ci: allow Codex review for contributors with access via GH team

[jakeaturner]

No description provided.

[github-actions]

No actionable issues found in the PR’s changes to .github/workflows/codex-review.yml. The gate checks effective repository permissions, preserves the same-repository restriction, and fails explicitly on unexpected API errors.

Validation was limited to static review; the workflow was not executed.

[Copilot]

Copilot review overview

🟡 Changes recommended

Custom repository roles may be rejected, and the gate unnecessarily receives write access.

Review effort: Balanced
Findings: 2

Open (2)

• Use read-only token permission for repository metadata check · New
• Check effective permission instead of custom role name · New

What changed in this PR

Adds team-derived repository permission checks before running Codex reviews.

Changes:

• Adds an authorization gate for same-repository PRs.
• Runs Codex only when the author has sufficient access.

File	Description
.github/​workflows/​codex-review.yml	Adds the permission gate and connects it to the Codex job.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟢 Approval recommended

The gate safely handles permission lookup failures and restricts secret-bearing review runs to authorized same-repository contributors.

Review effort: Balanced
Findings: None

Resolved since last review (2)

• Check effective permission instead of custom role name
• Use read-only token permission for repository metadata check

[libretexts-bot]

🎉 This PR is included in version 2.154.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