This is an automated email from the ASF dual-hosted git repository.
shuke987 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/master by this push:
new 296b8f2bc0d [fix](ci) Protect refreshed Codex auth updates (#66349)
296b8f2bc0d is described below
commit 296b8f2bc0d09af5422e96be5462a2f049e4356c
Author: shuke <[email protected]>
AuthorDate: Wed Aug 5 09:40:23 2026 +0800
[fix](ci) Protect refreshed Codex auth updates (#66349)
This PR makes the Codex `auth.json` write-back in the automated review
workflow conditional and conflict-aware.
- Record the SHA-256 of the selected and validated OSS auth file before
Codex starts.
- After the review finishes, upload `auth.json` only when Codex actually
changed the local file.
- Re-download the current OSS object immediately before write-back and
upload only when it still matches the originally downloaded version.
- Bound OSS reads and writes with the client's native retry policy:
three total attempts, a 10-second connection timeout, and a 30-second
read timeout. If a refreshed credential cannot be verified or persisted,
fail this non-required workflow instead of silently losing the update.
- Keep the downloaded verification copy and the OSS SDK's intermediate
`.temp` file private with `umask 077`, and clean both paths on every
exit.
- Preserve the pinned OSS client's native output so fatal reads and
writes retain the OSS error code, request ID, or concrete network cause.
- Run the sync whenever auth setup succeeded, even if the review later
failed for an unrelated reason, because Codex may already have refreshed
the credential.
---
.github/workflows/code-review-runner.yml | 64 +++++++++++++++++++++++---------
1 file changed, 46 insertions(+), 18 deletions(-)
diff --git a/.github/workflows/code-review-runner.yml
b/.github/workflows/code-review-runner.yml
index 1dab579277f..1f45d56fc5c 100644
--- a/.github/workflows/code-review-runner.yml
+++ b/.github/workflows/code-review-runner.yml
@@ -55,10 +55,9 @@ permissions:
jobs:
code-review:
runs-on: ubuntu-latest
- # Every pre-finalization step has its own timeout. Their worst-case budget,
- # including review/failure/status handling and best-effort cleanup, is 153
- # minutes, leaving 12 minutes for runner setup and post-job cleanup.
- timeout-minutes: 165
+ # Pre-finalization steps can use 153 minutes and auth sync can use 8 more,
+ # leaving 12 minutes for runner setup and post-job cleanup.
+ timeout-minutes: 173
if: >-
inputs.pr_number != '' ||
(
@@ -215,6 +214,8 @@ jobs:
id: auth
timeout-minutes: 5
run: |
+ set -o pipefail
+
install -m 700 -d "$RUNNER_TEMP/codex-home"
printf 'CODEX_HOME=%s\n' "$RUNNER_TEMP/codex-home" >> "$GITHUB_ENV"
@@ -277,6 +278,9 @@ jobs:
and (.tokens.access_token | type == "string" and length > 0)
and (.tokens.refresh_token | type == "string" and length > 0)
' "$RUNNER_TEMP/codex-home/auth.json" >/dev/null
+ sha256sum "$RUNNER_TEMP/codex-home/auth.json" \
+ | awk '{print $1}' \
+ > "$RUNNER_TEMP/codex-auth-original.sha256"
cat > "$RUNNER_TEMP/codex-home/config.toml" <<EOF
cli_auth_credentials_store = "file"
@@ -946,27 +950,51 @@ jobs:
OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com
OSS_CODEX_SESSION_PREFIX: oss://doris-community-ci/session
- - name: Sync Codex auth back to OSS
- if: ${{ always() }}
- continue-on-error: true
- timeout-minutes: 5
+ - name: Sync refreshed Codex auth back to OSS
+ if: ${{ always() && steps.auth.outcome == 'success' }}
+ timeout-minutes: 8
run: |
- if [ -z "$CODEX_AUTH_OSS_OBJECT" ]; then
- echo "No selected Codex auth object found; skipping OSS auth sync."
+ set -o pipefail
+
+ if ! jq -e '
+ .auth_mode == "chatgpt"
+ and (.tokens.access_token | type == "string" and length > 0)
+ and (.tokens.refresh_token | type == "string" and length > 0)
+ ' "$CODEX_HOME/auth.json" >/dev/null; then
+ echo "::error::Refreshed Codex auth is invalid; refusing OSS auth
sync."
+ exit 1
+ fi
+
+ original_hash="$(<"$RUNNER_TEMP/codex-auth-original.sha256")"
+ local_hash="$(sha256sum "$CODEX_HOME/auth.json" | awk '{print $1}')"
+ if [ "$local_hash" = "$original_hash" ]; then
+ echo "Codex auth was not refreshed; skipping OSS auth sync."
exit 0
fi
- if [ ! -s "$CODEX_HOME/auth.json" ]; then
- echo "No Codex auth file found; skipping OSS auth sync."
+ umask 077
+ remote_auth="$(mktemp "$RUNNER_TEMP/codex-auth-current.XXXXXX")"
+ trap 'rm -f "$remote_auth" "${remote_auth}.temp"' EXIT
+ if ! ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \
+ --retry-times=3 --connect-timeout=10 --read-timeout=30 \
+ cp -f "$CODEX_AUTH_OSS_OBJECT" "$remote_auth"; then
+ echo "::error::Could not verify the current OSS auth after 3
attempts."
+ exit 1
+ fi
+
+ remote_hash="$(sha256sum "$remote_auth" | awk '{print $1}')"
+ if [ "$remote_hash" != "$original_hash" ]; then
+ echo "::warning::OSS auth changed during this job; skipping stale
auth sync."
exit 0
fi
- jq -e '
- .auth_mode == "chatgpt"
- and (.tokens.access_token | type == "string" and length > 0)
- and (.tokens.refresh_token | type == "string" and length > 0)
- ' "$CODEX_HOME/auth.json" >/dev/null
- ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" cp -f
"$CODEX_HOME/auth.json" "$CODEX_AUTH_OSS_OBJECT"
+ if ! ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \
+ --retry-times=3 --connect-timeout=10 --read-timeout=30 \
+ cp -f "$CODEX_HOME/auth.json" "$CODEX_AUTH_OSS_OBJECT"; then
+ echo "::error::Could not persist the refreshed Codex auth after 3
attempts."
+ exit 1
+ fi
+ echo "Uploaded refreshed Codex auth: ${CODEX_AUTH_OSS_OBJECT##*/}"
env:
OSS_AK: ${{ secrets.OSS_AK }}
OSS_SK: ${{ secrets.OSS_SK }}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
