[DO NOT MERGE] Preview custom-code reporting with a new mixed file

.castiron.stats.yml

@@ -4,3 +4,5 @@ openapi_spec_hash: dd725fb7d43ceec7fb2de6f8713d14b6
 openapi_transformed_spec_hash: 10930179c5f116288e24e0c6fda46559
 config_hash: 85382dd94c503b5d225adc7636a77c9f
 codegen_sha: 6e990f52e3cbdeaae602710a1b0f2a2c944a5c35
+codegen_hash: f041a41892c7d3be7fb000e512a610e43ef265e8422e3030d36861f17b9fe515
+public_codegen_sha: 98c2f501bcbf0ad04cdf54f11aafff44dc275d6f

.github/workflows/castiron-custom-code.yml

@@ -0,0 +1,105 @@
+name: Castiron custom code
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+
+# These experimental refs are restricted to trusted SDK maintainers.
+# The workflow definition is trusted because its branch writers are trusted.
+concurrency:
+  group: castiron-custom-code-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+env:
+  REPORTER_SHA256: 03959d3f381df9459075ecd72004cb034d132866664a2154e3ed760dabb4e4cc
+
+jobs:
+  report:
+    name: Castiron / baseline consistency
+    if: github.event.pull_request.head.repo.full_name == github.repository && contains(fromJSON(vars.CASTIRON_CUSTOM_CODE_BRANCHES || '[]'), github.event.pull_request.head.ref)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out the protected test branch
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+
+      - name: Verify the reviewed reporter
+        run: printf '%s  %s\n' "$REPORTER_SHA256" scripts/castiron/custom_code_report.py | sha256sum --check --strict
+
+      - name: Test hash mismatch and snapshot isolation
+        run: python3 scripts/castiron/test_custom_code_report.py
+
+      - name: Validate the codegen hash and report custom code
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PUBLIC_REPOSITORY: ${{ !github.event.repository.private }}
+        run: |
+          git fetch --quiet --no-tags origin "$BASE_SHA" "$HEAD_SHA"
+          mode=()
+          if [[ "$PUBLIC_REPOSITORY" == true ]]; then mode=(--public); fi
+          python3 -I scripts/castiron/custom_code_report.py report \
+            --base "$BASE_SHA" --head "$HEAD_SHA" \
+            --fetch --require-head-hash "${mode[@]}" \
+            --out "$RUNNER_TEMP/castiron-custom-code"
+
+      - name: Add the report to the run summary
+        if: always()
+        run: |
+          if test -f "$RUNNER_TEMP/castiron-custom-code/summary.md"; then
+            cat "$RUNNER_TEMP/castiron-custom-code/summary.md" >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - name: Upload report and current custom-code patch
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: castiron-custom-code-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/castiron-custom-code/
+          if-no-files-found: error
+          retention-days: 7
+
+  comment:
+    name: Update custom-code comment
+    needs: report
+    if: always() && !cancelled() && needs.report.result != 'skipped'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: read
+      pull-requests: write
+    steps:
+      - name: Check out the protected test branch
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
+
+      - name: Verify the reviewed publisher before execution
+        run: printf '%s  %s\n' "$REPORTER_SHA256" scripts/castiron/custom_code_report.py | sha256sum --check --strict
+
+      - name: Download this run's report
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: castiron-custom-code-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/castiron-custom-code
+
+      - name: Create or update the single report comment
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          RUN_ID: ${{ github.run_id }}
+          RUN_ATTEMPT: ${{ github.run_attempt }}
+        run: |
+          python3 -I scripts/castiron/custom_code_report.py comment \
+            --report "$RUNNER_TEMP/castiron-custom-code/report.json" \
+            --repository "$REPOSITORY" --pr "$PR_NUMBER" --run-id "$RUN_ID" \
+            --run-attempt "$RUN_ATTEMPT"

scripts/castiron/README.md

@@ -0,0 +1,22 @@
+# Castiron custom-code reporting
+
+DO NOT MERGE: draft workflow experiment. This manually vendored reporter uses
+Python, Git, and `gh`; it does not execute SDK code.
+
+Run `python3 scripts/castiron/test_custom_code_report.py` for focused tests.
+Use the report comment’s expander to download the exact custom patch or reproduce
+it from pinned revisions. A public checkout uses `report --public` and resolves
+only public codegen snapshots. It never needs access to another repository.
+
+The hash format is specified in the reporter’s module docstring. It covers Git
+paths, modes, and blob bytes, excluding `.github/actions/` and
+`.github/workflows/`. The head must record a matching `codegen_hash`. Older base
+revisions can use the verified snapshot lineage with a legacy notice.
+
+The experimental workflow is limited to explicitly protected maintainer-owned
+branches listed in the repository variable `CASTIRON_CUSTOM_CODE_BRANCHES`
+(a JSON array). Its workflow definition is trusted because those branch writers and
+ruleset administrators are trusted. Before execution, both jobs verify the
+reporter’s reviewed SHA-256. This content pin is defense in depth, not a
+substitute for the branch restrictions. General contributor/fork support needs
+a publisher defined on a trusted default branch.