ci: Codex Actionを監査済みSHAへ固定する#251
Conversation
|
@codex review Issue #248の受け入れ条件、openai/codex-action v1.11 target SHAとCodex CLI pin、permission/secret/shell trust boundary、upstream audit記述、mutable ref回帰checker/self-test、src/docs/example同期を確認してください。 |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2a12de180f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Pull request overview
Chapter 13（Codex Action 例）と examples/ のサンプルについて、openai/codex-action を監査済みの full commit SHA に固定し、Codex CLI の exact version・read-only profile・権限境界の明確化、および回帰防止の 契約チェッカーを追加するPRです（Issue #248）。
Changes:
openai/codex-action@v1をopenai/codex-action@52fe01ec70a42f454c9d2ebd47598f9fd6893d56 # v1.11へ置換し、codex-version: 0.144.6とpermission-profile: ":read-only"を明記- pin更新手順・監査メモ（一次情報URL、監査条件）を Chapter 13 に追記（
src/とdocs/同期） - Chapter 13 Codex Action の supply-chain 契約チェッカー（self-test付き）を追加し、
test:lightと Book QA に組み込み
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| src/chapters/chapter13/index.md | Chapter 13 の Codex Action 例を SHA pin + CLI version 固定に更新し、更新手順/監査ノートを追記 |
| docs/chapters/chapter13/index.md | 公開側（Pages）も同内容へ同期 |
| examples/workflows/codex-pr-review-comment.yml | サンプル workflow の action pin / read-only profile / CLI version 固定を反映 |
| scripts/check-chapter13-codex-action-contract.js | Chapter 13 のサンプル・本文同期・最小権限・pin条件などを検証する契約チェッカーを追加 |
| package.json | check:chapter13-codex-action と self-test を追加し test:light に組み込み |
| .github/workflows/book-qa.yml | Book QA で契約チェッカーを実行するステップを追加 |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
@codex review 64c69f8で追加fetchを廃止し、checkout認証中のfetch-depth: 0 + persist-credentials: falseへ変更しました。public/private再現性、credential境界、全action ref検証、src/docs/example同期とchecker回帰を最新commitで確認してください。 |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 64c69f8d93
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review 0a53686で |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0a53686db3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
概要（必須）
関連Issue/仕様（必須）
openai/codex-actionv1.11のtarget commit52fe01ec70a42f454c9d2ebd47598f9fd6893d56とCodex CLI0.144.6を固定し、label gate、最小権限、:read-only、drop-sudoを維持します。影響範囲（必須）
/chapters/chapter13/examples/workflows/codex-pr-review-comment.yml、Chapter 13の対応例、Book QA、package QA scriptだけを更新。repository settingsや実運用workflowは変更しません。受入基準（必須）
openai/codex-action@v1が0件テスト/検証（必須）
v1/v1.11annotated tagをtarget commitまでdereferenceし、両方が52fe01ec70a42f454c9d2ebd47598f9fd6893d56を指すことを確認28712691847successpnpm install --frozen-lockfile、test 16/16、check/typecheck、build、dist差分0pnpm auditは10件（high 3 / moderate 5 / low 2）。公開GHSAなし、通常経路での到達可能性は未確定のため、本文に残存riskと再監査条件を明記mise exec node@24 -- npm ci: PASS、repository側audit 0mise exec node@24 -- npm run test:light: PASS（契約checker + negative self-test、markdownlint、Jekyll buildを含む）mise exec node@24 -- npm audit: PASS、0 vulnerabilitiesactionlint（example / Book QA）: PASSgit diff --check: PASSOPENAI_API_KEY/課金契約がないため未実施。upstream CI、upstream local validation、repository静的契約、PR CIで代替します。リスク/ロールバック（必須）
v1参照、GitHub-hosted単発/read-only用途への限定を根拠に条件付き採用します。self-hosted/ARC、unprivileged-user、同一job複数回実行は対象外です。Review 対応（必須）
QA（必須）
merge 後確認（原則必須）
Pages確認（原則必須）
/chapters/chapter13/HTTP 200 + action SHA / Codex CLI marker確認AI支援/エージェント利用の開示（任意）
補足