github-actions[bot] commented on code in PR #66319:
URL: https://github.com/apache/doris/pull/66319#discussion_r3689630107
##########
.github/workflows/code-review-runner.yml:
##########
@@ -212,15 +212,58 @@ jobs:
OSS_CODEX_GOAL_FALLBACK_OBJECT:
oss://doris-community-ci/codex/codex-goal
- name: Configure Codex auth
+ id: auth
timeout-minutes: 5
run: |
install -m 700 -d "$RUNNER_TEMP/codex-home"
printf 'CODEX_HOME=%s\n' "$RUNNER_TEMP/codex-home" >> "$GITHUB_ENV"
- auth_object="$(printf '%s\n' \
+ auth_object=""
+ earliest_retry_after_epoch=""
+ now_epoch="$(date +%s)"
+ while IFS= read -r candidate; do
+ context_file="$(mktemp "$RUNNER_TEMP/codex-auth-context.XXXXXX")"
+ if ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \
+ cp -f "${candidate}.context" "$context_file" >/dev/null 2>&1;
then
+ if ! context="$(jq -er '
+ select(.version == 1
+ and (.state | type == "string")
+ and (.retry_after_epoch | type == "number" and floor == .))
Review Comment:
[P2] Validate the epoch for the downstream shell/date domain
This accepts every integral JSON number, but the next consumers have
narrower domains. For example, `1e100` passes this filter and then makes `[
"$retry_after_epoch" -gt ... ]` return `integer expression expected`, so the
limited account is selected; `9223372036854775807` passes the comparison but
makes GNU `date -d` fail, aborting auth setup before the other account is
tried. Please constrain the schema to a canonical epoch that both Bash and
`date` can consume, or treat conversion/range failure through the existing
malformed-context warning/eligible path.
##########
.github/workflows/code-review-runner.yml:
##########
@@ -212,15 +212,58 @@ jobs:
OSS_CODEX_GOAL_FALLBACK_OBJECT:
oss://doris-community-ci/codex/codex-goal
- name: Configure Codex auth
+ id: auth
timeout-minutes: 5
run: |
install -m 700 -d "$RUNNER_TEMP/codex-home"
printf 'CODEX_HOME=%s\n' "$RUNNER_TEMP/codex-home" >> "$GITHUB_ENV"
- auth_object="$(printf '%s\n' \
+ auth_object=""
+ earliest_retry_after_epoch=""
+ now_epoch="$(date +%s)"
+ while IFS= read -r candidate; do
+ context_file="$(mktemp "$RUNNER_TEMP/codex-auth-context.XXXXXX")"
+ if ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \
+ cp -f "${candidate}.context" "$context_file" >/dev/null 2>&1;
then
+ if ! context="$(jq -er '
Review Comment:
[P2] Require exactly one context document
jq treats this file as an input stream rather than one JSON document. A
sidecar containing an active `usage_limited` object followed by a second valid
object makes this command exit 0 and emit two TSV rows; the later `read`
consumes only the first row and can skip the account. That multi-document file
is malformed for the version-1 sidecar schema and should take the
warning/eligible path. Please require exactly one top-level object (for example
via slurp mode and a `length == 1` check) before validating its fields.
##########
.github/workflows/code-review-runner.yml:
##########
@@ -212,15 +212,58 @@ jobs:
OSS_CODEX_GOAL_FALLBACK_OBJECT:
oss://doris-community-ci/codex/codex-goal
- name: Configure Codex auth
+ id: auth
timeout-minutes: 5
run: |
install -m 700 -d "$RUNNER_TEMP/codex-home"
printf 'CODEX_HOME=%s\n' "$RUNNER_TEMP/codex-home" >> "$GITHUB_ENV"
- auth_object="$(printf '%s\n' \
+ auth_object=""
+ earliest_retry_after_epoch=""
+ now_epoch="$(date +%s)"
+ while IFS= read -r candidate; do
+ context_file="$(mktemp "$RUNNER_TEMP/codex-auth-context.XXXXXX")"
+ if ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" \
+ cp -f "${candidate}.context" "$context_file" >/dev/null 2>&1;
then
+ if ! context="$(jq -er '
+ select(.version == 1
+ and (.state | type == "string")
+ and (.retry_after_epoch | type == "number" and floor == .))
+ | [.state, .retry_after_epoch] | @tsv
+ ' "$context_file" 2>/dev/null)"; then
+ echo "::warning::Ignoring malformed Codex auth context for
${candidate##*/}; the account remains eligible."
+ auth_object="$candidate"
+ break
+ fi
+
+ read -r context_state retry_after_epoch <<<"$context"
Review Comment:
[P2] Preserve the state string before comparing it
This `read` uses Bash's default whitespace IFS, so a sidecar with `state: "
usage_limited"` or `state: "usage_limited "` is normalized to the exact
`usage_limited` token and the account is skipped while its epoch is in the
future. That contradicts the documented fail-open rule that every state other
than the exact recognized value remains eligible. Split the jq TSV only on its
tab delimiter so the state is compared exactly.
```suggestion
IFS=$'\t' read -r context_state retry_after_epoch <<<"$context"
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
