Skip to content

Commit 899135e

Browse files
Pigbibiclaude
Pigbibi
and
claude
committed
chore: sync CI workflows and auto-generated files
Co-Authored-By: Claude <noreply@anthropic.com>
1 parent e8fc1da commit 899135e

9 files changed

Lines changed: 1514 additions & 0 deletions

‎.github/codex_auto_merge_policy.json‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"version": 1,
3+
"auto_merge_label": "auto-merge-ok",
4+
"human_review_label": "human-review-required",
5+
"monthly_marker_prefix": "<!-- codex-monthly-remediation:issue-",
6+
"blocked_path_patterns": [
7+
"(^|/)(\\.env|.*secret.*|.*credential.*|.*token.*|.*private.*|.*\\.pem|.*\\.key)$"
8+
],
9+
"risk_policy": {
10+
"low": {
11+
"prefixes": [
12+
"docs/",
13+
"tests/"
14+
],
15+
"exact": [
16+
"README.md",
17+
"README.zh-CN.md"
18+
],
19+
"reason": "docs/tests/readme-only changes"
20+
},
21+
"high": {
22+
"reason": "source code changes require review"
23+
}
24+
},
25+
"max_changed_files": 30,
26+
"max_changed_lines": 2000,
27+
"pr_review": {
28+
"enabled": true,
29+
"block_severities": [
30+
"critical",
31+
"high"
32+
],
33+
"skip_paths": [
34+
"docs/**",
35+
"**.md",
36+
"**.txt",
37+
"**.json",
38+
"**.csv",
39+
"LICENSE",
40+
".github/dependabot*"
41+
],
42+
"skip_risk_levels": [
43+
"low"
44+
],
45+
"timeout_minutes": 20,
46+
"max_diff_lines": 2400,
47+
"block_on_review_failure": false
48+
}
49+
}

‎.github/workflows/codex_pr_review.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
name: Codex PR Review
2+
3+
# Always run on PRs to guarantee a check run exists for branch protection.
4+
# The Python script handles skip logic internally for trivial changes.
5+
on:
6+
pull_request:
7+
types: [opened, synchronize, reopened]
8+
9+
permissions:
10+
contents: read
11+
id-token: write
12+
issues: write
13+
pull-requests: write
14+
15+
concurrency:
16+
group: codex-pr-review-${{ github.event.pull_request.number }}
17+
cancel-in-progress: true
18+
19+
jobs:
20+
review:
21+
runs-on: ubuntu-latest
22+
timeout-minutes: 30
23+
env:
24+
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
25+
26+
steps:
27+
- name: Checkout
28+
uses: actions/checkout@v6
29+
30+
- name: Set up Python
31+
uses: actions/setup-python@v6
32+
with:
33+
python-version: "3.11"
34+
35+
- name: Run Codex PR Review
36+
id: review
37+
env:
38+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
39+
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
40+
ANTHROPIC_MODEL: ${{ vars.ANTHROPIC_MODEL || 'claude-sonnet-4-6' }}
41+
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
42+
OPENAI_MODEL: ${{ vars.OPENAI_MODEL || 'gpt-5.4-mini' }}
43+
CODEX_AUDIT_SERVICE_URL: ${{ secrets.CODEX_AUDIT_SERVICE_URL }}
44+
CODEX_AUDIT_SERVICE_AUDIENCE: ${{ vars.CODEX_AUDIT_SERVICE_AUDIENCE || 'quant-codex-audit' }}
45+
run: python scripts/run_codex_pr_review.py
46+
47+
- name: Upload review diagnostics
48+
if: always()
49+
uses: actions/upload-artifact@v7
50+
with:
51+
name: codex-pr-review-${{ github.event.pull_request.number }}-${{ github.run_id }}
52+
path: data/output/codex_pr_review/
53+
if-no-files-found: warn

