Repository navigation
feat(publish)!: share issue receipts with finding tracking - #1426
mldangelo-oai wants to merge 23 commits into
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
github-actions
Bot
added
the
breaking-change
|
@codex review |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
🔵 Needs a closer look
The irreversible schema replacement and cross-runtime fallback behavior warrant final human review despite extensive tests.
0 open findings
What changed in this PR
This PR unifies CLI publication and plugin tracking around shared local finding-issue receipts.
Changes:
- Adds migration 44 and a shared
finding-issuesworkbench command. - Exposes MCP tools for reading and recording receipts across supported trackers.
- Adds migration, interoperability, sealed-artifact, and state-fallback coverage.
| File | Description |
|---|---|
sdk/typescript/tests-ts/runtime.test.ts |
Updates bundled command expectation. |
sdk/typescript/tests-ts/publication-store.test.ts |
Tests shared receipt persistence and migration. |
sdk/typescript/tests-ts/publication-integration.test.ts |
Tests CLI/plugin interoperability. |
sdk/typescript/src/publication-store.ts |
Adopts the shared receipt workbench API. |
sdk/typescript/docs/cli.md |
Documents shared history and upgrade compatibility. |
plugins/codex-security/tests/test_workbench_setup_and_migrations.py |
Updates migration expectations. |
plugins/codex-security/tests/test_workbench_db.py |
Updates schema-table assertions. |
plugins/codex-security/tests/test_finding_issue_receipts.py |
Tests receipt validation, migration, and replay. |
plugins/codex-security/skills/track-findings/SKILL.md |
Integrates shared receipts into tracking guidance. |
plugins/codex-security/skills/track-findings/references/github-security-advisories.md |
Adds advisory receipt recording guidance. |
plugins/codex-security/shared/workbench-migrations.json |
Adds the shared receipt table migration. |
plugins/codex-security/scripts/workbench_publication.py |
Implements shared receipt operations. |
plugins/codex-security/scripts/workbench_db.py |
Dispatches the new workbench command. |
plugins/codex-security/scripts/workbench_cli.py |
Registers the consolidated command. |
plugins/codex-security/mcp-app/tests/test_workbench_state_fallback.ts |
Tests receipt fallback recovery. |
plugins/codex-security/mcp-app/tests/test_finding_issue_tools.ts |
Tests the new MCP tools. |
plugins/codex-security/mcp-app/tests/test_compact_artifact_server.ts |
Verifies tool registration. |
plugins/codex-security/mcp-app/src/server/finding-issue-tools.ts |
Defines receipt MCP tools and schemas. |
plugins/codex-security/mcp-app/server.ts |
Registers tools and restores fallback selection. |
docs/plugin-connectors.md |
Documents shared tracker associations. |
🧠 Review effort: Balanced
Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.
mldangelo-oai
changed the title
mldangelo-oai
added
area:artifacts
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 279d39584f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
🟡 Changes recommended
Readback validation currently permits contradictory or incomplete status records in shared history.
2 open findings
🧠 Review effort: Balanced
Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.
mldangelo-oai
left a comment
mldangelo-oai
left a comment
There was a problem hiding this comment.
Clarified the existing contract: reuse records an established association; optional readback and diagnostic text do not undo that association. Keeping the supported no-read reuse path and optional diagnostics.
mldangelo-oai
removed
area:artifacts
zcrab-oai
left a comment
zcrab-oai
left a comment
There was a problem hiding this comment.
Reviewed the diff and relevant callers at 279d395, with an independent second pass. No actionable findings.
Focused validation: Actual model-facing issue tools MCP integration passed after selecting the source plugin and working Python explicitly. Python issue-receipts suite passed: 16 tests (143.83s).
Validation limits: Source review used the exact recorded head, not the current checkout. Full cross-platform/integration suites were not rerun.
CI still has failed, canceled, or unfinished checks. This source-review approval does not clear those checks.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6dc00c3f2b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0c0865166d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
zcrab-oai
left a comment
zcrab-oai
left a comment
There was a problem hiding this comment.
Approved at d1fe058d05da after independent source review and validation. The prior receipt ownership, URL replay, and large-response concerns are addressed.
Test-isolation consideration: the connector-identity fixture calls preparation without its fixture environment, so severity lookup depends on ambient workbench state. Pass { ...OPTIONS, environment: completed.environment } at publication-integration.test.ts:991. This omission predates the PR; it is a test-isolation issue. The failing case passed when rerun with an isolated initialized ambient database.
Validation: plugin build passed; 39 SDK tests passed initially, and both connector-identity cases passed on the targeted rerun. All 22 Python receipt tests passed. One process-group assertion was blocked by the outer sandbox denying ps. Local checks used macOS ARM64; the full platform matrix was not rerun.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e6e33bec5f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Codex Review: Something went wrong. Try again later by commenting “@codex review”. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
mldangelo-oai
changed the title
zcrab-oai
left a comment
zcrab-oai
left a comment
There was a problem hiding this comment.
Reviewed the changes since the previous reviewed head in two passes, using exact source at 85b3369803d9 and prior review evidence. Unchanged portions of the large branch were not exhaustively re-audited.
Approved with these considerations still open:
- P3: The pre-existing connector-identity fixture omits completed.environment during preparation and therefore depends on ambient severity state. Pass the fixture environment through preparation. sdk/typescript/tests-ts/publication-integration.test.ts:984
Validation: CI-helper TypeScript compilation and plugin bundling passed locally; native binaries came from CI with matching compiled source inputs. Focused Python tests passed: test_finding_issue_receipts.py (22 passed in 8.50s). The full cross-platform suite was not run locally; Windows execution remains unverified here.
alandelong-oai
left a comment
alandelong-oai
left a comment
There was a problem hiding this comment.
Reviewed the actual diff at 5da54aa9ecb00c7abdce1f8254f67dafa19c8900 in three independent passes, including receipt transactions, migrations, CLI/plugin interoperability tests, and the tracking documentation. Sealed-source ownership and destination checks remain enforced; accepted write identity survives an optional readback failure; rejected receipt updates roll back together.
No blocking findings. The migration intentionally requires coordinated publisher upgrades, as documented. Static review only; migrations, builds, and integration tests were not executed.
Summary
Share local issue history between CLI publication and plugin tracking. Tracking can reuse accepted associations across scans; CLI
--skip-existingremains scoped to the selected occurrence.Changes
Testing
Risk and rollout
Upgrade CLI and plugin together when sharing a state directory. Migration preserves existing Linear records but removes the old table, so older publishers cannot write afterward. A later readback failure neither invalidates an accepted association nor authorizes another issue creation. No additional CLI syntax is introduced by this refresh.
Public disclosure review