Repository navigation
ci(codex): add advisory Codex PR review (VGTR-2539) - #25
Conversation
Every pull request gets an independent Codex review posted as a PR comment, the same pattern as noise, gatorStats and rpc-proxy. Advisory: it never fails the check. Supports the SOC 2 CC8.1 change-review control. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JUoXFndo5sMNwUGUnjevrj
🤖 Codex ReviewNo findings. |
persist-credentials: false left the private-repo fetch unauthenticated, so the Codex review failed before it ran. Matches the noise workflow. The job token is contents: read only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JUoXFndo5sMNwUGUnjevrj
🤖 Codex ReviewNo findings. |
The review comment is posted with issues.createComment, which needs only issues: write. Addresses the Codex review Low finding. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JUoXFndo5sMNwUGUnjevrj
|
Heads-up: I'm merging this for the SOC 2 audit window (closes 2 Nov) so this repo's PRs carry a recorded independent review. It's the same advisory Codex review that noise and gatorStats already run: it posts a comment and never blocks a merge. Happy to revert or adjust if you'd like it different. |
…2539) Commenting on a pull request with only issues: write returns 403 (Resource not accessible by integration), so the post_feedback job needs pull-requests: write. Reverts the previous commit's permission change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JUoXFndo5sMNwUGUnjevrj
🤖 Codex ReviewLow: .github/workflows/codex-review.yml:57: |
…VGTR-2539) Records why the comment job keeps both issues: write and pull-requests: write (issues: write alone returned 403) and why the pull_request secret exposure is an accepted risk (write access already grants secret access; forks are excluded; only the two principals have user write access). Addresses the Codex review findings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JUoXFndo5sMNwUGUnjevrj
🤖 Codex ReviewHigh: .github/workflows/codex-review.yml:54: The job passes the OpenAI key while running the PR merge commit’s editable workflow and prompt, allowing a same-repository PR to direct Codex to expose the key; run the secret-bearing job only on trusted code or use an isolated, scoped credential. |
|
Accepted risk, documented in the workflow header. In GitHub Actions, write access already grants access to repository secrets (any branch push can run a workflow that reads them), so this trigger adds no exposure. Fork PRs are excluded by the head-repo guard, and the only user accounts with write access are the two principals. Hardening across all Codex workflows (a scoped key or a trusted-workflow design) is tracked in VGTR-2539. |
Why
Our SOC 2 Type II auditor tests that each production code change has an independent review. This repository is one of five without the Codex reviewer, so its PRs show no recorded review (VGTR-2539).
What
.github/workflows/codex-review.yml: runs Codex on each non-draft PR from this repository and posts the result as a PR comment. Advisory only (no fail step). Actions pinned to the same commit SHAs as noise; fork PRs and Dependabot are skipped..github/codex-review-prompt.md: a short repo-specific rubric (bugs, security, operational risk; no style comments;No findings.when clean).OPENAI_API_KEYrepository secret is already set (same key as ai-dan), so the review runs on this PR itself.🤖 Generated with Claude Code
https://claude.ai/code/session_01JUoXFndo5sMNwUGUnjevrj