chore: deploy Set it Free Loop (review tier, v2.0.0) - #1
Conversation
Source: HemSoft/set-it-free-loop@380fe0e Version: 2.0.0 Tier: review Components: labels, governance, sfl-pr-review Engine policy: codex-gpt-55-high See https://github.com/HemSoft/set-it-free-loop for full documentation.
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds a label-triggered SFL pull-request review workflow. It validates activation, runs Copilot in a sandbox with MCP services, processes constrained outputs, publishes review results, and removes the trigger label. ChangesSFL Review Workflow
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant ActivationJob
participant MCPGateway
participant CopilotCLI
participant ConclusionJob
participant SafeOutputsJob
PullRequest->>ActivationJob: apply sfl-review label
ActivationJob->>MCPGateway: configure read-only and safe-output services
ActivationJob->>CopilotCLI: run sandboxed review
CopilotCLI->>ConclusionJob: provide findings and usage data
ConclusionJob->>SafeOutputsJob: provide validated outputs
SafeOutputsJob->>PullRequest: publish results and remove label
Suggested labels: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
ApprovabilityVerdict: Needs human review Unable to check for correctness in 54da5b7. This PR deploys a new automated PR review workflow, but has multiple unresolved P1-level review comments identifying significant design issues: fork-based PRs won't trigger reviews, and the workflow may approve stale commits if pushes occur during review. These concerns warrant human review before merging. You can customize Macroscope's approvability policy. Learn more. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2945dd4375
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| (github.event_name != 'pull_request' || github.event.pull_request.head.repo.id == github.repository_id) && | ||
| (github.event_name != 'pull_request' || github.event.action != 'labeled' || github.event.label.name == 'sfl-review') |
There was a problem hiding this comment.
For any pull request whose head branch belongs to a fork, this condition makes pre_activation skip before the label or reviewer is considered, so applying sfl-review produces no review, check run, or label removal. This excludes the normal external-contributor flow despite the source workflow describing the trigger as applying to the triggering pull request without that limitation; use a fork-safe trigger/configuration and regenerate the lock file.
Useful? React with 👍 / 👎.
| Review only the pull request that triggered this workflow. The reviewed commit | ||
| must be `${{ github.event.pull_request.head.sha }}` and the SFL run ID is | ||
| `${{ github.run_id }}`. | ||
|
|
||
| Use the GitHub pull request tools to read the triggering PR, its changed files, | ||
| and the complete diff. Before creating comments, list existing review comments | ||
| and unresolved threads on the current head so you do not repeat a finding. |
There was a problem hiding this comment.
If another commit is pushed after the label event while this potentially 20-minute review is running, the embedded event SHA remains fixed while the requested pull-request metadata and complete diff can reflect the newer PR state; there is no final head comparison, and pushes do not trigger or cancel this label-only workflow. The run can therefore publish an approval/check whose reported SHA and reviewed content do not match, potentially approving an unreviewed revision; pin all review inputs to the event SHA and abort or rerun if the current head changes before safe outputs are processed.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.gitattributes:
- Line 1: Update the .github/workflows/*.lock.yml attribute rule to use a
supported built-in merge strategy, or add repository-level configuration
defining the ours merge driver so fresh clones do not depend on local
.git/config settings. Preserve linguist-generated=true for these generated
workflow lock files.
In @.github/workflows/sfl-pr-review.lock.yml:
- Line 58: The workflow name currently includes a deployment SHA, causing it to
change on every redeploy. Update the workflow’s name to a stable value and move
the source path and SHA provenance to run-name, preserving the existing stable
check run name SFL Reviewer Approval.
- Around line 1199-1267: Update the gh-aw workflow source that generates these
steps so noop, detection_runs, missing_tool, and report_incomplete each include
an if: always() condition. Preserve their existing handler configuration and
ensure every reporting step runs independently even when earlier steps fail; do
not edit the generated lock file directly.
