ci: add Codex review gate - #121
Conversation
Co-Authored-By: Codex <noreply@openai.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 43ddd79b26
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| allow_unconfigured_backend: false | ||
| api_fallback_enabled: "false" | ||
| direct_api_primary_enabled: "false" | ||
| secrets: inherit |
There was a problem hiding this comment.
Because this workflow runs on pull_request_target, every PR run uses the base repository's credential context; secrets: inherit then makes all repository/org secrets available to the reusable workflow, not just the audit-service secret or token it needs. In repositories that also store deployment/API credentials, this unnecessarily exposes those secrets to the AIAuditBridge workflow on every opened or synchronized PR even though the direct API fallback inputs are disabled above. Please map only the specific secrets required by the review wrapper instead of inheriting the full secret set.
Useful? React with 👍 / 👎.
|
|
||
| jobs: | ||
| review: | ||
| uses: QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@main |
There was a problem hiding this comment.
Using @main means every PR-targeted run immediately executes whatever version of the external AIAuditBridge workflow is currently on that branch, with this job's write permissions and OIDC access. If that branch is force-pushed, regressed, or compromised, this repository's PR review gate changes behavior without any change here; pinning the reusable workflow to a reviewed commit SHA or immutable release tag keeps updates deliberate.
Useful? React with 👍 / 👎.
|
|
||
| jobs: | ||
| review: | ||
| uses: QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@main |
There was a problem hiding this comment.
The called AIAuditBridge workflow currently exits with an error when github.event.pull_request.head.repo.full_name != github.repository, but this new pull_request_target caller runs for forked PRs too. In this public repository, every fork PR will therefore get a failing Codex PR Review check before any review runs, which blocks those contributions whenever the gate is required; add a same-repo if guard or provide a fork-safe review path.
Useful? React with 👍 / 👎.
1 participant
Add the organization-standard reusable Codex review wrapper. It runs from the trusted base branch with OIDC and both API fallback paths explicitly disabled; it does not execute PR head content.\n\nValidation:
actionlint .github/workflows/codex_pr_review.yml;git diff --check.