Repository navigation
Gate direct bench configuration changes with init checks - #6
Conversation
|
@codex review |
Reviewer's GuideIntroduces a narrowly scoped, immutable-checker workflow that gates direct Compose configuration changes with repository-local process-reaping validation while limiting permissions and credential exposure. Sequence diagram for bench configuration validationsequenceDiagram
participant PR as PullRequestOrMainChange
participant Actions as GitHubActions
participant Repo as RepositoryCheckout
participant Checker as ImmutableChecker
PR->>Actions: Trigger bench-init.yml
Actions->>Repo: checkout repository
Actions->>Checker: checkout opensoft/workBenches at f23eb71c240c8a530891bd7fd1e594b2831d0402
Actions->>Checker: check-bench-init.py .
Checker-->>Actions: Validation result
Actions-->>PR: Gate configuration change
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've reviewed your changes and they look great!
Sourcery assessment
Needs a human reviewer. The workflow executes a pinned script checked out from an external repository on pull requests, giving that code access to the repository workspace and a read-only GitHub token. If the pinned dependency were compromised, it could expose repository contents or otherwise misuse the CI job; reverting the workflow would not undo any exposure that already occurred.
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Add repository-local process-reaping validation for this setup-cloned bench.
Parent workBenches PRs cannot gate direct changes here because the setup clone is consumed from main, not a parent gitlink. This workflow checks the repository on every PR and main push without path filters, so a required check cannot remain pending because a workflow was skipped. Standard compose/docker-compose .yml/.yaml names and mixed-extension overlays are covered by the checker.
The checker is pinned to verified public workBenches commit 3f180c5c42cca2fce259105cb1252521423ee274, which the coordinated parent PR will preserve in main with a normal merge commit. No cross-repository secrets, image builds or container replacements are required. Both checkouts disable credential persistence.
Local effective-configuration checks and nine checker regression tests pass. This follows up the already merged process-reaping configuration fix and addresses the parent PR's final review finding.
Summary by Sourcery
Gate bench configuration changes with automated process-reaping validation across all pull requests and main-branch updates.
New Features:
Enhancements:
CI: