feat: add moss-chunking - pluggable chunking strategies over a shared chunk contract #749
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Codex Review (collect diff) | |
| # Stage 1 of the two-stage Codex PR review. | |
| # | |
| # Runs on EVERY pull request — including forks — but with NO secrets and a | |
| # read-only token, so it is safe against untrusted code. It performs no build or | |
| # install: it checks out the PR merge ref, computes the diff, and hands it to the | |
| # privileged Stage 2 (codex-review-post.yml) via an artifact consumed through | |
| # `workflow_run`. Because fork code never executes here and no secret is present, | |
| # a malicious PR has nothing to steal or abuse. | |
| # | |
| # NOTE: `workflow_run` only fires for the copy of these workflows on the default | |
| # branch, so Codex review activates once this pair is merged to main (the PR that | |
| # introduces it will not review itself). | |
| on: | |
| pull_request: | |
| # ready_for_review is included so a PR opened as a draft is reviewed the | |
| # moment it becomes non-draft (the collect-diff job gates on draft == false). | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: codex-review-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| collect-diff: | |
| # Skip drafts and bot-authored PRs; every other PR (incl. forks) is reviewed. | |
| if: github.event.pull_request.draft == false && github.event.pull_request.user.type != 'Bot' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Check out PR head | |
| uses: actions/checkout@v4 | |
| with: | |
| # The head ref always exists; the merge ref does NOT when the PR has | |
| # conflicts, which would silently skip the review. Diffing the head | |
| # against the base's merge-base reproduces GitHub's PR diff regardless. | |
| ref: refs/pull/${{ github.event.pull_request.number }}/head | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Compute PR diff and metadata | |
| env: | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| BASE_REF: ${{ github.event.pull_request.base.ref }} | |
| run: | | |
| set -euo pipefail | |
| mkdir -p codex-payload | |
| # Fetch the base branch, then take the merge-base ("...") diff — the exact | |
| # change set GitHub shows, and robust to an un-mergeable PR. | |
| git fetch --no-tags origin "$BASE_REF" | |
| git diff FETCH_HEAD...HEAD > codex-payload/pr.diff | |
| printf '%s' "$PR_NUMBER" > codex-payload/pr-number.txt | |
| echo "Collected $(wc -l < codex-payload/pr.diff) diff lines for PR #${PR_NUMBER}" | |
| - name: Upload review payload | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: codex-review-payload | |
| path: codex-payload/ | |
| retention-days: 1 | |
| if-no-files-found: error |