Fix Codex Cloud GitHub control plane - #1849
Conversation
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 58 minutes Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughCodex Cloud now refreshes and records the verified ChangesCodex Cloud readiness
Repository documentation updates
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7979706395
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
CI triageCI failed on this PR. Automated classification of the 2 failed job(s):
Compared with main CI run #9872 (success). Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/configure-codex-cloud-github-shell.sh`:
- Around line 48-54: Extract the plaintext-credential validation currently at
lines 69-77 into a reusable helper, then invoke it before validate_github_access
in both the existing gh-session path and the PAT authentication path. Ensure any
hosts.yml oauth_token entry causes the script to fail closed, and add a behavior
test covering an existing authenticated session with plaintext hosts.yml
credentials.
In `@scripts/install-codex-cloud-command-shims.sh`:
- Around line 35-40: Update the PATH construction around clean_path in the shim
script so it never emits a trailing separator when clean_path is empty, avoiding
an empty PATH entry that searches the current directory. Preserve node_bin as
the first entry, and retain the existing filtering of the shim directory while
excluding any other empty inherited entries if required by the script’s PATH
policy.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 7f861118-9f1b-40ae-b028-db8cbbb6f857
📒 Files selected for processing (9)
docs/codex-cloud.mddocs/scripts-index.mdscripts/check-codex-cloud-setup.mjsscripts/configure-codex-cloud-github-shell.shscripts/install-codex-cloud-command-shims.shscripts/maintain-codex-cloud.shscripts/refresh-codex-cloud-base.shscripts/setup-codex-cloud.shtests/codex-cloud-setup.test.ts
…control-plane' into codex/review-1849-security-fix
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/branch-review-ledger.md`:
- Line 904: Update the ledger entry for commit
34e5581c4418ef8a08909dff9ecf91d4a8f622de to include the decisive output lines
from check:codex-cloud and docs:check-inventory, rather than only their PASS
status. Also explicitly record whether the focused setup test, local lint, and
local typecheck were run after the final security repair, preserving the
existing verification context.
In `@tests/codex-cloud-setup.test.ts`:
- Around line 633-637: Update the assertions covering setup and maintenance to
verify that bash scripts/refresh-codex-cloud-base.sh appears before the runtime
validation command, rather than only asserting both commands are present.
Preserve the existing command checks while enforcing the required
refresh-before-validation ordering for both lifecycle scripts.
- Around line 627-630: Update the Cloud lifecycle script generation covered by
the setup and maintenance assertions to remove the --configure-gh-helper
invocation and its gh auth setup-git credential bootstrap. Use the native GitHub
connector instead, preserving the existing script behavior while ensuring
neither generated script contains the GitHub CLI authentication or
configure-codex-cloud-github-shell.sh path.
- Around line 638-642: Update the PATH normalization logic exercised by the
command-shim assertions to repeatedly remove adjacent duplicate $HOME/.local/bin
entries until none remain, while preserving first, last, and only-entry
handling. Extend the focused test coverage to assert that consecutive shim
entries are fully removed.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 804ccad6-87ea-4a6c-b590-810675b2bedb
📒 Files selected for processing (8)
docs/branch-review-ledger.mddocs/codex-cloud.mddocs/scripts-index.mdscripts/check-codex-cloud-setup.mjsscripts/install-codex-cloud-command-shims.shscripts/maintain-codex-cloud.shscripts/setup-codex-cloud.shtests/codex-cloud-setup.test.ts
💤 Files with no reviewable changes (2)
- scripts/maintain-codex-cloud.sh
- scripts/setup-codex-cloud.sh
🚧 Files skipped from review as they are similar to previous changes (3)
- scripts/check-codex-cloud-setup.mjs
- scripts/install-codex-cloud-command-shims.sh
- docs/scripts-index.md
1 participant
Summary
RAG impact: no retrieval behaviour change — Cloud bootstrap, GitHub control-plane policy, and environment documentation only.
Verification
npm run check:codex-cloud—[Codex Cloud Check] PASS: static Cloud contracts match.npm run docs:check-inventory— current at 226 script files and 236 npm scriptsnpm run check:branch-review-ledger— passednpm run format— passed immediately before pushgit diff --check— passednpm run test -- tests/codex-cloud-setup.test.ts— not rerun after the final security repair because the repository run coordinator was at focused-test capacity; the earlier PR head passed 24/24, and CI will exercise the pushed headRisk and rollback
Review disposition
The prior fix rejected plaintext
hosts.yml, but OS-backed storage still allowed the same agent user to rungh auth tokenor otherwise use the persisted setup credential. Head6ba68ffed2a3f7b36afa06067f5b2e04800b398eremoves that persistence path and adds a static regression guard while retaining the independent base-refresh and command-shim repairs.Summary by CodeRabbit
New Features
Bug Fixes
Documentation