chore: clean up argument-comment lint and roll out all-target CI on macOS (#16054)

## Why

`argument-comment-lint` was green in CI even though the repo still had
many uncommented literal arguments. The main gap was target coverage:
the repo wrapper did not force Cargo to inspect test-only call sites, so
examples like the `latest_session_lookup_params(true, ...)` tests in
`codex-rs/tui_app_server/src/lib.rs` never entered the blocking CI path.

This change cleans up the existing backlog, makes the default repo lint
path cover all Cargo targets, and starts rolling that stricter CI
enforcement out on the platform where it is currently validated.

## What changed

- mechanically fixed existing `argument-comment-lint` violations across
the `codex-rs` workspace, including tests, examples, and benches
- updated `tools/argument-comment-lint/run-prebuilt-linter.sh` and
`tools/argument-comment-lint/run.sh` so non-`--fix` runs default to
`--all-targets` unless the caller explicitly narrows the target set
- fixed both wrappers so forwarded cargo arguments after `--` are
preserved with a single separator
- documented the new default behavior in
`tools/argument-comment-lint/README.md`
- updated `rust-ci` so the macOS lint lane keeps the plain wrapper
invocation and therefore enforces `--all-targets`, while Linux and
Windows temporarily pass `-- --lib --bins`

That temporary CI split keeps the stricter all-targets check where it is
already cleaned up, while leaving room to finish the remaining Linux-
and Windows-specific target-gated cleanup before enabling
`--all-targets` on those runners. The Linux and Windows failures on the
intermediate revision were caused by the wrapper forwarding bug, not by
additional lint findings in those lanes.

## Validation

- `bash -n tools/argument-comment-lint/run.sh`
- `bash -n tools/argument-comment-lint/run-prebuilt-linter.sh`
- shell-level wrapper forwarding check for `-- --lib --bins`
- shell-level wrapper forwarding check for `-- --tests`
- `just argument-comment-lint`
- `cargo test` in `tools/argument-comment-lint`
- `cargo test -p codex-terminal-detection`

## Follow-up

- Clean up remaining Linux-only target-gated callsites, then switch the
Linux lint lane back to the plain wrapper invocation.
- Clean up remaining Windows-only target-gated callsites, then switch
the Windows lint lane back to the plain wrapper invocation.
This commit is contained in:
Michael Bolin authored and GitHub committed 2026-03-27 19:00:44 -07:00
1 parent ed977b42ac
commit 61dfe0b86c
307 files changed
+7724 -4710

