Repository navigation
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a40aa9fb1b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| raise ValueError("SOURCE_SECTION_TOO_LARGE") | ||
| refs = [] | ||
| for match in _REFS.findall(_FENCES.sub("", markdown)): | ||
| url = match.rstrip(".,;:!?)]}") |
There was a problem hiding this comment.
When a source URL legitimately ends in ), ], or }, this unconditional rstrip removes part of the URL rather than only surrounding Markdown punctuation. For example, [source](https://en.wikipedia.org/wiki/Function_(mathematics)) is fetched as .../Function_(mathematics, so the advisory can assess the wrong page or report a false failure; trim only delimiters proven to belong to the Markdown syntax.
Useful? React with 👍 / 👎.
| start, end = body.index(OPEN) + len(OPEN), body.index(CLOSE) | ||
| if end <= start: | ||
| raise ValueError("SOURCE_MARKERS_OUT_OF_ORDER") | ||
| urls = extract_pr_body_urls(body[start:end]) |
There was a problem hiding this comment.
When a PR description contains the marker block as a fenced documentation example, this selects the markers before extract_pr_body_urls strips fences, leaving only the URL between them and treating the example as a real opt-in. The workflow predicate likewise sees the marker, so documentation-only PRs can unexpectedly trigger external source reads and publish a coverage report; remove fenced regions before locating the opt-in block.
Useful? React with 👍 / 👎.
Purpose
Validate a small, GitHub-native PR source-evidence report without needing a Cursor Origin account or a second control plane.
Changes
pull_request.build_receiptevidence states.contents: readand checkout with no persisted credentials. No Secrets or hosted service.Local verification
pip install -e .[mcp]dependencies as CI.PARTIAL / attached_media_unreadas expected.Controlled opt-in check
This block is deliberately present only to exercise the new advisory workflow against a public source. A PARTIAL result is expected and must not be upgraded to PASS.
No production deployment or new account authorization is in scope.