Uh oh!
There was an error while loading. Please reload this page.
feat(ci): unfreeze the org nightly starter - #89
Conversation
Pin Core nightly.yml@0d3d8d3 (ci_deep analyze-semgrep + tests) and drop the frozen-v1 marking. Pack copy matches the template. Co-authored-by: Cursor <cursoragent@cursor.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
🟡 Changes recommended
The wrappers omit packages: read, which can cap the called nightly kernel’s needed permissions and break GitHub Packages-backed Node installs.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Updates the organization’s nightly starter workflow wrapper(s) to “unfreeze” and point at a newer l9-ci-core nightly kernel commit, while scoping elevated token permissions to the single reusable-workflow job.
Changes:
- Updated
workflow-templates/l9-nightly.ymlto call the nightly kernel at0d3d8d3cf2828e1a8c01c237597feb3979c2ba52and introduced explicit workflow/job permissions. - Added
l9-ci-pack/workflows/l9-nightly.ymlas the v2 pack entrypoint for the same nightly kernel wrapper. - Refreshed the starter’s metadata/README wording to describe the current nightly behavior (Semgrep advisory + full-tree tests).
File summaries
| File | Description |
|---|---|
| workflow-templates/l9-nightly.yml | Unfrozen starter wrapper now pins a newer nightly kernel and adds explicit permissions. |
| workflow-templates/l9-nightly.properties.json | Updates the starter description to match the new nightly behavior. |
| l9-ci-pack/workflows/l9-nightly.yml | Adds the pack version of the nightly wrapper pointing at the same kernel SHA. |
| l9-ci-pack/README.md | Clarifies that nightly is not frozen and documents what the nightly kernel includes. |
Review details
- Files reviewed: 4/4 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| permissions: | ||
| contents: read | ||
| jobs: | ||
| l9_nightly: | ||
| uses: Quantum-L9/l9-ci-core/.github/workflows/nightly.yml@0d3d8d3cf2828e1a8c01c237597feb3979c2ba52 | ||
| permissions: | ||
| actions: read | ||
| checks: write | ||
| contents: read |
| permissions: | ||
| actions: read | ||
| checks: write | ||
| contents: read |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:ac104432b0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| jobs: | ||
| l9_nightly: | ||
| uses: Quantum-L9/l9-ci-core/.github/workflows/nightly.yml@0d3d8d3cf2828e1a8c01c237597feb3979c2ba52 |
There was a problem hiding this comment.
Running the documented make sync-core REF=7148fc73dcbf41367f5c5401432dc997b1f4f869 path will silently break this new caller: ops/sync-v2-starters.sh lines 118-126 rewrites the Core pin in every l9-ci-pack/workflows/*.yml, but leaves the new language: python input intact. The registry's verified interface for that older SHA (workflow-interface-registry.yml lines 124-137) exposes only python-version and run-extended-tests, so GitHub will reject the resulting reusable-workflow call for an unsupported input; the pack copy will also diverge from the gallery copy, which the sync script does not repin. Exclude this special nightly from the generic repinning loop or update the pack's supported Core ref and interface metadata consistently.
Useful? React with 👍 / 👎.
Summary
workflow-templates/l9-nightly.ymland addl9-ci-pack/workflows/l9-nightly.yml.l9-ci-corenightly kernel at0d3d8d3cf2828e1a8c01c237597feb3979c2ba52(PR feat(ci): make nightly.yml the org ci_deep kernel l9-ci-core#132).checks: writeso nested analyze publication can emit a check.validate-startersPASS.Test plan
bash ops/validate-starters.sh(36 passed, 0 failed)Made with Cursor
Files touched
4 files — 4 files changed, 42 insertions(+), 6 deletions(-)
Warning
4 file(s) not declared under Changes by intent:
l9-ci-pack/README.md,l9-ci-pack/workflows/l9-nightly.yml,workflow-templates/l9-nightly.properties.json,workflow-templates/l9-nightly.ymll9-ci-pack/README.md— modifiedl9-ci-pack/workflows/l9-nightly.yml— addedworkflow-templates/l9-nightly.properties.json— modifiedl9-nightly.yml— modified