mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-21 00:02:23 +00:00
hugocasa
4e63ca2cd4
* feat(ci): gate PR ready on clean review rounds driven from draft Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ci): robust review-round wait loop, require codex evidence for marker skip Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ci): require pre-marker codex evidence, fail open on marker fetch errors Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
422 lines
19 KiB
YAML
422 lines
19 KiB
YAML
name: Codex Auto Review
|
|
|
|
on:
|
|
pull_request:
|
|
types: [ready_for_review, opened, synchronize]
|
|
workflow_call:
|
|
inputs:
|
|
pr_number:
|
|
description: 'PR number to review'
|
|
required: true
|
|
type: number
|
|
extra_prompt:
|
|
description: 'Additional reviewer instructions appended to the standard review prompt'
|
|
required: false
|
|
type: string
|
|
default: ''
|
|
triggered_by:
|
|
description: 'GitHub username that triggered this review (for audit only)'
|
|
required: false
|
|
type: string
|
|
default: ''
|
|
secrets:
|
|
OPENAI_API_KEY:
|
|
required: false
|
|
CODEX_AUTH_JSON:
|
|
required: false
|
|
WINDMILL_EE_PRIVATE_ACCESS:
|
|
required: false
|
|
|
|
concurrency:
|
|
group: codex-review-${{ inputs.pr_number || github.event.pull_request.number }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
codex-review:
|
|
runs-on: ubicloud-standard-2
|
|
timeout-minutes: 30
|
|
# A non-fork PR (head.repo.fork == false) can only be opened by someone with push
|
|
# access to this repo, so fork==false already enforces write access. Do NOT re-add
|
|
# an author_association gate: the pull_request webhook payload reports private org
|
|
# members as CONTRIBUTOR/NONE (only public members show as MEMBER), which silently
|
|
# skips auto-review for every private member.
|
|
if: |
|
|
github.event_name == 'workflow_call' ||
|
|
(
|
|
github.event.pull_request.draft == false &&
|
|
github.event.pull_request.head.repo.fork == false
|
|
)
|
|
permissions:
|
|
contents: read
|
|
issues: write
|
|
pull-requests: write
|
|
steps:
|
|
- name: Check Codex configuration
|
|
id: codex_config
|
|
env:
|
|
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
|
|
CODEX_AUTH_JSON: ${{ secrets.CODEX_AUTH_JSON }}
|
|
run: |
|
|
if [ -n "$OPENAI_API_KEY" ]; then
|
|
echo "enabled=true" >> "$GITHUB_OUTPUT"
|
|
echo "auth_mode=api_key" >> "$GITHUB_OUTPUT"
|
|
elif [ -n "$CODEX_AUTH_JSON" ]; then
|
|
echo "enabled=true" >> "$GITHUB_OUTPUT"
|
|
echo "auth_mode=oauth_json" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "enabled=false" >> "$GITHUB_OUTPUT"
|
|
echo "Codex auth is not configured; set OPENAI_API_KEY or CODEX_AUTH_JSON to enable Codex review."
|
|
fi
|
|
|
|
- name: Resolve PR metadata
|
|
if: steps.codex_config.outputs.enabled == 'true'
|
|
id: pr
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
INPUT_PR_NUMBER: ${{ inputs.pr_number }}
|
|
EVENT_PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
EVENT_BASE_REF: ${{ github.event.pull_request.base.ref }}
|
|
EVENT_BASE_SHA: ${{ github.event.pull_request.base.sha }}
|
|
EVENT_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
|
|
EVENT_TITLE: ${{ github.event.pull_request.title }}
|
|
EVENT_BODY: ${{ github.event.pull_request.body }}
|
|
EVENT_FORK: ${{ github.event.pull_request.head.repo.fork }}
|
|
EVENT_AUTHOR: ${{ github.event.pull_request.user.login }}
|
|
EVENT_ACTION: ${{ github.event.action }}
|
|
run: |
|
|
if [ -n "$INPUT_PR_NUMBER" ]; then
|
|
