From f5e2f0ef88f88fb64b4ff9c56ec1b40904d2634c Mon Sep 17 00:00:00 2001 From: cody-valigator Date: Wed, 28 Oct 2026 10:18:19 +0000 Subject: [PATCH 1/5] ci(codex): add advisory Codex PR review (VGTR-2539) Every pull request gets an independent Codex review posted as a PR comment, the same pattern as noise, gatorStats and rpc-proxy. Advisory: it never fails the check. Supports the SOC 2 CC8.1 change-review control. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01JUoXFndo5sMNwUGUnjevrj --- .github/codex-review-prompt.md | 28 ++++++++++++ .github/workflows/codex-review.yml | 72 ++++++++++++++++++++++++++++++ 2 files changed, 100 insertions(+) create mode 100644 .github/codex-review-prompt.md create mode 100644 .github/workflows/codex-review.yml diff --git a/.github/codex-review-prompt.md b/.github/codex-review-prompt.md new file mode 100644 index 0000000..5ad29bb --- /dev/null +++ b/.github/codex-review-prompt.md @@ -0,0 +1,28 @@ +# Code Review Guidelines + +valigatorHealthCheck is a Bash system health-check and diagnostics toolkit for Valigator's Linux validator servers, with an Ansible deployment playbook. + +Review ONLY the changes in this pull request: the diff between the base branch +and the pull request head (`git diff origin/...HEAD`). Do not comment on +unchanged code. + +Read enough of the repository to review against its real conventions (the +README, any CLAUDE.md, and the files the change touches) before commenting. + +## What to look for + +- Bugs and logic errors: wrong conditions, unhandled failures, broken paths or + references, behaviour that does not match the change's evident intent. +- Security: secrets, tokens or keys committed in the diff; command injection or + unquoted variables in shell; unsafe use of `eval`, `sudo` or `rm`; disabled + TLS verification; overly broad permissions in workflow files. +- Operational risk: changes that could break a production host, service or + scheduled job, or remove a safety check. + +Do not comment on style, formatting or wording. + +## Output format + +List each finding on its own line as `Severity: path:line: issue and suggested +fix`, where Severity is Critical, High, Medium or Low. If there are no findings, +reply with the single line `No findings.` diff --git a/.github/workflows/codex-review.yml b/.github/workflows/codex-review.yml new file mode 100644 index 0000000..7211c14 --- /dev/null +++ b/.github/workflows/codex-review.yml @@ -0,0 +1,72 @@ +# Codex PR Review: an independent AI review of every pull request, posted as a +# PR comment. Advisory: it does not fail the check on findings. Added under +# VGTR-2539 so each change to this repository carries a recorded independent +# review (SOC 2 CC8.1 change-review control). Same pattern as the Codex review +# in noise, gatorStats and rpc-proxy. Third-party actions pinned to commit SHAs. +name: Codex PR Review + +on: + pull_request: + types: [opened, synchronize, reopened, ready_for_review] + +concurrency: + group: codex-review-${{ github.event.pull_request.number }} + cancel-in-progress: true + +jobs: + codex: + if: >- + github.actor != 'dependabot[bot]' + && github.event.pull_request.head.repo.full_name == github.repository + && github.event.pull_request.draft == false + runs-on: ubuntu-latest + permissions: + contents: read + outputs: + final_message: ${{ steps.run_codex.outputs.final-message }} + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: refs/pull/${{ github.event.pull_request.number }}/merge + fetch-depth: 0 + persist-credentials: false + + - name: Pre-fetch base and head refs + env: + BASE_REF: ${{ github.event.pull_request.base.ref }} + PR_NUMBER: ${{ github.event.pull_request.number }} + run: | + git fetch --no-tags origin \ + "$BASE_REF" \ + "+refs/pull/${PR_NUMBER}/head" + + - name: Run Codex + id: run_codex + uses: openai/codex-action@52fe01ec70a42f454c9d2ebd47598f9fd6893d56 # v1.11 + with: + openai-api-key: ${{ secrets.OPENAI_API_KEY }} + model: gpt-6-luna + prompt-file: .github/codex-review-prompt.md + codex-home: ${{ runner.temp }}/codex-home + + post_feedback: + runs-on: ubuntu-latest + needs: codex + if: needs.codex.outputs.final_message != '' + permissions: + issues: write + pull-requests: write + steps: + - name: Post review comment + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + CODEX_FINAL_MESSAGE: ${{ needs.codex.outputs.final_message }} + with: + github-token: ${{ github.token }} + script: | + await github.rest.issues.createComment({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: context.payload.pull_request.number, + body: `## 🤖 Codex Review\n\n${process.env.CODEX_FINAL_MESSAGE}`, + }); From 60c3f06dad7ffd75a55ab58001dc397cb200d9c3 Mon Sep 17 00:00:00 2001 From: cody-valigator Date: Wed, 28 Oct 2026 10:23:33 +0000 Subject: [PATCH 2/5] ci(codex): keep checkout credentials for the base-ref fetch (VGTR-2539) persist-credentials: false left the private-repo fetch unauthenticated, so the Codex review failed before it ran. Matches the noise workflow. The job token is contents: read only. