Repository navigation
Validate published KEMHarbor source alpha independently - #1
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ddc7c08161
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| test ! -e .env | ||
| test ! -e secrets/mullvad_wg_private_key | ||
| test ! -e .github/workflows/publish-private.yml | ||
| git diff --check |
There was a problem hiding this comment.
On both push and pull-request runs, actions/checkout leaves the index and working tree matching the checked-out revision, so this no-argument command examines an empty working-tree-to-index diff and cannot detect whitespace errors or conflict markers introduced by the commit. The Git documentation confirms that the no-argument form shows unstaged changes relative to the index; pass the relevant commit range instead so malformed committed lines fail CI.
Useful? React with 👍 / 👎.
Add a minimal public read-only GitHub Actions workflow that validates shell syntax, checks source-only boundaries, checks the Docker Compose file with synthetic placeholders, builds the exact public source image while verifying its upstream binary at build time, tests expected runtime dependencies, and confirms startup refuses absent VPN configuration. No runtime source changes, no GHCR push, no credentials, no release artifacts. This provides an independent public-repository CI check for future reviewed changes; it is not a substitute for authenticated VPN security testing.