‎.github/workflows/codex_review_gate.yml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
name: Codex Review Gate
2+
3+
# Two-mode gate for the Codex GitHub App (chatgpt-codex-connector):
4+
#
5+
# 1. WAIT mode (PR opened/synchronized):
6+
# Creates a pending check → polls for Codex review up to N minutes.
7+
# If Codex responds → check reflects review state.
8+
# If Codex times out → check passes (don't block when App is broken).
9+
#
10+
# 2. REACT mode (Codex submits review):
11+
# Updates check instantly — CHANGES_REQUESTED → fail, APPROVED → pass.
12+
#
13+
# No API keys needed — reads the App's review via GitHub API.
14+
15+
on:
16+
pull_request:
17+
types: [opened, synchronize, reopened, ready_for_review]
18+
pull_request_review:
19+
types: [submitted]
20+
21+
permissions:
22+
contents: read
23+
pull-requests: read
24+
25+
concurrency:
26+
group: codex-review-gate-${{ github.event.pull_request.number }}
27+
cancel-in-progress: true
28+
29+
jobs:
30+
gate:
31+
if: >
32+
github.event_name == 'pull_request_review'
33+
&& github.event.review.user.login == 'chatgpt-codex-connector[bot]'
34+
|| github.event_name == 'pull_request'
35+
&& github.event.pull_request.draft == false
36+
37+
runs-on: ubuntu-latest
38+
timeout-minutes: 15
39+
env:
40+
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
41+
CODEX_GATE_POLL_SECONDS: ${{ vars.CODEX_GATE_POLL_SECONDS || '30' }}
42+
CODEX_GATE_MAX_WAIT_MINUTES: ${{ vars.CODEX_GATE_MAX_WAIT_MINUTES || '5' }}
43+
44+
steps:
45+
- name: Checkout
46+
uses: actions/checkout@v6
47+
48+
- name: Set up Python
49+
uses: actions/setup-python@v6
50+
with:
51+
python-version: "3.11"
52+
53+
- name: Evaluate Codex Review Gate
54+
id: gate
55+
env:
56+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
57+
run: python scripts/gate_codex_app_review.py
58+
59+
- name: Upload gate diagnostics
60+
if: always()
61+
uses: actions/upload-artifact@v7
62+
with:
63+
name: codex-review-gate-${{ github.event.pull_request.number || github.run_id }}
64+
path: data/output/codex_review_gate/
65+
if-no-files-found: warn

‎.github/workflows/hide-codex-limit-comments.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: Hide Codex Rate Limit Comments
2+
3+
on:
4+
issue_comment:
5+
types: [created]
6+
pull_request_review_comment:
7+
types: [created]
8+
9+
jobs:
10+
hide-comment:
11+
runs-on: ubuntu-latest
12+
if: >
13+
github.event.comment.user.login == 'chatgpt-codex-connector[bot]' &&
14+
(
15+
contains(github.event.comment.body, 'usage limit') ||
16+
contains(github.event.comment.body, 'rate limit') ||
17+
contains(github.event.comment.body, 'quota') ||
18+
contains(github.event.comment.body, 'limit reached') ||
19+
contains(github.event.comment.body, 'try again later')
20+
)
21+
permissions:
22+
issues: write
23+
pull-requests: write
24+
steps:
25+
- name: Minimize comment
26+
uses: actions/github-script@v8
27+
with:
28+
script: |
29+
const mutation = `
30+
mutation($id: ID!) {
31+
minimizeComment(input: {subjectId: $id, classifier: OFF_TOPIC}) {
32+
minimizedComment { isMinimized }
33+
}
34+
}
35+
`;
36+
await github.graphql(mutation, { id: context.payload.comment.node_id });
37+
console.log('Minimized codex rate-limit comment:', context.payload.comment.id);

‎prompts/pr_review.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
You are reviewing a pull request for a **production quantitative trading and data pipeline codebase**.
2+
3+
## Review priorities (in order)
4+
5+
1. **Security**: credential leaks, injection vectors, unauthorized data access
6+
2. **Correctness**: logic errors, wrong calculations, data corruption
7+
3. **Crash risks**: unhandled exceptions, null pointer dereferences, resource exhaustion
8+
4. **Data integrity**: silent data loss, incorrect transformations, schema violations
9+
5. **API compatibility**: breaking changes to function signatures, configuration formats
10+
6. **Race conditions**: concurrent access to shared state, inconsistent reads
11+
12+
## What NOT to flag
13+
14+
- Code style or formatting preferences
15+
- Variable/function naming suggestions
16+
- Missing type annotations
17+
- Documentation quality
18+
- Minor refactoring opportunities
19+
- Test coverage suggestions
20+
21+
## Severity definitions
22+
23+
| Severity | Definition | Example |
24+
|----------|-----------|---------|
25+
| critical | Causes data loss, security breach, or production crash | SQL injection, credential in plaintext, deletion without backup |
26+
| high | Produces wrong results or breaks downstream systems | Wrong formula, API signature change, resource leak |
27+
| medium | Degrades reliability or performance under load | Missing error handling, N+1 query, unbounded growth |
28+
| low | Misleading or confusing but not dangerous | Stale comment, redundant code, unclear intent |
29+
30+
## Output format
31+
32+
Return exactly one JSON object (do not wrap in markdown fences):
33+
34+
```json
35+
{
36+
"summary": "Brief assessment of the PR (1-3 sentences)",
37+
"findings": [
38+
{
39+
"severity": "critical",
40+
"category": "security",
41+
"file": "path/to/file.py",
42+
"line": 42,
43+
"description": "What's wrong",
44+
"suggestion": "How to fix it"
45+
}
46+
]
47+
}
48+
```
49+
50+
If no issues found, return `"findings": []`.

‎scripts/__init__.py‎

Whitespace-only changes.

0 commit comments

Comments
 (0)