fix: validate Codex action runtime contract

[loadinglucian]

Summary

• Correct all consumer Codex Action bot allowlist inputs.
• Load phase configuration through canonical config.toml.
• Pin Codex CLI 0.145.0 and enforce the reviewed action/runtime contract offline.
• Protect the contract and validator from routine maintenance edits.

Verification

• scripts/test.sh
• Unsupported-target behavior remains explicit
• Release selection and checksum behavior are covered by tests
• The php-bin release contract remains compatible
• Cross-repository A00-A20 verifier passed: sha256:607d0384bfabc339d50f419ee15b40331f14acb54ee8d398690b8cd78f7199f2
• Paired php-bin commit: 13979e6999f05895afd1d7181bc0c54fa141297f

Security

• Downloads still require an exact SHA-256 entry
• No credentials, generated fixtures, or install directories are committed
• Codex Action, CLI, bot allowlist, and config-loading inputs are validated before maintenance tests run

[coderabbitai]

📝 Walkthrough

Walkthrough

The change adds an offline Codex Action contract, aligns three maintenance workflow invocations with it, validates all pinned invocations before tests, and protects and documents the new contract and validator paths.

Changes

Codex Action contract validation

Layer / File(s)	Summary
Contract and workflow alignment .github/codex-action-contract.json, .github/workflows/maintenance-consumer.yml	Defines allowed inputs, security constraints, the required Codex version, and invocation count; updates investigation, implementation, and repair steps to use canonical config files and explicit bot permissions.
Offline invocation validator scripts/validate-codex-action-inputs	Parses workflow YAML, validates pinned action inputs and invocation counts against the contract, and supports summary or JSON output.
Test and repository enforcement scripts/test.sh, maintenance/protected-paths.json, test/test_maintenance.py, .github/CODEOWNERS, README.md	Runs validation before tests, protects the new paths, extends protected-path coverage, assigns ownership, and documents the validation checks.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant TestScript
  participant Validator
  participant Contract
  participant WorkflowFiles
  participant RubyYAMLParser
  TestScript->>Validator: run validation
  Validator->>Contract: load contract
  Validator->>WorkflowFiles: scan Codex Action invocations
  Validator->>RubyYAMLParser: parse workflow YAML
  RubyYAMLParser-->>Validator: return workflow data
  Validator-->>TestScript: return success or failure

Loading

Possibly related PRs

• Bigpixelrocket/mise-php#8: Extends the same protected-path admission checks and maintenance test coverage.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise and clearly reflects the main change: validating the Codex action runtime contract.
Description check	✅ Passed	The description follows the template and covers Summary, Verification, and Security with the required items completed.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/codex-action-input-contract

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

scripts/validate-codex-action-inputs (1)

94-95: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

--profile check misses compact flag form.

"--profile" in parsed_args only catches the flag as a separate list item. A single joined arg like "--profile=repair" would bypass this and reintroduce the named-profile drift the canonical config-copy convention is meant to prevent.

♻️ Proposed fix to catch compact profile flags

-                if "--profile" in parsed_args:
+                if any(item == "--profile" or item.startswith("--profile=") for item in parsed_args):
                     raise ValueError(f"{location} selects an undefined named profile")

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/validate-codex-action-inputs` around lines 94 - 95, Update the
profile validation around the parsed_args check to reject both the standalone
"--profile" argument and compact "--profile=<name>" arguments. Preserve
the existing ValueError message and location context for either form.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@scripts/validate-codex-action-inputs`:
- Around line 94-95: Update the profile validation around the parsed_args check
to reject both the standalone "--profile" argument and compact
"--profile=<name>" arguments. Preserve the existing ValueError message and
location context for either form.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 67c2d8c6-50ff-46e4-b475-c6997992ae64

📥 Commits

Reviewing files that changed from the base of the PR and between 8c1ebeb and 9aa9118.

📒 Files selected for processing (8)

• .github/CODEOWNERS
• .github/codex-action-contract.json
• .github/workflows/maintenance-consumer.yml
• README.md
• maintenance/protected-paths.json
• scripts/test.sh
• scripts/validate-codex-action-inputs
• test/test_maintenance.py