Disable unused Codex plugin startup checks - #57004
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
@copilot use toml config |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅
|
|
✅ Test Quality Sentinel completed test quality analysis. Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch test file diff
|
|
✅ PR Code Quality Reviewer completed the code quality review.
|
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft. No ADR enforcement needed: PR does not have the 'implementation' label and has <=100 new lines of code in business logic directories.
|
|
Lean already. Ship. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "ab.chatgpt.com"See Network Configuration for more information.
|
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Requesting changes
This change introduces a nil-dereference path in Codex config generation.
Blocking theme
RenderMCPConfig now reads workflowData.Plugins unconditionally when deciding whether to emit features.plugins=false. Other accesses in the same method are explicitly nil-safe, and WorkflowData.getContainerPinMappings() exists specifically to tolerate absent workflow metadata. That makes this a real regression: any caller that renders Codex MCP config without a populated WorkflowData will now panic instead of producing config.
🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 34.7 AIC · ⌖ 8.58 AIC · ⊞ 21.8K
Comment /review to run again
| if isFirewallEnabled(workflowData) { | ||
| e.renderOpenAIProxyProviderToml(&shellPolicyContent, " ", workflowData) | ||
| } | ||
| if len(workflowData.Plugins) == 0 { |
There was a problem hiding this comment.
Reading workflowData.Plugins unconditionally here is a regression: RenderMCPConfig otherwise tolerates a nil WorkflowData, so this branch can now panic during Codex config generation for callers that omit workflow metadata.
💡 Guard the plugin check with the same nil-safety used elsewhere
Use workflowData == nil || len(workflowData.Plugins) == 0 (or an equivalent helper) before emitting [features] plugins = false. That preserves the intended default of disabling plugins when none are declared without turning an absent WorkflowData into a hard crash.
if workflowData == nil || len(workflowData.Plugins) == 0 {
shellPolicyContent.WriteString(" [features]\n")
shellPolicyContent.WriteString(" plugins = false\n")
}This is worth fixing before merge because it converts a config-generation path into a panic, not just a wrong setting.
There was a problem hiding this comment.
Skills-Based Review 🧠
Applied /codebase-design — changes are clean, implementation is correct, and lock files are consistently regenerated.
📋 Key Themes & Highlights
Key Themes
- Correct guard condition:
len(workflowData.Plugins) == 0maps cleanly to the described intent. - Test coverage is solid: both "disabled when none declared" and "kept enabled when one is declared" cases are covered in
TestCodexEnginePluginConfig, and the existingTestCodexEngineRenderMCPConfigsnapshot is updated. - Documentation is clear: the
codex.mdaddition accurately describes the behaviour including the caveat that directly configured MCP servers are unaffected.
Positive Highlights
- ✅
[features]block is placed before[shell_environment_policy], preserving logical grouping in the generated TOML. - ✅ Lock file regeneration is consistent across all 79 changed workflow lock files — no partial rollout risk.
- ✅ Changeset entry is accurately scoped to
patch.
🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet46 · 33.6 AIC · ⌖ 15 AIC · ⊞ 7.6K
Comment /matt to run again
There was a problem hiding this comment.
The changes look correct and consistent. Every Codex config.toml heredoc across the compiled .lock.yml files gets [features] plugins = false injected immediately after the supports_websockets line, and the heredoc delimiter hashes are updated to match the new content. The changeset note accurately describes the intent: disabling the plugin subsystem when no Agent Plugins are declared prevents unsupported ChatGPT plugin catalog and curated repository startup checks during API-key and BYOK runs. No issues found.
🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · copilot · sonnet46 · 20.7 AIC · ⌖ 14.6 AIC · ⊞ 6.2K
There was a problem hiding this comment.
🟡 Changes recommended
The generated [features] table conflicts with valid custom Codex TOML containing the same table, producing an invalid configuration.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Disables Codex’s plugin subsystem when workflows declare no Agent Plugins, avoiding unnecessary startup synchronization.
Changes:
- Emits
features.plugins=falseconditionally and adds tests. - Documents behavior and adds a patch changeset.
- Regenerates affected workflow locks.
