chore: dispatch renamed codex audit workflow

Author: Pigbibi

.github/workflows/monthly_publish.yml

@@ -34,11 +34,12 @@ jobs:
       GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID }}
       GCS_BUCKET: ${{ vars.GCS_BUCKET }}
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-      SELFHOSTED_CODEX_REVIEW_ENABLED: ${{ vars.SELFHOSTED_CODEX_REVIEW_ENABLED || 'true' }}
-      SELFHOSTED_CODEX_REVIEW_REPOSITORY: ${{ vars.SELFHOSTED_CODEX_REVIEW_REPOSITORY || 'QuantStrategyLab/CodexAuditBridge' }}
-      SELFHOSTED_CODEX_REVIEW_MODE: ${{ vars.SELFHOSTED_CODEX_REVIEW_MODE || 'review_and_fix' }}
-      SELFHOSTED_CODEX_REVIEW_PROVIDER: ${{ vars.SELFHOSTED_CODEX_REVIEW_PROVIDER || 'auto' }}
-      SELFHOSTED_CODEX_REVIEW_AUTO_MERGE: ${{ vars.SELFHOSTED_CODEX_REVIEW_AUTO_MERGE || 'false' }}
+      CODEX_AUDIT_ENABLED: ${{ vars.CODEX_AUDIT_ENABLED || 'true' }}
+      CODEX_AUDIT_BRIDGE_REPOSITORY: ${{ vars.CODEX_AUDIT_BRIDGE_REPOSITORY || 'QuantStrategyLab/CodexAuditBridge' }}
+      CODEX_AUDIT_BRIDGE_REF: ${{ vars.CODEX_AUDIT_BRIDGE_REF || 'main' }}
+      CODEX_AUDIT_MODE: ${{ vars.CODEX_AUDIT_MODE || 'review_and_fix' }}
+      CODEX_AUDIT_PROVIDER: ${{ vars.CODEX_AUDIT_PROVIDER || 'auto' }}
+      CODEX_AUDIT_AUTO_MERGE: ${{ vars.CODEX_AUDIT_AUTO_MERGE || 'false' }}
 
     steps:
       - name: Checkout
@@ -177,9 +178,9 @@ jobs:
               print(f"issue_url={issue['html_url']}", file=output)
           PY
 
