fix(operator): guard Codex release compatibility #75
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Codex session storage and quota guard | |
| on: | |
| push: | |
| branches: [dev] | |
| paths: | |
| - "scripts/operator/codex-session-storage-guard.mjs" | |
| - "docs/CODEX_SESSION_STORAGE_GUARD.md" | |
| - "package.json" | |
| - ".github/workflows/session-storage-guard.yml" | |
| pull_request: | |
| paths: | |
| - "scripts/operator/codex-session-storage-guard.mjs" | |
| - "docs/CODEX_SESSION_STORAGE_GUARD.md" | |
| - "package.json" | |
| - ".github/workflows/session-storage-guard.yml" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| validate: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Checkout without persisted credentials | |
| uses: actions/checkout@v5 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: 1.3.11 | |
| - name: Validate script syntax | |
| run: node --check scripts/operator/codex-session-storage-guard.mjs | |
| - name: Verify storage thresholds and single-agent quota guard | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| HOME_DIR="$RUNNER_TEMP/codex-session-guard" | |
| mkdir -p "$HOME_DIR/sessions/2026/07/26" | |
| printf 'small rollout\n' > "$HOME_DIR/sessions/2026/07/26/rollout-a.jsonl" | |
| printf '[model]\nname = "approved"\n\n[agents]\nenabled = true\nmax_concurrent_threads_per_session = 8\n' > "$HOME_DIR/config.toml" | |
| SAFE=$(bun scripts/operator/codex-session-storage-guard.mjs \ | |
| --codex-home "$HOME_DIR" \ | |
| --total-warn-bytes 1048576 \ | |
| --total-critical-bytes 2097152 \ | |
| --file-warn-bytes 1048576 \ | |
| --file-critical-bytes 2097152 \ | |
| --free-warn-bytes 1 \ | |
| --free-critical-bytes 1 \ | |
| --json) | |
| node -e 'const value=JSON.parse(process.argv[1]);if(value.status!=="safe"||value.subagent_quota_guard_required!==true)process.exit(1)' "$SAFE" | |
| truncate -s 4096 "$HOME_DIR/sessions/2026/07/26/rollout-large.jsonl" | |
| set +e | |
| WARNING=$(bun scripts/operator/codex-session-storage-guard.mjs \ | |
| --codex-home "$HOME_DIR" \ | |
| --total-warn-bytes 2048 \ | |
| --total-critical-bytes 1048576 \ | |
| --file-warn-bytes 2048 \ | |
| --file-critical-bytes 1048576 \ | |
| --free-warn-bytes 1 \ | |
| --free-critical-bytes 1 \ | |
| --json) | |
| CODE=$? | |
| set -e | |
| test "$CODE" -eq 2 | |
| node -e 'const value=JSON.parse(process.argv[1]);if(value.status!=="warning")process.exit(1)' "$WARNING" | |
| APPLIED=$(bun scripts/operator/codex-session-storage-guard.mjs \ | |
| --codex-home "$HOME_DIR" \ | |
| --total-warn-bytes 10485760 \ | |
| --total-critical-bytes 20971520 \ | |
| --file-warn-bytes 10485760 \ | |
| --file-critical-bytes 20971520 \ | |
| --free-warn-bytes 1 \ | |
| --free-critical-bytes 1 \ | |
| --apply-subagent-quota-guard \ | |
| --json) | |
| node -e 'const value=JSON.parse(process.argv[1]);if(value.config_change.applied!==true||value.agent_policy.quota_guard_active!==true)process.exit(1)' "$APPLIED" | |
| grep -q '^\[agents\]$' "$HOME_DIR/config.toml" | |
| grep -q '^enabled = false$' "$HOME_DIR/config.toml" | |
| grep -q '^max_concurrent_threads_per_session = 1$' "$HOME_DIR/config.toml" | |
| test "$(grep -c '^enabled =' "$HOME_DIR/config.toml")" -eq 1 | |
| test "$(grep -c '^max_concurrent_threads_per_session =' "$HOME_DIR/config.toml")" -eq 1 | |
| find "$HOME_DIR/operator-backups/subagent-quota" -name config.toml -print -quit | grep -q . | |
| LEGACY=$(bun scripts/operator/codex-session-storage-guard.mjs \ | |
| --codex-home "$HOME_DIR" \ | |
| --total-warn-bytes 10485760 \ | |
| --total-critical-bytes 20971520 \ | |
| --file-warn-bytes 10485760 \ | |
| --file-critical-bytes 20971520 \ | |
| --free-warn-bytes 1 \ | |
| --free-critical-bytes 1 \ | |
| --apply-fork-limit \ | |
| --json) | |
| node -e 'const value=JSON.parse(process.argv[1]);if(value.agent_policy.quota_guard_active!==true)process.exit(1)' "$LEGACY" |