From ecbdcc39280e174fdca397ca87fd5e7c287cec8a Mon Sep 17 00:00:00 2001 From: idy Date: Tue, 4 Aug 2026 10:00:22 +0800 Subject: [PATCH] workflows: keep stage snapshots out of job outputs Publish only the structured summary, findings, and readiness fields across jobs while preserving full stage evidence in the existing review artifact. Cover the public output boundary to prevent GitHub secret scanning from suppressing it. Generated with [Codex](https://github.com/openai) --- .github/scripts/pr-review/run.mjs | 10 +++++++++- .github/scripts/pr-review/test.mjs | 13 +++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/.github/scripts/pr-review/run.mjs b/.github/scripts/pr-review/run.mjs index 3287703..2a7a130 100644 --- a/.github/scripts/pr-review/run.mjs +++ b/.github/scripts/pr-review/run.mjs @@ -734,7 +734,15 @@ try { outputTokens: totals.output_tokens, }); - appendOutput("review", JSON.stringify(review)); + // Cross-job outputs are inspected by GitHub's secret scanner. Keep the + // publication payload to the fields consumed by readiness and publication; + // the complete stage evidence remains in aggregate-result.json and the + // encrypted Actions artifact. + appendOutput("review", JSON.stringify({ + summary: review.summary, + findings: review.findings, + readiness: review.readiness, + })); appendOutput("session_id", sessionId); appendOutput("generation_key", generation.key); appendOutput("usage_available", "true"); diff --git a/.github/scripts/pr-review/test.mjs b/.github/scripts/pr-review/test.mjs index 108e3d9..0017943 100644 --- a/.github/scripts/pr-review/test.mjs +++ b/.github/scripts/pr-review/test.mjs @@ -542,6 +542,19 @@ fs.writeFileSync(outputFile, JSON.stringify( assert.equal(completedLedger.generations.at(-1).status, "completed"); assert.equal(completedLedger.generations.at(-1).aggregate.metrics.input_tokens, 100); const reviewOutputs = fs.readFileSync(reviewOutput, "utf8"); + const reviewOutputLine = reviewOutputs + .split("\n") + .find((line) => line.startsWith("review=")); + assert.ok(reviewOutputLine); + const publicReview = JSON.parse(reviewOutputLine.slice("review=".length)); + assert.deepEqual(Object.keys(publicReview).sort(), [ + "findings", + "readiness", + "summary", + ]); + assert.equal(publicReview.summary, "Fake code review complete."); + assert.deepEqual(publicReview.findings, []); + assert.equal(publicReview.readiness.verdict, "pass"); assert.match(reviewOutputs, /^credits_available=true$/m); assert.match(reviewOutputs, /^estimated_credits=0\.044$/m); const usageOutput = reviewOutputs