[codex] Fix IBIT zscore workflow and Dependabot guard#125
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3e696c3e65
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| printf '%s\n' "${metrics_urls}" | ||
| echo "EOF" | ||
| } >> "$GITHUB_ENV" | ||
| export ZSCORE_METRICS_URLS="${metrics_urls}" |
There was a problem hiding this comment.
When a manual run supplies ibit_zscore_metrics_url(s), this exports only ZSCORE_METRICS_URLS, so the same-step summary uses the override, but the later download still invokes scripts/download_ibit_zscore_metrics.py without --url/--urls-env; that script's defaults read IBIT_ZSCORE_METRICS_URLS and IBIT_ZSCORE_METRICS_URL, not ZSCORE_METRICS_URLS. As a result, after this crash fix the workflow can silently download from the repo vars/default URL instead of the operator-provided endpoint; persist the resolved value under the env name the downloader consumes or pass it explicitly.
Useful? React with 👍 / 👎.
1 participant
Summary
ZSCORE_METRICS_URLSinside the IBIT zscore publish target step before the same-step Python host summary reads itheadRefOidwithgithub.event.workflow_run.head_sha--match-head-committogh pr mergeso only the CI-checked Dependabot head can be mergedRoot cause
The failed
Publish Strategy Pluginsrun wroteZSCORE_METRICS_URLSto$GITHUB_ENVand then tried to read it from Python in the same step.$GITHUB_ENVonly affects subsequent steps, so the Python process raisedKeyError: 'ZSCORE_METRICS_URLS'.The Codex review on the Dependabot maintenance PR also identified that auto-merge could merge a newer untested Dependabot head if the branch changed after the CI run completed.
Validation
actionlint .github/workflows/publish-strategy-plugins.yml .github/workflows/dependabot_auto_merge.ymlgit diff --checkNotes
uv.lockwas intentionally left out of this PR.