🤖 ci: accept resolved Codex advisories on the review summary board - #4223
Merged
Conversation
Codex keeps resolved security advisories listed on its summary board and only adds the Resolved marker once a later review completes, so a completed board with the "Security findings" section failed the Codex Comments gate forever. Whitelist the section header, the advisory count line and bullets that link a review thread on this PR and end with Codex's Resolved marker; bare bullets, unknown sections and non-thread links keep blocking.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This was referenced Sep 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
Codex Commentsgate treats Codex's review summary board as a blocking comment whenever it carries a "Security findings" section, even after every advisory thread is resolved and both reviews are complete. This whitelists the section when each advisory bullet carries Codex's own Resolved marker, so PRs that once had a security advisory can passRequiredagain. Unblocks #4211.Background
Codex keeps resolved security advisories listed on the board and only adds the
· **Resolved**marker when a later review completes (verified from the board's edit history on #4211: the marker appeared at the next review completion, not when the thread was resolved). The gate's line whitelist (#4149, #4158) does not know the section, so a completed board with resolved advisories is reported as an unresolved Codex comment andRequiredcan never go green. On #4211 the gate log at 17:24Z shows exactly that:status: completed, both rows Completed, two**Resolved**advisories, still counted as blocking. The two most recent merged PRs with such boards (#4170, #4176) only passed because the section was added after their last gate run.Implementation
scripts/lib/codex_comments.jqaccepts three more line shapes inside a completed board:### Security findings,#### Advisory findings (N), and a bullet that links a review thread on a PR (.../pull/N#discussion_r<id>), names a severity, and ends with· **Resolved**. A bullet without the marker is a live finding and keeps blocking, as do unknown sections, non-thread links, and trailing text.Validation
python3 scripts/check_codex_comments_test.py: the existing unresolved-advisory case still expects blocking; new cases cover the resolved board (informational) and three malformed variants (still blocking). Red without the jq change: the resolved case fails1 != 0.Generated with
xum• Model:anthropic:claude-fable-5-1• Thinking:xhigh• Cost:$16.42