From 41a54c8b3d9d0fa5cbb2595e75284a546224fd25 Mon Sep 17 00:00:00 2001 From: Pigbibi <20649888+Pigbibi@users.noreply.github.com> Date: Fri, 10 Jul 2026 20:25:32 +0800 Subject: [PATCH 1/2] ci: add Codex review gate Co-Authored-By: Codex --- .github/workflows/codex_pr_review.yml | 30 +++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 .github/workflows/codex_pr_review.yml diff --git a/.github/workflows/codex_pr_review.yml b/.github/workflows/codex_pr_review.yml new file mode 100644 index 0000000..037717e --- /dev/null +++ b/.github/workflows/codex_pr_review.yml @@ -0,0 +1,30 @@ +name: Codex PR Review + +on: + pull_request_target: + types: [opened, synchronize, reopened] + +permissions: + contents: read + id-token: write + issues: write + pull-requests: write + +concurrency: + group: codex-pr-review-${{ github.event.pull_request.number }} + cancel-in-progress: true + +jobs: + review: + uses: QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@main + with: + caller_concurrency_key: pr-${{ github.event.pull_request.number || github.run_id }} + allow_unconfigured_backend: false + api_fallback_enabled: "false" + direct_api_primary_enabled: "false" + secrets: inherit + permissions: + contents: read + id-token: write + issues: write + pull-requests: write From a27c0a45c9c2ce854ae60666836be5bb19d9dbe4 Mon Sep 17 00:00:00 2001 From: Pigbibi <20649888+Pigbibi@users.noreply.github.com> Date: Fri, 10 Jul 2026 21:25:12 +0800 Subject: [PATCH 2/2] fix(ci): minimize reusable review secrets Co-Authored-By: Codex --- .github/workflows/codex_pr_review.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codex_pr_review.yml b/.github/workflows/codex_pr_review.yml index 037717e..7ebfe30 100644 --- a/.github/workflows/codex_pr_review.yml +++ b/.github/workflows/codex_pr_review.yml @@ -22,7 +22,8 @@ jobs: allow_unconfigured_backend: false api_fallback_enabled: "false" direct_api_primary_enabled: "false" - secrets: inherit + secrets: + CODEX_AUDIT_SERVICE_URL: ${{ secrets.CODEX_AUDIT_SERVICE_URL }} permissions: contents: read id-token: write