Repository navigation
feat(action)!: prepare hosted runners and require completed PR checks - #1580
Conversation
github-actions
Bot
added
the
breaking-change
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
Security findingsBlocking findings (1)
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
d207baa to
442b3b5
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 442b3b5881
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
🛡️ Codex Security Review · Automatically triggered
Here are some automated security review suggestions for this pull request.
Reviewed commit: 442b3b5881
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
…ing-pr-1580-refresh
|
@codex review |
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
🔵 Needs a closer look
It combines breaking enforcement behavior with privileged runner configuration and credential-boundary changes requiring final human review.
0 open findings
What changed in this PR
Prepares hosted Ubuntu runners automatically and makes configured severity enforcement require complete reviews.
Changes:
- Provisions and verifies the sandbox before credential-bearing scans.
- Fails incomplete enforced scans while preserving reports and artifact links.
- Adds canonical repository/PR workflows with a required review gate.
| File | Description |
|---|---|
action.yml |
Updates public input/output behavior. |
.github/workflows/action-ci.yml |
Exercises automatic sandbox setup. |
github-action/src/runtime.ts |
Provisions and probes the sandbox. |
github-action/src/main.ts |
Enforces completeness and links artifacts. |
github-action/src/inputs.ts |
Rejects enforcement during dry runs. |
github-action/src/reporting.ts |
Describes enforcement and report links. |
github-action/src/artifacts.ts |
Returns uploaded artifact IDs. |
github-action/scripts/linux-smoke.mjs |
Verifies the real sandbox probe. |
github-action/scripts/generate-input-docs.mjs |
Generates workflow examples. |
github-action/scripts/cli-integration.ts |
Validates example configurations. |
github-action/examples/repository.yml |
Adds the canonical repository workflow. |
github-action/examples/pull-request.yml |
Adds the required PR review workflow. |
github-action/README.md |
Documents new behavior and examples. |
github-action/dist/index.cjs |
Updates the shipped Action bundle. |
github-action/tests/runtime.test.ts |
Tests provisioning and preflight. |
github-action/tests/main.test.ts |
Tests enforcement and artifact links. |
github-action/tests/reporting.test.ts |
Tests incomplete-scan messaging. |
github-action/tests/inputs.test.ts |
Tests dry-run restrictions. |
github-action/tests/input-docs.test.ts |
Tests workflow generation. |
github-action/tests/examples.test.ts |
Tests the required-review gate. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
@codex review |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
alandelong-oai
left a comment
alandelong-oai
left a comment
There was a problem hiding this comment.
Thanks for the runner preparation and required-check updates. Current-head merge-safety review of 5ccb66845b57d45f463fd467ad8fa5537bbf406c found no new material issue. The existing README model correction remains a nonblocking suggestion; I have not repeated it inline.
Fresh validation passed all 195 Action tests, types, metadata/docs checks and byte-exact distribution reproduction. I reviewed the rebased provider, repository-origin and patched artifact-upload integration. Sandbox setup/probe code and the pinned runtime are unchanged from the previously verified hosted run; no new privileged runner provisioning or live model scan was performed locally.
alandelong-oai
left a comment
alandelong-oai
left a comment
There was a problem hiding this comment.
Thanks for tightening the runner setup and required-check contract. Reviewed all 20 changed files at 6870d26; the sandbox probe runs before scan credentials are supplied, and the required job accepts only a completed scan or a verified empty diff. The earlier model-description mismatch is fixed.
Fresh validation on Node 24 passed all 195 tests, typechecking, metadata/docs checks, and the generated-bundle comparison. No actionable issue found. Privileged hosted-runner provisioning and the pinned CLI integration were not rerun locally; their inputs match the previously validated hosted version.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7657cf0519
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
alandelong-oai
left a comment
alandelong-oai
left a comment
There was a problem hiding this comment.
Thanks for tightening hosted runner preparation and the required PR check. Reviewed all 21 changed files and their current integration; no remaining actionable issue. Base retargets trigger a scan, title/body edits preserve the substantive check, and the documented merge-queue limitation is clear. Sandbox setup and its probe run before scan credentials are supplied.
