From ae48e6a27ea24d6781e22efa4b2c67bc14b4cfbc Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Tue, 14 Jul 2026 16:05:26 +0000 Subject: [PATCH] ci: bypass Codex sandbox in PR review to fix bwrap netns failure Codex's bwrap sandbox fails to bring up its network-namespace loopback on the ubicloud-standard-2 runner (`bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted`) and aborts before reading any file, so the review posts "Unable to complete the review" instead of a verdict. Reproduced deterministically on the fork command path (#10064): two runs, identical failure, while non-fork auto-runs on the same pool succeed. Widening the sandbox with a mode flag is not enough (bwrap still initializes the netns and fails), so replace the `-s ` selection with `--dangerously-bypass-approvals-and-sandbox`, which skips sandbox setup entirely. Per Codex's own help this flag is "intended solely for running in environments that are externally sandboxed", which an ephemeral CI runner is; the job already ran with full access. This removes the network-disabled sandbox that #10069 relied on to contain untrusted fork code during review. That containment is traded for a working fork-review path: `/codex` is gated on a maintainer triggering it, and the runner is short-lived with only the Codex auth present. The rest of #10069's fork hardening is preserved (review policy read from the base ref, persist-credentials:false on checkout, output written outside the checkout). Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/codex-pr-review.yml | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/.github/workflows/codex-pr-review.yml b/.github/workflows/codex-pr-review.yml index 68bea1d715..1e7dda7448 100644 --- a/.github/workflows/codex-pr-review.yml +++ b/.github/workflows/codex-pr-review.yml @@ -306,14 +306,11 @@ jobs: if [ "$PR_IS_FORK" = "true" ]; then # Fork code is untrusted. Read the review policy/prompt from the base # ref (git show) rather than the attacker-controlled merge checkout, - # so a malicious fork can't rewrite the reviewer's own instructions, - # and run in a network-disabled sandbox to block secret exfiltration. + # so a malicious fork can't rewrite the reviewer's own instructions. git show "origin/$PR_BASE_REF:REVIEW.md" > /tmp/codex-prompt.md git show "origin/$PR_BASE_REF:.github/codex/pr-review.prompt.md" >> /tmp/codex-prompt.md - SANDBOX_MODE=workspace-write else cat REVIEW.md .github/codex/pr-review.prompt.md > /tmp/codex-prompt.md - SANDBOX_MODE=danger-full-access fi # The context file lives in RUNNER_TEMP (outside the attacker-controlled # checkout); tell the agent its absolute path. @@ -321,11 +318,17 @@ jobs: # Write the final message outside the checkout too: a fork could commit # codex-final-message.md as a symlink and redirect this write to overwrite # e.g. a GitHub Action's index.js, which then runs with our credentials. + # + # Bypass the sandbox entirely instead of selecting a sandbox mode: Codex's + # bwrap sandbox fails to initialize its network namespace on this runner + # (`bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted`) and aborts + # before reading any file, so no review is possible with it enabled. The + # runner is already an ephemeral, externally sandboxed CI environment. codex exec \ -C "$GITHUB_WORKSPACE" \ -m gpt-5.6-sol \ -c 'model_reasoning_effort="xhigh"' \ - -s "$SANDBOX_MODE" \ + --dangerously-bypass-approvals-and-sandbox \ -o "$RUNNER_TEMP/codex-final-message.md" \ - < /tmp/codex-prompt.md