File summaries
| File | Description |
|---|---|
pkg/workflow/codex_mcp.go |
Generates conditional Codex plugin configuration. |
pkg/workflow/codex_engine_test.go |
Tests plugin enablement behavior. |
docs/src/content/docs/engines/codex.md |
Documents the configuration tradeoff. |
.changeset/patch-disable-unused-codex-plugins.md |
Adds the patch release note. |
.github/workflows/ace-editor.lock.yml |
Regenerates Codex configuration. |
.github/workflows/agentic-token-trend-audit.lock.yml |
Regenerates Codex configuration. |
.github/workflows/ai-moderator.lock.yml |
Regenerates Codex configuration. |
.github/workflows/api-consumption-report.lock.yml |
Regenerates Codex configuration. |
.github/workflows/audit-workflows.lock.yml |
Regenerates Codex configuration. |
.github/workflows/avenger.lock.yml |
Regenerates Codex configuration. |
.github/workflows/bot-detection.lock.yml |
Regenerates Codex configuration. |
.github/workflows/cli-version-checker.lock.yml |
Regenerates Codex configuration. |
.github/workflows/cloclo.lock.yml |
Regenerates Codex configuration. |
.github/workflows/codex-github-remote-mcp-test.lock.yml |
Regenerates Codex configuration. |
.github/workflows/copilot-centralization-drilldown.lock.yml |
Regenerates Codex configuration. |
.github/workflows/copilot-centralization-optimizer.lock.yml |
Regenerates Codex configuration. |
.github/workflows/daily-architecture-diagram.lock.yml |
Regenerates Codex configuration. |
.github/workflows/daily-cli-tools-tester.lock.yml |
Regenerates Codex configuration. |
.github/workflows/daily-credit-limit-test.lock.yml |
Regenerates Codex configuration. |
.github/workflows/daily-documentation-diagram.lock.yml |
Regenerates Codex configuration. |
.github/workflows/daily-evals-report.lock.yml |
Regenerates Codex configuration. |
.github/workflows/daily-go-test-parallelizer.lock.yml |
Regenerates Codex configuration. |
.github/workflows/daily-max-ai-credits-test.lock.yml |
Regenerates Codex configuration. |
.github/workflows/daily-observability-report.lock.yml |
Regenerates Codex configuration. |
.github/workflows/daily-regulatory.lock.yml |
Regenerates Codex configuration. |
.github/workflows/daily-semgrep-scan.lock.yml |
Regenerates Codex configuration. |
.github/workflows/daily-spending-forecast.lock.yml |
Regenerates Codex configuration. |
.github/workflows/daily-storify.lock.yml |
Regenerates Codex configuration. |
.github/workflows/daily-windows-terminal-integration-builder.lock.yml |
Regenerates Codex configuration. |
.github/workflows/dependabot-go-checker.lock.yml |
Regenerates Codex configuration. |
.github/workflows/designer-drift-audit.lock.yml |
Regenerates Codex configuration. |
.github/workflows/dev.lock.yml |
Regenerates Codex configuration. |
.github/workflows/duplicate-code-detector.lock.yml |
Regenerates Codex configuration. |
.github/workflows/example-failure-category-filter.lock.yml |
Regenerates Codex configuration. |
.github/workflows/example-permissions-warning.lock.yml |
Regenerates Codex configuration. |
.github/workflows/feature-grower.lock.yml |
Regenerates Codex configuration. |
.github/workflows/front-page-copy-guard.lock.yml |
Regenerates Codex configuration. |
.github/workflows/functional-pragmatist.lock.yml |
Regenerates Codex configuration. |
.github/workflows/github-remote-mcp-auth-test.lock.yml |
Regenerates Codex configuration. |
.github/workflows/gpclean.lock.yml |
Regenerates Codex configuration. |
.github/workflows/grumpy-reviewer.lock.yml |
Regenerates Codex configuration. |
.github/workflows/issue-monster.lock.yml |
Regenerates Codex configuration. |
.github/workflows/issue-triage-agent.lock.yml |
Regenerates Codex configuration. |
.github/workflows/metrics-collector.lock.yml |
Regenerates Codex configuration. |
.github/workflows/necromancer.lock.yml |
Regenerates Codex configuration. |
.github/workflows/notion-issue-summary.lock.yml |
Regenerates Codex configuration. |
.github/workflows/outcome-collector.lock.yml |
Regenerates Codex configuration. |
.github/workflows/pdf-summary.lock.yml |
Regenerates Codex configuration. |
.github/workflows/ponytail-reviewer.lock.yml |
Regenerates Codex configuration. |
.github/workflows/purelock.lock.yml |
Regenerates Codex configuration. |
