feat(publish): check Linear access and skip recorded issues - #486
Conversation
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6b47211542
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
zcrab-oai
left a comment
zcrab-oai
left a comment
There was a problem hiding this comment.
Reviewed read-only publication checks, resumable destination identity, cancellation, and partial recovery.
|
@codex review Please review current head |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
mldangelo-oai
changed the title
|
@codex review Please review exact head |
|
@codex security review Please review exact head |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Something went wrong. Try again later by commenting “@codex review”. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
kmbroai
left a comment
kmbroai
left a comment
There was a problem hiding this comment.
Critical review
Reviewed head 025fc60acbdd2855f4f995248d7b5552546a2c2d.
Recommendation: keep exact-occurrence skipping; treat publish check as an optional diagnostic surface, not a new mandatory gate. No new blocking defect found in the reviewed changes. Avoiding a second publication of already recorded findings is useful. The limited local-history contract is much simpler and more honest than claiming general remote idempotency.
Correctness and boundaries
inspect_linear_publication opens SQLite read-only and verifies the selected scan/finding inventory before reading publication records. Matching includes scan occurrence, team, and optional project; it does not merely match a finding title or a repository-wide finding ID. The publisher keeps the full scan for store validation/persistence while sending only pending issues to mutation.
The existing abort-propagation comment is fixed: the signal now reaches Python discovery and workbench inspection, while post-creation persistence deliberately remains uncancelled so verified outcomes can be saved. The read-only inspection uses temporary input outside the scan directory instead of creating publication state alongside a missing history database.
The access result appropriately distinguishes not-checked, verified, not-requested, and issueCreation: not-tested. A successful team/project/member read cannot establish issue-creation permission. Likewise, --skip-existing neither checks that a remote issue still exists nor protects against concurrent publishers or unrecorded prior mutations. The README states those limitations; preserve them in UI copy.
Simplification and merge coordination
The shared destination option/parser is worthwhile because check and publish must interpret aliases and environment precedence identically. Keep the preflight opt-in; making all publication perform these extra reads would introduce latency and additional failure modes without proving write access.
When combining with #484 and #624, retain one selection/skip/digest pipeline and one recovery implementation. Add a combined selected-subset/recorded-occurrence regression, and coordinate a single final bundled-plugin version after reconciliation. Independent branch version bumps are not proof that a previously installed combined payload will refresh correctly.
Verification
Ran six focused CLI/check/store/preparation/publication suites: 152 passed, 0 failed, including cancellation, read-only history behavior, destination matching, and partial publication. Linux, Bun 1.3.14 / Node 22.13.1 with cached dependencies. No live Linear access or creation, native Windows run, or clean installed-package validation was performed.
faizan-oai
left a comment
faizan-oai
left a comment
There was a problem hiding this comment.
Reviewed the read-only preflight, exact-occurrence/destination skipping, cancellation, and bundle refresh. All 152 focused tests pass with the package's declared timeout; current-head CI is green. No blocking code findings. The existing disclosure-history note remains as documented.
Preserve saved-scan and Cloud publication behavior alongside read-only Linear checks and opt-in skipping of recorded issues.
Keep full-scan history validation with pending-only publication and recovery. Preserve skipped receipts and cooperative read-only cancellation, and clarify local-only retry behavior.
faizan-oai
left a comment
faizan-oai
left a comment
There was a problem hiding this comment.
Reviewed cf46d60 against main 4ec293c. Full-scan history validation, pending-only publication, skipped receipts, cancellation recovery, and Cloud behavior are preserved. The full local suite passed 1,772 tests with 30 skips; typecheck, formatting, and all 25 current-head CI jobs passed. No blocking code findings. The existing disclosure-history qualifications remain unchanged.
4 participants
Summary
After a partial publication, rerunning
publish scanrecreates successes already recorded locally. Add a read-only preflight and an opt-in way to skip findings recorded for the same scan occurrence and Linear destination. The default publish behavior remains unchanged.Changes
codex-security publish check SCAN_DIR --to linear --linear-team TEAM_IDfor local history validation and optional read-only Linear access checks. The existing project, API-key, and assignee options keep their current environment-variable defaults. Without an API key, remote access is reported asnot-checked; issue creation is never tested.--skip-existingtopublish scan. It defaults tofalseand skips only local records that match the exact scan occurrence, team, and optional project.checkScanPublicationand theskipExistingSDK option with the same behavior.0.1.37and verify a cached0.1.22bundle refreshes before the new history command is used.The existing dry run previews issue content but does not validate recorded publication history or destination access. A separate read-only check avoids changing publish behavior, while the opt-in flag preserves intentional republishing and compatibility for existing callers.
Testing
Checks on
025fc60acbdd2855f4f995248d7b5552546a2c2d:pnpm run types,pnpm run format, Ruff, andgit diff --check: passed.pnpm run build, package archive checks, and installed-package smoke: passed with 255 archive entries and 111 bundled plugin files.Native Windows behavior remains delegated to hosted CI. Hosted checks were not awaited before moving to the next PR.
Risk and rollout
Skipping recorded issues is opt-in. Local history does not prove that a remote issue still exists, and the preflight does not recover retained handoffs or prove issue-creation permission. Concurrent publishers and unrecorded remote operations can still create duplicates. There is no schema migration or dependency change, and no live Linear issues were created during testing. The bundle identity change refreshes cached preview contents but does not publish a package or deploy anything.
Public disclosure review
Previously published commits retain contributor corporate-email metadata, and existing automated comments contain requester-only report references. They are not reproduced here, and the second attestation remains unchecked because they are already part of the public PR history.