- Around line 1600-1605: Document that maintainers must remove and re-add the
sfl-review label to retry runs that do not reach safe_outputs, or update the
source gh-aw configuration so label removal occurs in the always-running
conclusion job. Make the change in the gh-aw source configuration rather than
the generated sfl-pr-review.lock.yml file, preserving the existing pull-requests
write permission.
In @.github/workflows/sfl-pr-review.md:
- Around line 51-52: Update the provenance markers near the workflow prompt
headings so they are not parsed as adjacent Markdown headings: wrap the
“Deployed from” and “To upgrade” lines in HTML comments, or add blank lines
around them if they should remain visible. Preserve the existing provenance
information.
- Around line 77-83: Update the workflow instructions around the pre-review SHA
binding and publishing steps to re-read the triggering pull request’s current
head immediately before creating comments, reviews, or checks; compare it with
the originally captured head SHA, and stop or requeue when they differ.
Alternatively, add a label-gated synchronize trigger that performs this
revalidation, while preserving the existing pull-request-only scope and
duplicate-comment checks.
- Around line 36-38: Update the create-pull-request-review-comment configuration
and its surrounding workflow instructions to enforce the documented
one-inline-thread-per-finding contract: either remove or raise the max beyond
possible findings, or define a deterministic finding limit and ensure severity
counts include only emitted inline findings for 21+ findings.
In `@sfl.json`:
- Around line 12-21: Align the sfl-pr-review workflow with
enginePolicy.defaultProfile by replacing its Copilot profile/provider/model
settings and corresponding generated lock metadata with the requested Codex
engine values, then regenerate the lock artifact using the project’s standard
generation process.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 02b26b59-495f-424b-ba73-3a40ea3d4753
📒 Files selected for processing (6)
.gitattributes.github/aw/actions-lock.json.github/workflows/sfl-pr-review.lock.yml.github/workflows/sfl-pr-review.mdREADME.mdsfl.json
| @@ -0,0 +1 @@ | |||
| .github/workflows/*.lock.yml linguist-generated=true merge=ours No newline at end of file | |||
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
git check-attr merge -- .github/workflows/sfl-pr-review.lock.yml
git config --local --get merge.ours.driverRepository: HemSoft/hs-conductor
Length of output: 212
🏁 Script executed:
#!/bin/bash
set -e
echo "Tracked .gitattributes:"
git ls-files .gitattributes
echo
echo ".gitattributes contents:"
cat -n .gitattributes
echo
echo "Git config merge.ours.driver values:"
git config --get-regexp '^merge\.ours\.driver$|^merge\.' | grep -E '^(merge\.ours\.driver|merge\.)' || true
echo
echo "Repository-wide merge config file excerpt:"
git config --show-scope --show-origin --get-regexp '^merge\.ours\.driver$' || trueRepository: HemSoft/hs-conductor
Length of output: 375
Register the ours merge driver or use a built-in strategy.
.gitattributes assigns merge=ours, but the repository does not define merge.ours.driver. Use a supported built-in merge attribute or add the repository merge-driver configuration in .git/config so generated lock workflows merge in fresh clones without local configuration.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.gitattributes at line 1, Update the .github/workflows/*.lock.yml attribute
rule to use a supported built-in merge strategy, or add repository-level
configuration defining the ours merge driver so fresh clones do not depend on
local .git/config settings. Preserve linguist-generated=true for these generated
workflow lock files.
