Ten-VoiceAgent/.github/workflows/codex_code_review.yml at main · thinkingdev923/Ten-VoiceAgent · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
name: Codex Code Review

on:
  pull_request_target:
    types: [opened, synchronize]
    branches: ["main"]
    paths-ignore:
      - "core/**"
      - "tests/**"
      - "tools/**"
      - "packages/**"
      - "build/**"
      - "third_party/**"
      - ".devcontainer/**"
      - ".github/**"
      - "!.github/workflows/codex_code_review.yml"
      - "!.github/prompts/code-review.md"
      - "!.github/actions/bootstrap-codex/**"
      - ".vscode/**"
      - "**.md"
      - "ai_agents/docs/**"
      - "ai_agents/esp32-client/**"
      - "ai_agents/Dockerfile"
      - "ai_agents/docker-compose.yml"
      - "ai_agents/playground/**"
      - "ai_agents/agents/examples/demo/**"

jobs:
  codex-review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      issues: write
    env:
      CODEX_MODEL: ${{ vars.CODEX_MODEL || 'gpt-5.6-terra' }}
      CODEX_BASE_URL: ${{ vars.CODEX_BASE_URL }}

    steps:
      # pull_request_target runs with secrets; checkout base (trusted) only — see
      # https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.base.sha }}
          fetch-depth: 0

      - name: Build code review prompt
        run: |
          PROMPT_FILE="$RUNNER_TEMP/codex_code_review_prompt.md"
          {
            printf 'REPO: %s\nPR NUMBER: %s\n\n' \
              "${{ github.repository }}" \
              "${{ github.event.pull_request.number }}"
            cat .github/prompts/code-review.md
          } > "$PROMPT_FILE"
          echo "PROMPT_FILE=$PROMPT_FILE" >> "$GITHUB_ENV"

      - name: Bootstrap Codex and run review
        uses: ./.github/actions/bootstrap-codex
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          codex_api_key: ${{ secrets.CODEX_OPENAI_API_KEY }}
          codex_model: ${{ env.CODEX_MODEL }}
          codex_base_url: ${{ secrets.CODEX_BASE_URL }}
          prompt_path: ${{ env.PROMPT_FILE }}
          recent_change_advice: |
            Prefer concrete risks in changed files or directly adjacent code when they have clear evidence.
            Do not force findings just because a file changed recently.