-      - name: Detect Self-hosted Review GitHub App Credentials
+      - name: Detect Codex Audit GitHub App Credentials
         id: codex_review_app_credentials
-        if: success() && env.PUBLISH_ENABLED != 'false' && env.SELFHOSTED_CODEX_REVIEW_ENABLED != 'false'
+        if: success() && env.PUBLISH_ENABLED != 'false' && env.CODEX_AUDIT_ENABLED != 'false'
         env:
           APP_ID: ${{ vars.CROSS_REPO_GITHUB_APP_ID }}
           APP_PRIVATE_KEY: ${{ secrets.CROSS_REPO_GITHUB_APP_PRIVATE_KEY }}
@@ -191,7 +192,7 @@ jobs:
             echo "available=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Create GitHub App Token For Self-hosted Review
+      - name: Create GitHub App Token For Codex Audit
         id: codex_review_app_token
         if: steps.codex_review_app_credentials.outputs.available == 'true'
         continue-on-error: true
@@ -214,11 +215,11 @@ jobs:
           GITHUB_REF_NAME: ${{ github.ref_name }}
           ISSUE_NUMBER: ${{ steps.review_issue.outputs.issue_number }}
           ISSUE_URL: ${{ steps.review_issue.outputs.issue_url }}
-          TARGET_REPOSITORY: ${{ env.SELFHOSTED_CODEX_REVIEW_REPOSITORY }}
-          REVIEW_MODE: ${{ env.SELFHOSTED_CODEX_REVIEW_MODE }}
-          REVIEW_PROVIDER: ${{ env.SELFHOSTED_CODEX_REVIEW_PROVIDER }}
-          AUTO_MERGE: ${{ env.SELFHOSTED_CODEX_REVIEW_AUTO_MERGE }}
-          CODEX_REVIEW_ENABLED: ${{ env.SELFHOSTED_CODEX_REVIEW_ENABLED }}
+          TARGET_REPOSITORY: ${{ env.CODEX_AUDIT_BRIDGE_REPOSITORY }}
+          REVIEW_MODE: ${{ env.CODEX_AUDIT_MODE }}
+          REVIEW_PROVIDER: ${{ env.CODEX_AUDIT_PROVIDER }}
+          AUTO_MERGE: ${{ env.CODEX_AUDIT_AUTO_MERGE }}
+          CODEX_AUDIT_ENABLED_RUNTIME: ${{ env.CODEX_AUDIT_ENABLED }}
         run: |
           set -euo pipefail
           python - <<'PY'
@@ -251,19 +252,19 @@ jobs:
               token = os.environ.get("APP_TOKEN", "").strip() or os.environ.get("CODEX_AUDIT_DISPATCH_TOKEN", "").strip()
               if not token:
                   raise RuntimeError(
-                      "Codex review workflow dispatch requires either a GitHub App token or CODEX_AUDIT_DISPATCH_TOKEN"
+                      "Codex audit workflow dispatch requires either a GitHub App token or CODEX_AUDIT_DISPATCH_TOKEN"
                   )
               target_repository = os.environ["TARGET_REPOSITORY"].strip()
               if not re.fullmatch(r"[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+", target_repository):
-                  raise RuntimeError(f"Invalid Codex review repository: {target_repository!r}")
+                  raise RuntimeError(f"Invalid Codex audit repository: {target_repository!r}")
               mode = os.environ["REVIEW_MODE"].strip() or "review_and_fix"
               if mode not in {"review_only", "review_and_fix"}:
-                  raise RuntimeError(f"Unsupported Codex review mode: {mode}")
+                  raise RuntimeError(f"Unsupported Codex audit mode: {mode}")
               provider = os.environ["REVIEW_PROVIDER"].strip() or "codex"
               if provider not in {"api", "anthropic", "codex", "openai", "auto"}:
-                  raise RuntimeError(f"Unsupported Codex review provider: {provider}")
+                  raise RuntimeError(f"Unsupported Codex audit provider: {provider}")
               payload = {
-                  "ref": "main",
+                  "ref": os.environ["CODEX_AUDIT_BRIDGE_REF"],
                   "inputs": {
                       "source_repo": os.environ["GITHUB_REPOSITORY"],
                       "source_ref": os.environ["GITHUB_REF_NAME"],
@@ -275,7 +276,7 @@ jobs:
               }
               status = dispatch(
                   token,
-                  f"https://api.github.com/repos/{target_repository}/actions/workflows/selfhosted_monthly_review.yml/dispatches",
+                  f"https://api.github.com/repos/{target_repository}/actions/workflows/codex_audit.yml/dispatches",
                   payload,
               )
               if status not in (201, 204):
@@ -285,11 +286,11 @@ jobs:
                   f"to {target_repository}"
               )
 
-          if enabled("CODEX_REVIEW_ENABLED"):
+          if enabled("CODEX_AUDIT_ENABLED_RUNTIME"):
               dispatch_codex()
               raise SystemExit(0)
 
-          raise RuntimeError("Monthly review bridge dispatch is disabled by SELFHOSTED_CODEX_REVIEW_ENABLED=false")
+          raise RuntimeError("Codex audit bridge dispatch is disabled by CODEX_AUDIT_ENABLED=false")
           PY
 
       - name: Write Release Heartbeat

README.zh-CN.md

@@ -32,7 +32,7 @@ Live-pool artifact 的作用是让策略判断可复现：包括 ranking 输入
 
 ## 月度 review 自动化
 
-月度 publish workflow 通过 `CodexAuditBridge` 触发自动 review 和 remediation；`SELFHOSTED_CODEX_REVIEW_PROVIDER` 默认走 `auto`，优先使用 self-hosted Codex 路径，再按桥接仓库配置 fallback 到 API reviewer。`OPENAI_API_KEY` 和 `ANTHROPIC_API_KEY` 等 provider secret 配置在 `CodexAuditBridge`，本仓库不直接读取这些 provider key。
+月度 publish workflow 通过 `CodexAuditBridge` 触发自动 review 和 remediation；`CODEX_AUDIT_PROVIDER` 默认走 `auto`，优先调用 CodexAuditBridge 的 HTTPS/443 service-backed Codex 路径，再按桥接仓库配置 fallback 到 API reviewer。`OPENAI_API_KEY` 和 `ANTHROPIC_API_KEY` 等 provider secret 配置在 `CodexAuditBridge`，本仓库不直接读取这些 provider key。可通过 `CODEX_AUDIT_BRIDGE_REF` pin 到指定 bridge ref，默认 `main`。
 
 生产发布目标如 GCP project、GCS bucket 和 Firestore document 必须从 GitHub variable 读取。本仓库不再保留 source-local `ai_review.yml`；旧的本仓库本地 API review workflow 已移除，provider 选择和 fallback 逻辑集中在 `CodexAuditBridge`。
 

docs/operator_runbook.md

@@ -82,7 +82,7 @@ Boundary rules:
 