PR_JSON=$(gh pr view "$INPUT_PR_NUMBER" --repo "${{ github.repository }}" \
|
|
--json number,baseRefName,baseRefOid,headRefOid,title,body,isCrossRepository,author)
|
|
PR_NUMBER=$(echo "$PR_JSON" | jq -r '.number')
|
|
BASE_REF=$(echo "$PR_JSON" | jq -r '.baseRefName')
|
|
BASE_SHA=$(echo "$PR_JSON" | jq -r '.baseRefOid')
|
|
HEAD_SHA=$(echo "$PR_JSON" | jq -r '.headRefOid')
|
|
PR_TITLE=$(echo "$PR_JSON" | jq -r '.title')
|
|
PR_BODY=$(echo "$PR_JSON" | jq -r '.body // ""')
|
|
IS_FORK=$(echo "$PR_JSON" | jq -r '.isCrossRepository')
|
|
PR_AUTHOR=$(echo "$PR_JSON" | jq -r '.author.login // ""')
|
|
else
|
|
PR_NUMBER="$EVENT_PR_NUMBER"
|
|
BASE_REF="$EVENT_BASE_REF"
|
|
BASE_SHA="$EVENT_BASE_SHA"
|
|
HEAD_SHA="$EVENT_HEAD_SHA"
|
|
PR_TITLE="$EVENT_TITLE"
|
|
PR_BODY="$EVENT_BODY"
|
|
IS_FORK="$EVENT_FORK"
|
|
PR_AUTHOR="$EVENT_AUTHOR"
|
|
fi
|
|
# Fork PRs run untrusted code with secrets present, so the automatic
|
|
# pull_request trigger never reviews them. A non-empty INPUT_PR_NUMBER
|
|
# means we arrived via workflow_call (a maintainer /codex comment gated
|
|
# by check-write-access), so allow forks only on that path.
|
|
if [ "$IS_FORK" = "true" ] && [ -z "$INPUT_PR_NUMBER" ]; then
|
|
echo "Skipping Codex review for fork PR (automatic trigger)."
|
|
echo "skip=true" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
# An agent-driven PR flips to ready only after a clean /review round on
|
|
# a draft, marked by an author comment naming the head SHA (pr skill,
|
|
# "Review rounds"). Re-reviewing that same head on ready_for_review is
|
|
# redundant. The marker alone is author attestation, so also require
|
|
# reviewer evidence: a Codex review (posted by github-actions[bot], not
|
|
# forgeable by the author) that predates the marker and carries a
|
|
# non-blocking verdict. Comment-triggered and synchronize runs never
|
|
# skip. Keep the three copies of this check in sync (pr-ready-review /
|
|
# codex-pr-review / pi-pr-review); a shared local action would need the
|
|
# repo checked out before the check, which the fork paths here
|
|
# deliberately avoid.
|
|
if [ "$EVENT_ACTION" = "ready_for_review" ] && [ -z "$INPUT_PR_NUMBER" ]; then
|
|
# Fetch failures fail open (no skip): an API hiccup must run the
|
|
# review, never skip it or fail the job.
|
|
COMMENTS=$(gh api "repos/${{ github.repository }}/issues/$PR_NUMBER/comments?per_page=100" --paginate | jq -s '[.[][]]') || COMMENTS='[]'
|
|
MARKER_TIME=$(jq -r --arg author "$PR_AUTHOR" --arg marker "✅ Review round clean @ $HEAD_SHA" \
|
|
'[.[] | select(.user.login == $author) | select(.body | contains($marker)) | .created_at] | min // empty' <<<"$COMMENTS")
|
|
CODEX_VERDICT=''
|
|
if [ -n "$MARKER_TIME" ]; then
|
|
# Only Codex evidence that predates the marker counts: the ready-
|
|
# triggered Codex run itself posts after the flip and must not
|
|
# vouch for a sibling reviewer's skip.
|
|
CODEX_VERDICT=$(jq -r --arg mt "$MARKER_TIME" \
|
|
'[.[] | select(.user.login == "github-actions[bot]") | select(.body | contains("## Codex Review")) | select(.created_at < $mt)] | last | .body // ""' <<<"$COMMENTS" \
|
|
| grep -m1 -oE '(Good to merge|Mergeable, but should ideally address nits|Should address issues before merging)' || true)
|
|
fi
|
|
if [ -n "$MARKER_TIME" ] && [ -n "$CODEX_VERDICT" ] && [ "$CODEX_VERDICT" != "Should address issues before merging" ]; then
|
|
echo "Clean review round marker found for $HEAD_SHA with pre-marker non-blocking Codex verdict; skipping redundant review."
