github-actions[bot] commented on code in PR #68547:
URL: https://github.com/apache/doris/pull/68547#discussion_r4119423438
##########
.github/workflows/code-review-runner.yml:
##########
@@ -35,8 +40,159 @@ env:
REVIEW_TIMEOUT_MINUTES: 120
jobs:
+ runtime-canary:
+ if: ${{ github.event_name == 'workflow_dispatch' && inputs.runtime_canary
== true }}
+ runs-on: ubuntu-24.04
+ timeout-minutes: 25
+ permissions:
+ contents: read
+ steps:
+ - name: Install ossutil
+ run: |
+ tmp_dir="$(mktemp -d)"
+ trap 'rm -rf "$tmp_dir"' EXIT
+ curl -fsSL -o "$tmp_dir/ossutil.zip"
https://gosspublic.alicdn.com/ossutil/1.7.19/ossutil-v1.7.19-linux-amd64.zip
+ unzip -q "$tmp_dir/ossutil.zip" -d "$tmp_dir"
+ sudo install -m 0755 "$tmp_dir/ossutil-v1.7.19-linux-amd64/ossutil"
/usr/local/bin/ossutil
+
+ - name: Install staged Codex package
+ env:
+ OSS_AK: ${{ secrets.OSS_AK }}
+ OSS_SK: ${{ secrets.OSS_SK }}
+ OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com
+ run: |
+ set -euo pipefail
+ archive="$RUNNER_TEMP/codex-exec-goal.tar.gz"
+ package="$RUNNER_TEMP/codex-exec-goal"
+ ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \
+ cp -f
oss://doris-community-ci/codex/releases/codex-exec-goal-0.156.1-a310d33f7ebb-x86_64-unknown-linux-gnu.tar.gz
"$archive"
+ echo
"2ee3073479bc8c94436684b55a13d7a3f299e768d04436d90e0427814a3954bc $archive" |
sha256sum --check
+ mkdir -p "$package"
+ tar -xzf "$archive" -C "$package"
+ (cd "$package" && sha256sum --check SHA256SUMS)
+ test "$(jq -r .version "$package/codex-package.json")" = 0.156.1
+ "$package/bin/codex" --version
+ "$package/bin/codex" exec --help | grep -q -- '--goal'
+ echo "CODEX_CANARY_BIN=$package/bin/codex" >> "$GITHUB_ENV"
+
+ - name: Load one review auth snapshot
+ id: auth
+ env:
+ OSS_AK: ${{ secrets.OSS_AK }}
+ OSS_SK: ${{ secrets.OSS_SK }}
+ OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com
+ run: |
+ set -euo pipefail
+ umask 077
+ home="$RUNNER_TEMP/codex-canary-home"
+ install -m 700 -d "$home"
+ ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \
+ cp -f oss://doris-community-ci/codex/auth.json.4 "$home/auth.json"
>/dev/null
Review Comment:
[P2] Isolate the canary credential from the live review pool. This always
loads auth.json.4, which a concurrent review can also select. If the canary
refreshes token T0 first, that review's local T0 fails at its next refresh; the
later OSS hash check cannot protect the already-running review. The canary also
ignores the production .context and .invalid-token eligibility markers, so a
quarantined slot can fail this package check even when another review account
works. Use a dedicated canary credential or a reservation that covers token use
and persistence.
##########
.github/workflows/code-review-runner.yml:
##########
@@ -35,8 +40,159 @@ env:
REVIEW_TIMEOUT_MINUTES: 120
jobs:
+ runtime-canary:
+ if: ${{ github.event_name == 'workflow_dispatch' && inputs.runtime_canary
== true }}
+ runs-on: ubuntu-24.04
+ timeout-minutes: 25
+ permissions:
+ contents: read
+ steps:
+ - name: Install ossutil
+ run: |
+ tmp_dir="$(mktemp -d)"
+ trap 'rm -rf "$tmp_dir"' EXIT
+ curl -fsSL -o "$tmp_dir/ossutil.zip"
https://gosspublic.alicdn.com/ossutil/1.7.19/ossutil-v1.7.19-linux-amd64.zip
+ unzip -q "$tmp_dir/ossutil.zip" -d "$tmp_dir"
+ sudo install -m 0755 "$tmp_dir/ossutil-v1.7.19-linux-amd64/ossutil"
/usr/local/bin/ossutil
+
+ - name: Install staged Codex package
+ env:
+ OSS_AK: ${{ secrets.OSS_AK }}
+ OSS_SK: ${{ secrets.OSS_SK }}
+ OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com
+ run: |
+ set -euo pipefail
+ archive="$RUNNER_TEMP/codex-exec-goal.tar.gz"
+ package="$RUNNER_TEMP/codex-exec-goal"
+ ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \
+ cp -f
oss://doris-community-ci/codex/releases/codex-exec-goal-0.156.1-a310d33f7ebb-x86_64-unknown-linux-gnu.tar.gz
"$archive"
+ echo
"2ee3073479bc8c94436684b55a13d7a3f299e768d04436d90e0427814a3954bc $archive" |
sha256sum --check
+ mkdir -p "$package"
+ tar -xzf "$archive" -C "$package"
+ (cd "$package" && sha256sum --check SHA256SUMS)
+ test "$(jq -r .version "$package/codex-package.json")" = 0.156.1
+ "$package/bin/codex" --version
+ "$package/bin/codex" exec --help | grep -q -- '--goal'
+ echo "CODEX_CANARY_BIN=$package/bin/codex" >> "$GITHUB_ENV"
+
+ - name: Load one review auth snapshot
+ id: auth
+ env:
+ OSS_AK: ${{ secrets.OSS_AK }}
+ OSS_SK: ${{ secrets.OSS_SK }}
+ OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com
+ run: |
+ set -euo pipefail
+ umask 077
+ home="$RUNNER_TEMP/codex-canary-home"
+ install -m 700 -d "$home"
+ ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \
+ cp -f oss://doris-community-ci/codex/auth.json.4 "$home/auth.json"
>/dev/null
+ jq -e '
+ .auth_mode == "chatgpt"
+ and (.tokens.access_token | type == "string" and length > 0)
+ and (.tokens.refresh_token | type == "string" and length > 0)
+ ' "$home/auth.json" >/dev/null
+ sha256sum "$home/auth.json" | awk '{print $1}' \
+ > "$RUNNER_TEMP/codex-canary-auth-original.sha256"
+ cat > "$home/config.toml" <<'EOF'
+ cli_auth_credentials_store = "file"
+ approval_policy = "never"
+
+ [features]
+ memories = true
+
+ [memories]
+ use_memories = true
+ generate_memories = true
+
+ [otel]
+ environment = "github-actions"
+ exporter = "none"
+ trace_exporter = "none"
+ metrics_exporter = "none"
+ EOF
+ echo "CODEX_HOME=$home" >> "$GITHUB_ENV"
+
+ - name: Test ChatGPT model access and goal mode without GitHub writes
+ timeout-minutes: 12
+ run: |
+ set -uo pipefail
+ run_model() {
+ local label="$1" model="$2" goal="$3"
+ local events="$RUNNER_TEMP/codex-canary-$label.jsonl"
+ local final="$RUNNER_TEMP/codex-canary-$label.txt"
+ local args=(exec --skip-git-repo-check --json --model "$model"
+ --config model_reasoning_effort=low --sandbox read-only
+ --color never --output-last-message "$final")
+ if [ "$goal" = true ]; then
+ args+=(--goal)
+ fi
+ local prompt="Reply with exactly OK. Do not access files or
external services."
+ if [ "$goal" = true ]; then
+ prompt="Create a goal to reply OK, mark it complete, then reply
OK. Do not access files or external services."
+ fi
+ timeout --signal=INT --kill-after=10s 180s \
+ env -u GH_TOKEN -u GITHUB_TOKEN "$CODEX_CANARY_BIN" \
+ "${args[@]}" "$prompt" > "$events" 2>
"$RUNNER_TEMP/codex-canary-$label.stderr"
+ local status=$?
+ echo "$label: exit_status=$status"
+ jq -r 'select(.type == "turn.failed" or .type == "error") |
+ .error.message // .message // empty' "$events" | tail -n 2 ||
true
+ if [ "$status" -ne 0 ] ||
+ ! jq -e 'select(.type == "turn.completed")' "$events"
>/dev/null; then
Review Comment:
[P2] Verify goal completion in the canary. A zero exit plus turn.completed
only proves that a model turn ended; the goal may never have been created or
marked complete. Since this probe is intended to validate the goal-mode package
used by production, inspect an authoritative goal-state/tool event (and the
requested final answer) before reporting it as successful.