| - name: Process no-op messages | ||
| id: noop | ||
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | ||
| env: | ||
| GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }} | ||
| GH_AW_NOOP_MAX: "1" | ||
| GH_AW_WORKFLOW_NAME: "Deployed from: HemSoft/set-it-free-loop/deployment/workflows/sfl-pr-review.md@380fe0edc7a87cfc7b31233a955b37df0223a3a8" | ||
| GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/sfl-pr-review.md" | ||
| GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | ||
| GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} | ||
| GH_AW_NOOP_REPORT_AS_ISSUE: "true" | ||
| GH_AW_AIC: ${{ needs.agent.outputs.aic }} | ||
| GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }} | ||
| GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }} | ||
| GH_AW_WORKFLOW_ID: "sfl-pr-review" | ||
| with: | ||
| github-token: ${{ steps.safe-outputs-app-token.outputs.token }} | ||
| script: | | ||
| const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io, getOctokit); | ||
| const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_noop_message.cjs'); | ||
| await main(); | ||
| - name: Log detection run | ||
| id: detection_runs | ||
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | ||
| env: | ||
| GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }} | ||
| GH_AW_WORKFLOW_NAME: "Deployed from: HemSoft/set-it-free-loop/deployment/workflows/sfl-pr-review.md@380fe0edc7a87cfc7b31233a955b37df0223a3a8" | ||
| GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/sfl-pr-review.md" | ||
| GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | ||
| GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }} | ||
| GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }} | ||
| with: | ||
| github-token: ${{ steps.safe-outputs-app-token.outputs.token }} | ||
| script: | | ||
| const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io, getOctokit); | ||
| const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_detection_runs.cjs'); | ||
| await main(); | ||
| - name: Record missing tool | ||
| id: missing_tool | ||
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | ||
| env: | ||
| GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }} | ||
| GH_AW_MISSING_TOOL_CREATE_ISSUE: "true" | ||
| GH_AW_WORKFLOW_NAME: "Deployed from: HemSoft/set-it-free-loop/deployment/workflows/sfl-pr-review.md@380fe0edc7a87cfc7b31233a955b37df0223a3a8" | ||
| GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/sfl-pr-review.md" | ||
| with: | ||
| github-token: ${{ steps.safe-outputs-app-token.outputs.token }} | ||
| script: | | ||
| const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io, getOctokit); | ||
| const { main } = require('${{ runner.temp }}/gh-aw/actions/missing_tool.cjs'); | ||
| await main(); | ||
| - name: Record incomplete | ||
| id: report_incomplete | ||
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | ||
| env: | ||
| GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }} | ||
| GH_AW_REPORT_INCOMPLETE_CREATE_ISSUE: "true" | ||
| GH_AW_WORKFLOW_NAME: "Deployed from: HemSoft/set-it-free-loop/deployment/workflows/sfl-pr-review.md@380fe0edc7a87cfc7b31233a955b37df0223a3a8" | ||
| GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/sfl-pr-review.md" | ||
| with: | ||
| github-token: ${{ steps.safe-outputs-app-token.outputs.token }} | ||
| script: | | ||
| const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io, getOctokit); | ||
| const { main } = require('${{ runner.temp }}/gh-aw/actions/report_incomplete_handler.cjs'); | ||
| await main(); |
There was a problem hiding this comment.
🩺 Stability & Availability | 🔵 Trivial | 💤 Low value
These four reporting steps stop on the first failure.
noop (line 1200), detection_runs (line 1222), missing_tool (line 1239), and report_incomplete (line 1254) carry no if: condition and no continue-on-error. GitHub Actions therefore skips each one when an earlier step in the job fails. handle_agent_failure (line 1270) is the only step with if: always().
If noop throws, the run loses the detection log entry, the missing-tool report, and the incomplete report, even though those handlers are independent of each other. Add if: always() to each reporting step so one handler failure does not suppress the rest. The change belongs in gh-aw, not in this generated file, so raise it upstream if you agree.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/sfl-pr-review.lock.yml around lines 1199 - 1267, Update
the gh-aw workflow source that generates these steps so noop, detection_runs,
missing_tool, and report_incomplete each include an if: always() condition.
Preserve their existing handler configuration and ensure every reporting step
runs independently even when earlier steps fail; do not edit the generated lock
file directly.
| safe_outputs: | ||
| needs: | ||
| - activation | ||
| - agent | ||
| - detection | ||
| if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success' |
There was a problem hiding this comment.
🩺 Stability & Availability | 🔵 Trivial
The sfl-review label stays applied when the run does not reach safe_outputs.
remove_labels runs only inside safe_outputs, and this job is skipped when needs.detection.result != 'success' or when agent is skipped. The trigger is pull_request with types: [labeled], so a run starts only on a fresh labeling event. When a run fails before safe_outputs, the label remains on the pull request, and re-applying it is a no-op because the label is already present. A maintainer must remove the label and add it again to retry.
