|
| 1 | +name: Codex Code Review |
| 2 | + |
| 3 | +on: |
| 4 | + pull_request: |
| 5 | + types: [opened, synchronize, ready_for_review] |
| 6 | + workflow_dispatch: |
| 7 | + inputs: |
| 8 | + pr_number: |
| 9 | + description: 'PR number to review' |
| 10 | + required: true |
| 11 | + type: number |
| 12 | + |
| 13 | +jobs: |
| 14 | + check-files: |
| 15 | + name: Check Changed Files |
| 16 | + runs-on: ubuntu-latest |
| 17 | + permissions: |
| 18 | + contents: read |
| 19 | + pull-requests: read |
| 20 | + outputs: |
| 21 | + skip_codex: ${{ steps.check.outputs.skip }} |
| 22 | + steps: |
| 23 | + - name: Check for Codex workflow-only changes |
| 24 | + id: check |
| 25 | + env: |
| 26 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 27 | + PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number }} |
| 28 | + run: | |
| 29 | + FILES=$(gh pr view "$PR_NUMBER" --repo "${{ github.repository }}" --json files -q '.files[].path') |
| 30 | +
|
| 31 | + if echo "$FILES" | grep -qvE '^(\.github/workflows/codex-code-review\.yml|\.github/codex/)'; then |
| 32 | + echo "PR contains non-Codex-review files - Codex will review" |
| 33 | + echo "skip=false" >> "$GITHUB_OUTPUT" |
| 34 | + else |
| 35 | + echo "PR only modifies Codex review automation files - skipping self-review" |
| 36 | + echo "skip=true" >> "$GITHUB_OUTPUT" |
| 37 | + fi |
| 38 | +
|
| 39 | + codex-review: |
| 40 | + name: Codex Review |
| 41 | + needs: check-files |
| 42 | + if: needs.check-files.outputs.skip_codex != 'true' |
| 43 | + runs-on: ubuntu-latest |
| 44 | + continue-on-error: true |
| 45 | + permissions: |
| 46 | + contents: read |
| 47 | + pull-requests: write |
| 48 | + env: |
| 49 | + HAS_OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY != '' }} |
| 50 | + steps: |
| 51 | + - name: Checkout repository |
| 52 | + uses: actions/checkout@v6 |
| 53 | + with: |
| 54 | + ref: refs/pull/${{ github.event.pull_request.number || inputs.pr_number }}/merge |
| 55 | + fetch-depth: 0 |
| 56 | + |
| 57 | + - name: Load pull request metadata |
| 58 | + id: pr |
| 59 | + env: |
| 60 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 61 | + PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number }} |
| 62 | + run: | |
| 63 | + gh pr view "$PR_NUMBER" --repo "${{ github.repository }}" \ |
| 64 | + --json number,baseRefName,baseRefOid,headRefName,headRefOid,author,isDraft \ |
| 65 | + > pr.json |
| 66 | +
|
| 67 | + { |
| 68 | + echo "number=$(jq -r '.number' pr.json)" |
| 69 | + echo "base_ref=$(jq -r '.baseRefName' pr.json)" |
| 70 | + echo "base_sha=$(jq -r '.baseRefOid' pr.json)" |
| 71 | + echo "head_ref=$(jq -r '.headRefName' pr.json)" |
| 72 | + echo "head_sha=$(jq -r '.headRefOid' pr.json)" |
| 73 | + echo "author=$(jq -r '.author.login' pr.json)" |
| 74 | + echo "draft=$(jq -r '.isDraft' pr.json)" |
| 75 | + } >> "$GITHUB_OUTPUT" |
| 76 | +
|
| 77 | + - name: Decide whether to run Codex |
| 78 | + id: gate |
| 79 | + env: |
| 80 | + AUTHOR: ${{ steps.pr.outputs.author }} |
| 81 | + IS_DRAFT: ${{ steps.pr.outputs.draft }} |
| 82 | + HAS_OPENAI_API_KEY: ${{ env.HAS_OPENAI_API_KEY }} |
| 83 | + run: | |
| 84 | + if [ "$IS_DRAFT" = 'true' ]; then |
| 85 | + { |
| 86 | + echo 'run=false' |
| 87 | + echo 'reason=Draft pull request' |
| 88 | + } >> "$GITHUB_OUTPUT" |
| 89 | + exit 0 |
| 90 | + fi |
| 91 | +
|
| 92 | + case "$AUTHOR" in |
| 93 | + dependabot[bot]|renovate[bot]|github-actions[bot]) |
| 94 | + { |
| 95 | + echo 'run=false' |
| 96 | + echo 'reason=Bot-authored pull request' |
| 97 | + } >> "$GITHUB_OUTPUT" |
| 98 | + exit 0 |
| 99 | + ;; |
| 100 | + esac |
| 101 | +
|