|
|
echo "skip=true" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
fi
|
|
# PR title/body are attacker-controlled free text. Use an unguessable
|
|
# per-run delimiter so a fork can't embed a fixed heredoc terminator to
|
|
# inject extra outputs — e.g. is_fork=false (last-write-wins), which
|
|
# would re-enable the EE checkout and trusted-path settings for forks.
|
|
RAND=$(head -c 16 /dev/urandom | od -An -tx1 | tr -d ' \n')
|
|
TITLE_EOF="TITLE_EOF_${RAND}"
|
|
BODY_EOF="BODY_EOF_${RAND}"
|
|
{
|
|
echo "skip=false"
|
|
echo "is_fork=$IS_FORK"
|
|
echo "pr_number=$PR_NUMBER"
|
|
echo "base_ref=$BASE_REF"
|
|
echo "base_sha=$BASE_SHA"
|
|
echo "head_sha=$HEAD_SHA"
|
|
echo "pr_author=$PR_AUTHOR"
|
|
echo "title<<$TITLE_EOF"
|
|
printf '%s\n' "$PR_TITLE"
|
|
echo "$TITLE_EOF"
|
|
echo "body<<$BODY_EOF"
|
|
printf '%s\n' "$PR_BODY"
|
|
echo "$BODY_EOF"
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Checkout repository
|
|
if: steps.codex_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
|
|
uses: actions/checkout@v5
|
|
with:
|
|
ref: refs/pull/${{ steps.pr.outputs.pr_number }}/merge
|
|
fetch-depth: 1
|
|
# Don't persist github.token in .git/config: the review agent can read
|
|
# the checkout, and on the fork path that token (issue/PR write) would
|
|
# otherwise be exfiltratable. All later git ops target the public origin
|
|
# and need no auth; EE checkout and gh use their own explicit tokens.
|
|
persist-credentials: false
|
|
|
|
# Never expose the EE private-repo token to untrusted fork code. Skipping
|
|
# this step leaves steps.ee.outputs.available empty, so the EE checkout and
|
|
# substitution steps below are skipped too.
|
|
- name: Check EE access
|
|
if: steps.codex_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true' && steps.pr.outputs.is_fork != 'true'
|
|
id: ee
|
|
env:
|
|
EE_TOKEN: ${{ secrets.WINDMILL_EE_PRIVATE_ACCESS }}
|
|
run: |
|
|
if [ -n "$EE_TOKEN" ]; then
|
|
echo "available=true" >> "$GITHUB_OUTPUT"
|
|
echo "ee_repo_ref=$(cat ./backend/ee-repo-ref.txt)" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "available=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Checkout EE repository
|
|
if: steps.ee.outputs.available == 'true'
|
|
uses: actions/checkout@v5
|
|
with:
|
|
repository: windmill-labs/windmill-ee-private
|
|
path: ./windmill-ee-private
|
|
ref: ${{ steps.ee.outputs.ee_repo_ref }}
|
|
token: ${{ secrets.WINDMILL_EE_PRIVATE_ACCESS }}
|
|
fetch-depth: 1
|
|
|
|
- name: Substitute EE code
|
|
if: steps.ee.outputs.available == 'true'
|
|
run: ./backend/substitute_ee_code.sh --copy --dir ./windmill-ee-private
|
|
|
|
- name: Set up Node.js
|
|
if: steps.codex_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
|
|
- name: Install Codex CLI
|
|
if: steps.codex_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
|
|
run: npm install --global @openai/codex@0.144.1
|
|
|
|
- name: Configure Codex auth
|
|
if: steps.codex_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
|
|
env:
|
|
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
|
|
CODEX_AUTH_JSON: ${{ secrets.CODEX_AUTH_JSON }}
|
|
run: |
|
|
CODEX_HOME="$HOME/.codex"
|
|
echo "CODEX_HOME=$CODEX_HOME" >> "$GITHUB_ENV"
|
|
mkdir -p "$CODEX_HOME"
|
|
chmod 700 "$CODEX_HOME"
|
|
cat > "$CODEX_HOME/config.toml" <<'EOF'
|
|
cli_auth_credentials_store = "file"
|
|
EOF
|
|
if [ -n "$OPENAI_API_KEY" ]; then
|
|
printf '%s' "$OPENAI_API_KEY" | codex login --with-api-key
|
|
else
|
|
printf '%s' "$CODEX_AUTH_JSON" > "$CODEX_HOME/auth.json"
|
|
chmod 600 "$CODEX_HOME/auth.json"
|
|
node -e 'JSON.parse(require("fs").readFileSync(process.argv[1], "utf8"))' "$CODEX_HOME/auth.json"
|
|
fi
|
|
|
|
- name: Pre-fetch base and head refs for the PR
|
|
if: steps.codex_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
|
|
env:
|
|
PR_BASE_REF: ${{ steps.pr.outputs.base_ref }}
|
|
PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
|
|
run: |
|
|
git fetch --no-tags origin \
|
|
"$PR_BASE_REF" \
|
|
"+refs/pull/$PR_NUMBER/head"
