Merge branch 'main' into codex/public-wolfi-image

Author: andy-tang-oai

.github/scripts/invoice-desk-target.test.mjs

@@ -27,55 +27,61 @@ function pullRequest(overrides = {}) {
   };
 }
 
-test("selects the requested PR head rather than the trusted workflow commit", async () => {
-  assert.deepEqual(
-    await resolveScanTargets(context, async (number) => {
-      assert.equal(number, "7");
-      return pullRequest();
-    }),
-    [{ pr: 7, sha: sourceSha }],
-  );
-});
-
-test("includes fork and draft PRs without depending on a PR workflow run", async () => {
-  assert.deepEqual(
-    await resolveScanTargets(context, async () =>
-      pullRequest({
-        draft: true,
-        head: { sha: sourceSha, repo: { full_name: "contributor/invoices" } },
-      }),
-    ),
-    [{ pr: 7, sha: sourceSha }],
-  );
+test("initial selection and approval recheck require the selected PR and revision to remain eligible", async () => {
+  const target = { pr: 7, sha: sourceSha };
+  // The approval step must use its matrix target even if dispatch inputs differ.
+  const recheck = {
+    ...context,
+    target: { ...target },
+    event: { inputs: { pr_number: "9", source_sha: mainSha } },
+  };
+  for (const request of [context, recheck]) {
+    for (const [overrides, expected] of [
+      [{}, [target]],
+      [
+        {
+          draft: true,
+          head: { sha: sourceSha, repo: { full_name: "contributor/invoices" } },
+        },
+        [target],
+      ],
+      [{ state: "closed" }, []],
+      [{ base: { ref: "release", repo: { full_name: repository } } }, []],
+      [{ base: { ref: "main", repo: { full_name: "other/invoices" } } }, []],
+      [{ head: { sha: mainSha } }, []],
+      [{ head: { sha: "3".repeat(40) } }, []],
+    ]) {
+      const actual = await resolveScanTargets(request, async (number) => {
+        assert.equal(number, "7");
+        return pullRequest(overrides);
+      });
+      assert.deepEqual(actual, expected);
+    }
+  }
 });
 
-test("rechecking after approval excludes closed, retargeted, and superseded PRs", async () => {
-  assert.deepEqual(
-    await resolveScanTargets(context, async () => pullRequest()),
-    [{ pr: 7, sha: sourceSha }],
-  );
-  for (const changed of [
-    { state: "closed" },
-    { base: { ref: "release", repo: { full_name: repository } } },
-    { base: { ref: "main", repo: { full_name: "other/invoices" } } },
-    { head: { sha: "3".repeat(40) } },
+test("manual and scheduled baselines use the trusted workflow commit before and after approval", async () => {
+  const target = { pr: 0, sha: mainSha };
+  const scheduled = {
+    ...context,
+    eventName: "schedule",
+    event: { schedule: "17 3 * * 1" },
+  };
+  for (const request of [
+    { ...context, event: { inputs: {} } },
+    scheduled,
+    { ...context, target: { ...target } },
+    { ...scheduled, target: { ...target } },
   ]) {
     assert.deepEqual(
-      await resolveScanTargets(context, async () => pullRequest(changed)),
-      [],
+      await resolveScanTargets(request, () =>
+        assert.fail("unexpected API call"),
+      ),
+      [target],
     );
   }
 });
 
-test("manual baseline scans use the trusted workflow commit", async () => {
-  assert.deepEqual(
-    await resolveScanTargets({ ...context, event: { inputs: {} } }, () =>
-      assert.fail("unexpected API call"),
-    ),
-    [{ pr: 0, sha: mainSha }],
-  );
-});
-
 test("incomplete or invalid PR inputs fail instead of falling back to a baseline", async () => {
   for (const inputs of [
     { pr_number: "7" },
@@ -117,48 +123,6 @@ test("PR events and completed PR workflows do not queue inference or query GitHu
   }
 });
 
-test("scheduled baseline scans use the trusted workflow commit", async () => {
-  assert.deepEqual(
-    await resolveScanTargets(
-      { ...context, eventName: "schedule", event: { schedule: "17 3 * * 1" } },
-      () => assert.fail("unexpected API call"),
-    ),
-    [{ pr: 0, sha: mainSha }],
-  );
-});
-
-test("approval recheck stays bound to its matrix PR and source revision", async () => {
-  const run = { ...context, target: { pr: 7, sha: sourceSha } };
-  for (const changed of [
-    { state: "closed" },
-    { base: { ref: "release", repo: { full_name: repository } } },
-    { head: { sha: mainSha } },
-  ]) {
-    assert.deepEqual(
-      await resolveScanTargets(run, async (number) => {
-        assert.equal(number, "7");
-        return pullRequest(changed);
-      }),
-      [],
-    );
-  }
-  assert.deepEqual(await resolveScanTargets(run, async () => pullRequest()), [
-    { pr: 7, sha: sourceSha },
-  ]);
-});
-
-test("baseline approval recheck retains the original trusted workflow commit", async () => {
-  for (const eventName of ["workflow_dispatch", "schedule"]) {
-    assert.deepEqual(
-      await resolveScanTargets(
-        { ...context, eventName, target: { pr: 0, sha: mainSha } },
-        () => assert.fail("unexpected API call"),
-      ),
-      [{ pr: 0, sha: mainSha }],
-    );
-  }
-});
-
 test("resolver CLI emits the requested target without dispatching another workflow", (t) => {
   const root = mkdtempSync(join(tmpdir(), "invoice-desk-target-"));
   t.after(() => rmSync(root, { recursive: true, force: true }));

.github/scripts/test_check_plugin_source_compatibility.mts

@@ -92,10 +92,10 @@ test("checkout preserves source size with autocrlf", () => {
     git(root, "add", "--", ".gitattributes", name);
     unlinkSync(source);
     git(root, "checkout-index", "--", name);
-    const result = runChecker("--plugin-root", root);
-    assert.equal(result.status, 0, result.stderr);
     assert.deepEqual(readFileSync(source), content);
   }
+  const result = runChecker("--plugin-root", root);
+  assert.equal(result.status, 0, result.stderr);
 });
 
 test("accepts Markdown structures, natural line endings, and inline markup", () => {

action.yml

@@ -1,5 +1,5 @@
 name: OpenAI Codex Security
-description: Scan code with Codex Security, enforce findings policy, and produce JSON, coverage, and SARIF reports.
+description: Scan code with Codex Security, enforce findings policy, and produce JSON and SARIF reports.
 branding:
   icon: shield
   color: black
@@ -60,8 +60,10 @@ outputs:
     description: Absolute validated SARIF file path, or empty when unavailable or withheld.
   json-path:
     description: Absolute canonical findings JSON path, or empty when unavailable or withheld.
+  manifest-path:
+    description: Absolute scan manifest path, including scan status and scope, or empty when unavailable or withheld.
   coverage-path:
-    description: Absolute coverage JSON path, or empty when unavailable or withheld.
+    description: Legacy coverage JSON path. Empty for current CLI results.
   results-directory:
     description: Runner-local reports directory; do not upload it recursively.
   scan-status:

evals/secret-discovery/harness.mts

@@ -94,7 +94,7 @@ export const outputSchema = object({
       remediation: text,
     }),
   ),
-  coverage: object({
+  reviewState: object({
     surfaces: array(
       object({
         label: text,