🤖 Codex PR Review

🚫 Merge blocked: 1 serious issue(s) found in high-risk files

🚫 Blocking Issues

These issues must be fixed before this PR can be merged:

1. 🟠 [HIGH] Logic in scripts/run_codex_pr_review.py

publish_retryable_review_failure constructs the decision payload with blocked=False and blocking_findings=[], then calls publish_review_decision with exit_code=1. Any downstream workflow step or artifact consumer that reads decision.json or the blocked GitHub step output will see blocked=false and zero blocking findings, and may proceed to merge. The review_completed=False flag is intended to signal this state, but existing workflow consumers that key on blocked (the primary gate output, written by write_decision_outputs) will not observe the failure. The call path is directly reachable from main() for every ReviewError raised by the backend or parser. (line 1100)

Suggestion: Set blocked=True in the retryable-failure decision payload so the primary blocked step output correctly prevents merge when the review did not complete. Alternatively, document and enforce that all workflow gates must check review_completed before inspecting blocked, and add a test asserting decision['blocked'] is True on retryable failure.

ℹ️ Other Findings

1. 🟡 [MEDIUM] Reliability in scripts/run_codex_pr_review.py

After this PR removes all use of the prior review comment (streak, fingerprint, history), find_existing_review_comment is still called unconditionally in main() (the call is retained; only the parsing of its return value was removed). This performs an authenticated GitHub API request whose result previous_comment is immediately discarded. The call can raise ReviewError, which under the old code was caught and handled — but with the new code the exception would propagate uncaught out of main(), producing an unhandled exception and a non-zero exit without posting a PR comment or writing decision outputs. (line 1166)

Suggestion: Remove the find_existing_review_comment call entirely from main() since its return value is no longer consumed. The upsert_pr_comment path already handles comment creation vs. update internally.

Review by Codex PR Review bot • PR