fix: add sparse-checkout-cone-mode: false to verify workflows + harden setup-api-client - #1637
Merged
Merged
Conversation
When workflows sparse-checkout the Workflows repo and include .github/scripts/ files individually, cone-mode includes package.json (as an ancestor-dir file) but NOT node_modules/minimatch/ (a subdirectory). This causes npm install to fail on the unresolvable "file:node_modules/minimatch" dependency. Add a pre-install step that detects and strips file: dependencies whose targets don't exist, so npm install succeeds regardless of whether the vendored packages were checked out. Fixes agents-verify-to-new-pr, agents-verify-to-new-pr-autopilot, agents-verify-to-issue-v2, and ~12 other workflows that use sparse-checkout with setup-api-client. https://claude.ai/code/session_012WnYCcttvFEY3FETnhVcNL
stranske
temporarily deployed
to
agent-standard
February 23, 2026 03:05 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
Contributor
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dc03a11e39
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Contributor
Automated Status SummaryHead SHA: 0610a09
Coverage Overview
Coverage Trend
Top Coverage Hotspots (lowest coverage)
Updated automatically; will refresh on subsequent CI/Docker completions. Keepalive checklistScopeSummaryThis PR adds a new workflow template for consumer repos that enables the keepalive pipeline with CLI Codex. ChangesNew FilesContext for AgentRelated Issues/PRsTasks
Acceptance criteria
|
Contributor
🤖 Keepalive Loop StatusPR #1637 | Agent: Codex | Iteration 0/5 Current State
🔍 Failure Classification| Error type | infrastructure | |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes a critical issue where the setup-api-client action fails when workflows use sparse checkout that doesn't include vendored dependencies. The fix adds an inline Node.js script that strips unresolvable file: dependencies from package.json before running npm install, allowing the action to work regardless of whether vendored packages are present in the sparse checkout.
Changes:
- Added inline Node.js script to strip unresolvable
file:dependencies frompackage.json - Script runs after
create_vendor_aliasesand beforenpm install - Outputs GitHub Actions notices when dependencies are stripped
…ify-to-issue-v2 workflows Consistent with how all other workflows in the repo handle sparse checkouts of the Workflows repo. Without non-cone mode, package.json (which references vendored minimatch) gets pulled in by the ancestor directory rule, but node_modules/minimatch/ does not, causing npm install to fail with ENOENT. https://claude.ai/code/session_012WnYCcttvFEY3FETnhVcNL
stranske
temporarily deployed
to
agent-high-privilege
February 23, 2026 03:12 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
…ify-to-issue-v2 workflows Consistent with how all other workflows in the repo handle sparse checkouts of the Workflows repo. Without non-cone mode, package.json (which references vendored minimatch) gets pulled in by the ancestor directory rule, but node_modules/minimatch/ does not, causing npm install to fail with ENOENT. https://claude.ai/code/session_012WnYCcttvFEY3FETnhVcNL
…ify-to-issue-v2 workflows Consistent with how all other workflows in the repo handle sparse checkouts of the Workflows repo. Without non-cone mode, package.json (which references vendored minimatch) gets pulled in by the ancestor directory rule, but node_modules/minimatch/ does not, causing npm install to fail with ENOENT. https://claude.ai/code/session_012WnYCcttvFEY3FETnhVcNL
stranske
temporarily deployed
to
agent-high-privilege
February 23, 2026 03:14 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
…ify-to-issue-v2 workflows Consistent with how all other workflows in the repo handle sparse checkouts of the Workflows repo. Without non-cone mode, package.json (which references vendored minimatch) gets pulled in by the ancestor directory rule, but node_modules/minimatch/ does not, causing npm install to fail with ENOENT. https://claude.ai/code/session_012WnYCcttvFEY3FETnhVcNL
stranske
changed the title
stranske
temporarily deployed
to
agent-high-privilege
February 23, 2026 03:16 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Address review feedback: the stripped package.json was never restored, which could leak modified state into downstream steps that expect a clean workspace. Now backs up the original before stripping and restores it after npm install completes. https://claude.ai/code/session_012WnYCcttvFEY3FETnhVcNL
Mirror the same backup/restore + strip logic for unresolvable file: dependencies into the consumer-repo template copy, so synced consumer repos also get the defense-in-depth fix. https://claude.ai/code/session_012WnYCcttvFEY3FETnhVcNL
stranske
temporarily deployed
to
agent-high-privilege
February 23, 2026 03:20 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Previous push was empty due to shell variable truncation. This commit contains the full action.yml with the vendored dep strip + restore fix. https://claude.ai/code/session_012WnYCcttvFEY3FETnhVcNL
stranske
temporarily deployed
to
agent-high-privilege
February 23, 2026 03:21 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated Status Summary
Scope
Summary
This PR adds a new workflow template for consumer repos that enables the keepalive pipeline with CLI Codex.
Changes
New Files
Context for Agent
Related Issues/PRs
Tasks
templates/consumer-repo/.github/workflows/agents-keepalive-loop.yml- Full keepalive workflow for consumer reposAcceptance criteria
.github/scripts/keepalive_loop.js- Added support for override payload parameter.github/workflows/maint-68-sync-consumer-repos.yml- Added agents-keepalive-loop.yml to sync list.github/workflows/reusable-codex-run.yml- Added fetch/rebase before push to handle concurrent changesdocs/keepalive/SETUP_CHECKLIST.md- Added keepalive-specific requirementsHead SHA: 5401a89
Latest Runs: ✅ success — Gate
Required: gate: ✅ success