CI: stabilize live release lanes (#67838)

* CI: stabilize live release lanes * CI: widen codex live exclusions * Gateway: stop live config/auth lazy re-imports * CI: mount writable live Docker homes * Live: tighten retry and provider filter overrides * CI: use API-key auth for codex live lanes * CI: fix remaining live lanes * CI: stop forwarding live OpenAI base URLs * Gateway: fix live startup loader regression * CI: stop expanding OpenAI keys in live Docker lanes * CI: stop expanding installer secrets in Docker * CI: tighten live secret boundaries * Gateway: pin Codex harness base URL * CI: fix reusable workflow runner label * CI: avoid template expansion in live ref guard * CI: tighten live trust gate * Gateway: ignore empty Codex harness base URL * CI: stabilize remaining live lanes * CI: harden live retries and canvas auth test * CI: extend cron live probe budget * CI: keep codex harness lane on api-key auth * CI: stage live Docker OpenAI auth via env files * CI: bootstrap codex login for Docker API-key lanes * CI: accept hosted-runner codex fallback responses * CI: accept additional codex sandbox fallback text * CI: accept hosted-runner live fallback variants * CI: accept codex current-model fallback * CI: broaden codex sandbox model fallbacks * CI: cover extra codex sandbox wording * CI: extend cli backend cron retry budget * CI: match codex models fallbacks by predicate * CI: accept configured-models live fallback * CI: relax OpenAI websocket warmup timeout * CI: accept extra codex model fallback wording * CI: generalize codex model fallback matching * CI: retry cron verify cancellation wording * CI: accept interactive codex model entrypoint fallback * Agents: stabilize Claude bundle skill command test * CI: prestage live Docker auth homes * Tests: accept current Codex models wording * CI: stabilize remaining live lanes * Tests: widen CLI backend live timeout * Tests: accept current Codex model summary wording * CI: disable codex-cli image probe in Docker lane * Tests: respect CLI override for Codex Docker login * Tests: accept current Codex session models header * CI: stabilize remaining live validation lanes * CI: preserve Gemini ACP coverage in auth fallback * CI: fix final live validation blockers * CI: restore Codex auth for CLI backend lane * CI: drop local Codex config in live Docker lane * Tests: tolerate Codex cron and model reply drift * Tests: accept current Codex live replies * Tests: retry more Codex cron retry wording * Tests: accept environment-cancelled Codex cron retries * Tests: retry blank Codex cron probe replies * Tests: broaden Codex cron retry wording * Tests: require explicit Codex cron retry replies * Tests: accept current Codex models environment wording * CI: restore trusted Codex config in live lane * CI: bypass nested Codex sandbox in docker * CI: instrument live codex cron lane * CI: forward live CLI resume args * Tests: accept interactive Codex model selection * Tests: bound websocket warm-up live lane * CI: close live lane review gaps * Tests: lazy-load gateway live server * Tests: avoid gateway live loader regression * CI: scope reusable workflow secrets * Tests: tighten codex models live assertion * Tests: normalize OpenAI speech live text
2026-05-08 11:00:44 +00:00 · 2026-04-18 03:18:12 +02:00
parent a22b789547
commit 361750775d
32 changed files with 1598 additions and 190 deletions
--- a/src/scripts/prepare-codex-ci-config.test.ts
+++ b/src/scripts/prepare-codex-ci-config.test.ts
@@ -0,0 +1,49 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import {
+  buildCiSafeCodexConfig,
+  writeCiSafeCodexConfig,
+} from "../../scripts/prepare-codex-ci-config.ts";
+import { withTempDir } from "../test-utils/temp-dir.js";
+
+describe("prepare-codex-ci-config", () => {
+  it("renders a minimal trusted non-interactive Codex config for the target repo", () => {
+    expect(
+      buildCiSafeCodexConfig({
+        projectPath: "/tmp/openclaw-pr-sync.xph5uu",
+      }),
+    ).toBe(
+      [
+        "# Generated for Codex CI runs.",
+        "# Keep the checked-out repo trusted while avoiding maintainer-local",
+        "# provider/profile overrides that do not exist on CI runners.",
+        'approval_policy = "never"',
+        'sandbox_mode = "workspace-write"',
+        "",
+        '[projects."/tmp/openclaw-pr-sync.xph5uu"]',
+        'trust_level = "trusted"',
+        "",
+      ].join("\n"),
+    );
+  });
+
+  it("writes the generated config to disk", async () => {
+    await withTempDir("codex-ci-config-", async (tempDir) => {
+      const outputPath = path.join(tempDir, ".codex", "config.toml");
+      const projectPath = path.join(tempDir, "repo");
+
+      await writeCiSafeCodexConfig({
+        outputPath,
+        projectPath,
+      });
+
+      await expect(fs.readFile(outputPath, "utf-8")).resolves.toContain(
+        `approval_policy = "never"`,
+      );
+      await expect(fs.readFile(outputPath, "utf-8")).resolves.toContain(
+        `[projects."${projectPath}"]`,
+      );
+    });
+  });
+});