Skip to content

fix: force review gate to use Actions token #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JoeyTeng merged 1 commit into from
Apr 25, 2026
Merged

fix: force review gate to use Actions token #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/codex-review-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ jobs:

- name: Wait for Codex review
env:
GITHUB_TOKEN: ${{ secrets.CODEX_REVIEW_GATE_TOKEN || github.token }}
GITHUB_TOKEN: ${{ github.token }}
GITHUB_REPOSITORY: ${{ github.repository }}
GITHUB_RUN_ID: ${{ github.run_id }}
GITHUB_RUN_ATTEMPT: ${{ github.run_attempt }}
Expand Down
10 changes: 2 additions & 8 deletions docs/CODEX_REVIEW_GATE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@

## 仓库配置

workflow 合入默认分支并至少运行一次后，把 `codex/review-gate` 加到仓库 ruleset 的 required status checks。这个 context 建议选择 "any source"，因为 status 可能由 `GITHUB_TOKEN` 写入，也可能由 `CODEX_REVIEW_GATE_TOKEN` 写入。
workflow 合入默认分支并至少运行一次后，把 `codex/review-gate` 加到仓库 ruleset 的 required status checks。这个 context 建议选择 GitHub Actions 作为 source，因为 status 由 workflow 的 `GITHUB_TOKEN` 写入。

首次引入这个 workflow 的 PR 不能完整自测 gate，因为 `pull_request_target` 只会运行 repository default branch 上已经存在的 workflow。这个 PR 也不会因为新 commit 自动创建 gate comment 或写入 `codex/review-gate` status。

Expand All @@ -47,10 +47,4 @@ workflow 合入默认分支并至少运行一次后，把 `codex/review-gate`

不要在 workflow 还没进入受保护分支前提前要求 `codex/review-gate`，否则当前引入 PR 会被一个没有 runner 能创建的 required status 卡住。

workflow 默认使用 `GITHUB_TOKEN`。如果本仓库里 GitHub Actions comment 不能触发 Codex，则配置 `CODEX_REVIEW_GATE_TOKEN` secret。建议使用 fine-grained token，并授予：

- Commit statuses: read/write
- Issues: read/write
- Pull requests: read

为了让信号最干净，建议关闭 Codex automatic review-on-push，只让这个 gate comment 触发当前 head review。
workflow 使用 `GITHUB_TOKEN`，这样 marker comment 的作者会是 `github-actions[bot]`。为了让信号最干净，建议关闭 Codex automatic review-on-push，只让这个 gate comment 触发当前 head review。
1 change: 1 addition & 0 deletions docs/PROJECT_STATE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@
- 创建 marker 前和通过前会重新确认 PR head 没变；PR body reaction 不作为通过信号，因为它不能绑定到当前 head
- workflow 落到默认分支后，还需要把 `codex/review-gate` 加进远端 ruleset 的 required status checks。
- 2026-04-25 用临时非默认 base branch 测试过：PR 只触发普通 `pull_request` CI，没有触发 `Codex Review Gate`；真实 GitHub Actions bot 路径要等 workflow 进入 repository default branch 后再测。
- 2026-04-25 在默认分支首次实测时，`Codex Review Gate` 成功触发并写入 `codex/review-gate` status，但 marker comment 创建失败：workflow 选择了 `CODEX_REVIEW_GATE_TOKEN` secret，导致 `POST /issues/8/comments` 返回 `403 Resource not accessible by integration`。当前修正方向是强制使用 `github.token`，保证 marker 身份是 `github-actions[bot]`。

## 当前架构方向

Expand Down
Loading