github-actions[bot] commented on code in PR #66349:
URL: https://github.com/apache/doris/pull/66349#discussion_r3696352866
##########
.github/workflows/code-review-runner.yml:
##########
@@ -946,27 +949,46 @@ jobs:
OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com
OSS_CODEX_SESSION_PREFIX: oss://doris-community-ci/session
- - name: Sync Codex auth back to OSS
- if: ${{ always() }}
- continue-on-error: true
+ - name: Sync refreshed Codex auth back to OSS
+ if: ${{ always() && steps.auth.outcome == 'success' }}
timeout-minutes: 5
run: |
- if [ -z "$CODEX_AUTH_OSS_OBJECT" ]; then
- echo "No selected Codex auth object found; skipping OSS auth sync."
+ jq -e '
+ .auth_mode == "chatgpt"
+ and (.tokens.access_token | type == "string" and length > 0)
+ and (.tokens.refresh_token | type == "string" and length > 0)
+ ' "$CODEX_HOME/auth.json" >/dev/null
+
+ original_hash="$(<"$RUNNER_TEMP/codex-auth-original.sha256")"
+ local_hash="$(sha256sum "$CODEX_HOME/auth.json" | awk '{print $1}')"
+ if [ "$local_hash" = "$original_hash" ]; then
+ echo "Codex auth was not refreshed; skipping OSS auth sync."
exit 0
fi
- if [ ! -s "$CODEX_HOME/auth.json" ]; then
- echo "No Codex auth file found; skipping OSS auth sync."
+ umask 077
+ remote_auth="$(mktemp "$RUNNER_TEMP/codex-auth-current.XXXXXX")"
+ trap 'rm -f "$remote_auth" "${remote_auth}.temp"' EXIT
+ if ! ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \
+ --retry-times=3 --connect-timeout=10 --read-timeout=30 \
+ cp -f "$CODEX_AUTH_OSS_OBJECT" "$remote_auth" >/dev/null; then
Review Comment:
[P2] Preserve the OSS failure reason
Both guarded transfers now redirect stdout, but pinned `ossutil` v1.7.19
prints its terminal `Error: ...` through stdout
([source](https://github.com/aliyun/ossutil/blob/v1.7.19/ossutil.go#L11-L21)),
including the OSS error code/request ID or the concrete network cause. On a
failed verification or upload, the log therefore retains only this generic
annotation, so an operator cannot distinguish a missing object, rejected
credentials, a timeout, or an OSS service failure even though this PR makes the
step fatal. Please retain the client output on failure, or capture it privately
and emit a credential-safe diagnostic only when the command fails; successful
copies can remain quiet.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