Document that retry step, or move label removal to the conclusion job, which already runs with always() and holds pull-requests: write (line 1053). The change belongs in gh-aw configuration, not in this generated file.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/sfl-pr-review.lock.yml around lines 1600 - 1605, Document
that maintainers must remove and re-add the sfl-review label to retry runs that
do not reach safe_outputs, or update the source gh-aw configuration so label
removal occurs in the always-running conclusion job. Make the change in the
gh-aw source configuration rather than the generated sfl-pr-review.lock.yml
file, preserving the existing pull-requests write permission.
| create-pull-request-review-comment: | ||
| side: RIGHT | ||
| max: 20 |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== candidate files =="
git ls-files | rg '(^|/)\.github/workflows/sfl-pr-review\.md$|sfl-pr-review|pr-review' || true
echo
echo "== workflow content =="
if [ -f .github/workflows/sfl-pr-review.md ]; then
nl -ba .github/workflows/sfl-pr-review.md | sed -n '1,220p'
fi
echo
echo "== related workflow files =="
git ls-files .github/workflows | sed -n '1,200p'Repository: HemSoft/hs-conductor
Length of output: 321
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow sfl-pr-review.md =="
awk '{printf "%6d\t%s\n", NR, $0}' .github/workflows/sfl-pr-review.md | sed -n '1,260p'
echo
echo "== lock file =="
awk '{printf "%6d\t%s\n", NR, $0}' .github/workflows/sfl-pr-review.lock.yml | sed -n '1,260p'
echo
echo "== workflow workflow files =="
awk '{print}' .github/workflows 2>/dev/null || true
git ls-files .github/workflowsRepository: HemSoft/hs-conductor
Length of output: 28009
Make the finding limit match the workflow contract.
The workflow states one inline thread per finding, but create-pull-request-review-comment caps comments at 20 and the instructions do not limit findings or handle severity counts for 21+ findings. Raise the cap, or define a deterministic limit and count only the emitted inline findings.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/sfl-pr-review.md around lines 36 - 38, Update the
create-pull-request-review-comment configuration and its surrounding workflow
instructions to enforce the documented one-inline-thread-per-finding contract:
either remove or raise the max beyond possible findings, or define a
deterministic finding limit and ensure severity counts include only emitted
inline findings for 21+ findings.
| Review only the pull request that triggered this workflow. The reviewed commit | ||
| must be `${{ github.event.pull_request.head.sha }}` and the SFL run ID is | ||
| `${{ github.run_id }}`. | ||
|
|
||
| Use the GitHub pull request tools to read the triggering PR, its changed files, | ||
| and the complete diff. Before creating comments, list existing review comments | ||
| and unresolved threads on the current head so you do not repeat a finding. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Revalidate the pull request head before publishing outputs.
The workflow triggers only on labeled, but Lines 77-79 bind the review to ${{ github.event.pull_request.head.sha }}. A contributor can push a new commit while the run is active. The workflow can then publish comments, a review, and a check for an old head on the current pull request. Re-read the current head immediately before safe outputs and stop or requeue when it differs, or add a label-gated synchronize path.
🧰 Tools
🪛 LanguageTool
[uncategorized] ~78-~78: The official name of this software platform is spelled with a capital “H”.
Context: ...s workflow. The reviewed commit must be ${{ github.event.pull_request.head.sha }} and the...
(GITHUB)
[uncategorized] ~78-~78: The official name of this software platform is spelled with a capital “H”.
Context: ...uest.head.sha }}and the SFL run ID is${{ github.run_id }}`. Use the GitHub pull reques...
(GITHUB)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/sfl-pr-review.md around lines 77 - 83, Update the workflow
instructions around the pre-review SHA binding and publishing steps to re-read
the triggering pull request’s current head immediately before creating comments,
reviews, or checks; compare it with the originally captured head SHA, and stop
or requeue when they differ. Alternatively, add a label-gated synchronize
trigger that performs this revalidation, while preserving the existing
pull-request-only scope and duplicate-comment checks.
