Repository navigation
fix: publish reviewed daily renderer scripts with the package - #1110
Conversation
Co-Authored-By: Codex <noreply@openai.com>
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@codex review |
|
Codex Review: Didn't find any major issues. Keep it up! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Pigbibi
added
the
agent-approved
AI assistance
OpenAI Codex, GPT-6.
What changed
Prepare exactly the two reviewed daily renderer scripts from the workflow's main commit after that commit passes Validate. Pass the same-run artifact to the pinned shared package release, which checks its protected candidate digest, stages it, backs up the active package and replaces it conditionally. Rollback uses the saved ZIP without preparing an overlay.
How verified
Actionlint, documentation checks and git diff --check passed. The pinned shared release passed 13 Blob contract tests and 11 container release tests in CI, including zero-write verification and digest-mismatch cases. No runtime release or notification is performed by this PR.
Why
The daily report renderer fixes were merged but the scheduled Azure package still runs the old files. The existing release needs a staged candidate package; this caller supplies only the reviewed source changes while retaining the active package's dependencies and wrapper.
Risk
R2 release caller. Artifact preparation has read-only contents/actions permissions. OIDC stays in the protected reusable release job. The existing Azure federated trust must be advanced to the reviewed immutable workflow pin before release. The same fixed target, digest pair, conditional replacement and rollback contract remain in force.