ci: enforce Codex plugin contribution scanner gate - #361
Conversation
Signed-off-by: Michael Kantor <6068672+kantorcodes@users.noreply.github.com>
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bf51e3f3fc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Signed-off-by: Michael Kantor <6068672+kantorcodes@users.noreply.github.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1959442d8a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| echo "matrix=$(cat \"$MATRIX_FILE\")" >> "$GITHUB_OUTPUT" | ||
| echo "has_failures=$(jq -r '.has_failures' \"$STATUS_FILE\")" >> "$GITHUB_OUTPUT" | ||
| echo "results=$(jq -c '.results' \"$STATUS_FILE\")" >> "$GITHUB_OUTPUT" |
There was a problem hiding this comment.
When either workflow reaches its export step, \"$MATRIX_FILE\" is parsed inside the command substitution as literal quote characters, so cat looks for a path named "/.../open-pr-matrix.json" rather than the generated file. The surrounding echo still succeeds and exports an empty matrix; fromJSON('') then prevents the scan matrix from being instantiated, while the two jq calls here also lose the validation status and per-PR results. Use normal nested quoting such as $(cat "$MATRIX_FILE"); the same defect is present in .github/workflows/validate-contribution.yml.
Useful? React with 👍 / 👎.
| url=match.group(2).strip(), | ||
| owner=match.group(3), | ||
| repo=match.group(4), |
There was a problem hiding this comment.
The fresh .git URL case remains despite the new URL normalization: for a standard clone-form link such as https://github.com/acme/plugin.git, the regex stores plugin.git here even though normalize_url() strips the suffix only for duplicate comparison. Workflow discovery consequently requests /repos/acme/plugin.git/..., and the generated clone URL becomes plugin.git.git, so an otherwise valid contribution is rejected or fails its scan. Canonicalize the captured repository name before constructing the Contribution.
Useful? React with 👍 / 👎.
| if existing is not None and isinstance(existing.get("id"), int): | ||
| github_api( | ||
| repository, | ||
| f"/issues/comments/{existing['id']}", | ||
| token, | ||
| method="PATCH", | ||
| payload={"body": body}, |
There was a problem hiding this comment.
Because sweep-open-prs.yml runs scheduled all-PR sweeps and per-PR synchronize sweeps concurrently without ordering, an older scheduled run can finish after a newer head-specific run and PATCH this shared marker comment with results calculated from the previous PR head. The check runs remain attached to their respective SHAs, but the contributor-facing comment can regress from passed to failed or otherwise show stale guidance. Before updating the comment, verify that the PR still has the result's head_sha, or serialize/cancel superseded runs.
Useful? React with 👍 / 👎.
1 participant
Summary
hashgraph-online/ai-plugin-scanner-actiononpushorpull_requestCONTRIBUTING.mdValidation
actionlint .github/workflows/validate-contribution.yml .github/workflows/sweep-open-prs.ymlpython3 scripts/check-alphabetical.py README.mdvalidate-contribution.py --open-prssweep againsthashgraph-online/awesome-codex-plugins(17 open PRs classified; seven missing scanner CI, three queued for scan)The target-side workflow checks out only the default branch. It reads PR metadata and README refs through the GitHub API, so fork PRs do not execute untrusted workflow code with write permissions. Scanner jobs clone only the public source repository selected by the validated README URL.