mirror of
https://github.com/openai/codex.git
synced 2026-04-24 14:45:27 +00:00
f50e88db82
Prevent binaries >500KB from being committed. And maintain an allowlist if we need to bypass on a case-by-case basis. I checked the currently tracked binary-like assets in the repo. There are only 5 obvious committed binaries by extension/MIME type: - `.github/codex-cli-splash.png`: `838,131` bytes, about `818 KiB` - `codex-rs/vendor/bubblewrap/bubblewrap.jpg`: `40,239` bytes, about `39 KiB` - `codex-rs/skills/src/assets/samples/skill-creator/assets/skill-creator.png`: `1,563` bytes - `codex-rs/skills/src/assets/samples/openai-docs/assets/openai.png`: `1,429` bytes - `codex-rs/skills/src/assets/samples/skill-installer/assets/skill-installer.png`: `1,086` bytes So `500 KB` looks like a good default for this repo. It would only trip on one existing intentional asset, which keeps the allowlist small and the policy easy to understand. Here's a smoke-test from a throwaway branch that tries to commit a large binary: https://github.com/openai/codex/actions/runs/22971558828/job/66689330435?pr=14383
30 lines
759 B
YAML
30 lines
759 B
YAML
name: blob-size-policy
|
|
|
|
on:
|
|
pull_request: {}
|
|
|
|
jobs:
|
|
check:
|
|
name: Blob size policy
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Determine PR comparison range
|
|
id: range
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
echo "base=$(git rev-parse HEAD^1)" >> "$GITHUB_OUTPUT"
|
|
echo "head=$(git rev-parse HEAD^2)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Check changed blob sizes
|
|
run: |
|
|
python3 scripts/check_blob_size.py \
|
|
--base "${{ steps.range.outputs.base }}" \
|
|
--head "${{ steps.range.outputs.head }}" \
|
|
--max-bytes 512000 \
|
|
--allowlist .github/blob-size-allowlist.txt
|