[codex] Add workflow action pin contract - #1925
Merged
Merged
Conversation
stranske
temporarily deployed
to
agent-high-privilege
April 26, 2026 22:15 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
Contributor
Contributor
Automated Status SummaryHead SHA: d9c3090
Coverage Overview
Coverage Trend
Top Coverage Hotspots (lowest coverage)
Updated automatically; will refresh on subsequent CI/Docker completions. Keepalive checklistScopeSync/Dependabot Campaign QueueRemote GitHub Actions owns discovery for sync-generated and Dependabot PR rounds. Local Codex should only claim items from this issue when SummaryContext for AgentRelated Issues/PRs
Tasks
Acceptance criteria
|
stranske
temporarily deployed
to
agent-high-privilege
April 26, 2026 22:18 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
stranske
marked this pull request as ready for review
April 26, 2026 22:21
stranske
temporarily deployed
to
agent-high-privilege
April 26, 2026 22:21 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f10b79895c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
+79
to
+81
| uses = match.group("uses") | ||
| action, separator, ref = uses.rpartition("@") | ||
| if not separator or not _is_checked_action(action, prefixes): |
There was a problem hiding this comment.
The parser treats the raw uses token as-is, so YAML-quoted action refs are silently skipped by the enforcement. For example, uses: "actions/checkout@v6" yields an action value of "actions/checkout, which fails _is_checked_action(...) and bypasses both SHA and version-comment validation. Since quoted uses syntax is valid YAML (and already used in this repo for other actions), this creates an easy path for floating refs to evade the new pin contract.
Useful? React with 👍 / 👎.
6 tasks
stranske
pushed a commit
that referenced
this pull request
Jun 17, 2026
Health 74 "Check Template Drift" was RED on main: 7 of 15 allowlisted root->template workflow pairs had stale fingerprints, so they showed as unallowlisted drift (exit 1). They went stale after action-version bumps (#2391/#2394) and root feature work changed the normalized content of both sides without re-baselining. Each of the 7 was examined; all are intentional, bidirectional divergence rather than a missing consumer improvement: - consumer template workflows SHA-pin third-party actions per the fleet action-pin contract (docs/HISTORY.md, PR #1925) and carry LangSmith tracing env; - the root Workflows-repo copies use floating major tags plus repo-internal concurrency + sparse-checkout (docs/fixes/sparse-checkout-audit-2026-02-03.csv); - agents-63-issue-intake is additionally an alias-mapped Workflows-internal superset (~1.7k lines) vs the 216-line consumer intake template. Aligning the template to root would strip the contractually-required consumer action pins from all consumers, so the entries are re-baselined (fingerprints refreshed + documented reasons) rather than aligned. The 8 already-passing entries are untouched. Verified: scripts/check_template_drift.py --allowlist config/template-drift-allowlist.txt now reports 0 unallowlisted drift (15 allowlisted, 3 in sync), exit 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> # Conflicts: # config/template-drift-allowlist.txt
stranske
added a commit
that referenced
this pull request
Jun 17, 2026
…2397) Health 74 "Check Template Drift" was RED on main: 7 of 15 allowlisted root->template workflow pairs had stale fingerprints, so they showed as unallowlisted drift (exit 1). They went stale after action-version bumps (#2391/#2394) and root feature work changed the normalized content of both sides without re-baselining. Each of the 7 was examined; all are intentional, bidirectional divergence rather than a missing consumer improvement: - consumer template workflows SHA-pin third-party actions per the fleet action-pin contract (docs/HISTORY.md, PR #1925) and carry LangSmith tracing env; - the root Workflows-repo copies use floating major tags plus repo-internal concurrency + sparse-checkout (docs/fixes/sparse-checkout-audit-2026-02-03.csv); - agents-63-issue-intake is additionally an alias-mapped Workflows-internal superset (~1.7k lines) vs the 216-line consumer intake template. Aligning the template to root would strip the contractually-required consumer action pins from all consumers, so the entries are re-baselined (fingerprints refreshed + documented reasons) rather than aligned. The 8 already-passing entries are untouched. Verified: scripts/check_template_drift.py --allowlist config/template-drift-allowlist.txt now reports 0 unallowlisted drift (15 allowlisted, 3 in sync), exit 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> # Conflicts: # config/template-drift-allowlist.txt Co-authored-by: Tim Stranske <tim@stranskemo.com>
stranske
added a commit
that referenced
this pull request
Jul 24, 2026
#2815) Health 74 Template Drift has been red on main since 2026-07-20, forcing an admin override on every Workflows merge. Root cause is NOT unintended drift: Renovate/dep-pin bumps (#2799 actions/checkout v7.0.1, #2776 coverage pins) moved the consumer templates' pinned action SHAs, so 13 already-allowlisted entries' recorded fingerprints went stale. Verified via `git log --since=<last baseline>` that the only commits touching these 13 workflow files since the last re-baseline were those dependency bumps (root workflows keep floating major tags by design; consumer templates SHA-pin per the fleet action-pin contract, docs/HISTORY.md / PR #1925). The divergence is the intentional action-pin-contract drift, not a missing consumer improvement — so per the allowlist's own documented process, refresh the fingerprints rather than align (aligning would strip the required consumer pins). Refreshed main/template sha256 for: belt 71/72/73, auto-label, autofix-dispatcher, capability-check, decompose, dedup, guard, issue-optimizer, keepalive-loop-reporter, verifier, weekly-metrics. Per-entry reasons preserved; dated re-baseline note added to the header. check_template_drift.py now reports "unallowlisted drift: 0" (exit 0). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related to campaign issue #1836
Automated Status Summary
Scope
Sync/Dependabot Campaign Queue
Remote GitHub Actions owns discovery for sync-generated and Dependabot PR rounds. Local Codex should only claim items from this issue when
needs-local-codexwork is queued.Summary
Context for Agent
Related Issues/PRs
Tasks
Acceptance criteria
Head SHA: f10b798
Latest Runs: ⏹️ cancelled — Gate
Required: gate: ⏹️ cancelled