No files matched your search

+88 -31
View File
@@ -33,7 +33,7 @@ async fn refresh_without_id_token() {
);
let updated = super::persist_tokens(
&storage,
None,
/*id_token*/ None,
Some("new-access-token".to_string()),
Some("new-refresh-token".to_string()),
)
@@ -97,9 +97,13 @@ async fn pro_account_with_no_api_key_uses_chatgpt_auth() {
)
.expect("failed to write auth file");
let auth = super::load_auth(codex_home.path(), false, AuthCredentialsStoreMode::File)
.unwrap()
.unwrap();
let auth = super::load_auth(
codex_home.path(),
/*enable_codex_api_key_env*/ false,
AuthCredentialsStoreMode::File,
)
.unwrap()
.unwrap();
assert_eq!(None, auth.api_key());
assert_eq!(crate::AuthMode::Chatgpt, auth.auth_mode());
assert_eq!(auth.get_chatgpt_user_id().as_deref(), Some("user-12345"));
@@ -144,9 +148,13 @@ async fn loads_api_key_from_auth_json() {
)
.unwrap();
let auth = super::load_auth(dir.path(), false, AuthCredentialsStoreMode::File)
.unwrap()
.unwrap();
let auth = super::load_auth(
dir.path(),
/*enable_codex_api_key_env*/ false,
AuthCredentialsStoreMode::File,
)
.unwrap()
.unwrap();
assert_eq!(auth.auth_mode(), crate::AuthMode::ApiKey);
assert_eq!(auth.api_key(), Some("sk-test-key"));
@@ -175,7 +183,7 @@ fn unauthorized_recovery_reports_mode_and_step_names() {
let dir = tempdir().unwrap();
let manager = AuthManager::shared(
dir.path().to_path_buf(),
false,
/*enable_codex_api_key_env*/ false,
AuthCredentialsStoreMode::File,
);
let managed = UnauthorizedRecovery {
@@ -210,9 +218,13 @@ fn refresh_failure_is_scoped_to_the_matching_auth_snapshot() {
)
.expect("failed to write auth file");
let auth = super::load_auth(codex_home.path(), false, AuthCredentialsStoreMode::File)
.expect("load auth")
.expect("auth available");
let auth = super::load_auth(
codex_home.path(),
/*enable_codex_api_key_env*/ false,
AuthCredentialsStoreMode::File,
)
.expect("load auth")
.expect("auth available");
let mut updated_auth_dot_json = auth
.get_current_auth_json()
.expect("AuthDotJson should exist");
@@ -347,7 +359,12 @@ async fn enforce_login_restrictions_logs_out_for_method_mismatch() {
login_with_api_key(codex_home.path(), "sk-test", AuthCredentialsStoreMode::File)
.expect("seed api key");
let config = build_config(codex_home.path(), Some(ForcedLoginMethod::Chatgpt), None).await;
let config = build_config(
codex_home.path(),
Some(ForcedLoginMethod::Chatgpt),
/*forced_chatgpt_workspace_id*/ None,
)
.await;
let err =
super::enforce_login_restrictions(&config).expect_err("expected method mismatch to error");
@@ -372,7 +389,12 @@ async fn enforce_login_restrictions_logs_out_for_workspace_mismatch() {
)
.expect("failed to write auth file");
let config = build_config(codex_home.path(), None, Some("org_mine".to_string())).await;
let config = build_config(
codex_home.path(),
/*forced_login_method*/ None,
Some("org_mine".to_string()),
)
.await;
let err = super::enforce_login_restrictions(&config)
.expect_err("expected workspace mismatch to error");
@@ -397,7 +419,12 @@ async fn enforce_login_restrictions_allows_matching_workspace() {
)
.expect("failed to write auth file");
let config = build_config(codex_home.path(), None, Some("org_mine".to_string())).await;
let config = build_config(
codex_home.path(),
/*forced_login_method*/ None,
Some("org_mine".to_string()),
)
.await;
super::enforce_login_restrictions(&config).expect("matching workspace should succeed");
assert!(
@@ -413,7 +440,12 @@ async fn enforce_login_restrictions_allows_api_key_if_login_method_not_set_but_f
login_with_api_key(codex_home.path(), "sk-test", AuthCredentialsStoreMode::File)
.expect("seed api key");
let config = build_config(codex_home.path(), None, Some("org_mine".to_string())).await;
let config = build_config(
codex_home.path(),
/*forced_login_method*/ None,
Some("org_mine".to_string()),
)
.await;
super::enforce_login_restrictions(&config).expect("matching workspace should succeed");
assert!(
@@ -428,7 +460,12 @@ async fn enforce_login_restrictions_blocks_env_api_key_when_chatgpt_required() {
let _guard = EnvVarGuard::set(CODEX_API_KEY_ENV_VAR, "sk-env");
let codex_home = tempdir().unwrap();
let config = build_config(codex_home.path(), Some(ForcedLoginMethod::Chatgpt), None).await;
let config = build_config(
codex_home.path(),
Some(ForcedLoginMethod::Chatgpt),
/*forced_chatgpt_workspace_id*/ None,
)
.await;
let err = super::enforce_login_restrictions(&config)
.expect_err("environment API key should not satisfy forced ChatGPT login");
@@ -451,9 +488,13 @@ fn plan_type_maps_known_plan() {
)
.expect("failed to write auth file");
let auth = super::load_auth(codex_home.path(), false, AuthCredentialsStoreMode::File)
.expect("load auth")
.expect("auth available");
let auth = super::load_auth(
codex_home.path(),
/*enable_codex_api_key_env*/ false,
AuthCredentialsStoreMode::File,
)
.expect("load auth")
.expect("auth available");
pretty_assertions::assert_eq!(auth.account_plan_type(), Some(AccountPlanType::Pro));
}
@@ -471,9 +512,13 @@ fn plan_type_maps_self_serve_business_usage_based_plan() {
)
.expect("failed to write auth file");
let auth = super::load_auth(codex_home.path(), false, AuthCredentialsStoreMode::File)
.expect("load auth")
.expect("auth available");
let auth = super::load_auth(
codex_home.path(),
/*enable_codex_api_key_env*/ false,
AuthCredentialsStoreMode::File,
)
.expect("load auth")
.expect("auth available");
pretty_assertions::assert_eq!(
auth.account_plan_type(),
@@ -494,9 +539,13 @@ fn plan_type_maps_enterprise_cbp_usage_based_plan() {
)
.expect("failed to write auth file");
let auth = super::load_auth(codex_home.path(), false, AuthCredentialsStoreMode::File)
.expect("load auth")
.expect("auth available");
let auth = super::load_auth(
codex_home.path(),
/*enable_codex_api_key_env*/ false,
AuthCredentialsStoreMode::File,
)
.expect("load auth")
.expect("auth available");
pretty_assertions::assert_eq!(
auth.account_plan_type(),
@@ -517,9 +566,13 @@ fn plan_type_maps_unknown_to_unknown() {
)
.expect("failed to write auth file");
let auth = super::load_auth(codex_home.path(), false, AuthCredentialsStoreMode::File)
.expect("load auth")
.expect("auth available");
let auth = super::load_auth(
codex_home.path(),
/*enable_codex_api_key_env*/ false,
AuthCredentialsStoreMode::File,
)
.expect("load auth")
.expect("auth available");
pretty_assertions::assert_eq!(auth.account_plan_type(), Some(AccountPlanType::Unknown));
}
@@ -537,9 +590,13 @@ fn missing_plan_type_maps_to_unknown() {
)
.expect("failed to write auth file");
let auth = super::load_auth(codex_home.path(), false, AuthCredentialsStoreMode::File)
.expect("load auth")
.expect("auth available");
let auth = super::load_auth(
codex_home.path(),
/*enable_codex_api_key_env*/ false,
AuthCredentialsStoreMode::File,
)
.expect("load auth")
.expect("auth available");
pretty_assertions::assert_eq!(auth.account_plan_type(), Some(AccountPlanType::Unknown));
}
@@ -85,7 +85,7 @@ async fn test_create_client_sets_default_headers() {
.expect("residency header missing");
assert_eq!(residency_header.to_str().unwrap(), "us");
set_default_client_residency_requirement(None);
set_default_client_residency_requirement(/*enforce_residency*/ None);
}
#[test]