktree) &&
+			printf "040000 tree %s\t.github\n" "$github" |
+				git mktree
+		} &&
+		before=$(ci_tree 205325eb33b06444f24a11271a9e669841e29cb9) &&
+		pinned=$(ci_tree 485e3be66581518bca55b62d97ebd2217be194b1) &&
+		updated=$(ci_tree 09dbf0c59a288b752c9a41a2c8ed749e3af1a1e8) &&
+		unknown=$(ci_tree 1111111111111111111111111111111111111111) &&
+		mode=$(ci_tree 09dbf0c59a288b752c9a41a2c8ed749e3af1a1e8 100755) &&
+		empty=$(git mktree </dev/null) &&
+		ci_workflow_pins_are_reviewed "$before" "$pinned" &&
+		ci_workflow_pins_are_reviewed "$before" "$updated" &&
+		ci_workflow_pins_are_reviewed "$pinned" "$updated" &&
+		test_expect_code 1 ci_workflow_pins_are_reviewed "$pinned" "$unknown" &&
+		test_expect_code 1 ci_workflow_pins_are_reviewed "$unknown" "$updated" &&
+		test_expect_code 1 ci_workflow_pins_are_reviewed "$pinned" "$mode" &&
+		test_expect_code 1 ci_workflow_pins_are_reviewed "$pinned" "$empty" &&
+		test_expect_code 1 ci_workflow_pins_are_reviewed "$updated" "$pinned"
+	)
+'
+
 test_done