mirror of
https://github.com/openai/codex.git
synced 2026-06-01 19:02:59 +00:00
8bea5d231a
This does two things: - We use `persist-credentials: false` everywhere now. This is unfortunately not the default in GitHub Actions, but it prevents `actions/checkout` from dropping `secrets.GITHUB_TOKEN` onto disk. - We interpose (some) template expansions through environment variables. I've limited this to contexts that have non-fixed values; contexts that are fixed (like `*.result`) are not dangerous to expand directly inline (but maybe we should clean those up in the future for consistency anyways). This is a medium-risk change in terms of CI breakage: I did a scan for usage of `git push` and other commands that implicitly use the persisted credential, but couldn't find any. Even still, some implicit usages of the persisted credentials may be lurking. Please ping ww@ if any issues arise.
34 lines
916 B
YAML
34 lines
916 B
YAML
name: blob-size-policy
|
|
|
|
on:
|
|
pull_request: {}
|
|
|
|
jobs:
|
|
check:
|
|
name: Blob size policy
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Determine PR comparison range
|
|
id: range
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
echo "base=$(git rev-parse HEAD^1)" >> "$GITHUB_OUTPUT"
|
|
echo "head=$(git rev-parse HEAD^2)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Check changed blob sizes
|
|
env:
|
|
BASE_SHA: ${{ steps.range.outputs.base }}
|
|
HEAD_SHA: ${{ steps.range.outputs.head }}
|
|
run: |
|
|
python3 scripts/check_blob_size.py \
|
|
--base "$BASE_SHA" \
|
|
--head "$HEAD_SHA" \
|
|
--max-bytes 512000 \
|
|
--allowlist .github/blob-size-allowlist.txt
|