codex_audit.yml

name: Codex Audit

on:
  workflow_dispatch:
    inputs:
      source_repo:
        description: "Repository that owns the monthly review issue"
        required: true
        default: "QuantStrategyLab/CryptoLivePoolPipelines"
      issue_number:
        description: "Monthly review issue number in source_repo"
        required: true
      source_ref:
        description: "Source repository branch to audit"
        required: false
        default: "main"
      mode:
        description: "Run mode"
        required: false
        type: choice
        default: "review_and_fix"
        options:
          - review_only
          - review_and_fix
      provider:
        description: "Audit provider"
        required: false
        type: choice
        default: "task_default"
        options:
          - task_default
          - auto
          - api
          - anthropic
          - codex
          - openai
      task:
        description: "Codex bridge task"
        required: false
        type: choice
        default: "monthly_snapshot_audit"
        options:
          - monthly_snapshot_audit
          - long_horizon_signal_shadow
      auto_merge:
        description: "Request guarded source-repository auto-merge for generated PRs"
        required: false
        type: boolean
        default: false
  repository_dispatch:
    types:
      - monthly-review-created

permissions:
  contents: read
  id-token: write

concurrency:
  group: codex-audit-${{ github.event.client_payload.source_repo || inputs.source_repo }}-${{ github.event.client_payload.issue_number || inputs.issue_number }}
  cancel-in-progress: true

jobs:
  codex-audit:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    env:
      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
      SOURCE_REPO: ${{ github.event.client_payload.source_repo || inputs.source_repo || 'QuantStrategyLab/CryptoLivePoolPipelines' }}
      ISSUE_NUMBER: ${{ github.event.client_payload.issue_number || inputs.issue_number }}
      SOURCE_REF: ${{ github.event.client_payload.source_ref || inputs.source_ref || 'main' }}
      CODEX_AUDIT_MODE: ${{ github.event.client_payload.mode || inputs.mode || 'review_and_fix' }}
      CODEX_AUDIT_PROVIDER: ${{ github.event.client_payload.provider || inputs.provider || 'task_default' }}
      CODEX_AUDIT_CODEX_BACKEND: service
      CODEX_AUDIT_TASK: ${{ github.event.client_payload.task || inputs.task || 'monthly_snapshot_audit' }}
      CODEX_AUDIT_AUTO_MERGE: ${{ github.event.client_payload.auto_merge || inputs.auto_merge || 'false' }}
    steps:
      - name: Checkout Bridge
        uses: actions/checkout@v6.0.3

      - name: Detect GitHub App Credentials
        id: app_credentials
        env:
          APP_ID: ${{ vars.CROSS_REPO_GITHUB_APP_ID }}
          APP_PRIVATE_KEY: ${{ secrets.CROSS_REPO_GITHUB_APP_PRIVATE_KEY }}
        run: |
          set -euo pipefail
          if [ -n "${APP_ID:-}" ] && [ -n "${APP_PRIVATE_KEY:-}" ]; then
            echo "available=true" >> "$GITHUB_OUTPUT"
          else
            echo "available=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Resolve Source Repository Name
        id: source_repo
        run: |
          set -euo pipefail
          repository="${SOURCE_REPO#*/}"
          if [ -z "${repository}" ] || [ "${repository}" = "${SOURCE_REPO}" ]; then
            echo "Invalid SOURCE_REPO: ${SOURCE_REPO}" >&2
            exit 1
          fi
          echo "repository=${repository}" >> "$GITHUB_OUTPUT"

      - name: Create GitHub App Token For Source Repository
        id: source_app_token
        if: steps.app_credentials.outputs.available == 'true'
        continue-on-error: true
        uses: actions/create-github-app-token@v3.2.0
        with:
          app-id: ${{ vars.CROSS_REPO_GITHUB_APP_ID }}
          private-key: ${{ secrets.CROSS_REPO_GITHUB_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: ${{ steps.source_repo.outputs.repository }}
          permission-contents: write
          permission-issues: write
          permission-pull-requests: write

      - name: Run Codex Audit
        env:
          CODEX_AUDIT_GH_TOKEN: ${{ steps.source_app_token.outputs.token || secrets.CODEX_AUDIT_GH_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          OPENAI_MODEL: ${{ vars.OPENAI_MODEL || 'gpt-5.4-mini' }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          ANTHROPIC_MODEL: ${{ vars.ANTHROPIC_MODEL || 'claude-sonnet-4-6' }}
          CODEX_AUDIT_API_FALLBACK_ALLOWED_SOURCE_REPOSITORIES: ${{ vars.CODEX_AUDIT_API_FALLBACK_ALLOWED_SOURCE_REPOSITORIES }}
          CODEX_AUDIT_API_FALLBACK_ALLOW_FIX: ${{ vars.CODEX_AUDIT_API_FALLBACK_ALLOW_FIX || 'true' }}
          CODEX_AUDIT_API_FALLBACK_PROVIDER_ORDER: ${{ vars.CODEX_AUDIT_API_FALLBACK_PROVIDER_ORDER || 'openai,anthropic' }}
          CODEX_AUDIT_SERVICE_URL: ${{ secrets.CODEX_AUDIT_SERVICE_URL }}
          CODEX_AUDIT_SERVICE_AUDIENCE: ${{ vars.CODEX_AUDIT_SERVICE_AUDIENCE || 'quant-codex-audit' }}
        run: python scripts/run_monthly_codex_audit.py