 ## Monthly Codex Remediation
 
-The monthly publish workflow creates a `monthly-review` issue, then dispatches `CodexAuditBridge` as the automated review and remediation path. The bridge owns provider selection through `SELFHOSTED_CODEX_REVIEW_PROVIDER`: `auto` is the default and runs the self-hosted Codex path first, falls back to the configured API reviewers when Codex setup or execution fails, and fails loudly when no API fallback key is configured. `codex` disables API fallback; `api` posts a combined API review; `openai` and `anthropic` post a single-provider API review only.
+The monthly publish workflow creates a `monthly-review` issue, then dispatches `CodexAuditBridge` as the automated review and remediation path. The bridge owns provider selection through `CODEX_AUDIT_PROVIDER`: `auto` is the default and calls the service-backed Codex path first, falls back to the configured API reviewers when Codex service execution fails, and fails loudly when no API fallback key is configured. `codex` disables API fallback; `api` posts a combined API review; `openai` and `anthropic` post a single-provider API review only. Set `CODEX_AUDIT_BRIDGE_REF` to pin the bridge workflow ref; the default is `main`.
 
 If the bridge dispatch fails, the monthly publish workflow fails loudly. Source-local legacy AI review workflows are intentionally removed; provider fallback lives in `CodexAuditBridge`.
 

tests/test_monthly_publish_workflow_config.py

@@ -37,7 +37,9 @@ def test_monthly_review_issue_creation_does_not_require_gh_cli(self) -> None:
         self.assertIn('GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}', workflow)
         self.assertNotIn("GITHUB_OUTPUT: ${{ github.output }}", workflow)
         self.assertIn("issue_number=", workflow)
-        self.assertIn("SELFHOSTED_CODEX_REVIEW_REPOSITORY", workflow)
+        self.assertIn("CODEX_AUDIT_BRIDGE_REPOSITORY", workflow)
+        self.assertIn("CODEX_AUDIT_BRIDGE_REF", workflow)
+        self.assertIn('"ref": os.environ["CODEX_AUDIT_BRIDGE_REF"]', workflow)
         self.assertIn("QuantStrategyLab/CodexAuditBridge", workflow)
         self.assertIn("CROSS_REPO_GITHUB_APP_ID", workflow)
         self.assertIn("CROSS_REPO_GITHUB_APP_PRIVATE_KEY", workflow)
@@ -47,17 +49,17 @@ def test_monthly_review_issue_creation_does_not_require_gh_cli(self) -> None:
         self.assertIn("APP_TOKEN", workflow)
         self.assertIn("Trigger Monthly Review Automation", workflow)
         self.assertIn("CODEX_AUDIT_DISPATCH_TOKEN", workflow)
-        self.assertIn("SELFHOSTED_CODEX_REVIEW_PROVIDER", workflow)
-        self.assertIn("SELFHOSTED_CODEX_REVIEW_PROVIDER || 'auto'", workflow)
+        self.assertIn("CODEX_AUDIT_PROVIDER", workflow)
+        self.assertIn("CODEX_AUDIT_PROVIDER || 'auto'", workflow)
         self.assertIn("REVIEW_PROVIDER", workflow)
         self.assertIn('"provider": provider', workflow)
         self.assertIn('"anthropic"', workflow)
         self.assertIn('"api"', workflow)
         self.assertNotIn("ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}", workflow)
         self.assertNotIn("OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}", workflow)
         self.assertNotIn("legacy API review fallback", workflow)
-        self.assertIn("selfhosted_monthly_review.yml", workflow)
-        self.assertIn("/actions/workflows/selfhosted_monthly_review.yml/dispatches", workflow)
+        self.assertIn("codex_audit.yml", workflow)
+        self.assertIn("/actions/workflows/codex_audit.yml/dispatches", workflow)
         self.assertNotIn("/repos/{target_repository}/dispatches", workflow)
         self.assertNotIn("LEGACY_API_REVIEW_ENABLED", workflow)
         self.assertNotIn("/actions/workflows/ai_review.yml/dispatches", workflow)
@@ -76,7 +78,7 @@ def test_chinese_readme_matches_current_monthly_review_defaults(self) -> None:
         readme = README_ZH_PATH.read_text(encoding="utf-8")
 
         self.assertIn("CodexAuditBridge", readme)
-        self.assertIn("SELFHOSTED_CODEX_REVIEW_PROVIDER", readme)
+        self.assertIn("CODEX_AUDIT_PROVIDER", readme)
         self.assertIn("OPENAI_API_KEY", readme)
         self.assertIn("ANTHROPIC_API_KEY", readme)
         self.assertIn("配置在 `CodexAuditBridge`", readme)