ci: accept exact-head Codex no-finding comments - #4006
Conversation
Codex emits zero-finding results as issue comments with a ten-character commit token. Resolve that token through GitHub and require the returned full SHA to equal the pull request head before publishing success. Constraint: Codex zero-finding comments expose only a 10-hex commit token Rejected: Direct prefix comparison | permits a chosen-prefix replay against another head Rejected: Status timestamp freshness | delayed review results can race a force-push Confidence: high Scope-risk: narrow Reversibility: clean Directive: Keep comment evidence bound through GitHub commit resolution; do not replace this with prefix-only matching Tested: Focused gate tests, format, lint, typecheck, diff check, live comment and commit payload, independent security review Not-tested: Full test:scripts is blocked by unrelated generated-artifact and documentation-source failures reproduced outside this diff
|
@codex review |
|
Warning Review limit reached
Next review available in: 1 second Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
📦 Client bundle boundary
A server module in a client graph aborts hydration in the browser. New leaks fail CI; known leaks are tracked in |
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Post-merge gate verification: PR-head CI and merge-group SHA |
1 participant
Why
The automated-review gate accepts formal Codex reviews, but Codex reports a zero-finding review as an authenticated issue comment. That leaves reviewed PRs red when CodeRabbit is rate-limited and deadlocks the protected merge queue. PR #3999 is the first affected migration PR.
Design
Verification
Bootstrap
The workflow intentionally loads gate code from the default branch. Therefore this PR itself still runs the old gate implementation until this change merges. Any one-time reconciliation must be tied to an authenticated exact-head review artifact; no skipped/rate-limited comment counts.