fix(codex-pr-review): embed review prompt, drop cross-repo checkout - #19
Merged
Conversation
The reviewer checked out the shared prompt from ci-workflows using the calling repo\x27s GITHUB_TOKEN. That works here (public) but fails on an internal repo, where a consumer token cannot fetch this repo, so every consumer PR red-Xed at the checkout step. Embed the prompt as base64 (PROMPT_B64) and decode at runtime instead: no cross-repo checkout, works regardless of visibility, and a PR still cannot alter what the credentialed reviewer runs. Add check-prompt-embed.yml so the embedded copy can never silently drift from the prompt file (the single-source-of-truth concern that the checkout approach was solving). Keeps parity with product-org-len/ci-workflows (PR #8).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Embed the shared review prompt in
codex-pr-review.ymlas base64 (PROMPT_B64) and decode it at runtime, instead of checking it out cross-repo from ci-workflows.Why
The old step checked out the prompt from ci-workflows using the calling repo's
GITHUB_TOKEN. That works here (modsy/ci-workflows is public) but fails on an internal repo: a consumer's job token can resolve the reusable workflow but cannot fetch this repo, so every consumer PR red-Xed at "Check out shared review prompt" before the reviewer ran. This is what is currently breaking all Product Org (Atlas) consumers, and a parity sync had reintroduced the checkout that an earlier commit fixed by embedding.Guard against drift
The checkout was the single-source-of-truth approach, so embedding reintroduces a drift risk (prompt in two places). New
check-prompt-embed.ymlfails CI ifPROMPT_B64ever stops matching the prompt file, so they can never silently diverge.Parity
Matches product-org-len/ci-workflows PR #8 byte-for-byte (same base64). Keeps the two ci-workflows repos identical.
Issue: none (CI infra).