Repository navigation
fix(ci): use an explicit browser demo dependency - #4185
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Castiron custom codeEvaluated main: Trusted main policy: ✅ No new custom-code files detected. 0 mixed files remain; 0 existing customizations changed. Compared A changed generated baseline means this report cannot reliably identify which handwritten lines changed. Inspect the custom-code diffDownload the exact patch produced by this run (requires repository access): gh run download 40420699510 --repo openai/openai-python \
--name castiron-custom-code-40420699510-1 --dir /tmp/castiron-custom-code-40420699510-1
git apply --stat /tmp/castiron-custom-code-40420699510-1/custom-code.patch
cat /tmp/castiron-custom-code-40420699510-1/custom-code.patchOr reproduce it from an SDK checkout containing the vendored reporter: git fetch --no-tags origin 06dbb5d019d7b6870b5898bf5df579ca60b61d28 5aa0852ee2dbcca00dcdced3bab432a2e21ab80c
python3 scripts/castiron/custom_code_report.py report \
--base 06dbb5d019d7b6870b5898bf5df579ca60b61d28 \
--head 5aa0852ee2dbcca00dcdced3bab432a2e21ab80c --target-branch main --fetch --require-head-hash --public \
--out /tmp/castiron-custom-code-5aa0852ee2db
cat /tmp/castiron-custom-code-5aa0852ee2db/custom-code.patchThis is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 08c09a692a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if isinstance(entry, str): | ||
| result.append(entry) | ||
| elif isinstance(entry, dict) and set(entry) == {"include-group"} and isinstance(entry["include-group"], str): | ||
| result.extend(dependency_group_requirements(project, entry["include-group"], (*active, key))) |
There was a problem hiding this comment.
A valid acyclic include graph can expand exponentially here because every path recursively materializes another list, while active only detects cycles. For example, a small layered diamond where each group includes two groups from the preceding layer doubles the copied requirements per layer; roughly 30 layers can make the security check consume gigabytes or hang CI before validation completes. Memoize or traverse into bounded sets/contexts, and enforce an explicit work/output limit as the marker-expansion code does.
Useful? React with 👍 / 👎.
marcuswood-oai
changed the title
jbeckwith-oai
left a comment
jbeckwith-oai
left a comment
There was a problem hiding this comment.
Reviewed the final one-line change at 5aa0852. The explicit browser-demo requirement matches provider-browser and the existing uv.lock metadata, while avoiding the security checker’s string-only parsing failure. The earlier recursive resolver and its expansion concern are absent from this revision. No actionable findings. Static review only; no local code or tests ran. Hosted lock freshness, Python policy, browser-demo types, and Castiron checks have passed; other hosted checks are still running.
markstuart-oai
left a comment
markstuart-oai
left a comment
There was a problem hiding this comment.
Reviewed 5aa0852ee2dbcca00dcdced3bab432a2e21ab80c. The explicit browser-demo pin matches provider-browser and the existing lock metadata. It also fits the security checker's string-only dependency parser. No blocking findings in this one-line change.
Source-only review; no candidate tests or installs ran here. Hosted CI and the required human SDK CODEOWNER review remain separate gates.
Automated Release PR --- ## [3.40.0](openai/openai-python@v3.39.0...v3.40.0) (2026-10-27) ### Features * **api:** add prompt cache breakpoint TTL options ([openai#4188](openai#4188)) ([3596d18](openai@3596d18)) ### Bug Fixes * **ci:** use an explicit browser demo dependency ([openai#4185](openai#4185)) ([a3f4302](openai@a3f4302)) ### Chores * **api:** record completed generated-code separation ([openai#4190](openai#4190)) ([d7ab5ee](openai@d7ab5ee)) * **deps-dev:** bump griffe from 1.14.0 to 2.3.0 ([openai#4069](openai#4069)) ([766b849](openai@766b849)) * **deps:** bump actions/create-github-app-token from 3.2.0 to 3.3.0 ([openai#4178](openai#4178)) ([06dbb5d](openai@06dbb5d)) * **deps:** bump actions/download-artifact from 8.0.1 to 8.0.2 ([openai#4110](openai#4110)) ([2404d04](openai@2404d04)) * **deps:** bump actions/upload-artifact from 7.0.1 to 7.0.2 ([openai#4107](openai#4107)) ([0adf711](openai@0adf711)) * **deps:** bump github/codeql-action/analyze from 4.38.2 to 4.39.0 ([openai#4177](openai#4177)) ([1e42321](openai@1e42321)) * **deps:** bump openai/codex-action from 1.12 to 1.13 ([openai#4070](openai#4070)) ([904ed3f](openai@904ed3f)) * update generated-code verification and preserve SDK helpers ([openai#4186](openai#4186)) ([9412200](openai@9412200)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: openai-sdks[bot] <284451331+openai-sdks[bot]@users.noreply.github.com>
The security-update checker on main expects dependency-group entries to be requirement strings and crashes on the browser-demo group's include-group entry, blocking #4127.
Replace that alias with
playwright==1.63.0, the exact requirement already declared by provider-browser. The final change is one line in pyproject.toml. Package versions, the resolved dependency graph, and uv.lock remain unchanged.Validation: Python policy check, focused dependency-policy tests, and CI. This must land on main first because #4127's security gate executes the checker from the immutable base commit.