|
|
|
|
- name: Fetch prior PR discussion
|
|
if: steps.codex_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
REPO: ${{ github.repository }}
|
|
PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
|
|
run: |
|
|
# Write outside the checkout: on the fork path the merge tree is
|
|
# attacker-controlled, and a committed symlink at this path would
|
|
# redirect the write.
|
|
gh api "repos/$REPO/issues/$PR_NUMBER/comments?per_page=100" \
|
|
--jq '[.[] | {user: .user.login, created_at: .created_at, body: (.body | .[:4000])}] | sort_by(.created_at) | .[-20:]' \
|
|
> "$RUNNER_TEMP/prior-comments.json" || echo "[]" > "$RUNNER_TEMP/prior-comments.json"
|
|
|
|
- name: Write Codex review context
|
|
if: steps.codex_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
|
|
env:
|
|
PR_REPOSITORY: ${{ github.repository }}
|
|
PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
|
|
PR_BASE_SHA: ${{ steps.pr.outputs.base_sha }}
|
|
PR_HEAD_SHA: ${{ steps.pr.outputs.head_sha }}
|
|
PR_TITLE: ${{ steps.pr.outputs.title }}
|
|
PR_BODY: ${{ steps.pr.outputs.body }}
|
|
PR_AUTHOR: ${{ steps.pr.outputs.pr_author }}
|
|
EXTRA_PROMPT: ${{ inputs.extra_prompt }}
|
|
run: |
|
|
node <<'NODE'
|
|
const fs = require('fs');
|
|
const tmp = process.env.RUNNER_TEMP;
|
|
const lines = [
|
|
`Repository: ${process.env.PR_REPOSITORY}`,
|
|
`PR number: ${process.env.PR_NUMBER}`,
|
|
];
|
|
if (process.env.PR_AUTHOR) {
|
|
lines.push(`PR AUTHOR: ${process.env.PR_AUTHOR}`);
|
|
}
|
|
lines.push(
|
|
`Base SHA: ${process.env.PR_BASE_SHA}`,
|
|
`Head SHA: ${process.env.PR_HEAD_SHA}`,
|
|
'',
|
|
'PR title:',
|
|
process.env.PR_TITLE || '(empty)',
|
|
'',
|
|
'PR body:',
|
|
process.env.PR_BODY || '(empty)',
|
|
'',
|
|
'Changed commits command:',
|
|
`git log --oneline ${process.env.PR_BASE_SHA}...${process.env.PR_HEAD_SHA}`,
|
|
'',
|
|
'Changed files command:',
|
|
`git diff --stat ${process.env.PR_BASE_SHA}...${process.env.PR_HEAD_SHA}`,
|
|
'',
|
|
'Full review diff command:',
|
|
`git diff --unified=0 ${process.env.PR_BASE_SHA}...${process.env.PR_HEAD_SHA}`
|
|
);
|
|
if (process.env.EXTRA_PROMPT && process.env.EXTRA_PROMPT.trim()) {
|
|
lines.push('', 'Additional reviewer instructions:', process.env.EXTRA_PROMPT.trim());
|
|
}
|
|
if (fs.existsSync(`${tmp}/prior-comments.json`)) {
|
|
try {
|
|
const comments = JSON.parse(fs.readFileSync(`${tmp}/prior-comments.json`, 'utf8'));
|
|
if (Array.isArray(comments) && comments.length > 0) {
|
|
lines.push(
|
|
'',
|
|
'Prior PR discussion (most recent up to 20 comments):',
|
|
'',
|
|
'If you have already reviewed this PR (look for your own earlier "## Codex Review" comment), focus on what changed since then per the diff and respect any decisions the human made in replies. Do not re-flag findings the human already pushed back on.',
|
|
''
|
|
);
|
|
for (const c of comments) {
|
|
lines.push(`### @${c.user} (${c.created_at})`, '', c.body, '', '---', '');
|
|
}
|
|
}
|
|
} catch (_) {}
|
|
}
|
|
fs.writeFileSync(`${tmp}/pr-review-context.md`, `${lines.join('\n')}\n`);
|
|
NODE
|
|
|
|
- name: Run Codex review
|
|
if: steps.codex_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
|
|
env:
