refactor(ci): share container Compose smoke checks

[mldangelo-oai]

Summary

Container validation and release repeat the same Compose smoke script. Source one shared helper so both workflows exercise the same version and empty-input checks.

Changes

• Extract the existing Bash smoke body and keep both callers' image environment bindings.
• Select workflow quality checks when the helper changes and run ShellCheck on the extracted script.
• Add the helper-selection scenario and combine identical container-validation selector arms.

Testing

Passed on commit 51685f52aa05:

• From the repository root: pnpm --dir sdk/typescript run build:ci — passed.
• From sdk/typescript: pnpm run build:plugin, pnpm run types, and pnpm run format — passed.
• From sdk/typescript: bun test --timeout 30000 --seed 12345 tests-ts/workflow-quality.test.ts tests-ts/container-ci-workflow.test.ts tests-ts/release-automation.test.ts tests-ts/skeleton.test.ts — 324 passed, 0 failed.
• Workflow checks: SHELLCHECK_OPTS=--severity=warning actionlint -color, SHELLCHECK_OPTS=--severity=warning shellcheck docker/verify-container-compose.sh, and zizmor --offline --strict-collection --min-severity medium --format github --config .github/zizmor.yml .github — passed.
• From sdk/typescript: pnpm run test --seed 12345 — 3,566 passed, 53 skipped, 0 failed.
• From sdk/typescript: pnpm run test — 3,566 passed, 53 skipped, 0 failed; randomized seed 2056951882.

Three independent Codex reviews and separate verification completed without findings.

Risk and rollout

The existing shell options, directory permissions, user mapping, expected exit status and diagnostic check are retained. Workflow permissions, release dependencies and image selection are unchanged. The local workflow checks are static checks; actual Compose execution remains for container CI.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-04T21:30:00.366273Z	51685f5	Manual request
🔒 Security Review	✅ Completed 2026-10-04T21:29:15.480639Z	51685f5	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

@codex review the current head SHA.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 51685f52aa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Copilot review overview

🟢 Approval recommended

The extraction preserves the existing checks and caller settings, with no unresolved findings.

Review effort: Balanced
Findings: None

What changed in this PR

Shares the Compose smoke checks between container validation and release while preserving existing behavior and image selection.

Changes:

• Extracts the duplicated smoke script into a shared Bash helper.
• Adds ShellCheck and workflow-quality selection for helper changes.
• Tests helper selection and combines equivalent container-validation selector branches.

File	Description
sdk/​typescript/​tests-ts/​workflow-quality.test.ts	Tests workflow-quality selection for helper changes.
docker/​verify-container-compose.sh	Holds shared version and empty-input checks.
.github/​workflows/​workflow-quality.yml	Runs ShellCheck on the helper.
.github/​workflows/​node-ci.yml	Updates quality selection and consolidates validation branches.
.github/​workflows/​container-validate.yml	Sources the helper with the validation image.
.github/​workflows/​container-release.yml	Sources the helper with the release candidate image.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[alandelong-oai]

Reviewed the actual PR diff at 51685f52aa0547e7ff33892e064380f0d7e02755 against explicit base 1fb0e5fbf8684c926cac2a36d08389b212d28d5a with three independent HIGH full-diff passes and root synthesis, including every changed test and fixture. No supported introduced issue was identified.

Read all141 actual diff lines including the changed workflow test and shared Compose script; the extracted sourced Bash body preserves prior commands and callers. Touched workflow checkout, environment and ShellCheck installation support the refactor. Workflows, containers and tests were not executed.

Static source review only; no local tests, builds, release operations or models were run. Source approval does not establish current CI, integration or deployment.