Source: HemSoft/set-it-free-loop@235a0df Version: 2.0.0 Tier: review Components: labels, governance, sfl-pr-review Engine policy: codex-gpt-55-high See https://github.com/HemSoft/set-it-free-loop for full documentation.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/sfl-pr-review.lock.yml:
- Around line 775-781: The GitHub MCP server configuration uses the wrong token
variable, leaving Codex unauthenticated. Update the gh-aw template/source that
generates the `mcp_servers.github` environment so `GITHUB_PERSONAL_ACCESS_TOKEN`
uses `$GITHUB_MCP_SERVER_TOKEN`, matching the gateway configuration, and
regenerate the locked workflow if required.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 4a3715f7-7638-4c82-9d47-4b704b3ef308
📒 Files selected for processing (3)
.github/workflows/sfl-pr-review.lock.yml.github/workflows/sfl-pr-review.mdsfl.json
| [mcp_servers.github] | ||
| user_agent = "deployed-from-hemsoft-set-it-free-loop-deployment-workflows-sfl-pr-reviewmd235a0df0c70fded4982e8763223e7c9936242215" | ||
| startup_timeout_sec = 120 | ||
| tool_timeout_sec = 60 | ||
| container = "ghcr.io/github/github-mcp-server:v1.7.0" | ||
| env = { "GITHUB_FEATURES" = "fields_param", "GITHUB_HOST" = "$GITHUB_SERVER_URL", "GITHUB_PERSONAL_ACCESS_TOKEN" = "$GH_AW_GITHUB_TOKEN", "GITHUB_READ_ONLY" = "1", "GITHUB_TOOLSETS" = "pull_requests,repos" } | ||
| env_vars = ["GITHUB_FEATURES", "GITHUB_HOST", "GITHUB_PERSONAL_ACCESS_TOKEN", "GITHUB_READ_ONLY", "GITHUB_TOOLSETS"] |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n 'GH_AW_GITHUB_TOKEN|GITHUB_MCP_SERVER_TOKEN|mcp_servers.github|mcpServers' \
.github/workflows/sfl-pr-review.lock.ymlRepository: HemSoft/hs-conductor
Length of output: 8139
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## workflow outline around setup/env"
sed -n '170,215p' .github/workflows/sfl-pr-review.lock.yml
echo
echo "## generated gh-aw setup around token exports"
sed -n '515,540p' .github/workflows/sfl-pr-review.lock.yml
echo
echo "## gateway setup and config region"
sed -n '728,748p' .github/workflows/sfl-pr-review.lock.yml
sed -n '772,806p' .github/workflows/sfl-pr-review.lock.yml
sed -n '850,868p' .github/workflows/sfl-pr-review.lock.yml
sed -n '910,974p' .github/workflows/sfl-pr-review.lock.yml
echo
echo "## search for gh-aw-mcpg config generation in workflow"
rg -n -C 3 'CODEX_HOME|config.toml|mcp-config|gitleaks|GITHUB_MCP_SERVER_TOKEN|GITHUB_PERSONAL_ACCESS_TOKEN' .github/workflows/sfl-pr-review.lock.ymlRepository: HemSoft/hs-conductor
Length of output: 47984
🌐 Web query:
github gh-aw v0.83.4 start_mcp_gateway.cjs mcpServers mcp_servers.codex home config.toml
💡 Result:
In the context of the GitHub gh-aw repository (GitHub Agentic Workflows), start_mcp_gateway.cjs is a critical JavaScript-based startup script responsible for managing and launching Model Context Protocol (MCP) server gateways [1][2]. The script handles tasks such as: - Initializing the MCP gateway environment and reading configurations [1]. - Managing Docker container lifecycles via child_process to host MCP servers [1]. - Performing robust health checks using an exponential backoff strategy to account for transient port-binding delays [2]. - Validating configuration shapes and handling JSON-RPC communication securely [3][4]. Regarding configuration and mcpServers, the gh-aw system and related tools (like Codex) use structured configuration files to define MCP servers [5][6]. - The mcpServers object is a standard format for defining MCP server configurations, often found in .mcp.json files or embedded within other project-specific config files [5][6]. - While config.toml (typically located at ~/.codex/config.toml for Codex or similar paths for other tools) is a common way to define these servers for local workspaces, it uses a [mcp_servers.<name>] syntax rather than a top-level mcpServers key [7][5][6]. - mcp_servers.codex refers to a specific entry within the [mcp_servers] table of a config.toml file, defining the command and arguments used to run a Codex-specific MCP server [7]. As of the v0.83.4 release of gh-aw (released July 27, 2026), the system includes refinements for gateway startup diagnostics, security hardening for secret handling, and updated MCP protocol management [8]. Developers working with these workflows should ensure that their environment configuration properly maps these server definitions, noting that tools like Codex may distinguish between global/plugin MCP servers and repository-scoped configurations [9].
