Add effx pull-request review - #11
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4e2e741cbb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - name: Install the reviewed effx tool | ||
| working-directory: .effx-tool | ||
| run: | | ||
| bun install --frozen-lockfile --ignore-scripts |
There was a problem hiding this comment.
On a fresh GitHub-hosted ubuntu-latest runner, neither this job nor the publisher installs Bun before invoking it, so analysis stops here with bun: command not found and the trusted publication job has the same failure at its install step. The repository's existing CI explicitly provisions the pinned Bun 1.3.14 via oven-sh/setup-bun; add an equivalent setup step to both new jobs before their first bun command.
Useful? React with 👍 / 👎.
| uses: actions/checkout@v4 | ||
| with: | ||
| persist-credentials: false |
There was a problem hiding this comment.
For a pull_request workflow, checkout's default ref is GitHub's synthetic merge commit, while the artifact is labeled and verified against github.event.pull_request.head.sha. When the base branch has changes not present in the PR head—especially edits earlier in the same file—the diagnostics can therefore have content or line numbers from the merge tree and then be published against a different commit. Pass ref: ${{ github.event.pull_request.head.sha }} here so the analyzed tree is the SHA the publication input claims to represent.
Useful? React with 👍 / 👎.
1 participant
Adds the two-stage effx review integration and a supported-version reminder.
Classification: agent-migration-opt-in-required. No dependency or application-source migration is included; agent-authored migration remains opt-in.
The analysis workflow runs without write authority. The trusted workflow publishes only an immutable-head-bound artifact.