docs: prefer GitHub connector in Codex Cloud - #1447
Conversation
📝 WalkthroughWalkthroughThe change expands Cloud GitHub connector instructions and updates the append-only branch review ledger with additional review, verification, fix, and merge records. ChangesGitHub connector guidance
Branch review ledger
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
|
Closing as superseded by merged PR #1449. Current main already establishes the authenticated GitHub connector as the default for explicitly authorised repository/PR/review-thread/Actions work, prohibits PAT workarounds, requires exact-target confirmation before writes, and documents the same contract in both AGENTS.md and docs/codex-cloud.md. The remaining one-line branch delta is redundant and less complete than the merged policy. |
|
@cursoragent this PR will be re-opened soon. Please resolve any failing CI, run bugbot and resolve any bugbot comments against current repo and fix any merge conflicts and also fix any errors and address and fix all comments or suggestions that are likely to improve the PR and Codebase. Please implement smallest required fix according to best code practices. Check your work. Leave this PR closed for now but still make all these changes and run the review. I want it ready to go for when I re-open it. |
|
PR #1447 is ready to reopen and left closed. Done
Branch tip
Notes for reopen
  |
Resolve the AGENTS.md conflict against #1449 by keeping the merged connector control-plane wording, then add the remaining #1447 gaps: Actions artifact inspection, intended BigSimmo admin connection, shell git/gh only for genuine connector gaps, write-result verification, and matching Cursor Cloud + docs/codex-cloud guidance. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
Local docs/policy review of codex/cloud-github-connector-policy at fc42cf0 found no high-confidence P0-P2 issues; ledger append only. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
Avoid over-reading the connector-first Cursor Cloud bullet as a ban on ordinary authorised git branch publication; keep shell gh for genuine connector gaps only. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
…nnector-policy Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
|
@cursoragent Work this open PR (confirm number + GitHub head first). Start from Goal: review + Bugbot the tip, fix actionable issues with smallest changes,
Stop when merge-tree clean, no actionable threads left, and required checks are |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
PR #1447 — tip Snapshot → unblock
Review + Bugbot
CI on tip
|
…nnector-policy Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
Local ledger append for tip after main sync; not pushed alone (ledger-only tip policy). Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
PR #1447 review+bugbot+fixTip: Threads / Bugbot: no unresolved Codex, Bugbot, Copilot, or human review threads. Ignored CodeRabbit rate-limit + Codex usage-limit noise. Review (delta vs main): docs-only — Required CI on tip Residual: PR body still describes the old one-liner (token cannot Leave merge to you. |
|
@cursoragent resolve merge conflict please |
|
Merge conflict cleared on PR #1447.
Required checks will re-run on the new tip. |
…nnector-policy Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
|
Resolved merge conflict by syncing
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@AGENTS.md`:
- Around line 886-887: Update the write-safety policy in AGENTS.md so
confirmations include the exact branch for branch mutations and exact file path
for file mutations, alongside repository, PR, thread, and job. Require
verification of the connector result for every allowed write; when using shell
git or gh due to a connector gap, verify the command result and perform a remote
read-back. Apply identical wording to docs/codex-cloud.md and the Cursor Cloud
block.
In `@docs/codex-cloud.md`:
- Around line 102-103: Update the Actions capability documentation near the
listed run/job operations to distinguish read-only inspection from retry
mutations. State that retrying a workflow run or job requires explicit
confirmation for the exact target and its expected side effects, including
potential deployments, while preserving inspection and approved mutation
permissions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 0f8fcc8e-3cbe-4ec2-ba51-c56fdfc0e4c5
📒 Files selected for processing (3)
AGENTS.mddocs/branch-review-ledger.mddocs/codex-cloud.md
| - Confirm the exact repository and PR/thread/job before a write, and verify the | ||
| connector result before treating the write as successful. If the connector lacks a |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Complete target and result verification for every allowed write.
This policy allows branch and file mutations, but the confirmation list names only the repository, PR, thread, and job. Confirm the exact branch and file path for branch and file writes. If the connector gap requires shell git or gh, verify that control plane’s result and perform a remote read-back; no connector result exists for that path.
Apply the same wording to docs/codex-cloud.md and the Cursor Cloud block.
Suggested wording
- Confirm the exact repository and PR/thread/job before a write, and verify the
- connector result before treating the write as successful.
+ Confirm the exact repository and operation-specific target (branch, file, PR,
+ thread, or job) before a write. Verify the result from the selected control
+ plane; for shell `git` or `gh`, perform a remote read-back.Based on the PR objective, exact-target confirmation must cover every write target.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@AGENTS.md` around lines 886 - 887, Update the write-safety policy in
AGENTS.md so confirmations include the exact branch for branch mutations and
exact file path for file mutations, alongside repository, PR, thread, and job.
Require verification of the connector result for every allowed write; when using
shell git or gh due to a connector gap, verify the command result and perform a
remote read-back. Apply identical wording to docs/codex-cloud.md and the Cursor
Cloud block.
| issue and PR comments, inline-review-thread replies/resolution, Actions | ||
| run/job/log/artifact inspection and retries, and approved branch, file, or PR mutations. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Require explicit confirmation before retrying Actions runs.
Actions inspection is read-only. Retrying a run is a hosted-CI mutation. It can trigger a deployment or another external side effect. Require confirmation for the exact workflow, run, or job and its expected side effects before retrying.
Suggested wording
- run/job/log/artifact inspection and retries, and approved branch, file, or PR mutations.
+ run/job/log/artifact inspection, and approved branch, file, or PR mutations.
+ Treat Actions retries as writes. Require explicit confirmation for the exact
+ workflow, run, or job and its expected side effects before retrying.As per coding guidelines, hosted CI mutations require explicit user confirmation.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| issue and PR comments, inline-review-thread replies/resolution, Actions | |
| run/job/log/artifact inspection and retries, and approved branch, file, or PR mutations. | |
| issue and PR comments, inline-review-thread replies/resolution, Actions | |
| run/job/log/artifact inspection, and approved branch, file, or PR mutations. | |
| Treat Actions retries as writes. Require explicit confirmation for the exact | |
| workflow, run, or job and its expected side effects before retrying. |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/codex-cloud.md` around lines 102 - 103, Update the Actions capability
documentation near the listed run/job operations to distinguish read-only
inspection from retry mutations. State that retrying a workflow run or job
requires explicit confirmation for the exact target and its expected side
effects, including potential deployments, while preserving inspection and
approved mutation permissions.
Source: Coding guidelines
2 participants
Summary
Adds a Cloud environment instruction to prefer the connected GitHub connector for supported GitHub tasks, including review-thread replies/resolution and GitHub Actions inspection.
Why
Cloud has an authenticated GitHub connector with administrator access to this repository. A missing shell
ghCLI must not block work the connector can perform, and agents must not add a PAT as a workaround.Validation
Summary by CodeRabbit