codex.yml

name: Codex Review

on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  pull_request_review:
    types: [submitted]

jobs:
  codex:
    # Bot actors are excluded up front: the Codex connector's own review
    # posts contain the literal "@codex" (the "comment @codex review"
    # boilerplate in its collapsible footer), which used to re-trigger this
    # workflow as chatgpt-codex-connector[bot] — an actor openai/codex-action
    # then rejects (write access 'none', allow-bots false), failing the
    # `codex` check on every bot review. Skip instead of fail.
    if: |
      github.event.sender.type != 'Bot' && (
        (github.event_name == 'issue_comment' && github.event.issue.pull_request != null && contains(github.event.comment.body, '@codex')) ||
        (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@codex')) ||
        (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@codex'))
      )
    runs-on: blacksmith-4vcpu-ubuntu-2404
    permissions:
      contents: read
      pull-requests: write
      issues: write
    outputs:
      final_message: ${{ steps.run_codex.outputs.final-message }}
      pr_number: ${{ steps.pr.outputs.number }}
    steps:
      - name: Resolve PR number
        id: pr
        env:
          EVENT_NAME: ${{ github.event_name }}
          ISSUE_NUMBER: ${{ github.event.issue.number }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          if [ "$EVENT_NAME" = "issue_comment" ]; then
            echo "number=$ISSUE_NUMBER" >> "$GITHUB_OUTPUT"
          else
            echo "number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
          fi

      - name: Get PR metadata
        id: meta
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          PR_NUMBER: ${{ steps.pr.outputs.number }}
        run: |
          json=$(gh api "repos/$REPO/pulls/$PR_NUMBER")
          echo "head_sha=$(echo "$json" | jq -r '.head.sha')" >> "$GITHUB_OUTPUT"
          echo "base_sha=$(echo "$json" | jq -r '.base.sha')" >> "$GITHUB_OUTPUT"
          echo "base_ref=$(echo "$json" | jq -r '.base.ref')" >> "$GITHUB_OUTPUT"
          {
            echo "title<<EOF"
            echo "$json" | jq -r '.title // ""'
            echo "EOF"
            echo "body<<EOF"
            echo "$json" | jq -r '.body // ""'
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Checkout PR merge commit
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: refs/pull/${{ steps.pr.outputs.number }}/merge
          fetch-depth: 0

      - name: Pre-fetch base and head refs
        env:
          PR_BASE_REF: ${{ steps.meta.outputs.base_ref }}
          PR_NUMBER: ${{ steps.pr.outputs.number }}
        run: |
          git fetch --no-tags origin \
            "$PR_BASE_REF" \
            "+refs/pull/$PR_NUMBER/head"

      - name: Run Codex
        id: run_codex
        uses: openai/codex-action@c25d10f3f498316d4b2496cc4c6dd58057a7b031 # v1.6
        with:
          openai-api-key: ${{ secrets.OPENAI_API_KEY }}
          sandbox: read-only
          prompt: |
            You are reviewing PR #${{ steps.pr.outputs.number }} for ${{ github.repository }} — the Darkbloom / d-inference decentralized inference project.

            Review ONLY the changes introduced by this PR. Inspect the diff with:
              git log --oneline ${{ steps.meta.outputs.base_sha }}...${{ steps.meta.outputs.head_sha }}
              git diff ${{ steps.meta.outputs.base_sha }}...${{ steps.meta.outputs.head_sha }}

            Focus on, in order of importance:
            1. Correctness and regressions — broken imports, provider protocol/fixture consistency, native inference safeguards, and release-bundle consistency across `.github/workflows/release-swift.yml`, `scripts/install.sh`, and `ProviderCore.version`. The private platform owns backend implementation; do not fetch private source or credentials for public PR review.
            2. Security — leaked secrets, skipped attestation or auth, unsafe eval of user input, weakened sandboxing.
            3. Test coverage — per AGENTS.md every non-trivial change ships with a test; bug fixes ship with a regression test.
            4. Adherence to project conventions in `AGENTS.md` and `CONTRIBUTING.md`.

            Be concise and specific. Reference exact file paths and line numbers. Keep feedback under ~400 words. If the PR is clean, say so briefly.

            PR title:
            ${{ steps.meta.outputs.title }}

            PR body:
            ${{ steps.meta.outputs.body }}

  post_feedback:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    needs: codex
    if: needs.codex.outputs.final_message != ''
    permissions:
      issues: write
      pull-requests: write
    steps:
      - name: Post Codex feedback as PR comment
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
        env:
          CODEX_FINAL_MESSAGE: ${{ needs.codex.outputs.final_message }}
          PR_NUMBER: ${{ needs.codex.outputs.pr_number }}
        with:
          github-token: ${{ github.token }}
          script: |
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: Number(process.env.PR_NUMBER),
              body: `### Codex review\n\n${process.env.CODEX_FINAL_MESSAGE}`,
            });