ci: require Codex fixes to land on the PR head branch

[BigSimmo]

Motivation

• Prevent @codex auto-fix replies from claiming fixes that never land by binding repair requests to the exact repository and PR head branch and refusing detached/synthetic work branches.
• Make thread-resolution machine-verifiable so the workflow can close a thread only when a reported pushed commit is the actual PR head.
• Strengthen the auto-resolve routing and guard so only appropriate, low-risk, auditable automatic repairs run.

Description

• Updated the auto-resolve workflow .github/workflows/codex-autofix-review-comments.yml to embed the intended repository/PR-head into the request prompt, add machine-readable result markers (<!-- codex-thread-result:fixed-head:<sha> --> and <!-- codex-thread-result:no-change -->), and validate that a reported fixed commit equals the PR head before resolving a thread.
• Hardened the thread-resolution path to fail-closed on malformed or mismatched results and to reject ambiguous/no-op dispositions.
• Revised repo guidance in AGENTS.md and docs/codex-review-protocol.md to require publishing fixes through the authenticated connector and to document the new result markers and verification discipline.
• Extended the workflow guard scripts/check-codex-autofix-workflow.mjs to assert the new markers, routing, and verification rules.
• Added/updated executable tests in tests/codex-autofix-workflow.test.ts to cover intended-branch routing, dedupe behavior, malformed results, mismatched-head refusal, and no-change dispositions.
• Archived issue Tighten TypeScript: generated DB types, typed Supabase client, strict env #131 in docs/outstanding-issues.md and updated the outstanding-issues guard where relevant.

Testing

• Ran npm run check:codex-autofix-workflow and the guard passed.
• Ran the focused workflow tests with npm run test -- tests/codex-autofix-workflow.test.ts and the updated test file passed (all included assertions green).
• Ran repository gates: npm run format, npm run check:outstanding-issues, and npm run verify:cheap (dry and full local gates as part of the PR-local dry run); verify:cheap completed successfully (full test suite run completed: all unit tests passed with a small number skipped per environment).
• Note: fetching the external Codex manual failed in this environment due to outbound network ENETUNREACH, so implementation and checks relied on the repository’s existing hardening and executable guards rather than an external docs fetch.

---

Codex Task

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 41 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 94940502-9b83-4999-b8b6-214be6ba3efb

📥 Commits

Reviewing files that changed from the base of the PR and between e26b5a1 and 87bc83e.

📒 Files selected for processing (7)

• .github/workflows/codex-autofix-review-comments.yml
• AGENTS.md
• docs/branch-review-ledger.md
• docs/codex-review-protocol.md
• docs/outstanding-issues.md
• scripts/check-codex-autofix-workflow.mjs
• tests/codex-autofix-workflow.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[chatgpt-codex-connector]

Summary

• No follow-up code change was needed. The checkout is already at the supplied PR head, a32078825b667a780c5d0566cb8c1320d3efa8d4, and the worktree remains clean.
• The supplied comments contain no actionable review finding: CodeRabbit reported only a temporary review limit, while Supabase correctly skipped the PR because it does not change the supabase directory.
• The existing PR implementation already documents the fixed-head/no-change result-marker contract and requires the reported commit to match the pull-request head before automatic thread resolution. docs/codex-review-protocol.mdL35-L38
• The workflow guard and focused test suite passed. Because no files changed, I did not create an empty commit or an unnecessary follow-up pull request.

Testing

• ✅ git diff --check d6a1473187a4c6f109c456b75bb97d02ff1951b4...HEAD
• ✅ npm run check:codex-autofix-workflow — Codex auto-resolve workflow guard passed.
• ✅ npm run test -- tests/codex-autofix-workflow.test.ts — Test Files 1 passed (1) and Tests 51 passed (51).
• ✅ git status --short --branch — clean worktree on branch work.

View task →