Citations:
- 1: feat: mount MCP servers as local CLIs after gateway starts github/gh-aw#25928
- 2: Harden MCP Gateway startup health check against transient port-binding delays github/gh-aw#26697
- 3: Fix MCP setup JS typecheck failures in GitHub Actions workflow github/gh-aw#26546
- 4: Fix invalid JSON escapes in GitHub remote MCP gateway config generation github/gh-aw#41864
- 5: https://github.com/Szpadel/codex-mcp-code-review
- 6: https://github.com/ChrisPulman/CodexComputerRunMCPServer
- 7: Codex-side MCP discovery/display bug or limitation openai/codex#16689
- 8: https://github.com/github/gh-aw/releases/tag/v0.83.4
- 9: Codex Desktop MCP panel shows only global/plugin servers while repo-scoped MCP servers are active and usable openai/codex#20539
🌐 Web query:
github gh-aw v0.83.4 resolve_docker_connection.sh mcp_servers.codex host.docker.internal
💡 Result:
The query components relate to two distinct software ecosystems: GitHub's gh-aw extension and the OpenAI Codex/MCP (Model Context Protocol) integration [1][2][3]. 1. gh-aw v0.83.4: This is a specific release of the GitHub gh-aw (Agentic Workflows) extension, published on July 27, 2026 [1]. It introduced security hardening, new authentication options (including Google Vertex AI Workload Identity Federation), and internal improvements to MCP gateway and agentic workflow compilation [1][2]. It is not directly related to resolve_docker_connection.sh or mcp_servers.codex [1]. 2. mcp_servers.codex & host.docker.internal: These are standard components for configuring MCP servers within the Codex CLI and desktop environment [3]. - mcp_servers.codex: Codex stores its MCP configuration in a config.toml file (typically ~/.codex/config.toml), which includes a [mcp_servers] table to define integrated servers [3]. - host.docker.internal: This is the standard DNS name used by Docker containers to communicate with the host machine [4][5]. When running MCP servers inside a Docker container that need to connect to services on the host—or when Codex needs to connect to an MCP server running within a Docker container—host.docker.internal is frequently used in configuration URLs (e.g., http://host.docker.internal:PORT) [6][4][7]. - resolve_docker_connection.sh: There is no standard, widely documented script by this exact name in official Codex or Docker MCP documentation. It is likely a custom utility or a component of a specific third-party MCP implementation intended to automate the configuration of host.docker.internal or Docker environment variables when connecting MCP servers to Codex [4][7]. In summary, gh-aw is an unrelated GitHub project [1], while the other terms describe the standard way of bridging Docker-based MCP servers with the Codex assistant via local networking [3][4].
Citations:
- 1: https://github.com/github/gh-aw/releases/tag/v0.83.4
- 2: chore: upgrade gh-aw extension to v0.83.4 pre-release and recompile workflows github/gh-aw-firewall#6681
- 3: https://developers.openai.com/codex/mcp
- 4: https://github.com/mohsin-zaheer/mcp-server/blob/main/docs/DOCKER_TROUBLESHOOTING.md
- 5: https://github.com/YujiSuzuki/hostmcp
- 6: https://github.com/grafana/mcp-grafana/blob/f04fea9d/docs/clients/codex.md
- 7: https://community.latenode.com/t/unable-to-establish-connection-between-n8n-and-local-mcp-server-mcp-client-sub-node-connection-failure/25766
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## lock file relevant steps around Codex runtime"
sed -n '880,922p' .github/workflows/sfl-pr-review.lock.yml
echo
echo "## source actions containing server startup hooks, if present"
fd -a 'start_mcp_gateway\.cjs|resolve_docker_connection|codex.*mcp|network.*mcp|mcp.*codex' . && true
grep -RIn "mcp_servers\.codex|start_mcp_gateway|mcpServers|gh-aw-mcpg|topologyAttach|network.*topology" .github/workflows/sfl-pr-review.lock.yml | head -100
echo
echo "## deterministic check: parse TOML/Gateway env assignments"
python3 - <<'PY'
from pathlib import Path
p = Path('.github/workflows/sfl-pr-review.lock.yml')
s = p.read_text()
for i, line in enumerate(s.splitlines(), 1):
if 'GITHUB_PERSONAL_ACCESS_TOKEN' in line and 'GITHUB_MCP_SERVER_TOKEN' not in line and 'GH_AW_GITHUB_TOKEN' not in line:
print(f'found token at line {i}')
PYRepository: HemSoft/hs-conductor
Length of output: 9812
🌐 Web query:
gh-aw v0.83.4 source gitee github code start_mcp_gateway.cjs mcp_servers.codex
💡 Result:
The components identified relate to two distinct software ecosystems: 1. gh-aw (v0.83.4): This is an extension used in GitHub-integrated agentic workflows (often within GitHub Actions) [1][2]. - start_mcp_gateway.cjs: This is a core JavaScript startup script within the gh-aw repository (actions/setup/js/start_mcp_gateway.cjs) [3][4]. It is responsible for initializing the Model Context Protocol (MCP) gateway, which includes managing Docker container lifecycles, performing health checks (now using exponential backoff to handle transient binding delays), and dispatching engine-specific configurations [3][4][5]. It has recently been updated to include improved diagnostics for JSON parsing failures and safer handling of MCP configuration inputs [5][6][7]. - The repository is hosted on GitHub (github/gh-aw) [1][8]. There is no official evidence suggesting this project is mirrored or maintained on Gitee under the same name. 2. mcp_servers.codex: This refers to a configuration section used by the OpenAI Codex CLI/Desktop application to define and load MCP servers [9][10][11]. - Users configure these servers in a TOML configuration file (typically ~/.codex/config.toml) under a table named [mcp_servers.codex] [10][11]. - This configuration pattern allows the Codex environment to interact with various tools via the Model Context Protocol [10][11]. In summary, start_mcp_gateway.cjs is a functional script within the GitHub-maintained gh-aw ecosystem for managing MCP gateways in automation [3][4], while mcp_servers.codex is a configuration key used in the OpenAI Codex CLI ecosystem to register MCP servers [10][11]. There is no direct functional link between these two specific identifiers.
Citations:
- 1: https://github.com/github/gh-aw/releases/tag/v0.83.4
- 2: chore: upgrade gh-aw extension to v0.83.4 pre-release and recompile workflows github/gh-aw-firewall#6681
- 3: feat: mount MCP servers as local CLIs after gateway starts github/gh-aw#25928
- 4: Harden MCP Gateway startup health check against transient port-binding delays github/gh-aw#26697
- 5: Fix MCP setup JS typecheck failures in GitHub Actions workflow github/gh-aw#26546
- 6: github/gh-aw@15d7e27
- 7: Fix invalid JSON escapes in GitHub remote MCP gateway config generation github/gh-aw#41864
- 8: https://github.com/github/gh-aw/releases
- 9: https://docs.umbraco.com/umbraco-in-ai/17.latest/mcp/local-mcp-setup/openai-codex
- 10: Codex CLI hangs when configured to use codex mcp-server as an MCP server openai/codex#6664
- 11: https://github.com/Szpadel/codex-mcp-code-review
Use the gateway App token in the Codex MCP server config.