|
|
PR_IS_FORK: ${{ steps.pr.outputs.is_fork }}
|
|
PR_BASE_REF: ${{ steps.pr.outputs.base_ref }}
|
|
run: |
|
|
if [ "$PR_IS_FORK" = "true" ]; then
|
|
# Fork code is untrusted. Read the review policy/prompt from the base
|
|
# ref (git show) rather than the attacker-controlled merge checkout,
|
|
# so a malicious fork can't rewrite the reviewer's own instructions,
|
|
# and run in a network-disabled sandbox to block secret exfiltration.
|
|
git show "origin/$PR_BASE_REF:REVIEW.md" > /tmp/codex-prompt.md
|
|
git show "origin/$PR_BASE_REF:.github/codex/pr-review.prompt.md" >> /tmp/codex-prompt.md
|
|
SANDBOX_MODE=workspace-write
|
|
else
|
|
cat REVIEW.md .github/codex/pr-review.prompt.md > /tmp/codex-prompt.md
|
|
SANDBOX_MODE=danger-full-access
|
|
fi
|
|
# The context file lives in RUNNER_TEMP (outside the attacker-controlled
|
|
# checkout); tell the agent its absolute path.
|
|
printf '\nReview context file (absolute path): %s\n' "$RUNNER_TEMP/pr-review-context.md" >> /tmp/codex-prompt.md
|
|
# Write the final message outside the checkout too: a fork could commit
|
|
# codex-final-message.md as a symlink and redirect this write to overwrite
|
|
# e.g. a GitHub Action's index.js, which then runs with our credentials.
|
|
codex exec \
|
|
-C "$GITHUB_WORKSPACE" \
|
|
-m gpt-5.6-sol \
|
|
-c 'model_reasoning_effort="xhigh"' \
|
|
-s "$SANDBOX_MODE" \
|
|
-o "$RUNNER_TEMP/codex-final-message.md" \
|
|
- < /tmp/codex-prompt.md
|
|
|
|
- name: Post Codex review comment
|
|
if: steps.codex_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
|
|
uses: actions/github-script@v7
|
|
env:
|
|
PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
|
|
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
|
|
CODEX_AUTH_JSON: ${{ secrets.CODEX_AUTH_JSON }}
|
|
GH_JOB_TOKEN: ${{ github.token }}
|
|
with:
|
|
github-token: ${{ github.token }}
|
|
script: |
|
|
const fs = require('fs');
|
|
const path = `${process.env.RUNNER_TEMP}/codex-final-message.md`;
|
|
if (!fs.existsSync(path)) {
|
|
core.info('Codex did not produce a final message; skipping PR comment.');
|
|
return;
|
|
}
|
|
let body = fs.readFileSync(path, 'utf8').trim();
|
|
if (!body) {
|
|
core.info('Codex final message was empty; skipping PR comment.');
|
|
return;
|
|
}
|
|
// Defense-in-depth for fork reviews: the model call needs the provider
|
|
// credential in the env, and the posted comment bypasses Actions log
|
|
// masking. Strip any credential (API key, raw auth JSON, nested
|
|
// tokens) that leaked into the review text before posting.
|
|
const secrets = [];
|
|
const addSecret = (v, min) => {
|
|
if (typeof v === 'string' && v.length >= min) secrets.push(v);
|
|
};
|
|
addSecret(process.env.OPENAI_API_KEY, 8);
|
|
addSecret(process.env.CODEX_AUTH_JSON, 8);
|
|
addSecret(process.env.GH_JOB_TOKEN, 8);
|
|
if (process.env.CODEX_AUTH_JSON) {
|
|
try {
|
|
const collect = (o) => {
|
|
if (typeof o === 'string') addSecret(o, 20);
|
|
else if (Array.isArray(o)) o.forEach(collect);
|
|
else if (o && typeof o === 'object') Object.values(o).forEach(collect);
|
|
};
|
|
collect(JSON.parse(process.env.CODEX_AUTH_JSON));
|
|
} catch (_) {}
|
|
}
|
|
for (const s of [...new Set(secrets)].sort((a, b) => b.length - a.length)) {
|
|
body = body.split(s).join('[REDACTED]');
|
|
}
|
|
body = body.trim();
|
|
if (!body) {
|
|
core.info('Codex final message was empty after redaction; skipping PR comment.');
|
|
return;
|
|
}
|
|
await github.rest.issues.createComment({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
issue_number: Number(process.env.PR_NUMBER),
|
|
body,
|
|
});
|