feat(codex): disable analytics in generated runs#27427
Conversation
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/d6b3bde3-c2a8-418d-944b-73c948531eb1 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds a default Codex CLI override to disable analytics for generated workflow runs, with supporting tests and documentation updates.
Changes:
- Add
-c analytics.enabled=falseto the Codex execution command generated byCodexEngine. - Add a unit test asserting analytics are disabled by default.
- Update engine reference docs and multiple locked workflow fixtures to include the analytics-disable flag.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/codex_engine.go | Appends -c analytics.enabled=false to the generated codex exec command. |
| pkg/workflow/codex_engine_test.go | Adds test coverage ensuring the analytics-disable flag is present by default. |
| docs/src/content/docs/reference/engines.md | Documents that Codex analytics are disabled by default in workflow runs. |
| .github/workflows/smoke-codex.lock.yml | Updates Codex invocations in smoke workflow to include analytics-disable flag. |
| .github/workflows/smoke-call-workflow.lock.yml | Updates Codex invocations to include analytics-disable flag. |
| .github/workflows/schema-feature-coverage.lock.yml | Updates Codex invocations to include analytics-disable flag. |
| .github/workflows/issue-arborist.lock.yml | Updates Codex invocations to include analytics-disable flag. |
| .github/workflows/grumpy-reviewer.lock.yml | Updates Codex invocations to include analytics-disable flag. |
| .github/workflows/duplicate-code-detector.lock.yml | Updates Codex invocations to include analytics-disable flag. |
| .github/workflows/daily-observability-report.lock.yml | Updates Codex invocations to include analytics-disable flag. |
| .github/workflows/daily-fact.lock.yml | Updates Codex invocations to include analytics-disable flag. |
| .github/workflows/codex-github-remote-mcp-test.lock.yml | Updates Codex invocation to include analytics-disable flag. |
| .github/workflows/changeset.lock.yml | Updates Codex invocation to include analytics-disable flag. |
| .github/workflows/ai-moderator.lock.yml | Updates Codex invocation to include analytics-disable flag. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 14/14 changed files
- Comments generated: 1
| # shellcheck disable=SC1003 | ||
| sudo -E awf --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" --env-all --exclude-env CODEX_API_KEY --exclude-env GH_AW_GH_TOKEN --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --exclude-env OPENAI_API_KEY --allow-domains '*.githubusercontent.com,172.30.0.1,api.openai.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,cdn.playwright.dev,codeload.github.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,docs.github.com,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.blog,github.com,github.githubassets.com,go.dev,golang.org,goproxy.io,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,lfs.github.com,objects.githubusercontent.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,openai.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,pkg.go.dev,playwright.download.prss.microsoft.com,ppa.launchpad.net,proxy.golang.org,raw.githubusercontent.com,s.symcb.com,s.symcd.com,security.ubuntu.com,storage.googleapis.com,sum.golang.org,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com' --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --allow-host-ports 80,443,8080 --image-tag 0.25.25 --skip-pull --enable-api-proxy \ | ||
| -- /bin/bash -c 'export PATH="$(find /opt/hostedtoolcache -maxdepth 4 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true && INSTRUCTION="$(cat /tmp/gh-aw/aw-prompts/prompt.txt)" && codex ${GH_AW_MODEL_AGENT_CODEX:+-c model="$GH_AW_MODEL_AGENT_CODEX" }exec -c web_search="disabled" --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check "$INSTRUCTION"' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log | ||
| -- /bin/bash -c 'export PATH="$(find /opt/hostedtoolcache -maxdepth 4 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true && INSTRUCTION="$(cat /tmp/gh-aw/aw-prompts/prompt.txt)" && codex ${GH_AW_MODEL_AGENT_CODEX:+-c model="$GH_AW_MODEL_AGENT_CODEX" }exec -c web_search="disabled" -c analytics.enabled=false --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check "$INSTRUCTION"' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log |
There was a problem hiding this comment.
Good observation! The smoke workflow currently doesn't disable fetch, while the CodexEngine does so by default when web-fetch is not declared. Adding -c fetch="disabled" here would keep the smoke workflow consistent with engine defaults and reduce network surface area.
📰 BREAKING: Report filed by Smoke Copilot · ● 1.6M
🧪 Test Quality Sentinel ReportTest Quality Score: 60/100
Test Classification Details
Flagged Tests — Requires Review
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Test Quality Sentinel: 60/100. Test quality is acceptable — 0% of new tests are implementation tests (threshold: 30%). TestCodexEngineAnalytics correctly enforces the behavioral contract that analytics is disabled by default in Codex workflow runs. Minor suggestion: add edge-case coverage to reach a higher score.
|
|
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
|
🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation... |
|
|
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
|
Hey The contribution checks all look good:
This PR looks ready for maintainer review! 🟢
|
Agent Container Tool Check
Result: 12/12 tools available ✅ — PASS
|
|
Smoke Test §24690506196: ✅ PASS
All 13 tests passed. PR author:
|
There was a problem hiding this comment.
This PR correctly adds -c analytics.enabled=false to Codex execution commands and includes a new test. Two minor suggestions: define the flag as a named constant, and add an argument-order assertion to the test. Overall a clean, well-tested change.
📰 BREAKING: Report filed by Smoke Copilot · ● 1.6M
| // Disable Codex analytics by default for workflow runs. | ||
| // Codex config schema supports [analytics] enabled = false, which maps to | ||
| // -c analytics.enabled=false for CLI overrides. | ||
| analyticsParam := " -c analytics.enabled=false" |
There was a problem hiding this comment.
The analytics flag is hardcoded as a constant string here. Consider defining this as a named constant (e.g., codexAnalyticsDisabledFlag = " -c analytics.enabled=false") to make it easier to update if the Codex CLI flag syntax changes in the future.
| }) | ||
| } | ||
|
|
||
| func TestCodexEngineAnalytics(t *testing.T) { |
There was a problem hiding this comment.
Good test coverage for the analytics flag. Consider also adding a test case that verifies the analytics flag appears before fullAutoParam in the command string, since argument ordering matters for the Codex CLI and the fmt.Sprintf format string reflects a specific order.
|
Smoke Test 24690506212 — Claude Engine ✅ PARTIAL PASS
|
There was a problem hiding this comment.
💥 Automated smoke test review - all systems nominal! This PR correctly adds -c analytics.enabled=false consistently across all affected workflow lock files.
💥 [THE END] — Illustrated by Smoke Claude · ● 201.7K
| @@ -774,7 +774,7 @@ jobs: | |||
| (umask 177 && touch /tmp/gh-aw/agent-stdio.log) | |||
There was a problem hiding this comment.
✅ Smoke test review comment #1 — The -c analytics.enabled=false flag addition looks correct and consistent with the PR's intent to disable Codex analytics in generated runs.
| @@ -793,7 +793,7 @@ jobs: | |||
| (umask 177 && touch /tmp/gh-aw/agent-stdio.log) | |||
There was a problem hiding this comment.
✅ Smoke test review comment #2 — The analytics flag is consistently applied here too. Good cross-workflow consistency.
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
-cconfig flags are assembledmake agent-finishpre-commit validation and capture existing unrelated failures✨ PR Review Safe Output Test - Run 24690506212