From c7b875ff398614bc05c63704b9af4ee20de9cb0d Mon Sep 17 00:00:00 2001 From: Pigbibi <20649888+Pigbibi@users.noreply.github.com> Date: Fri, 10 Jul 2026 20:24:38 +0800 Subject: [PATCH 1/2] ci: harden Codex review workflow Co-Authored-By: Codex --- .github/workflows/codex_pr_review.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codex_pr_review.yml b/.github/workflows/codex_pr_review.yml index 5f80923..037717e 100644 --- a/.github/workflows/codex_pr_review.yml +++ b/.github/workflows/codex_pr_review.yml @@ -1,7 +1,7 @@ name: Codex PR Review on: - pull_request: + pull_request_target: types: [opened, synchronize, reopened] permissions: @@ -19,7 +19,9 @@ jobs: uses: QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@main with: caller_concurrency_key: pr-${{ github.event.pull_request.number || github.run_id }} - allow_unconfigured_backend: true + allow_unconfigured_backend: false + api_fallback_enabled: "false" + direct_api_primary_enabled: "false" secrets: inherit permissions: contents: read From aa62d768e3e3b5c5c3b4c860b7d65f53f6afa060 Mon Sep 17 00:00:00 2001 From: Pigbibi <20649888+Pigbibi@users.noreply.github.com> Date: Fri, 10 Jul 2026 22:34:22 +0800 Subject: [PATCH 2/2] fix(ci): harden Codex review invocation Co-Authored-By: Codex --- .github/workflows/codex_pr_review.yml | 3 ++- .github/workflows/codex_review_gate.yml | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codex_pr_review.yml b/.github/workflows/codex_pr_review.yml index 037717e..7ebfe30 100644 --- a/.github/workflows/codex_pr_review.yml +++ b/.github/workflows/codex_pr_review.yml @@ -22,7 +22,8 @@ jobs: allow_unconfigured_backend: false api_fallback_enabled: "false" direct_api_primary_enabled: "false" - secrets: inherit + secrets: + CODEX_AUDIT_SERVICE_URL: ${{ secrets.CODEX_AUDIT_SERVICE_URL }} permissions: contents: read id-token: write diff --git a/.github/workflows/codex_review_gate.yml b/.github/workflows/codex_review_gate.yml index 56bcf4e..050094f 100644 --- a/.github/workflows/codex_review_gate.yml +++ b/.github/workflows/codex_review_gate.yml @@ -23,7 +23,7 @@ permissions: pull-requests: read concurrency: - group: codex-review-gate-${{ github.event.pull_request.number }} + group: codex-review-gate-${{ github.event.pull_request.number }}-${{ github.event_name }} cancel-in-progress: true jobs: