🤖 ci: accept resolved Codex advisories on the review summary board

scripts/check_codex_comments_test.py

@@ -169,11 +169,20 @@ def test_summary_completion_requires_metadata_and_every_review_row(self):
             .replace('"status":"running"', '"status":"completed"')
             .replace("🔄 **Running** since", "✅ **Completed**")
         )
+        # Codex keeps resolved advisories on the board; only its own Resolved marker,
+        # not a bare bullet, an unknown section, or a non-thread link, is informational.
+        resolved_findings = completed_findings.replace(
+            ") · **Medium**", ") · **Medium** · **Resolved**"
+        )
         for body, expected in (
             (completed.replace('"status":"completed"', '"status":"running"'), 1),
             (completed.replace("✅ **Completed**", "🔄 **Running** since", 1), 1),
             (completed_pr_opened, 0),
             (completed_findings, 1),
+            (resolved_findings, 0),
+            (resolved_findings.replace("#### Advisory findings", "#### Blocking findings"), 1),
+            (resolved_findings.replace("#discussion_r3960253571", "#issuecomment-1"), 1),
+            (resolved_findings.replace("· **Resolved**", "· **Resolved** see below"), 1),
         ):
             for cached in (False, True):
                 with self.subTest(body=body, cached=cached):

scripts/lib/codex_comments.jq

@@ -45,6 +45,13 @@ def codex_comment_is_informational($bot):
                 + "[^[:alnum:]|]*\\*\\*Completed\\*\\*"
                 + "( <relative-time datetime=\"[0-9TZ:.+-]+\">[0-9TZ:.+-]+</relative-time>)? "
                 + "\\| `[0-9a-f]+` \\| (Manual request|New commits|Draft marked ready|PR opened) \\|$")
+              # Security advisories stay listed after their review threads are resolved, and
+              # Codex adds the Resolved marker only when a later review completes. A bullet
+              # without it is a live finding and keeps blocking; other sections stay unknown.
+              or . == "### Security findings"
+              or test("^#### Advisory findings \\([0-9]+\\)$")
+              or test("^- [^[:alnum:]|\\[]*\\[[^\\]]+\\]\\(https://github\\.com/[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+/pull/[0-9]+#discussion_r[0-9]+\\)"
+                + " · \\*\\*[A-Za-z]+\\*\\* · \\*\\*Resolved\\*\\*$")
             ))
         ) catch false) // false
       else