Repository navigation
Fetch completed remote task results for Hub review - #45
Conversation
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
Security findingsAdvisory findings (1)ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
🛡️ Codex Security Review · Automatically triggered
Here are some automated security review suggestions for this pull request.
Reviewed commit: 0b29eb37ec
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
| subprocess.run(['git', '-C', repo, 'fetch', '--no-tags', str(bundle), | ||
| 'refs/heads/' + branch + ':refs/openswarm/' + run_id], | ||
| capture_output=True, check=True, timeout=130) |
There was a problem hiding this comment.
🛡️ Codex Security Review · Automatically triggered
When a concurrent lower-privileged executor or process can rewrite refs in the shared fleet repository, do not publish this fetched ref without pinning it to the recorded SHA. fleet-result-bundle checks the branch before a later bundle create, so the ref can change between those operations; this fetch validates only JSON metadata and never resolves the imported ref. Reproduction produced metadata for commit A with a bundle advertising B, and this code accepted B as local_review_ref. Export an immutable temporary ref and verify or delete the destination unless it equals commit.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
deferred: security work frozen until functional acceptance
Closes surlymochan/phanes#2. When a remote run finishes, the existing gateway transfers its result as a Git bundle and the Hub bridge fetches it into a local review ref. Retrieval failures remain visible without masking the completed task. No additional persistent service is required.
Validation: 32 Hub bridge and fleet capacity tests passed, including transfer between real temporary Git repositories. Live gores1-to-Hub acceptance remains to be performed after deployment.