ci: keep self-release codex job on ubuntu-latest - #78
Merged
Conversation
The release-info job runs openai/codex-action@v1, which defaults to
safety-strategy: drop-sudo. That removes the runner from the sudo group
then asserts `sudo -n true` fails. On Blacksmith runners sudo is granted
via a blanket NOPASSWD rule rather than the sudo group, so the revocation
doesn't take and the action's own verify step exits 1 ("Expected sudo to
be disabled, but sudo succeeded").
Commit 5ef6ab3 moved this job to blacksmith-4vcpu-ubuntu-2404; revert
just release-info to ubuntu-latest where drop-sudo works. check-labels
and github-release stay on Blacksmith.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
Caution Review failedPull request was closed or merged during review No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📜 Recent review details⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
🧰 Additional context used🧠 Learnings (3)📚 Learning: 2026-04-05T00:07:12.194ZApplied to files:
📚 Learning: 2026-04-27T01:30:22.893ZApplied to files:
📚 Learning: 2026-04-27T01:30:22.893ZApplied to files:
🔇 Additional comments (1)
📝 WalkthroughWalkthroughThe self-release GitHub Actions workflow is updated to run the ChangesRelease Workflow Runner Configuration
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Revert the
release-infojob inself-release.yamlfromblacksmith-4vcpu-ubuntu-2404back toubuntu-latest.Why
release-inforunsopenai/codex-action@v1, which defaults tosafety-strategy: drop-sudo. That strategy removes therunneruser from thesudogroup and then assertssudo -n truenow fails. On Blacksmith runners, passwordless sudo is granted by a blanketNOPASSWDrule in/etc/sudoers.d/rather than via thesudogroup, so dropping the group membership doesn't revoke it — the action's own verify step then exits 1:Commit 5ef6ab3 ("route photon-hq ubuntu-latest jobs to Blacksmith") moved this job onto Blacksmith, which is what broke it. This reverts only
release-info— the one job that runs codex.check-labelsandgithub-releasestay on Blacksmith since they're unaffected.Alternative considered
Keep it on Blacksmith and set
safety-strategy: read-onlyon the action (the workflow already passessandbox: read-only). Skipped becauseread-onlyruns codex as a user that still has sudo, so it loses the secret-exfil hardening thatdrop-sudoprovides. Staying onubuntu-latestkeeps the stronger posture.🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmithwith what you need. Autofix is disabled.Summary by CodeRabbit