shuke987 opened a new pull request, #69737: URL: https://github.com/apache/doris/pull/69737
### What problem does this PR solve? Issue Number: N/A Related PR: #67635 Problem Summary: Code Review Runner only detects and records `refresh_token_reused`. Revoked sessions now fail with `refresh_token_invalidated` in Codex's Rust `TokenErrorDetail` stderr, while the terminal error is only `workspace routing discovery unauthorized (401)`. The invalid-auth recording step is skipped, so subsequent reviews keep selecting the failed credential. For example, [run 40643700741](https://github.com/apache/doris/actions/runs/40643700741) reproduces this sequence. Recognize both permanent refresh failures in terminal events and Codex stderr, including `error_code: Some(...)`. Pass the detected reason through the quarantine condition, marker JSON, and failure notification. Preserve the existing per-refresh-token hash marker so replacing a token restores eligibility and late failures cannot quarantine its replacement. Generic 401/`token_revoked`, tool-output quotations, and successful reviews remain excluded from permanent quarantine. Only the workflow and its offline tests change. The tests also supply the required convergence fields in the fake final submission so existing success-path assertions can execute. ### Release note None ### Check List (For Author) - Test - [x] Unit Test - [x] Manual test: replayed the actual auth error and terminal-summary excerpts from four failed production runs; all classify as `refresh_token_invalidated`. - Final Linux quarantine suite: **29/29 passed**, including the complete runner path, marker persistence, next-run exclusion, replacement eligibility, negative cases, and upload-failure notifications. - macOS script suite: **245 passed, 21 skipped** (266 total). - Linux script suite: **264 passed, 1 skipped, 1 failed** (266 total). The unchanged `ProcessLifecycleTest.test_cli_reaps_detached_descendants_without_touching_other_processes` failed its timeout/non-graceful PID-exit assertion. A targeted rerun with Docker `--init` passed that test plus all 29 quarantine tests (**30/30**). The full suite was not rerun; this does not establish init as the root-cause fix. - `git diff --check` passed. actionlint 1.7.7 passed with optional ShellCheck/Pyflakes disabled and only the existing `concurrency.queue` compatibility diagnostic excluded; the same diagnostic was verified on unchanged master. - Behavior changed: - [x] Yes. Permanently invalidated review refresh tokens are quarantined and skipped by subsequent reviews. - Does this need documentation? - [x] No. ### Check List (For Reviewer who merge this PR) - [ ] Confirm the release note - [ ] Confirm test cases - [ ] Confirm document - [ ] Add branch pick label -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