Fresh validation passed all 204 Action tests, types, metadata/docs checks, workflow linting and byte-exact bundle reproduction. Current hosted CI separately passed actual Ubuntu sandbox preparation, the shipped sandbox probe, dry-run/post cleanup and pinned CLI compatibility. No live provider scan or privileged local provisioning was performed.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8bb135153c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
alandelong-oai
left a comment
alandelong-oai
left a comment
There was a problem hiding this comment.
Thanks for tightening the preflight and setup flow. The installed CLI configuration is checked before provisioning, ordinary provider/configuration errors do not trigger apt, and the required PR gate still distinguishes completed scans from skipped work. No material issue found.
Fresh validation passed all 211 Action tests, types, metadata/docs checks, byte-exact bundle reproduction, formatting and configured workflow linting. Current hosted CI also passed the matching Action tree, published CLI integration, packaged sandbox/dry-run smoke and cleanup.
The existing needrestart discussion remains a nonblocking setup-efficiency follow-up: the historical log shows a roughly 90-second recoverable PHP restart timeout, while CI preconfigures its exemption. I did not establish an apt failure or indefinite hang.
alandelong-oai
left a comment
alandelong-oai
left a comment
There was a problem hiding this comment.
Thanks for tightening the standalone runner setup and PR-check behavior. I completed an owner-level merge-safety review of all 24 changed files at deb147e38c020f91d6af598ff88501b67f3e2bd9; no material unresolved findings.
The required-check example intentionally qualifies its event snapshot. Trusted workflow provenance and merge-time requalification remain separate prerequisites, as documented. The dry-run/severity compatibility change is explicit, and the temporary needrestart workaround now belongs to the Action itself.
Fresh local validation passed 143 selected functional/workflow tests, types, metadata/docs checks, byte-exact bundles, actionlint and ShellCheck. Current hosted CI passed all 222 Action tests, packaged smoke and pinned CLI integration on an exact-tree merge; separate smoke steps checked out this exact head and passed automatic Ubuntu setup, sandbox startup, both credential-free provider configurations and cleanup. I did not run the full suite or privileged setup locally, and no live model/provider call was performed.
Summary
Prepare GitHub-hosted Ubuntu runners for Codex Security scans and make the pull-request check require a completed scan or a verified empty diff for its event snapshot.
Changes
fail-on-severity: nonefor dry runs. The required-check example rejects dry runs, failed or cancelled scans, and skipped scan jobs; verified empty diffs remain successful no-ops.Testing
Final commit
deb147e3changes only the Action README. Documentation checks and all 31 example tests pass. Executable source, tests, workflows, generated files, and dependency metadata match qualified parent322d369e, where the following passed:github-action:npm run buildandnpm run validate— 222 tests, TypeScript, metadata/docs checks, and generated distribution parity passed.npm run test:cli— integration against the locked published CLI passed with synthetic inputs and no external model calls, including sandbox readiness and filesystem enforcement.Hosted checks for
deb147e3, including the Ubuntu 24.04 sandbox-setup smoke test, remain pending.Risk and rollout
This changes dry-run compatibility: configurations combining a dry run with severity enforcement must set
fail-on-severity: none. Automatic sandbox setup modifies packages and the AppArmor profile on supported GitHub-hosted Ubuntu virtual machines. Self-hosted runners and job containers need a working sandbox beforehand.The example verifies its event snapshot. Repositories requiring a scan of the current merge diff must separately enforce trusted workflow provenance and a merge-time gate that requalifies whenever the live base changes, including after this check completes. A same-head status check and strict up-to-date requirement alone do not establish that freshness; CODEOWNERS alone does not establish workflow provenance. The example targets repositories without merge queues;
merge_groupis unsupported. Fork contributions need an approved scan path before the required check can succeed.Release the Action with its matching CLI through the coordinated release workflow.
Public disclosure review