Codex Audit #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Codex Audit | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| source_repo: | |
| description: "Repository that owns the monthly review issue" | |
| required: true | |
| default: "QuantStrategyLab/CryptoLivePoolPipelines" | |
| issue_number: | |
| description: "Monthly review issue number in source_repo" | |
| required: true | |
| source_ref: | |
| description: "Source repository branch to audit" | |
| required: false | |
| default: "main" | |
| mode: | |
| description: "Run mode" | |
| required: false | |
| type: choice | |
| default: "review_and_fix" | |
| options: | |
| - review_only | |
| - review_and_fix | |
| provider: | |
| description: "Audit provider" | |
| required: false | |
| type: choice | |
| default: "auto" | |
| options: | |
| - auto | |
| - api | |
| - anthropic | |
| - codex | |
| - openai | |
| task: | |
| description: "Codex bridge task" | |
| required: false | |
| type: choice | |
| default: "monthly_snapshot_audit" | |
| options: | |
| - monthly_snapshot_audit | |
| - long_horizon_signal_shadow | |
| auto_merge: | |
| description: "Request guarded source-repository auto-merge for generated PRs" | |
| required: false | |
| type: boolean | |
| default: false | |
| repository_dispatch: | |
| types: | |
| - monthly-review-created | |
| permissions: | |
| contents: read | |
| id-token: write | |
| concurrency: | |
| group: codex-audit-${{ github.event.client_payload.source_repo || inputs.source_repo }}-${{ github.event.client_payload.issue_number || inputs.issue_number }} | |
| cancel-in-progress: true | |
| jobs: | |
| codex-audit: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" | |
| SOURCE_REPO: ${{ github.event.client_payload.source_repo || inputs.source_repo || 'QuantStrategyLab/CryptoLivePoolPipelines' }} | |
| ISSUE_NUMBER: ${{ github.event.client_payload.issue_number || inputs.issue_number }} | |
| SOURCE_REF: ${{ github.event.client_payload.source_ref || inputs.source_ref || 'main' }} | |
| CODEX_AUDIT_MODE: ${{ github.event.client_payload.mode || inputs.mode || 'review_and_fix' }} | |
| CODEX_AUDIT_PROVIDER: ${{ github.event.client_payload.provider || inputs.provider || 'auto' }} | |
| CODEX_AUDIT_CODEX_BACKEND: service | |
| CODEX_AUDIT_TASK: ${{ github.event.client_payload.task || inputs.task || 'monthly_snapshot_audit' }} | |
| CODEX_AUDIT_AUTO_MERGE: ${{ github.event.client_payload.auto_merge || inputs.auto_merge || 'false' }} | |
| steps: | |
| - name: Checkout Bridge | |
| uses: actions/checkout@v6.0.3 | |
| - name: Detect GitHub App Credentials | |
| id: app_credentials | |
| env: | |
| APP_ID: ${{ vars.CROSS_REPO_GITHUB_APP_ID }} | |
| APP_PRIVATE_KEY: ${{ secrets.CROSS_REPO_GITHUB_APP_PRIVATE_KEY }} | |
| run: | | |
| set -euo pipefail | |
| if [ -n "${APP_ID:-}" ] && [ -n "${APP_PRIVATE_KEY:-}" ]; then | |
| echo "available=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "available=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Resolve Source Repository Name | |
| id: source_repo | |
| run: | | |
| set -euo pipefail | |
| repository="${SOURCE_REPO#*/}" | |
| if [ -z "${repository}" ] || [ "${repository}" = "${SOURCE_REPO}" ]; then | |
| echo "Invalid SOURCE_REPO: ${SOURCE_REPO}" >&2 | |
| exit 1 | |
| fi | |
| echo "repository=${repository}" >> "$GITHUB_OUTPUT" | |
| - name: Create GitHub App Token For Source Repository | |
| id: source_app_token | |
| if: steps.app_credentials.outputs.available == 'true' | |
| continue-on-error: true | |
| uses: actions/create-github-app-token@v3.2.0 | |
| with: | |
| app-id: ${{ vars.CROSS_REPO_GITHUB_APP_ID }} | |
| private-key: ${{ secrets.CROSS_REPO_GITHUB_APP_PRIVATE_KEY }} | |
| owner: ${{ github.repository_owner }} | |
| repositories: ${{ steps.source_repo.outputs.repository }} | |
| permission-contents: write | |
| permission-issues: write | |
| permission-pull-requests: write | |
| - name: Run Codex Audit | |
| env: | |
| CODEX_AUDIT_GH_TOKEN: ${{ steps.source_app_token.outputs.token || secrets.CODEX_AUDIT_GH_TOKEN }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} | |
| OPENAI_MODEL: ${{ vars.OPENAI_MODEL || 'gpt-5.4-mini' }} | |
| ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} | |
| ANTHROPIC_MODEL: ${{ vars.ANTHROPIC_MODEL || 'claude-sonnet-4-6' }} | |
| CODEX_AUDIT_API_FALLBACK_ALLOWED_SOURCE_REPOSITORIES: ${{ vars.CODEX_AUDIT_API_FALLBACK_ALLOWED_SOURCE_REPOSITORIES }} | |
| CODEX_AUDIT_API_FALLBACK_ALLOW_FIX: ${{ vars.CODEX_AUDIT_API_FALLBACK_ALLOW_FIX || 'true' }} | |
| CODEX_AUDIT_API_FALLBACK_PROVIDER_ORDER: ${{ vars.CODEX_AUDIT_API_FALLBACK_PROVIDER_ORDER || 'openai,anthropic' }} | |
| CODEX_AUDIT_SERVICE_URL: ${{ secrets.CODEX_AUDIT_SERVICE_URL }} | |
| CODEX_AUDIT_SERVICE_AUDIENCE: ${{ vars.CODEX_AUDIT_SERVICE_AUDIENCE || 'quant-codex-audit' }} | |
| run: python scripts/run_monthly_codex_audit.py |