##########
.github/workflows/code-review-runner.yml:
##########
@@ -35,8 +40,159 @@ env:
REVIEW_TIMEOUT_MINUTES: 120
jobs:
+ runtime-canary:
+ if: ${{ github.event_name == 'workflow_dispatch' && inputs.runtime_canary
== true }}
+ runs-on: ubuntu-24.04
+ timeout-minutes: 25
+ permissions:
+ contents: read
+ steps:
+ - name: Install ossutil
+ run: |
+ tmp_dir="$(mktemp -d)"
+ trap 'rm -rf "$tmp_dir"' EXIT
+ curl -fsSL -o "$tmp_dir/ossutil.zip"
https://gosspublic.alicdn.com/ossutil/1.7.19/ossutil-v1.7.19-linux-amd64.zip
+ unzip -q "$tmp_dir/ossutil.zip" -d "$tmp_dir"
+ sudo install -m 0755 "$tmp_dir/ossutil-v1.7.19-linux-amd64/ossutil"
/usr/local/bin/ossutil
+
+ - name: Install staged Codex package
+ env:
+ OSS_AK: ${{ secrets.OSS_AK }}
+ OSS_SK: ${{ secrets.OSS_SK }}
+ OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com
+ run: |
+ set -euo pipefail
+ archive="$RUNNER_TEMP/codex-exec-goal.tar.gz"
+ package="$RUNNER_TEMP/codex-exec-goal"
+ ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \
+ cp -f
oss://doris-community-ci/codex/releases/codex-exec-goal-0.156.1-a310d33f7ebb-x86_64-unknown-linux-gnu.tar.gz
"$archive"
+ echo
"2ee3073479bc8c94436684b55a13d7a3f299e768d04436d90e0427814a3954bc $archive" |
sha256sum --check
+ mkdir -p "$package"
+ tar -xzf "$archive" -C "$package"
+ (cd "$package" && sha256sum --check SHA256SUMS)
+ test "$(jq -r .version "$package/codex-package.json")" = 0.156.1
+ "$package/bin/codex" --version
+ "$package/bin/codex" exec --help | grep -q -- '--goal'
+ echo "CODEX_CANARY_BIN=$package/bin/codex" >> "$GITHUB_ENV"
+
+ - name: Load one review auth snapshot
+ id: auth
+ env:
+ OSS_AK: ${{ secrets.OSS_AK }}
+ OSS_SK: ${{ secrets.OSS_SK }}
+ OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com
+ run: |
+ set -euo pipefail
+ umask 077
+ home="$RUNNER_TEMP/codex-canary-home"
+ install -m 700 -d "$home"
+ ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \
+ cp -f oss://doris-community-ci/codex/auth.json.4 "$home/auth.json"
>/dev/null
+ jq -e '
+ .auth_mode == "chatgpt"
+ and (.tokens.access_token | type == "string" and length > 0)
+ and (.tokens.refresh_token | type == "string" and length > 0)
+ ' "$home/auth.json" >/dev/null
+ sha256sum "$home/auth.json" | awk '{print $1}' \
+ > "$RUNNER_TEMP/codex-canary-auth-original.sha256"
+ cat > "$home/config.toml" <<'EOF'
+ cli_auth_credentials_store = "file"
+ approval_policy = "never"
+
+ [features]
+ memories = true
+
+ [memories]
+ use_memories = true
+ generate_memories = true
+
+ [otel]
+ environment = "github-actions"
+ exporter = "none"
+ trace_exporter = "none"
+ metrics_exporter = "none"
+ EOF
+ echo "CODEX_HOME=$home" >> "$GITHUB_ENV"
+
+ - name: Test ChatGPT model access and goal mode without GitHub writes
+ timeout-minutes: 12
+ run: |
+ set -uo pipefail
+ run_model() {
+ local label="$1" model="$2" goal="$3"
+ local events="$RUNNER_TEMP/codex-canary-$label.jsonl"
+ local final="$RUNNER_TEMP/codex-canary-$label.txt"
+ local args=(exec --skip-git-repo-check --json --model "$model"
+ --config model_reasoning_effort=low --sandbox read-only
+ --color never --output-last-message "$final")
+ if [ "$goal" = true ]; then
+ args+=(--goal)
+ fi
+ local prompt="Reply with exactly OK. Do not access files or
external services."
+ if [ "$goal" = true ]; then
+ prompt="Create a goal to reply OK, mark it complete, then reply
OK. Do not access files or external services."
+ fi
+ timeout --signal=INT --kill-after=10s 180s \
+ env -u GH_TOKEN -u GITHUB_TOKEN "$CODEX_CANARY_BIN" \
+ "${args[@]}" "$prompt" > "$events" 2>
"$RUNNER_TEMP/codex-canary-$label.stderr"
+ local status=$?
+ echo "$label: exit_status=$status"
+ jq -r 'select(.type == "turn.failed" or .type == "error") |
+ .error.message // .message // empty' "$events" | tail -n 2 ||
true
+ if [ "$status" -ne 0 ] ||
+ ! jq -e 'select(.type == "turn.completed")' "$events"
>/dev/null; then
+ return 1
+ fi
+ return 0
+ }
+
+ run_model sol gpt-6-sol false
+ sol_status=$?
+ run_model prior-sol gpt-5.6-sol false
+ prior_status=$?
+ goal_status=1
+ if [ "$sol_status" -eq 0 ]; then
+ run_model sol-goal gpt-6-sol true
+ goal_status=$?
+ fi
+ echo "model_canary: gpt-6-sol=$sol_status gpt-5.6-sol=$prior_status
gpt-6-sol-goal=$goal_status"
+ test "$sol_status" -eq 0 && test "$goal_status" -eq 0
Review Comment:
[P2] Require the fallback probe to pass. The canary records prior_status for
gpt-5.6-sol but this final test ignores it, so a failed fallback request still
produces a green canary. The production review explicitly supplies gpt-5.6-sol
as its fallback when gpt-6-sol is unsupported. Include prior_status in the pass
condition, and exercise its --goal path if the canary is meant to validate both
production choices.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