.github/workflows/python-data-charts.lock.yml |
Regenerates Codex configuration. |
.github/workflows/refactoring-cadence.lock.yml |
Regenerates Codex configuration. |
.github/workflows/repo-audit-analyzer.lock.yml |
Regenerates Codex configuration. |
.github/workflows/repo-tree-map.lock.yml |
Regenerates Codex configuration. |
.github/workflows/research.lock.yml |
Regenerates Codex configuration. |
.github/workflows/schema-feature-coverage.lock.yml |
Regenerates Codex configuration. |
.github/workflows/security-review.lock.yml |
Regenerates Codex configuration. |
.github/workflows/sighthound-security-scan.lock.yml |
Regenerates Codex configuration. |
.github/workflows/skillet.lock.yml |
Regenerates Codex configuration. |
.github/workflows/smoke-call-workflow.lock.yml |
Regenerates Codex configuration. |
.github/workflows/smoke-ci.lock.yml |
Regenerates Codex configuration. |
.github/workflows/smoke-codex.lock.yml |
Regenerates Codex configuration. |
.github/workflows/smoke-drive.lock.yml |
Regenerates Codex configuration. |
.github/workflows/smoke-otel-backends.lock.yml |
Regenerates Codex configuration. |
.github/workflows/smoke-service-ports.lock.yml |
Regenerates Codex configuration. |
.github/workflows/smoke-temporary-id.lock.yml |
Regenerates Codex configuration. |
.github/workflows/smoke-test-tools.lock.yml |
Regenerates Codex configuration. |
.github/workflows/stale-repo-identifier.lock.yml |
Regenerates Codex configuration. |
.github/workflows/sub-issue-closer.lock.yml |
Regenerates Codex configuration. |
.github/workflows/super-linter.lock.yml |
Regenerates Codex configuration. |
.github/workflows/terminal-stylist.lock.yml |
Regenerates Codex configuration. |
.github/workflows/update-astro.lock.yml |
Regenerates Codex configuration. |
.github/workflows/video-analyzer.lock.yml |
Regenerates Codex configuration. |
.github/workflows/weekly-issue-summary.lock.yml |
Regenerates Codex configuration. |
.github/workflows/weekly-network-domains-audit.lock.yml |
Regenerates Codex configuration. |
.github/workflows/weekly-safe-outputs-spec-review.lock.yml |
Regenerates Codex configuration. |
.github/workflows/windows-grower.lock.yml |
Regenerates Codex configuration. |
.github/workflows/windows.lock.yml |
Regenerates Codex configuration. |
.github/workflows/workflow-normalizer.lock.yml |
Regenerates Codex configuration. |
Review details
- Files reviewed: 79/79 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
| if len(workflowData.Plugins) == 0 { | ||
| shellPolicyContent.WriteString(" [features]\n") | ||
| shellPolicyContent.WriteString(" plugins = false\n") |
|
@copilot Please address the latest blocking review feedback on this PR, including the nil workflowData panic noted by PR Code Quality Reviewer, then run the Failed checks to fix:
Please refresh the branch if needed while addressing the review comments.
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "github.com"See Network Configuration for more information.
|
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Addressed the Codex TOML duplicate [features] issue and nil workflowData panic, with regression coverage and updated golden output. The fix is in the latest commit. |
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
|
/smoke-codex |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "ab.chatgpt.com"See Network Configuration for more information.
|
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "ab.chatgpt.com"See Network Configuration for more information.
|
Codex enables plugins by default, causing API-key and BYOK runs to contact unavailable ChatGPT catalogs and synchronize curated plugins at startup. Codex provides no sync-only disable switch.
features.plugins=falsewhen no Agent Plugins are declared.codex exec -c features.plugins=false …Documentation
Generated workflows
Overview
Processed the current compact PR candidate set and nudged the highest-priority eligible pull requests. PRs with actively running recent checks were skipped to avoid duplicate churn.
Counters
Nudged PRs
Skipped details
on.cooldownworkflow gating #56998 — checks_running_recentWarning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
github.comTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.