Repository navigation
fix(release): make the Codex dogfood runners able to execute the real harness - #2676
Conversation
… harness Three per-platform environment defects surfaced on run 30216261391, the first to get past bundle verification and the database self-heal: - linux-x64-glibc / linux-arm64: Ubuntu 24.04 AppArmor permits creating unprivileged user namespaces but denies capability use inside them, so Codex's bubblewrap sandbox dies at loopback setup (bwrap: loopback: Failed RTM_NEWADDR). Lift kernel.apparmor_restrict_unprivileged_userns so the dogfood exercises the real sandbox instead of disabling it. - darwin-arm64 / linux-arm64: the slsa-verifier installer action bootstraps through a linux-amd64 binary and can never run on arm64 runners (ENOEXEC on macOS, exit 2 on ubuntu-24.04-arm; it failed on every darwin run to date). Install the platform-correct v2.7.1 release asset directly, pinned to upstream's SHA256SUM.md ledger and verified against fresh downloads. - linux-x64-musl: the harness fails any capability probe that writes stderr, and the adapter's first docker run of the unpulled Alpine image streams pull progress there. Pre-pull the exact pinned digest. Validated: the complete dogfood entry passes offline on darwin-arm64 against the real signed v5.260726.7 candidate (both product fixes) — codex-dogfood-entry: OK, N→T lifecycle through real Codex 0.144.1.
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe release workflow replaces the SLSA verifier action with checksum-verified platform-specific installation and configures Linux sandbox networking. Alpine container jobs now pre-pull a pinned image digest before capability probing. ChangesRelease runner setup
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
fix(release): dogfood runner environment fixes (dev twin of #2676)
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a4ee056181
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| # clean. Image pin must match scripts/run-musl-dogfood.sh. | ||
| - name: Pre-pull the pinned Alpine image for the musl execution adapter | ||
| if: matrix.execution == 'alpine-container' | ||
| run: docker pull -q 'alpine:3.19@sha256:6baf43584bcb78f2e5847d1de515f23499913ac9f12bdf834811a3145eb11ca1' |
There was a problem hiding this comment.
For the linux-x64-musl matrix entry, this pre-pull cannot keep the capability probe's stderr clean: scripts/run-musl-dogfood.sh:50 still invokes every adapter call with docker run --pull=always, and Docker documents always as “Always perform a pull before creating the container.” The resulting pull status is written to Docker CLI stderr, which tests/support/codex-dogfood-harness.ts:658-659 rejects, so this release job still fails at the probe even when the image was pre-pulled. Use a non-pulling policy after the digest-pinned pre-pull or otherwise prevent that status output from reaching probe stderr.
AGENTS.md reference: AGENTS.md:L43-L45
Useful? React with 👍 / 👎.
Why main-first
The dogfood job executes from
github.sha= main, so this fix is inert until it lands here — and landing it on main BEFORE merging to dev means the dev merge fires the first release that can go full green, with zero wasted cycles. A twin PR to dev follows immediately after this merges.The three per-platform environment defects (run 30216261391 — the first run past bundle verification and the DB self-heal)
linux-x64-glibc / linux-arm64 —
bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted. Ubuntu 24.04 images permit creating unprivileged user namespaces but AppArmor denies capability use inside them, killing Codex's bubblewrap sandbox at loopback setup. Fix: liftkernel.apparmor_restrict_unprivileged_usernson Linux runners so the dogfood exercises Codex's real sandbox rather than disabling it.darwin-arm64 / linux-arm64 — slsa-verifier installer action cannot run on arm64. Its bootstrap is a linux-amd64 binary:
spawn ENOEXECon macOS (failed on every darwin run to date), exit 2 on ubuntu-24.04-arm. Fix: install the platform-correct v2.7.1 release asset directly, SHA256-pinned to upstream's checksum ledger and cross-verified against fresh downloads. The other jobs keep the action — they run on amd64 where it works.linux-x64-musl — capability probe fails on docker pull noise. The harness fails any probe that writes stderr; the adapter's first
docker runof the unpulled Alpine image streams pull progress there. Fix: pre-pull the exact pinned digest (same pin asscripts/run-musl-dogfood.sh).Evidence this is the last dogfood layer
The complete dogfood entry passes offline on darwin-arm64 against the real signed v5.260726.7 candidate (which carries both product fixes):
codex-dogfood-entry: OK— full N→T lifecycle through real Codex 0.144.1, evidence emitted. The publish tail beyond dogfood was independently reviewed clean (verdict SHIP; latent findings filed as #2674/#2675).Validation: YAML lint clean, all action pins resolve, the four workflow-referencing test files pass (67 tests).
Summary by CodeRabbit