Repository navigation
feat: apply the runner's file commands between steps - #80
Conversation
|
@codex security review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
Security findingsAdvisory findings (8)
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
ce21777 to
b8ea4f1
Compare
|
@codex security review |
b8ea4f1 to
24d6745
Compare
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
24d6745 to
42df9af
Compare
|
@codex security review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
🛡️ Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: 42df9afe5f
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex security review |
1 similar comment
|
@codex security review |
There was a problem hiding this comment.
🛡️ Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: 7992ffce83
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex security review |
1f05be4 to
c3d75a3
Compare
|
@codex security review |
c3d75a3 to
68ccaf9
Compare
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex security review |
There was a problem hiding this comment.
🛡️ Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: 68ccaf912f
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex security review |
5b0e514 to
a594ab2
Compare
There was a problem hiding this comment.
🛡️ Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: a594ab28d3
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
A hosted runner communicates with a step through files and the step's stdout, so the local runner now does the same around each command the executor port runs. It asks a new scratch port for fresh command files per step and passes their paths as GITHUB_OUTPUT, GITHUB_ENV, GITHUB_PATH and GITHUB_STEP_SUMMARY; after the step it reads what was written and applies outputs to the step's report, environment entries and path entries to the job's later steps, and the summary to the run's new output port. A new required field on CommandResult carries stdout, which the runner reads for the workflow command stream: add-mask hides the value from the echoed output, and the debug, warning, error and notice commands route to the output port with their file, line, endLine and title annotation. Unknown commands, malformed file lines and unterminated heredocs are errors naming the command or the file and line, never silent passes. The runner still touches no filesystem and spawns no process: the host supplies the scratch and output ports, the executor's result carries stdout, and CommandExecution carries the job's accumulated path entries for the host to join onto the PATH it started from. The environment a step writes sits below the env the pipeline declares, masks and accumulated state are scoped to one job run, and path entries follow the provider's precedence (last written first, repeats moved not duplicated), each detail read from the actions/runner and actions/toolkit sources. The CLI pipes step stdout to collect it and echoes it after masking, which means step output appears when the step finishes rather than as it happens. What inner steps write is not forwarded to an outer provider runner's own files; that boundary is documented and tracked separately.
…ch at the run's end
|
@codex security review |
a594ab2 to
0666234
Compare
|
@codex security review |
There was a problem hiding this comment.
🛡️ Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: edc4752424
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex security review |
There was a problem hiding this comment.
🛡️ Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: a405acfdef
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex security review |
There was a problem hiding this comment.
🛡️ Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: 9ce74eea3d
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex security review |
1 similar comment
|
@codex security review |
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
🎉 This PR is included in version 0.3.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
|
🎉 This PR is included in version 0.2.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
1 participant
Implements #73.
A hosted runner communicates with a step through files and the step's stdout; the local runner now does the same around each command the executor port runs, still without touching a filesystem or spawning a process itself.
Around each step, the runner asks a new
StepScratchport for fresh command files and passes their paths asGITHUB_OUTPUT,GITHUB_ENV,GITHUB_PATHandGITHUB_STEP_SUMMARY. After the step it reads what was written: outputs land on the step's report entry (StepReport.outputs), environment entries and path entries carry to the job's later steps, and the summary goes to a newRunOutputport the host supplies.CommandResultgainsstdout, from which the runner reads the workflow command stream:::add-mask::hides the value from the echoed output, and::debug::,::warning::,::error::and::notice::route to the output port with theirfile,line,endLineandtitleannotation.CommandExecutiongains the job's accumulatedpathEntries, which the host joins onto thePATHit started from, because only the host knows it.The detail is read from the provider's own sources rather than its documentation summaries: the key=value and heredoc file format and the skip-blank-line behaviour from actions/runner, the path precedence (last written first, repeats moved rather than duplicated) from its
ScriptHandler, and the command syntax with the%25/%0D/%0A/%3A/%2Cescaping and its space-separated properties from actions/toolkit. Environment a step writes sits below the env the pipeline declares; masks and accumulated state are scoped to one job run, as a runner process is on the provider. Unknown commands, malformed file lines, unterminated heredocs, empty masks and properties outside the documented set are errors naming the command or the file and line, never silent passes.Two consequences worth naming. The CLI now pipes step stdout to read it, so output appears when the step finishes rather than as it happens; stderr stays on the terminal live. And what inner steps write is not forwarded to an outer provider runner's own files, which changes the wrapper form's old pass-through: a native step after a wrapper call no longer sees the inner steps' environment or path entries. That boundary is documented in
docs/providers.mdand tracked in #79.The conformance kit gains the behavioural spec (fresh files per step, environment and paths carried, outputs recorded, masks and levels routed, the error cases, the per-job scoping), and the unit tests cover the parsers, the apply logic through fakes, and one run through a real
shexecutor writing the files and the command stream.Fixes #73