Files
codex/.github/workflows/blob-size-policy.yml
Adam Perry @ OpenAI 965b9f263a Run required CI against pull request merge commits (#38051)
## Why

Checking only the pull request head can miss conflicts with changes already on
`main`.

## What changed

Remove explicit pull request head refs from required workflow checkouts so
GitHub Actions checks out the synthetic merge commit by default. Keep the
blocking gate on the same combined revision as the child workflows it
evaluates, and document the merge-commit policy in the workflow README.

GitOrigin-RevId: dc357caa5dc43f46b9b9a0edea6ee560b4fe8efb
2026-08-11 18:31:31 +00:00

54 lines
1.6 KiB
YAML

name: blob-size-policy
on:
workflow_call:
jobs:
check:
name: Blob size policy
runs-on: ubuntu-24.04
permissions:
contents: read
steps:
- uses: openai/fence@e6b39c80c51cb2b2a39448ddeff74b3b886c0a63 # pin@v0.10.0
with:
mode: audit
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
persist-credentials: false
- name: Determine comparison range
id: range
shell: bash
run: |
set -euo pipefail
# PRs inspect the proposed diff; main pushes inspect only the commit
# range that just landed. Both paths feed the same blob-size checker.
if [[ "${{ github.event_name }}" == "pull_request" ]]; then
base='${{ github.event.pull_request.base.sha }}'
head='${{ github.event.pull_request.head.sha }}'
else
base='${{ github.event.before }}'
head='${{ github.sha }}'
fi
echo "base=$base" >> "$GITHUB_OUTPUT"
echo "head=$head" >> "$GITHUB_OUTPUT"
- name: Check changed blob sizes
env:
BASE_SHA: ${{ steps.range.outputs.base }}
HEAD_SHA: ${{ steps.range.outputs.head }}
run: |
python3 scripts/check_blob_size.py \
--base "$BASE_SHA" \
--head "$HEAD_SHA" \
--max-bytes 512000 \
--allowlist .github/blob-size-allowlist.txt
- name: Check for a clean worktree
if: always() && !cancelled()
uses: ./.github/actions/check-clean-worktree