feat: align Codex plugin with Claude OAuth and bundled CLI #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CLI Check | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'plugins/greptile/scripts/**' | |
| - 'plugins/greptile/skills/**' | |
| - '.github/workflows/cli-check.yml' | |
| pull_request: | |
| paths: | |
| - 'plugins/greptile/scripts/**' | |
| - 'plugins/greptile/skills/**' | |
| - '.github/workflows/cli-check.yml' | |
| schedule: | |
| - cron: '41 8 * * *' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| check: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - name: Recorded version is well formed | |
| run: | | |
| set -euo pipefail | |
| version=$(tr -d '[:space:]' < plugins/greptile/scripts/greptile.version) | |
| if ! printf '%s' "$version" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then | |
| echo "::error::plugins/greptile/scripts/greptile.version is not a plain semver string." | |
| exit 1 | |
| fi | |
| printf '%s' "$version" > "$RUNNER_TEMP/version.txt" | |
| echo "Recorded version $version" | |
| - name: Bundle runs and reports the recorded version | |
| run: | | |
| set -euo pipefail | |
| version=$(cat "$RUNNER_TEMP/version.txt") | |
| reported=$(node plugins/greptile/scripts/greptile.mjs --version | tr -d '[:space:]') | |
| if [ "$reported" != "$version" ]; then | |
| echo "::error::Vendored bundle reports $reported but greptile.version records $version." | |
| exit 1 | |
| fi | |
| echo "Bundle reports $reported." | |
| - name: Login and review run outside the checkout | |
| run: | | |
| set -euo pipefail | |
| mkdir -p "$RUNNER_TEMP/installed plugin/scripts" | |
| cp plugins/greptile/scripts/greptile.mjs "$RUNNER_TEMP/installed plugin/scripts/greptile.mjs" | |
| cd "$RUNNER_TEMP" | |
| GREPTILE_NO_UPDATE_CHECK=1 node "$RUNNER_TEMP/installed plugin/scripts/greptile.mjs" login --help | |
| GREPTILE_NO_AUTO_INSTALL=1 GREPTILE_NO_UPDATE_CHECK=1 node "$RUNNER_TEMP/installed plugin/scripts/greptile.mjs" review --agent --help | |
| - name: Bundle is byte-identical to the published npm release | |
| run: | | |
| set -euo pipefail | |
| version=$(cat "$RUNNER_TEMP/version.txt") | |
| cd "$RUNNER_TEMP" | |
| npm pack "greptile@$version" >/dev/null | |
| tar -xzf "greptile-$version.tgz" | |
| cd "$GITHUB_WORKSPACE" | |
| published=$(shasum -a 256 "$RUNNER_TEMP/package/dist/greptile.js" | cut -d' ' -f1) | |
| vendored=$(shasum -a 256 plugins/greptile/scripts/greptile.mjs | cut -d' ' -f1) | |
| if [ "$published" != "$vendored" ]; then | |
| echo "::error::Vendored bundle does not match npm greptile@$version. published=$published vendored=$vendored. Re-vendor with: npm pack greptile@$version && tar -xzf greptile-$version.tgz && cp package/dist/greptile.js plugins/greptile/scripts/greptile.mjs" | |
| exit 1 | |
| fi | |
| echo "Vendored bundle matches npm greptile@$version ($vendored)." | |
| - name: Commands invoke the vendored bundle, not a fetched one | |
| run: | | |
| set -euo pipefail | |
| for f in plugins/greptile/skills/review/SKILL.md plugins/greptile/skills/login/SKILL.md; do | |
| block=$(awk '/^```/{fence = !fence; next} fence' "$f") | |
| if [ -z "$block" ]; then | |
| echo "::error::$f has no fenced command block to validate." | |
| exit 1 | |
| fi | |
| if grep -q 'npx' <<<"$block"; then | |
| echo "::error::$f still fetches the CLI with npx. The plugin vendors it; invoke <plugin-root>/scripts/greptile.mjs instead." | |
| exit 1 | |
| fi | |
| if ! grep -qF 'node "<plugin-root>/scripts/greptile.mjs"' <<<"$block"; then | |
| echo "::error::$f does not invoke the vendored bundle at <plugin-root>/scripts/greptile.mjs." | |
| exit 1 | |
| fi | |
| if ! grep -qF 'GREPTILE_NO_UPDATE_CHECK=1 node "<plugin-root>/scripts/greptile.mjs"' <<<"$block"; then | |
| echo "::error::$f invokes the vendored bundle without GREPTILE_NO_UPDATE_CHECK=1. CLI versions that predate plugin-install detection read this path as a standalone install and name an installer that cannot update the plugin's copy. --agent already suppresses the notice, so this is a second line of defence for invocations that drop it." | |
| exit 1 | |
| fi | |
| done | |
| echo "Commands invoke the vendored bundle with the update check disabled." | |
| - name: Review command suppresses the renderer download | |
| run: | | |
| set -euo pipefail | |
| block=$(awk '/^```/{fence = !fence; next} fence' plugins/greptile/skills/review/SKILL.md) | |
| if ! grep -qF 'GREPTILE_NO_AUTO_INSTALL=1 GREPTILE_NO_UPDATE_CHECK=1 node "<plugin-root>/scripts/greptile.mjs"' <<<"$block"; then | |
| echo "::error::plugins/greptile/skills/review/SKILL.md must invoke the bundle with GREPTILE_NO_AUTO_INSTALL=1 ahead of GREPTILE_NO_UPDATE_CHECK=1. README.md tells users the plugin never downloads the mmdr renderer; this is what makes that true." | |
| exit 1 | |
| fi | |
| echo "Review command suppresses the renderer download." |