ci: add Codex Security PR scans - #10
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe pull request adds a GitHub Actions workflow for Codex Security. It validates pull request revisions, runs a pinned scanner, reports findings through inline comments and a sticky summary, stores artifacts, and finalizes policy checks. ChangesCodex Security pipeline
Estimated code review effort: 5 (Critical) | ~90+ minutes Sequence Diagram(s)sequenceDiagram
participant Pull_Request
participant GitHub_Actions
participant Codex_Security
participant Security_Reporter
participant GitHub_APIs
Pull_Request->>GitHub_Actions: trigger eligible security workflow
GitHub_Actions->>GitHub_APIs: validate revisions and create pending check
GitHub_Actions->>Codex_Security: scan base-to-merge delta
Codex_Security-->>GitHub_Actions: return findings and scan status
GitHub_Actions->>Security_Reporter: report scan results
Security_Reporter->>GitHub_APIs: update inline comments and sticky summary
GitHub_Actions->>GitHub_APIs: finalize policy check
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (3)
.github/scripts/codex-security-report.mjs (3)
188-211: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winDegrade gracefully when
git difffails.
mergeDiffForPathcaches the promise, including a rejection. If thegit diffcall fails, for example because ofmaxBufferoverflow on a large file, the rejection propagates and the whole report fails. No summary comment is then published. Catch the error and return an empty diff so the finding falls back to summary-only delivery.♻️ Proposed refactor
{ maxBuffer: 10 * 1024 * 1024 }, - ).then(({ stdout }) => stdout), + ) + .then(({ stdout }) => stdout) + .catch(() => ""), );🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/scripts/codex-security-report.mjs around lines 188 - 211, Update mergeDiffForPath so failures from the cached git diff promise are caught and resolved as an empty diff string. Preserve promise caching while ensuring errors such as maxBuffer overflow do not propagate, allowing callers to use summary-only delivery.
410-415: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueUse
Object.hasOwnfor the severity lookup.
severity in countsalso matches inheritedObject.prototypekeys. Scanner-provided severity levels are untrusted input. Restrict the check to own properties.♻️ Proposed refactor
- if (severity in counts) { + if (typeof severity === "string" && Object.hasOwn(counts, severity)) { counts[severity] += 1; }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/scripts/codex-security-report.mjs around lines 410 - 415, Update the severity validation in the findings loop to use Object.hasOwn for checking whether severity is an own property of counts, then increment counts only when that check succeeds. Keep the existing optional severity extraction and counting behavior unchanged.
115-128: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low valueConsider caching the revalidation result briefly.
Every non-GET request triggers one extra PR read. A run with many findings therefore doubles its request count. Cache the result for a few seconds, or revalidate once per mutation batch, to reduce rate-limit pressure. The current behaviour is correct, so this is optional.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/scripts/codex-security-report.mjs around lines 115 - 128, Optionally cache the successful result of assertCurrentPullRequest for a short interval or reuse one validation across each mutation batch, so repeated non-GET operations avoid redundant PR reads while preserving the existing stale-PR checks before mutations.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/scripts/codex-security-report.mjs:
- Line 506: Replace the raw fingerprint key with findingMarkerId at both
affected sites in .github/scripts/codex-security-report.mjs:506-506 and
.github/scripts/codex-security-report.mjs:713-715. Update activeFingerprints to
map sortedFindings through findingMarkerId, and use findingMarkerId for the
summary row key so both comparisons use the marker-ID namespace.
- Line 40: Update the scanExitCode initialization in the security report flow to
validate SCAN_EXIT_CODE as a non-empty integer before using it. Reject empty,
non-numeric, and non-integer values rather than allowing Number coercion to
produce a passing code, while preserving valid exit-code handling for
statusSummary and policy_state.
- Around line 713-715: The Delivery lookup in the row construction must use the
same marker identifier stored in deliveredInline. Update the fingerprint value
used by the row template to call findingMarkerId(finding) instead of
findingFingerprint(finding), while preserving the existing inline-comment versus
summary-only output.
In @.github/workflows/codex-security.yml:
- Around line 331-338: Add --max-time 30 to the curl GET requests in the
workflow sections around pull_request and the other remaining GET calls,
matching the existing POST and PATCH requests. Apply the timeout consistently to
all four referenced GET call sites so stalled connections terminate within 30
seconds.
- Around line 547-561: Update the “Finalize policy status” step to expose
steps.scan-context.outputs.current in its environment, then handle a false
scan-context value like the stale-revision path and conclude with cancelled.
Preserve the existing finalization behavior for current scans and other
outcomes.
---
Nitpick comments:
In @.github/scripts/codex-security-report.mjs:
- Around line 188-211: Update mergeDiffForPath so failures from the cached git
diff promise are caught and resolved as an empty diff string. Preserve promise
caching while ensuring errors such as maxBuffer overflow do not propagate,
allowing callers to use summary-only delivery.
- Around line 410-415: Update the severity validation in the findings loop to
use Object.hasOwn for checking whether severity is an own property of counts,
then increment counts only when that check succeeds. Keep the existing optional
severity extraction and counting behavior unchanged.
- Around line 115-128: Optionally cache the successful result of
assertCurrentPullRequest for a short interval or reuse one validation across
each mutation batch, so repeated non-GET operations avoid redundant PR reads
while preserving the existing stale-PR checks before mutations.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 5091f50b-c216-4139-97bf-938e06fbd6b4
📒 Files selected for processing (2)
.github/scripts/codex-security-report.mjs.github/workflows/codex-security.yml
📜 Review details
🧰 Additional context used
🪛 actionlint (1.7.12)
.github/workflows/codex-security.yml
[error] 309-309: label "codex-security" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2025-vs2026", "windows-2022", "windows-11-arm", "ubuntu-slim", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xlarge", "macos-latest-large", "macos-26-intel", "macos-26-xlarge", "macos-26-large", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xlarge", "macos-14-large", "macos-14", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
🪛 zizmor (1.28.0)
.github/workflows/codex-security.yml
[error] 3-18: use of fundamentally insecure workflow trigger (dangerous-triggers): pull_request_target is almost always used insecurely
(dangerous-triggers)
[warning] 361-366: ad-hoc installation of packages (adhoc-packages): installs a package outside of a lockfile
(adhoc-packages)
🔇 Additional comments (15)
.github/workflows/codex-security.yml (8)
33-107: LGTM!
130-239: LGTM!
251-300: LGTM!
345-375: LGTM!
377-402: LGTM!
419-500: LGTM!
502-545: LGTM!
639-683: LGTM!.github/scripts/codex-security-report.mjs (7)
53-113: LGTM!
153-184: LGTM!Also applies to: 213-262
264-290: LGTM!
292-330: LGTM!Also applies to: 357-400
514-583: LGTM!Also applies to: 606-635
670-712: LGTM!Also applies to: 716-757
759-816: LGTM!
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cfdf96b862
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5dcbd90241
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 429d841c2e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 935b0e2435
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7d14f40030
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4ed2017a45
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
1 participant
Summary
Validation
The workflow intentionally matches the implementation already prepared for liquidium-pool and liquidium-instant-loan. This PR does not merge or enable a required branch-protection check by itself.
Summary by CodeRabbit
New Features
Chores