| 102 | + if [ "$HAS_OPENAI_API_KEY" != 'true' ]; then |
| 103 | + { |
| 104 | + echo 'run=false' |
| 105 | + echo 'reason=OPENAI_API_KEY is unavailable for this run' |
| 106 | + } >> "$GITHUB_OUTPUT" |
| 107 | + exit 0 |
| 108 | + fi |
| 109 | +
|
| 110 | + { |
| 111 | + echo 'run=true' |
| 112 | + echo 'reason=Review enabled' |
| 113 | + } >> "$GITHUB_OUTPUT" |
| 114 | +
|
| 115 | + - name: Pre-fetch base and head refs |
| 116 | + if: steps.gate.outputs.run == 'true' |
| 117 | + run: | |
| 118 | + git fetch --no-tags origin \ |
| 119 | + "${{ steps.pr.outputs.base_ref }}" \ |
| 120 | + "+refs/pull/${{ steps.pr.outputs.number }}/head" |
| 121 | +
|
| 122 | + - name: Run Codex Review |
| 123 | + if: steps.gate.outputs.run == 'true' |
| 124 | + id: run_codex |
| 125 | + uses: openai/codex-action@v1 |
| 126 | + env: |
| 127 | + PR_NUMBER: ${{ steps.pr.outputs.number }} |
| 128 | + PR_BASE_SHA: ${{ steps.pr.outputs.base_sha }} |
| 129 | + PR_HEAD_SHA: ${{ steps.pr.outputs.head_sha }} |
| 130 | + PR_AUTHOR: ${{ steps.pr.outputs.author }} |
| 131 | + PR_HEAD_REF: ${{ steps.pr.outputs.head_ref }} |
| 132 | + with: |
| 133 | + openai-api-key: ${{ secrets.OPENAI_API_KEY }} |
| 134 | + prompt-file: .github/codex/prompts/review.md |
| 135 | + output-file: codex-review.json |
| 136 | + output-schema-file: .github/codex/schemas/review-output.schema.json |
| 137 | + codex-args: --full-auto |
| 138 | + safety-strategy: drop-sudo |
| 139 | + sandbox: read-only |
| 140 | + |
| 141 | + - name: Post Codex review |
| 142 | + if: steps.gate.outputs.run == 'true' |
| 143 | + env: |
| 144 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 145 | + PR_NUMBER: ${{ steps.pr.outputs.number }} |
| 146 | + run: | |
| 147 | + jq -e '.event and .body' codex-review.json >/dev/null |
| 148 | + jq -r '.body' codex-review.json > codex-review-body.md |
| 149 | + REVIEW_EVENT=$(jq -r '.event' codex-review.json) |
| 150 | +
|
| 151 | + case "$REVIEW_EVENT" in |
| 152 | + APPROVE) REVIEW_FLAG='--approve' ;; |
| 153 | + REQUEST_CHANGES) REVIEW_FLAG='--request-changes' ;; |
| 154 | + COMMENT) REVIEW_FLAG='--comment' ;; |
| 155 | + *) |
| 156 | + echo "::error::Unsupported review event: $REVIEW_EVENT" |
| 157 | + exit 1 |
| 158 | + ;; |
| 159 | + esac |
| 160 | +
|
| 161 | + gh pr review "$PR_NUMBER" \ |
| 162 | + --repo "${{ github.repository }}" \ |
| 163 | + "$REVIEW_FLAG" \ |
| 164 | + --body-file codex-review-body.md |
| 165 | +
|
| 166 | + - name: Log skipped Codex review |
| 167 | + if: steps.gate.outputs.run != 'true' |
| 168 | + run: | |
| 169 | + echo "Skipping Codex review" |
| 170 | + echo "Reason: ${{ steps.gate.outputs.reason }}" |
| 171 | +
|
| 172 | + skip-notification: |
| 173 | + name: Skip Notification |
| 174 | + needs: check-files |
| 175 | + if: needs.check-files.outputs.skip_codex == 'true' |
| 176 | + runs-on: ubuntu-latest |
| 177 | + permissions: |
| 178 | + pull-requests: write |
| 179 | + steps: |
| 180 | + - name: Post skip notification |
| 181 | + env: |
| 182 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 183 | + PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number }} |
| 184 | + run: | |
| 185 | + gh pr comment "$PR_NUMBER" --repo "${{ github.repository }}" --body "## Codex Code Review - Skipped |
| 186 | +
|
| 187 | + This PR only modifies Codex review automation files. Codex cannot review changes to its own workflow or prompt files. |
| 188 | +
|
| 189 | + **Alternative reviewers:** |
| 190 | + - Claude Code Review |
| 191 | + - CodeRabbit |
| 192 | + - Human codeowner (@ANcpLua) |
| 193 | +
|
| 194 | + --- |
| 195 | + *This is expected behavior, not an error.*" |
0 commit comments