Add health-driven automation decisions #160
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Codex PR Review | |
| # Runs on PRs AND can be called as a reusable workflow from other repos. | |
| # Consumer repos use: | |
| # uses: QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@main | |
| # secrets: inherit | |
| on: | |
| pull_request_target: | |
| types: [opened, synchronize, reopened] | |
| workflow_call: | |
| inputs: | |
| caller_concurrency_key: | |
| description: "Stable caller-side key used to cancel stale review jobs for the same PR." | |
| required: false | |
| type: string | |
| allow_unconfigured_backend: | |
| description: "Allow the review job to pass with a human-review note when no AI backend is configured in the caller repository." | |
| required: false | |
| type: boolean | |
| default: false | |
| api_fallback_enabled: | |
| description: "Optional true/false override for direct API fallback after a recoverable Codex service failure. Empty defers to repository variables." | |
| required: false | |
| type: string | |
| default: "" | |
| direct_api_primary_enabled: | |
| description: "Optional true/false override for API-only PR review when CODEX_AUDIT_SERVICE_URL is not configured. Empty defers to repository variables." | |
| required: false | |
| type: string | |
| default: "" | |
| secrets: | |
| CODEX_AUDIT_REUSABLE_WORKFLOW_TOKEN: | |
| description: "Token that can read QuantStrategyLab/AIAuditBridge when this workflow is called from another private repo." | |
| required: false | |
| ANTHROPIC_API_KEY: | |
| required: false | |
| OPENAI_API_KEY: | |
| required: false | |
| CODEX_AUDIT_SERVICE_URL: | |
| required: false | |
| permissions: | |
| contents: read | |
| id-token: write | |
| issues: write | |
| pull-requests: write | |
| concurrency: | |
| group: codex-pr-review-${{ github.repository }}-${{ inputs.caller_concurrency_key || github.event.pull_request.number || github.run_id }} | |
| cancel-in-progress: true | |
| jobs: | |
| review: | |
| if: github.event_name != 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" | |
| steps: | |
| - name: Checkout review target | |
| uses: actions/checkout@v6 | |
| with: | |
| path: source | |
| ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }} | |
| persist-credentials: false | |
| - name: Checkout bridge review scripts | |
| uses: actions/checkout@v6 | |
| with: | |
| repository: ${{ github.repository == 'QuantStrategyLab/AIAuditBridge' && 'QuantStrategyLab/AIAuditBridge' || job.workflow_repository }} | |
| ref: ${{ github.repository == 'QuantStrategyLab/AIAuditBridge' && github.event.pull_request.base.sha || job.workflow_sha }} | |
| path: bridge | |
| token: ${{ secrets.CODEX_AUDIT_REUSABLE_WORKFLOW_TOKEN || github.token }} | |
| persist-credentials: false | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.11" | |
| - name: Run Codex PR Review | |
| id: review | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} | |
| ANTHROPIC_MODEL: ${{ vars.ANTHROPIC_MODEL || 'claude-sonnet-4-6' }} | |
| OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} | |
| OPENAI_MODEL: ${{ vars.OPENAI_MODEL || 'gpt-5.4-mini' }} | |
| CODEX_AUDIT_SERVICE_URL: ${{ secrets.CODEX_AUDIT_SERVICE_URL }} | |
| CODEX_AUDIT_SERVICE_AUDIENCE: ${{ vars.CODEX_AUDIT_SERVICE_AUDIENCE || 'quant-codex-audit' }} | |
| CODEX_PR_REVIEW_REPO_ROOT: ${{ github.workspace }}/source | |
| CODEX_PR_REVIEW_ALLOW_UNCONFIGURED_BACKEND: ${{ inputs.allow_unconfigured_backend || 'false' }} | |
| CODEX_PR_REVIEW_API_FALLBACK_ENABLED: ${{ github.event_name == 'workflow_call' && inputs.api_fallback_enabled != '' && inputs.api_fallback_enabled || vars.CODEX_PR_REVIEW_API_FALLBACK_ENABLED || 'true' }} | |
| CODEX_PR_REVIEW_DIRECT_API_PRIMARY_ENABLED: ${{ github.event_name == 'workflow_call' && inputs.direct_api_primary_enabled != '' && inputs.direct_api_primary_enabled || vars.CODEX_PR_REVIEW_DIRECT_API_PRIMARY_ENABLED || 'true' }} | |
| working-directory: source | |
| run: | | |
| set -euo pipefail | |
| bridge_script="${GITHUB_WORKSPACE}/bridge/scripts/run_codex_pr_review.py" | |
| if [ -f "${bridge_script}" ]; then | |
| script_path="${bridge_script}" | |
| else | |
| echo "::error::Trusted Codex review script not found. Ensure the bridge checkout can read QuantStrategyLab/AIAuditBridge." >&2 | |
| exit 1 | |
| fi | |
| python "${script_path}" | |
| - name: Upload review diagnostics | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: codex-pr-review-${{ github.event.pull_request.number || github.run_id }}-${{ github.run_id }} | |
| path: source/data/output/codex_pr_review/ | |
| if-no-files-found: warn |