feat(ci): add Codex Security release qualification - #3087
Merged
Conversation
Scan cumulative release-train diffs through NVIDIA inference and publish findings to Code Scanning. Signed-off-by: alangou <alangou@nvidia.com>
alangou
requested review from
a team,
derekwaynecarr,
mrunalp and
sjenning
as code owners
September 1, 2026 12:03
|
🌿 Preview your docs: https://nvidia-preview-pr-3087.docs.buildwithfern.com/openshell |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Prevent cache poisoning in the tag-triggered Codex Security workflow. Signed-off-by: alangou <alangou@nvidia.com>
Remove custom inference cost accounting so the workflow remains focused on scanning and SARIF publication. Signed-off-by: alangou <alangou@nvidia.com>
SDAChess
approved these changes
Sep 1, 2026
Contributor
Author
|
/ok to test 325efd2 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add release-scoped Codex Security qualification for pre-release candidates. Each run analyzes the cumulative diff from the previous stable release through NVIDIA-hosted GPT-5.6 Sol inference and publishes train-scoped SARIF to Code Scanning.
Related Issue
Part of #2989.
This PR implements cumulative release-train scans and SARIF publication. Periodic full scans and deduplicated private draft GitHub Security Advisories remain follow-up work.
Changes
vX.Y.Z-pre.NtagsOperational prerequisite: the repository secret
CODEX_SECURITY_API_KEYmust contain a key authorized foropenai/openai/gpt-5.6-solon the NVIDIA inference endpoint.Testing
mise run pre-commitpassesmise run testpassesmise run test:codex-security-release-rangepasses.github/workflows/codex-security.yml.github/workflows/codex-security.ymlmise run markdown:lintpassesChecklist