Codex review labels #500
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Codex review labels | |
| on: | |
| pull_request_target: | |
| types: [opened, synchronize, reopened, ready_for_review, converted_to_draft] | |
| workflow_run: | |
| workflows: ["CI"] | |
| types: [completed] | |
| issue_comment: | |
| types: [created, edited] | |
| pull_request_review: | |
| types: [submitted, edited, dismissed] | |
| schedule: | |
| - cron: "*/15 * * * *" | |
| permissions: | |
| actions: read | |
| checks: read | |
| contents: read | |
| issues: write | |
| pull-requests: read | |
| statuses: read | |
| concurrency: | |
| # A scheduled all-open run can touch every PR, so all synchronization paths | |
| # share one repository-wide mutex to prevent stale or duplicate writes. | |
| group: codex-review-labels-${{ github.repository }} | |
| cancel-in-progress: false | |
| jobs: | |
| sync-pr: | |
| name: Sync Codex labels for PR | |
| runs-on: ubuntu-24.04 | |
| if: >- | |
| ${{ | |
| github.event_name == 'pull_request_target' || | |
| github.event_name == 'pull_request_review' || | |
| (github.event_name == 'issue_comment' && github.event.issue.pull_request) | |
| }} | |
| steps: | |
| - name: Checkout trusted base | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| with: | |
| persist-credentials: false | |
| ref: ${{ github.event.repository.default_branch }} | |
| - name: Sync labels | |
| env: | |
| # A user-owned token is required for comments that trigger Codex. | |
| # Store a fine-grained PAT as CODEX_LABEL_SYNC_TOKEN with Actions | |
| # read, Checks read, Contents read, Issues read/write, | |
| # Pull requests read, and Commit statuses read. GITHUB_TOKEN remains | |
| # sufficient for label maintenance when the PAT is not configured. | |
| GH_TOKEN: ${{ secrets.CODEX_LABEL_SYNC_TOKEN || github.token }} | |
| HAS_CODEX_LABEL_SYNC_TOKEN: ${{ secrets.CODEX_LABEL_SYNC_TOKEN != '' }} | |
| PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }} | |
| REPO: ${{ github.repository }} | |
| run: | | |
| if [ ! -f .github/scripts/sync_codex_review_labels.py ]; then | |
| echo ".github/scripts/sync_codex_review_labels.py is not available on the default branch yet; skipping bootstrap run" | |
| exit 0 | |
| fi | |
| review_trigger_args=() | |
| if [ "$HAS_CODEX_LABEL_SYNC_TOKEN" != "true" ]; then | |
| echo "::warning::CODEX_LABEL_SYNC_TOKEN is not configured; labels will sync, but @codex review will not be posted automatically." | |
| review_trigger_args+=(--no-trigger-missing-codex) | |
| fi | |
| python3 .github/scripts/sync_codex_review_labels.py \ | |
| --repo "$REPO" \ | |
| --pr "$PR_NUMBER" \ | |
| --apply \ | |
| --tolerate-write-permission-errors \ | |
| "${review_trigger_args[@]}" | |
| sync-after-ci: | |
| name: Sync Codex labels after CI | |
| runs-on: ubuntu-24.04 | |
| if: >- | |
| ${{ | |
| github.event_name == 'schedule' || | |
| ( | |
| github.event_name == 'workflow_run' && | |
| github.event.workflow_run.event == 'pull_request' | |
| ) | |
| }} | |
| steps: | |
| - name: Checkout trusted base | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| with: | |
| persist-credentials: false | |
| ref: ${{ github.event.repository.default_branch }} | |
| - name: Sync labels | |
| env: | |
| GH_TOKEN: ${{ secrets.CODEX_LABEL_SYNC_TOKEN || github.token }} | |
| HAS_CODEX_LABEL_SYNC_TOKEN: ${{ secrets.CODEX_LABEL_SYNC_TOKEN != '' }} | |
| REPO: ${{ github.repository }} | |
| run: | | |
| if [ ! -f .github/scripts/sync_codex_review_labels.py ]; then | |
| echo ".github/scripts/sync_codex_review_labels.py is not available on the default branch yet; skipping bootstrap run" | |
| exit 0 | |
| fi | |
| review_trigger_args=() | |
| if [ "$HAS_CODEX_LABEL_SYNC_TOKEN" != "true" ]; then | |
| echo "::warning::CODEX_LABEL_SYNC_TOKEN is not configured; labels will sync, but @codex review will not be posted automatically." | |
| review_trigger_args+=(--no-trigger-missing-codex) | |
| fi | |
| python3 .github/scripts/sync_codex_review_labels.py \ | |
| --repo "$REPO" \ | |
| --all-open \ | |
| --apply \ | |
| --tolerate-write-permission-errors \ | |
| --tolerate-read-errors \ | |
| "${review_trigger_args[@]}" |