codex/.github/workflows/blob-size-policy.yml

name: blob-size-policy

on:
  workflow_call:

jobs:
  check:
    name: Blob size policy
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - uses: openai/fence@e017427978b91977d79a3023842166ab79b5b816 # pin@v0.12.2
        with:
          mode: audit
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Determine comparison range
        id: range
        shell: bash
        run: |
          set -euo pipefail

          # PRs inspect the proposed diff; main pushes inspect only the commit
          # range that just landed. Both paths feed the same blob-size checker.
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            base='${{ github.event.pull_request.base.sha }}'
            head='${{ github.event.pull_request.head.sha }}'
          else
            base='${{ github.event.before }}'
            head='${{ github.sha }}'
          fi

          echo "base=$base" >> "$GITHUB_OUTPUT"
          echo "head=$head" >> "$GITHUB_OUTPUT"

      - name: Check changed blob sizes
        env:
          BASE_SHA: ${{ steps.range.outputs.base }}
          HEAD_SHA: ${{ steps.range.outputs.head }}
        run: |
          python3 scripts/check_blob_size.py \
            --base "$BASE_SHA" \
            --head "$HEAD_SHA" \
            --max-bytes 512000 \
            --allowlist .github/blob-size-allowlist.txt

      - name: Check for a clean worktree
        if: always() && !cancelled()
        uses: ./.github/actions/check-clean-worktree