ci: isolate integration orchestration and external approval - #2553
Open
miguelg719 wants to merge 4 commits into
Open
ci: isolate integration orchestration and external approval#2553miguelg719 wants to merge 4 commits into
miguelg719 wants to merge 4 commits into
Conversation
|
miguelg719
force-pushed
the
codex/v4-external-ci-approval
branch
2 times, most recently
from
August 1, 2026 17:21
ceb700b to
ca0bc50
Compare
miguelg719
changed the title
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Review completed against the latest diff
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
miguelg719
force-pushed
the
codex/v4-external-ci-approval
branch
from
August 1, 2026 17:34
ca0bc50 to
9b21e6f
Compare
miguelg719
force-pushed
the
codex/v4-integration-parity
branch
from
August 3, 2026 05:16
b8eb13c to
457e142
Compare
miguelg719
force-pushed
the
codex/v4-external-ci-approval
branch
3 times, most recently
from
August 3, 2026 05:21
d2374d1 to
917d1f7
Compare
akeimach
approved these changes
Aug 3, 2026
miguelg719
force-pushed
the
codex/v4-integration-parity
branch
from
August 3, 2026 20:19
6bfd3a9 to
3d906c8
Compare
miguelg719
force-pushed
the
codex/v4-external-ci-approval
branch
from
August 3, 2026 20:19
917d1f7 to
71d7394
Compare
miguelg719
added a commit
that referenced
this pull request
Aug 4, 2026
## Summary - port 23 public-SDK integration specs from main, growing the v4 suite from 5 to 28 files - adapt legacy cases to hermetic v4 fixtures and public APIs - define ten stable local semantic groups with complete, unique test ownership - leave FlowLogger coverage retired because FlowLogger is absent from both v4 implementations ## Scope boundary This PR is mechanical test transfer only. It has no packages/server production changes, generated extension update, or .github/workflows diff from v4-spike. Three transferred specs that expose runtime gaps travel with their standalone fixes: - operation timeouts: #2555 - well-formed snapshot Unicode: #2556 - locator screenshot masks: #2557 Together the stack grows the suite to 31 files. CI orchestration and external-contributor approval policy remain isolated in #2553. The remaining main integration specs are not silently omitted: Agent/streaming/cache cases require the v4 Agent surface; Browserbase/CDP lifecycle, downloads, OOPIF, and connection cases require dedicated browser infrastructure; logger and FlowLogger cases target lifecycle code removed from v4. ## Verification - integration discovery and ownership tests: 12 passed - focused default-page and screenshot-adjacent integration run: 9 passed before extraction - GitHub semantic matrix is the authoritative full-suite validation after this history rewrite ## Review order #2551 → #2555 → #2556 → #2557 → #2553
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sibling of #2555 and stacked directly on #2551. This PR contains only the ci.yml orchestration and external-contributor execution policy.
CI orchestration
Security issue
Expanding SDK path coverage would let an external SDK-only PR fan out jobs that v4-spike did not previously run. A persistent approval label must not allow a later, unreviewed fork commit to inherit approval.
Security posture after this PR
Divergence from v4-spike and main
v4-spike currently permits ordinary direct-fork CI and gates only selected expensive jobs; this PR is stricter and blocks all repository-code execution from direct fork heads.
Main records the approved SHA and mirrors it to an internal PR, but its Tests workflow only gates secret-bearing E2E jobs with is_internal_head. Ordinary build and lint may still run on forks subject to GitHub repository approval settings. This proposal is therefore intentionally stricter than main.
Rollout constraint
The existing approval handoff lives on main and currently creates mirror PRs against main. Consequently this consumer-side change is complete when the v4 stack lands on main; if it is merged into a long-lived v4-spike first, external PRs targeting v4-spike will remain blocked rather than bypassing approval. Supporting approved external PRs directly against v4-spike requires a separate handoff-policy change.
Validation
Stack
Runtime path: #2551 → #2555 → #2556 → #2557
CI/security sibling: #2551 → #2553