Fix Codex credential check 401 by disabling WebSocket transport

[Copilot]

The "Codex credential check" job failed with 401 Unauthorized: Missing bearer or basic authentication in header on wss://api.openai.com/v1/responses, despite valid credentials.

Root cause

• Codex's Responses WebSocket transport has a known upstream bug where the handshake can spuriously return 401 even with valid credentials (openai/codex#39578, openai/codex#38638).
• The built-in openai model provider rejects -c overrides of supports_websockets (built-in provider IDs are reserved), so there's no CLI-flag escape hatch.
• HTTPS fallback only kicks in after 5 failed WebSocket retries, and in this run the fallback request also failed.

Fix

• .github/workflows/credentials-check.yml: the codex job now writes a minimal config.toml to a scratch CODEX_HOME defining a custom openai-direct provider pointed at https://api.openai.com/v1 with supports_websockets = false, forcing HTTPS transport and skipping the broken WebSocket path — mirroring the workaround already used by pkg/workflow/codex_mcp.go for the firewall proxy provider.
• Dropped --ignore-user-config from the codex exec invocation so the generated config is actually loaded.

model_provider = "openai-direct"

[model_providers.openai-direct]
name = "OpenAI"
base_url = "https://api.openai.com/v1"
env_key = "OPENAI_API_KEY"
supports_websockets = false

[pelikhan]

Review failure https://github.com/github/gh-aw/actions/runs/32648730537/job/97216933962

[pelikhan]

@copilot Review failure https://github.com/github/gh-aw/actions/runs/32648730537/job/97216933962

[Copilot]

@copilot Review failure https://github.com/github/gh-aw/actions/runs/32648730537/job/97216933962

Looked at the new failure. The original bug is actually fixed: the error changed from 401 Unauthorized: Missing bearer or basic authentication in header (no Authorization header sent at all, the websocket-fallback bug) to a real, authenticated response from OpenAI:

401 Unauthorized: You do not have access to the project tied to the API key., auth error code: invalid_project

invalid_project means the request reached OpenAI with a valid bearer token, but the project associated with the CODEX_API_KEY/OPENAI_API_KEY secret doesn't have access to the Responses API endpoint Codex calls. I confirmed locally that wire_api has no alternative to "responses" for custom providers (Codex refuses to start with wire_api = "chat"), so there's no workflow-side setting that avoids this.

This is a secret/account configuration issue, not a workflow bug — it matches the existing "insufficient quota" guidance in docs/reference/auth.mdx. Verifying/rotating the CODEX_API_KEY (or OPENAI_API_KEY) secret with a key whose project has Responses API access at https://platform.openai.com/api-keys should resolve it; no further code change is needed for this PR.

[Copilot]

Pull request overview

Forces the Codex credential check to use HTTPS, avoiding upstream WebSocket authentication failures.

Changes:

• Creates an isolated Codex configuration with WebSockets disabled.
• Loads the configuration through a scratch CODEX_HOME.

Show a summary per file

File	Description
.github/workflows/credentials-check.yml	Configures a direct HTTPS-only OpenAI provider for Codex.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.87.5