Close kernel conformance freshness and authority gaps #35
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Boatstack-owned advisory review plane. | |
| name: Codex code review | |
| on: | |
| pull_request: | |
| types: [opened, reopened, synchronize, ready_for_review] | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| concurrency: | |
| group: codex-review-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| review: | |
| name: codex-review | |
| if: github.event.pull_request.draft == false | |
| runs-on: ubuntu-latest | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| REPOSITORY: ${{ github.repository }} | |
| steps: | |
| - name: Check reviewer configuration | |
| id: configuration | |
| env: | |
| HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }} | |
| REVIEWER_API_KEY: ${{ secrets.CODEX_REVIEWER_API }} | |
| shell: bash | |
| run: | | |
| if [[ "$HEAD_REPOSITORY" != "$REPOSITORY" ]]; then | |
| echo "enabled=false" >> "$GITHUB_OUTPUT" | |
| echo "Codex review is disabled for fork pull requests." >> "$GITHUB_STEP_SUMMARY" | |
| elif [[ -z "$REVIEWER_API_KEY" ]]; then | |
| echo "enabled=false" >> "$GITHUB_OUTPUT" | |
| echo "Codex review is ready but CODEX_REVIEWER_API is not configured." >> "$GITHUB_STEP_SUMMARY" | |
| else | |
| echo "enabled=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Checkout pull request merge commit | |
| if: steps.configuration.outputs.enabled == 'true' | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| ref: refs/pull/${{ github.event.pull_request.number }}/merge | |
| - name: Fetch exact base and head revisions | |
| if: steps.configuration.outputs.enabled == 'true' | |
| shell: bash | |
| run: | | |
| git fetch --no-tags origin \ | |
| "+refs/pull/${PR_NUMBER}/head:refs/remotes/origin/codex-review-head" | |
| git cat-file -e "$BASE_SHA^{commit}" | |
| test "$(git rev-parse refs/remotes/origin/codex-review-head)" = "$HEAD_SHA" | |
| - name: Load admitted review policy | |
| if: steps.configuration.outputs.enabled == 'true' | |
| id: policy | |
| shell: bash | |
| run: | | |
| prompt="$RUNNER_TEMP/codex-review-prompt.md" | |
| schema="$RUNNER_TEMP/codex-review-output-schema.json" | |
| if ! git cat-file -e "$BASE_SHA:.github/codex/review-prompt.md" || \ | |
| ! git cat-file -e "$BASE_SHA:.github/codex/review-output-schema.json"; then | |
| echo "enabled=false" >> "$GITHUB_OUTPUT" | |
| echo "Automated review is skipped because the base revision has no admitted review policy." >> "$GITHUB_STEP_SUMMARY" | |
| exit 0 | |
| fi | |
| git show "$BASE_SHA:.github/codex/review-prompt.md" > "$prompt" | |
| git show "$BASE_SHA:.github/codex/review-output-schema.json" > "$schema" | |
| echo "enabled=true" >> "$GITHUB_OUTPUT" | |
| echo "path=$prompt" >> "$GITHUB_OUTPUT" | |
| echo "schema=$schema" >> "$GITHUB_OUTPUT" | |
| - name: Build review prompt | |
| if: steps.configuration.outputs.enabled == 'true' && steps.policy.outputs.enabled == 'true' | |
| id: prompt | |
| shell: bash | |
| run: | | |
| prompt="${{ steps.policy.outputs.path }}" | |
| merge_base="$(git merge-base "$BASE_SHA" "$HEAD_SHA")" | |
| changed_count="$(git diff --name-only "$merge_base" "$HEAD_SHA" | wc -l | tr -d ' ')" | |
| { | |
| echo | |
| echo "Repository: $REPOSITORY" | |
| echo "Pull request: $PR_NUMBER" | |
| echo "Base revision: $BASE_SHA" | |
| echo "Head revision: $HEAD_SHA" | |
| echo "Merge base: $merge_base" | |
| echo | |
| echo "Changed files: $changed_count total (first 200 shown)" | |
| git --no-pager diff --name-status "$merge_base" "$HEAD_SHA" | sed -n '1,200p' | |
| echo | |
| echo "Diff summary:" | |
| git --no-pager diff --shortstat "$merge_base" "$HEAD_SHA" | |
| echo | |
| echo "Inspect the exact pull request change with:" | |
| echo "git --no-pager diff --unified=5 $merge_base $HEAD_SHA" | |
| echo "Read only the relevant portions needed to review the change." | |
| } >> "$prompt" | |
| echo "path=$prompt" >> "$GITHUB_OUTPUT" | |
| - name: Run structured Codex review | |
| if: steps.configuration.outputs.enabled == 'true' && steps.policy.outputs.enabled == 'true' | |
| id: codex | |
| uses: openai/codex-action@dd78cb653811af44014baa08fe954e28d32c1bf9 # main, 2026-08-12 | |
| with: | |
| openai-api-key: ${{ secrets.CODEX_REVIEWER_API }} | |
| prompt-file: ${{ steps.prompt.outputs.path }} | |
| output-schema-file: ${{ steps.policy.outputs.schema }} | |
| output-file: ${{ runner.temp }}/codex-review-output.json | |
| permission-profile: ":read-only" | |
| safety-strategy: drop-sudo | |
| codex-version: "0.147.0" | |
| model: ${{ vars.CODEX_REVIEW_MODEL || 'gpt-5.6-sol' }} | |
| effort: ${{ vars.CODEX_REVIEW_EFFORT || 'high' }} | |
| - name: Validate structured review | |
| if: steps.configuration.outputs.enabled == 'true' && steps.policy.outputs.enabled == 'true' | |
| shell: bash | |
| run: | | |
| test -s "$RUNNER_TEMP/codex-review-output.json" | |
| jq -e ' | |
| (.findings | type == "array") and | |
| (.overall_correctness == "patch is correct" or .overall_correctness == "patch is incorrect") and | |
| (.overall_confidence_score >= 0 and .overall_confidence_score <= 1) | |
| ' "$RUNNER_TEMP/codex-review-output.json" >/dev/null | |
| - name: Build GitHub review payload | |
| if: steps.configuration.outputs.enabled == 'true' && steps.policy.outputs.enabled == 'true' | |
| shell: bash | |
| run: | | |
| python3 .github/scripts/build_codex_github_review.py \ | |
| --input "$RUNNER_TEMP/codex-review-output.json" \ | |
| --output "$RUNNER_TEMP/codex-github-review.json" \ | |
| --workspace "$GITHUB_WORKSPACE" \ | |
| --base "$BASE_SHA" \ | |
| --head "$HEAD_SHA" | |
| - name: Publish GitHub review | |
| if: steps.configuration.outputs.enabled == 'true' && steps.policy.outputs.enabled == 'true' | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| shell: bash | |
| run: | | |
| jq -e 'all(.comments[]; | |
| ((.path | length) > 0) and | |
| (((.path | startswith("/")) or (.path | startswith("../")) or (.path | contains("/../"))) | not) and | |
| ((.start_line // .line) <= .line) | |
| )' \ | |
| "$RUNNER_TEMP/codex-github-review.json" >/dev/null | |
| gh api \ | |
| --method POST \ | |
| "repos/$REPOSITORY/pulls/$PR_NUMBER/reviews" \ | |
| --input "$RUNNER_TEMP/codex-github-review.json" |