chore(ci): lower Codex security review effort

[wpfleger96]

Changes CODEX_REASONING_EFFORT from max to high in the security-review job.

max increases both normal review latency and exposure to the upstream PTY-shutdown hang (openai/codex-action#169) where Codex finishes writing its output file but holds stdio open. The composite uses: action ignores the 30-minute step timeout and continues running until the 40-minute job timeout fires; at that point GitHub cancels the entire job and the always() salvage step never gets to run. high retains a high reasoning setting while trading some depth for speed, reducing typical completion time and shrinking the window during which a hung process blocks the salvage path.

No other behavior changes. Action pin, CLI version, model, output schema, prompt, and timeout values are unchanged.

[github-actions]

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

• Exact PR diff: 114dbf745f1fe0bdbecb70e07a07f03c23687bdc...f3769ea1f2d904cffbeebc2ad8c552ed350249b5
• Model: gpt-5.6-sol

💡 Click "edited" above to see earlier reviews for this PR.

---

Review Summary

Overall Risk: NONE

The PR only changes CODEX_REASONING_EFFORT from max to the supported high setting. The value remains safely passed as a fixed Codex configuration argument and does not alter workflow authorization, permissions, secret handling, checkout isolation, or result validation.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

• No additional limitations were reported.

---

_{Generated by Codex Security Review |
Requested by: @wpfleger96 |
Workflow run}

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Review clear

Reviewed head f3769ea1f2d904cffbeebc2ad8c552ed350249b5 against base 114dbf745f1fe0bdbecb70e07a07f03c23687bdc (merge base 59328d5ae38a51a618dd2fddd7faf1343d42096f). The complete merge-base-to-head tree comparison contains only the one-line workflow setting change. No actionable defect found in that change.

• CODEX_REASONING_EFFORT=high is passed directly into the existing model_reasoning_effort CLI override (workflow lines 223–225, 309). high is a recognized effort value in the pinned Codex CLI version (v0.150.1 source).
• The advisory review contract is unchanged: authorization, read-only execution permissions, secret isolation configuration, exact-range checks, model/action/CLI pins, output schema, and posting conditions are untouched. This is an effort/latency tradeoff, not removal of a security gate.
• Limitation: this does not repair PTY shutdown, timeout enforcement, or salvage behavior. Those paths are unchanged. Any reduction in latency or hang incidence, and any effect on finding quality, remain unmeasured here; the PR description’s operational explanation is not runtime evidence.

Read exact-base governing/product guidance. Source-only review of the configuration and its consumer; no checkout, builds, tests, workflow execution, or current CI success asserted. No independent lane was needed for this one-line change. This is a clear review, not approval or a fresh certification of the entire existing security-review workflow.