Skip to content

ci: add Codex review gate #121

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Pigbibi merged 1 commit into from
Jul 10, 2026
Merged

ci: add Codex review gate #121

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 30 additions & 0 deletions .github/workflows/codex_pr_review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
name: Codex PR Review

on:
pull_request_target:
types: [opened, synchronize, reopened]

permissions:
contents: read
id-token: write
issues: write
pull-requests: write

concurrency:
group: codex-pr-review-${{ github.event.pull_request.number }}
cancel-in-progress: true

jobs:
review:
uses: QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@main

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Pin the reusable workflow ref

Using @main means every PR-targeted run immediately executes whatever version of the external AIAuditBridge workflow is currently on that branch, with this job's write permissions and OIDC access. If that branch is force-pushed, regressed, or compromised, this repository's PR review gate changes behavior without any change here; pinning the reusable workflow to a reviewed commit SHA or immutable release tag keeps updates deliberate.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Gate the same-repo-only wrapper off for forks

The called AIAuditBridge workflow currently exits with an error when github.event.pull_request.head.repo.full_name != github.repository, but this new pull_request_target caller runs for forked PRs too. In this public repository, every fork PR will therefore get a failing Codex PR Review check before any review runs, which blocks those contributions whenever the gate is required; add a same-repo if guard or provide a fork-safe review path.

Useful? React with 👍 / 👎.

with:
caller_concurrency_key: pr-${{ github.event.pull_request.number || github.run_id }}
allow_unconfigured_backend: false
api_fallback_enabled: "false"
direct_api_primary_enabled: "false"
secrets: inherit

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Pass only the audit secrets this PR check needs

Because this workflow runs on pull_request_target, every PR run uses the base repository's credential context; secrets: inherit then makes all repository/org secrets available to the reusable workflow, not just the audit-service secret or token it needs. In repositories that also store deployment/API credentials, this unnecessarily exposes those secrets to the AIAuditBridge workflow on every opened or synchronized PR even though the direct API fallback inputs are disabled above. Please map only the specific secrets required by the review wrapper instead of inheriting the full secret set.

Useful? React with 👍 / 👎.

permissions:
contents: read
id-token: write
issues: write
pull-requests: write
Loading