mirror of
https://github.com/openai/codex.git
synced 2026-05-14 16:22:51 +00:00
8bea5d231a
This does two things: - We use `persist-credentials: false` everywhere now. This is unfortunately not the default in GitHub Actions, but it prevents `actions/checkout` from dropping `secrets.GITHUB_TOKEN` onto disk. - We interpose (some) template expansions through environment variables. I've limited this to contexts that have non-fixed values; contexts that are fixed (like `*.result`) are not dangerous to expand directly inline (but maybe we should clean those up in the future for consistency anyways). This is a medium-risk change in terms of CI breakage: I did a scan for usage of `git push` and other commands that implicitly use the persisted credential, but couldn't find any. Even still, some implicit usages of the persisted credentials may be lurking. Please ping ww@ if any issues arise.
55 lines
1.7 KiB
YAML
55 lines
1.7 KiB
YAML
name: rust-release-prepare
|
|
on:
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: "0 */4 * * *"
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
prepare:
|
|
# Prevent scheduled runs on forks (no secrets, wastes Actions minutes)
|
|
if: github.repository == 'openai/codex'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
ref: main
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Update models.json
|
|
env:
|
|
OPENAI_API_KEY: ${{ secrets.CODEX_OPENAI_API_KEY }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
client_version="99.99.99"
|
|
terminal_info="github-actions"
|
|
user_agent="codex_cli_rs/99.99.99 (Linux $(uname -r); $(uname -m)) ${terminal_info}"
|
|
base_url="${OPENAI_BASE_URL:-https://chatgpt.com/backend-api/codex}"
|
|
|
|
headers=(
|
|
-H "Authorization: Bearer ${OPENAI_API_KEY}"
|
|
-H "User-Agent: ${user_agent}"
|
|
)
|
|
|
|
url="${base_url%/}/models?client_version=${client_version}"
|
|
curl --http1.1 --fail --show-error --location "${headers[@]}" "${url}" | jq '.' > codex-rs/models-manager/models.json
|
|
|
|
- name: Open pull request (if changed)
|
|
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
|
|
with:
|
|
commit-message: "Update models.json"
|
|
title: "Update models.json"
|
|
body: "Automated update of models.json."
|
|
branch: "bot/update-models-json"
|
|
reviewers: "pakrym-oai,aibrahim-oai"
|
|
delete-branch: true
|