The generated TOML at .github/workflows/sfl-pr-review.lock.yml:780 leaves GITHUB_PERSONAL_ACCESS_TOKEN as $GH_AW_GITHUB_TOKEN, while the gateway config at :802 uses $GITHUB_MCP_SERVER_TOKEN from the GitHub App token. GH_AW_GITHUB_TOKEN is not passed in the start-mcp-gateway step, so Codex can inherit an empty token and start GitHub’s MCP server directly unauthenticated. If this locked workflow is generated, update the gh-aw template/source so both configs use the same app token.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/sfl-pr-review.lock.yml around lines 775 - 781, The GitHub
MCP server configuration uses the wrong token variable, leaving Codex
unauthenticated. Update the gh-aw template/source that generates the
`mcp_servers.github` environment so `GITHUB_PERSONAL_ACCESS_TOKEN` uses
`$GITHUB_MCP_SERVER_TOKEN`, matching the gateway configuration, and regenerate
the locked workflow if required.
Source: HemSoft/set-it-free-loop@78483bb Version: 2.0.0 Tier: review Components: labels, governance, sfl-pr-review Engine policy: codex-gpt-55-high See https://github.com/HemSoft/set-it-free-loop for full documentation.
|
Closing this v2.0.0 SFL rollout as superseded. HemSoft now uses v2.1.0-rc.9, and hs-buddy is the only approved HemSoft SFL validation repository. This old deployment should not be merged or refreshed. |
1 participant
Set it Free Loop — Deployment
Version: 2.0.0
Tier: review
Source SHA:
380fe0edc7a87cfc7b31233a955b37df0223a3a8Engine policy:
codex-gpt-55-highComponents deployed
labelsgovernancesfl-pr-reviewWhat is the Set it Free Loop?
The Set it Free Loop is a continuous
quality improvement operating model for software repositories. See the
CATALOG
for all available workflows.
Before merging
.\deployment\governance\setup-labels.ps1 -Owner <org> -Repo <repo>if labels are not yet configured.mdworkflow: verifygh aw compile .github/workflows/<name>.mdsucceedssfl.jsonmanifest in the repo rootSummary by cubic
Deploys Set it Free Loop (review tier) v2.0.0 to enable automated, full‑spectrum PR reviews with a single approval check. Uses OpenRouter
moonshotai/kimi-k3with GitHub App auth and cleans up thesfl-reviewlabel after completion.New Features
sfl-pr-reviewworkflow (.mdand compiled.lock.yml) that triggers on thesfl-reviewlabel, posts inline findings, submits one consolidated review, publishes theSFL Reviewer Approvalcheck, and removes the label.github/gh-aw-actions/setup@v0.84.1via.github/aw/actions-lock.json.sfl.json(v2.0.0, tierreview) with engine policycodex-gpt-55-highand workflow modelmoonshotai/kimi-k3via OpenRouter..gitattributesto mark*.lock.ymlas generated withmerge=ours, plus a README badge that displays the deployed SFL version.Migration
.\deployment\governance\setup-labels.ps1 -Owner <org> -Repo <repo>if labels are not configured.OPENROUTER_API_KEY,SFL_APP_PRIVATE_KEY.gh aw compile .github/workflows/<name>.md, then trigger once to confirm comments and the approval check.sfl.jsonin the repo root.Written for commit 54da5b7. Summary will update on new commits.
Note
Deploy Set it Free Loop PR review workflow at review tier v2.0.0
sfl-reviewPR label, runs multi-pass security/correctness/quality analysis usingmoonshotai/kimi-k3via OpenRouter, posts inline comments per finding, and submits a consolidatedAPPROVEorREQUEST_CHANGESreview with aSFL Reviewer Approvalcheck run.*.lock.ymlworkflow files as linguist-generated with amerge=oursstrategy in .gitattributes.Macroscope summarized 54da5b7.