mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-25 09:41:04 +01:00
Harold KimandPaperclip
98df214917
When reusing a Codex sandbox, the workspace-restore step now performs an auth-merge check before adopting the sandbox's auth.json. The merge fails closed when: - host or sandbox Codex auth is unusable (missing token or account) - the subscription payload shapes differ between host and sandbox - subscription account identities do not match Additional hardening: node absence on PATH during the embedded decision script now exits non-zero instead of silently falling through. Co-change comments link parseAuth (the embedded script) to hasUsableAuthPayload (codex-home.ts) so a future auth-format change cannot silently diverge between the two implementations. Co-Authored-By: Paperclip <noreply@paperclip.ing>
32 lines
1.2 KiB
JavaScript
32 lines
1.2 KiB
JavaScript
#!/usr/bin/env node
|
|
/**
|
|
* check-pr-lockfile.mjs
|
|
* Checks that pnpm-lock.yaml was not manually edited.
|
|
* Export: checkLockfile(files, prAuthor, prBranch) → { passed, failures }
|
|
*/
|
|
import { fileURLToPath } from 'node:url';
|
|
|
|
export function checkLockfile(files, prAuthor, prBranch) {
|
|
const lockfileChanged = files.some(f => f.filename === 'pnpm-lock.yaml');
|
|
if (!lockfileChanged) return { passed: true, failures: [] };
|
|
|
|
const isRefreshBot =
|
|
prAuthor === 'github-actions[bot]' && prBranch === 'chore/refresh-lockfile';
|
|
|
|
return {
|
|
passed: isRefreshBot,
|
|
failures: isRefreshBot ? [] : [
|
|
'You have changes to `pnpm-lock.yaml` — `pr.yml` will hard-fail this PR with a confusing message about lockfile edits. ' +
|
|
'To fix: run `pnpm install` locally, exclude the lockfile from your commit, push again. ' +
|
|
'The lockfile is regenerated automatically by the refresh bot on a schedule.',
|
|
],
|
|
};
|
|
}
|
|
|
|
if (process.argv[1] === fileURLToPath(import.meta.url)) {
|
|
const files = JSON.parse(process.env.PR_FILES ?? '[]');
|
|
const result = checkLockfile(files, process.env.PR_AUTHOR ?? '', process.env.PR_BRANCH ?? '');
|
|
console.log(JSON.stringify(result));
|
|
process.exit(result.passed ? 0 : 1);
|
|
}
|