codex-security/github-action/examples/pull-request.yml at main · openai/codex-security · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
# Configure branch protection and merge-time freshness before requiring this check.
# https://github.com/openai/codex-security/tree/main/github-action#scan-pull-requests
name: Codex Security PR
on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review, edited]

permissions:
  contents: read
  pull-requests: read

concurrency:
  # Each push gets its own group. A rerun cannot cancel a newer scan, even
  # when the target branch changed only in case.
  group: codex-security-pr-${{ github.event.pull_request.number }}-${{ github.run_id }}
  cancel-in-progress: true

jobs:
  security:
    if: >-
      github.event.pull_request.head.repo.full_name == github.repository &&
      (github.event.action != 'edited' || github.event.changes.base != null)
    name: Scan changes
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    outputs:
      scan-status: ${{ steps.security.outputs.scan-status }}
      skip-reason: ${{ steps.security.outputs.skip-reason }}
    steps:
      - &verify-current-pr
        name: Verify the PR still matches this scan
        env:
          GH_TOKEN: ${{ github.token }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          current=$(gh api --hostname "${GITHUB_SERVER_URL#https://}" "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER" --jq '[.head.sha, .base.ref, .base.sha] | @tsv')
          expected=$(printf '%s\t%s\t%s' "$PR_HEAD_SHA" "$PR_BASE_REF" "$PR_BASE_SHA")
          if [ "$current" != "$expected" ]; then
            echo 'The PR head or target changed. Run the workflow for the current PR snapshot.' >&2
            exit 1
          fi
          base_ref=$(printf '%s' "$PR_BASE_REF" | jq -sRr @uri)
          live_base=$(gh api --hostname "${GITHUB_SERVER_URL#https://}" "repos/$GITHUB_REPOSITORY/git/ref/heads/$base_ref" --jq '.object.sha')
          if [ "$live_base" != "$PR_BASE_SHA" ]; then
            echo 'The PR head or target changed. Run the workflow for the current PR snapshot.' >&2
            exit 1
          fi
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0
          persist-credentials: false
      - name: Scan PR changes
        id: security
        uses: openai/codex-security@REPLACE_WITH_REVIEWED_COMMIT
        with:
          scope: diff
          model: gpt-5.6-sol
          effort: high
          max-cost: "5"
          fail-on-severity: high
        env:
          OPENAI_API_KEY: ${{ secrets.CODEX_SECURITY_API_KEY }}

  required-review:
    name: ${{ github.event.action == 'edited' && github.event.changes.base == null && 'metadata / ' || '' }}Codex Security / ${{ github.event.pull_request.base.ref }}
    needs: security
    if: always() && (github.event.action != 'edited' || github.event.changes.base != null)
    runs-on: ubuntu-24.04
    steps:
      - *verify-current-pr
      - name: Require a completed review or an empty diff
        env:
          SCAN_JOB_RESULT: ${{ needs.security.result }}
          SCAN_STATUS: ${{ needs.security.outputs.scan-status }}
          SKIP_REASON: ${{ needs.security.outputs.skip-reason }}
        run: |
          test "$SCAN_JOB_RESULT" = success
          if [ "$SCAN_STATUS" = completed ]; then
            exit 0
          fi
          test "$SCAN_STATUS" = skipped
          test "$SKIP_REASON" = empty-diff