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01JUoXFndo5sMNwUGUnjevrj --- .github/workflows/codex-review.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/codex-review.yml b/.github/workflows/codex-review.yml index 7211c14..1cfae01 100644 --- a/.github/workflows/codex-review.yml +++ b/.github/workflows/codex-review.yml @@ -29,7 +29,6 @@ jobs: with: ref: refs/pull/${{ github.event.pull_request.number }}/merge fetch-depth: 0 - persist-credentials: false - name: Pre-fetch base and head refs env: From f8263e6428016b61709562e00e56d18f21f4ee00 Mon Sep 17 00:00:00 2001 From: cody-valigator Date: Wed, 28 Oct 2026 10:31:52 +0000 Subject: [PATCH 3/5] ci(codex): drop unneeded pull-requests: write (VGTR-2539) The review comment is posted with issues.createComment, which needs only issues: write. Addresses the Codex review Low finding. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01JUoXFndo5sMNwUGUnjevrj --- .github/workflows/codex-review.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/codex-review.yml b/.github/workflows/codex-review.yml index 1cfae01..f4c25c7 100644 --- a/.github/workflows/codex-review.yml +++ b/.github/workflows/codex-review.yml @@ -54,7 +54,6 @@ jobs: if: needs.codex.outputs.final_message != '' permissions: issues: write - pull-requests: write steps: - name: Post review comment uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 From 5982e6f6425bd9d4217b4819ccc6a54e5645ae8d Mon Sep 17 00:00:00 2001 From: cody-valigator Date: Wed, 28 Oct 2026 10:37:13 +0000 Subject: [PATCH 4/5] ci(codex): restore pull-requests: write for the review comment (VGTR-2539) Commenting on a pull request with only issues: write returns 403 (Resource not accessible by integration), so the post_feedback job needs pull-requests: write. Reverts the previous commit's permission change. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01JUoXFndo5sMNwUGUnjevrj --- .github/workflows/codex-review.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/codex-review.yml b/.github/workflows/codex-review.yml index f4c25c7..1cfae01 100644 --- a/.github/workflows/codex-review.yml +++ b/.github/workflows/codex-review.yml @@ -54,6 +54,7 @@ jobs: if: needs.codex.outputs.final_message != '' permissions: issues: write + pull-requests: write steps: - name: Post review comment uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 From 7f654bf447e67f3775b5616069b69f4b91e73e49 Mon Sep 17 00:00:00 2001 From: cody-valigator Date: Wed, 28 Oct 2026 10:50:08 +0000 Subject: [PATCH 5/5] ci(codex): document the review permissions and secret-exposure risk (VGTR-2539) Records why the comment job keeps both issues: write and pull-requests: write (issues: write alone returned 403) and why the pull_request secret exposure is an accepted risk (write access already grants secret access; forks are excluded; only the two principals have user write access). Addresses the Codex review findings. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01JUoXFndo5sMNwUGUnjevrj --- .github/workflows/codex-review.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/codex-review.yml b/.github/workflows/codex-review.yml index 1cfae01..1380426 100644 --- a/.github/workflows/codex-review.yml +++ b/.github/workflows/codex-review.yml @@ -3,6 +3,14 @@ # VGTR-2539 so each change to this repository carries a recorded independent # review (SOC 2 CC8.1 change-review control). Same pattern as the Codex review # in noise, gatorStats and rpc-proxy. Third-party actions pinned to commit SHAs. +# +# Secret exposure (accepted risk): pull_request runs the workflow from the PR +# merge commit, so a same-repository PR could edit this file to read +# OPENAI_API_KEY. That grants nothing new: anyone with write access can already +# read repository secrets by pushing a workflow on any branch. Fork PRs are +# excluded by the head.repo guard, and the only user accounts with write access +# are the two principals. The control is write-access governance, not this +# workflow. name: Codex PR Review on: @@ -52,6 +60,10 @@ jobs: runs-on: ubuntu-latest needs: codex if: needs.codex.outputs.final_message != '' + # Both permissions are kept on purpose. With issues: write alone the PR + # comment returned 403 "Resource not accessible by integration" (verified + # 2026-10-28); this pair is the configuration verified to post the comment. + # The job runs no PR code and holds no other secret. permissions: issues: write pull-requests: write