ci: resolve fork PRs missing Castiron run associations - #3831
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Castiron custom code✅ No new custom-code files detected. 36 mixed files remain; 2 existing customizations changed. Compared
34 existing customizations unchanged
A changed generated baseline means this report cannot reliably identify which handwritten lines changed. Inspect the custom-code diffDownload the exact patch produced by this run (requires repository access): gh run download 34417845521 --repo openai/openai-python \
--name castiron-custom-code-34417845521-1 --dir /tmp/castiron-custom-code-34417845521-1
git apply --stat /tmp/castiron-custom-code-34417845521-1/custom-code.patch
cat /tmp/castiron-custom-code-34417845521-1/custom-code.patchOr reproduce it from an SDK checkout containing the vendored reporter: git fetch --no-tags origin 2d4b97cc84d5c3ca051cc2ac2d8a6c9928b4d5f0 3fbd4ac29d4c0bb8fe0c41155b23d1763b6c95e4
python3 scripts/castiron/custom_code_report.py report \
--base 2d4b97cc84d5c3ca051cc2ac2d8a6c9928b4d5f0 \
--head 3fbd4ac29d4c0bb8fe0c41155b23d1763b6c95e4 --fetch --require-head-hash --public \
--out /tmp/castiron-custom-code-3fbd4ac29d4c
cat /tmp/castiron-custom-code-3fbd4ac29d4c/custom-code.patchThis is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR. |
markstuart-oai
left a comment
markstuart-oai
left a comment
There was a problem hiding this comment.
Reviewed with two independent reviewers. No actionable findings. The fork owner/branch fallback discovers candidates without replacing the existing live PR, exact-head, target/base and ambiguity checks. Trusted-main evaluation and publication freshness checks remain intact, and the shared Python helper keeps discovery consistent across computation and publication.
Validation: the 53-test Castiron suite passed with one optional compiler-contract test skipped; reporter digest and whitespace checks passed. I did not independently run Ruff/mypy/Pyright or live fork/workflow checks. Normal SDK CODEOWNER review remains required.
jbeckwith-oai
left a comment
jbeckwith-oai
left a comment
There was a problem hiding this comment.
Reviewed exact head 3fbd4ac. No findings. The owner/branch lookup is used only after direct workflow-run and commit associations are empty; trusted report generation and passing status publication still re-read live PR data and require the exact head, expected target repository, current main base, and a unique match. Empty, stale, wrong-target, or ambiguous fallback results fail closed. The protected-main reporter and least-privilege publisher split remain intact.
Validation: complete security diff review of all six changed files found no issues; the 53-test Castiron suite passed locally with one optional test skipped; Python compilation, reporter digest, and diff checks passed; exact-head CI is green.
3 participants
Summary
Fork PRs #3760 and #3345 have green Python CI but no required Castiron budget statuses: both the workflow-run association and commit-to-PR endpoint return no PRs. The trusted evaluator fails with
source run must identify exactly one current PR targeting main, and the publisher returns without posting statuses.Fall back to listing open PRs by the source run's fork owner and branch, then retain the existing exact-head, target, freshness, and ambiguity checks. Apply the fallback to report computation, budget evaluation, and publication; update the reporter integrity digest.
Validation
scripts/castiron.The trusted handler runs from main. After this fix merges, rerun the Castiron custom-code workflows for #3760 and #3345 to publish their required statuses.