From 548794cdbee448be9a990d6ea96bc869298d154f Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Mon, 4 May 2026 16:44:53 +0000 Subject: [PATCH] ci: pi progress streaming, codex gpt-5.5 + danger-full-access sandbox (#9030) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * ci: install bubblewrap for codex sandbox; stream pi progress in logs - Codex's vendored bwrap fails to set up loopback on some ubicloud runners, leaving codex unable to read any local files. Install the system bubblewrap package before running codex so its read-only sandbox works reliably. - Switch pi to --mode json and pipe events through jq to surface agent/turn boundaries and tool calls live in the GitHub Actions log, matching codex's progress visibility. Final assistant text is extracted from the saved event log into pi-final-message.md for the PR comment. Co-Authored-By: Claude Opus 4.7 (1M context) * ci: drop bubblewrap install, use codex -s danger-full-access Codex's read-only sandbox uses bwrap which fails to set up loopback on some ubicloud runners. Rather than apt-installing bubblewrap, switch to the no-sandbox mode for parity with how Pi and Claude already operate in the same workflow — runner is ephemeral and we trust the codex prompt the same way. Co-Authored-By: Claude Opus 4.7 (1M context) * ci: bump codex review model from gpt-5.4 to gpt-5.5 gpt-5.5 is positioned as the agentic successor to gpt-5.4 — same per-token latency, fewer tokens to complete Codex tasks, and explicitly stronger at holding context across large systems and multi-tool reasoning, which matches the PR review workload. Co-Authored-By: Claude Opus 4.7 (1M context) --------- Co-authored-by: Claude Opus 4.7 (1M context) --- .github/workflows/codex-pr-review.yml | 4 ++-- .github/workflows/pi-pr-review.yml | 32 ++++++++++++++++++++++++++- 2 files changed, 33 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codex-pr-review.yml b/.github/workflows/codex-pr-review.yml index f40f86ca2c..1a3e968272 100644 --- a/.github/workflows/codex-pr-review.yml +++ b/.github/workflows/codex-pr-review.yml @@ -237,9 +237,9 @@ jobs: run: | codex exec \ -C "$GITHUB_WORKSPACE" \ - -m gpt-5.4 \ + -m gpt-5.5 \ -c 'model_reasoning_effort="xhigh"' \ - -s read-only \ + -s danger-full-access \ -o codex-final-message.md \ - < .github/codex/pr-review.prompt.md diff --git a/.github/workflows/pi-pr-review.yml b/.github/workflows/pi-pr-review.yml index 04cf8a20ca..eba8c2bad3 100644 --- a/.github/workflows/pi-pr-review.yml +++ b/.github/workflows/pi-pr-review.yml @@ -222,12 +222,42 @@ jobs: DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }} PI_SKIP_VERSION_CHECK: '1' run: | + set -o pipefail pi -p \ --provider deepseek \ --model deepseek-v4-pro \ --tools read,grep,find,ls,bash \ + --mode json \ < .github/pi/pr-review.prompt.md \ - > pi-final-message.md + | tee pi-events.jsonl \ + | jq -rc --unbuffered ' + if .type == "agent_start" then "🤖 pi agent started" + elif .type == "turn_start" then "── turn ──" + elif .type == "message_end" then + "[\(.message.role)] " + ( + (.message.content // []) + | map( + if .type == "text" then "text(\(.text | length)c)" + elif .type == "tool_use" then "🔧 \(.name) \(.input | @json | .[:160])" + elif .type == "tool_result" then "✅ result" + else .type + end + ) + | join(" | ") + ) + elif .type == "turn_end" then "── turn done (\((.toolResults // []) | length) tool result(s)) ──" + elif .type == "agent_end" then "🏁 pi agent done" + else empty + end + ' + + jq -r ' + select(.type == "agent_end") + | .messages + | map(select(.role == "assistant")) + | last + | (.content[]? | select(.type == "text") | .text) + ' pi-events.jsonl > pi-final-message.md - name: Post Pi review comment if: steps.pi_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'