[codex] Add org health dashboard and reusable PR review support

[Pigbibi]

Summary

• add authenticated /v1/ai/org-health for core QuantStrategyLab Actions health
• add dashboard organization health card and allowed proxy route
• make Codex PR Review reusable across consumer repos by separating source and bridge checkouts

Validation

• python3 -m pytest -q
• python3 -m ruff check .
• actionlint -oneline .github/workflows/*.yml
• node --test cloudflare/ai-gateway-dash/tests/index.test.mjs
• python3 -m compileall service scripts
• git diff --check

Notes

• Consumer repos that call the reusable workflow may need a token with read access to QuantStrategyLab/AIAuditBridge, for example CODEX_AUDIT_REUSABLE_WORKFLOW_TOKEN.

[github-actions]

🤖 Codex PR Review

🚫 Merge blocked: 1 serious issue(s) found in high-risk files

🚫 Blocking Issues

These issues must be fixed before this PR can be merged:

1. 🔴 [CRITICAL] Security in .github/workflows/codex_pr_review.yml

The workflow still runs on pull_request, which means the workflow definition is taken from the PR's merge context rather than a trusted default-branch copy. A PR author can therefore edit .github/workflows/codex_pr_review.yml itself to add arbitrary steps before Checkout bridge review scripts and exfiltrate OPENAI_API_KEY, ANTHROPIC_API_KEY, or CODEX_AUDIT_REUSABLE_WORKFLOW_TOKEN on same-repo PRs, so the new split checkout does not actually establish a trusted review boundary. (line 8)

Suggestion: Move the secret-bearing review job to a trusted trigger such as pull_request_target or a default-branch workflow_run/dispatcher flow, and ensure the trusted workflow never executes PR-controlled steps before secrets are consumed.

ℹ️ Other Findings

1. 🟡 [MEDIUM] Reliability in service/ai_gateway_service.py

/v1/ai/org-health returns HTTP 503 whenever CODEX_AUDIT_SERVICE_GITHUB_TOKEN is not configured, even though the feature is optional and the dashboard explicitly treats that state as a normal 'unavailable' card. Because the dashboard polls every 30 seconds, this will generate continuous 5xx traffic and can distort error-rate alerts/SLOs for a service that is otherwise healthy. (line 619)

Suggestion: Return HTTP 200 with a payload status like unavailable for the 'token not configured' case, or hide/disable the route until the integration is configured so optional feature absence does not count as server failure.

2. 🟡 [MEDIUM] Performance in service/org_health.py

A cold read_org_health() refresh synchronously walks every workflow in every configured repository and can fetch up to three pages of runs per workflow before responding. With the default 12 repos, a repository that has many active workflows can turn a single dashboard refresh into hundreds of GitHub API calls and minutes of wall-clock time under timeout conditions, tying up request threads and pushing the shared GitHub token toward rate limits. (line 190)

Suggestion: Take org-health collection out of the request path or cap the fan-out aggressively: monitor an explicit workflow allowlist, limit workflows per repo, keep serving stale data while a background refresh runs, and enforce an overall per-request deadline instead of per-call timeouts only.

---

Review by Codex PR Review bot • PR

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.