From 8f95402850e7f2c2d918bbbcdc94c8da80cad121 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 15 May 2026 13:14:58 +0000
Subject: [PATCH] use OPENAI_API_KEY for codex workflow

---
 .github/workflows/codex-pr-review.yml    | 24 ++++++++++++++++++------
 .github/workflows/pr-review-commands.yml |  1 +
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/codex-pr-review.yml b/.github/workflows/codex-pr-review.yml
index b4916714f2..66cc4b5f10 100644
--- a/.github/workflows/codex-pr-review.yml
+++ b/.github/workflows/codex-pr-review.yml
@@ -20,6 +20,8 @@ on:
         type: string
         default: ''
     secrets:
+      OPENAI_API_KEY:
+        required: false
       CODEX_AUTH_JSON:
         required: false
       WINDMILL_EE_PRIVATE_ACCESS:
@@ -60,13 +62,18 @@ jobs:
       - name: Check Codex configuration
         id: codex_config
         env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           CODEX_AUTH_JSON: ${{ secrets.CODEX_AUTH_JSON }}
         run: |
-          if [ -n "$CODEX_AUTH_JSON" ]; then
+          if [ -n "$OPENAI_API_KEY" ]; then
             echo "enabled=true" >> "$GITHUB_OUTPUT"
+            echo "auth_mode=api_key" >> "$GITHUB_OUTPUT"
+          elif [ -n "$CODEX_AUTH_JSON" ]; then
+            echo "enabled=true" >> "$GITHUB_OUTPUT"
+            echo "auth_mode=oauth_json" >> "$GITHUB_OUTPUT"
           else
             echo "enabled=false" >> "$GITHUB_OUTPUT"
-            echo "CODEX_AUTH_JSON is not configured; skipping Codex review."
+            echo "Codex auth is not configured; set OPENAI_API_KEY or CODEX_AUTH_JSON to enable Codex review."
           fi
 
       - name: Resolve PR metadata
@@ -169,9 +176,10 @@ jobs:
         if: steps.codex_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
         run: npm install --global @openai/codex@0.128.0
 
-      - name: Configure file-backed Codex auth
+      - name: Configure Codex auth
         if: steps.codex_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
         env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           CODEX_AUTH_JSON: ${{ secrets.CODEX_AUTH_JSON }}
         run: |
           CODEX_HOME="$HOME/.codex"
@@ -181,9 +189,13 @@ jobs:
           cat > "$CODEX_HOME/config.toml" <<'EOF'
           cli_auth_credentials_store = "file"
           EOF
-          printf '%s' "$CODEX_AUTH_JSON" > "$CODEX_HOME/auth.json"
-          chmod 600 "$CODEX_HOME/auth.json"
-          node -e 'JSON.parse(require("fs").readFileSync(process.argv[1], "utf8"))' "$CODEX_HOME/auth.json"
+          if [ -n "$OPENAI_API_KEY" ]; then
+            printf '%s' "$OPENAI_API_KEY" | codex login --with-api-key
+          else
+            printf '%s' "$CODEX_AUTH_JSON" > "$CODEX_HOME/auth.json"
+            chmod 600 "$CODEX_HOME/auth.json"
+            node -e 'JSON.parse(require("fs").readFileSync(process.argv[1], "utf8"))' "$CODEX_HOME/auth.json"
+          fi
 
       - name: Pre-fetch base and head refs for the PR
         if: steps.codex_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
diff --git a/.github/workflows/pr-review-commands.yml b/.github/workflows/pr-review-commands.yml
index 21d5e1decd..ba55bfea2f 100644
--- a/.github/workflows/pr-review-commands.yml
+++ b/.github/workflows/pr-review-commands.yml
@@ -100,6 +100,7 @@ jobs:
       extra_prompt: ${{ needs.parse.outputs.extra_prompt }}
       triggered_by: ${{ github.event.comment.user.login }}
     secrets:
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
       CODEX_AUTH_JSON: ${{ secrets.CODEX_AUTH_JSON }}
       WINDMILL_EE_PRIVATE_ACCESS: ${{ secrets.WINDMILL_EE_PRIVATE_ACCESS }}