## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## AI-Assisted

## Reusable workflow: OpenAI Codex code review.
##
## Trigger asymmetry vs reusable-claude-code-review.yml: Codex
## has no mention listener; its consumer wrapper relies on
## pull_request + workflow_dispatch (with a pr_ref input for
## fork PRs). Claude is mention-driven and adds issue_comment
## + pull_request_review_comment triggers. The asymmetry is
## intentional; do not normalize.
##
## ## Status: DISABLED (org-wide kill-switch)
##
## The Codex review workflow path is currently disabled via the
## job-level 'if: false' kill-switch in the active 'review:' job
## below. Every consumer wrapper calls this reusable via '@master',
## so flipping the switch here propagates to every caller
## immediately - no consumer wrapper edits needed to disable, and
## no edits needed to re-enable.
##
## ## Re-enabling
##
## The full implementation (PR / comment / workflow_dispatch
## triggers, fork-PR safety, PR-head resolve, openai/codex-action
## invocation) is preserved as commented YAML at the bottom of
## this file under '## ARCHIVED IMPLEMENTATION ##'. Inputs schema,
## permissions, and concurrency block above stay identical between
## disabled and enabled states; only the 'review:' job body needs
## to swap.
##
## To re-enable:
##   1. Delete the active 'review:' job below (the one with
##      'if: false').
##   2. Uncomment the archived 'review:' block at the bottom
##      (remove the leading '## ' on each line of the block
##      between the BEGIN/END markers).
##   3. Re-add the 'secrets:' schema under 'on.workflow_call:'
##      (see the inline note near the inputs schema below).
##      Without this step every consumer's secrets: forward for
##      OPENAI_API_KEY is silently ignored and the action receives
##      an empty key at runtime.
##   4. Update the file 'name:' from "DISABLED" to drop the suffix.
##   5. Update this header doc status accordingly.
##
## ## What this does NOT disable
##
## - OpenAI's hosted Codex Cloud GitHub App
##   (chatgpt-codex-connector[bot]) which listens natively for
##   '@codex review' comments and PR-open events. That App is
##   configured at https://chatgpt.com/codex/cloud/settings/general
##   and is independent of this workflow.
## - The OPENAI_API_KEY org secret. Leave it in place - it is
##   simply unreferenced while this stub is in effect.
##
## ## Trust footprint (when enabled)
##
## openai/codex-action - SHA-pinned, calls the OpenAI API with the
## caller's OPENAI_API_KEY. Posts review comments via the runner's
## GITHUB_TOKEN scoped to the permissions block on the calling job.
##
## ## Inputs (preserved for caller compatibility)
##
## - allow-bot-users   (optional)  Comma-separated bot usernames
##                                 to bypass the action's actor-
##                                 write-access gate. Doubles as
##                                 the @codex-review comment-
##                                 trigger roster (humans in this
##                                 list are also allowed to invoke
##                                 via comment).
##                                 Default: org canonical bot list.
## - pr-ref            (optional)  Ref to checkout (workflow_dispatch
##                                 fork-PR review path). Use
##                                 'refs/pull/<N>/merge' (most
##                                 accurate) or 'refs/pull/<N>/head'.
##                                 Default: "" (use github.ref).
## - sandbox           (optional)  Codex sandbox mode. Default
##                                 'read-only' - the action runs
##                                 review-only, no workspace
##                                 mutation.
## - prompt            (optional)  Instruction passed to Codex.
##                                 Default: a generic
##                                 security/correctness/best-practices
##                                 review prompt.
## - timeout-minutes   (optional)  Job timeout. Default 30.
##
## Defaults are kept at their enabled-state values so that a
## re-enable does not silently change behavior.

name: OpenAI Codex Review (reusable, DISABLED)

on:
  workflow_call:
    inputs:
      allow-bot-users:
        required: false
        type: string
        default: "adrelanos,ArrayBolt3,assisted-by-ai"
      pr-ref:
        required: false
        type: string
        default: ""
      sandbox:
        required: false
        type: string
        default: "read-only"
      prompt:
        required: false
        type: string
        default: "Review the code changes in this PR for security, correctness, and best practices."
      timeout-minutes:
        required: false
        type: number
        default: 30
    ## When re-enabling, you MUST re-add an explicit 'secrets:'
    ## schema declaration here:
    ##
    ##   secrets:
    ##     OPENAI_API_KEY:
    ##       required: true
    ##
    ## Consumers (consumer-codex-review.yml) already forward
    ## OPENAI_API_KEY via an explicit secrets: map, but with no
    ## schema declared here that forward is silently ignored by
    ## Actions - the action call inside the archived 'review:' job
    ## would then receive an empty 'openai-api-key' input and fail
    ## opaquely at runtime. The schema makes the contract
    ## load-time-enforced instead. Mirrors the Claude reusable's
    ## hardening; same rationale (forces explicit forwarding vs
    ## 'secrets: inherit').

permissions:
  contents: read

## No reusable-side concurrency block. Per agents/github-actions.md
## G-A-006: github.workflow inside a reusable resolves to the
## caller's workflow name, so a reusable that declares a group key
## the caller cannot disambiguate produces an identical lock to the
## caller's and self-cancels. The caller's lock lives in
## consumer-codex-review.yml and covers this reusable's runs. When
## re-enabling the archived job body below, do NOT re-add a
## concurrency block here.

jobs:
  ## ACTIVE: kill-switch stub. Every consumer wrapper calls this
  ## reusable via '@master', so this single 'if: false' disables
  ## Codex review across every caller in the org. The job is
  ## skipped (no runner allocated, zero CI minutes); the
  ## corresponding check appears as 'skipped' in the consumer's
  ## PR check list.
  review:
    name: OpenAI Codex Review (disabled)
    if: false
    runs-on: ubuntu-latest
    timeout-minutes: 1
    steps:
      - run: ":"

## ## ARCHIVED IMPLEMENTATION ##
##
## Below is the full Codex review job body, preserved for revival.
## To re-enable, delete the active 'review:' job above and
## uncomment the block between the BEGIN/END markers (remove the
## leading '## ' on each line).
##
## Notes for revival:
## - When re-enabled, both this workflow path AND the OpenAI Codex
##   Cloud App will respond to '@codex review' comments. Intentional;
##   mirrors the Claude reusable + Anthropic-side App parallel.
## - The openai/codex-action SHA below was current as of 2026-05-06.
##   Re-pin to a more recent SHA at revival time and verify the
##   action's input surface has not drifted (allow-bot-users,
##   sandbox, prompt names).
## - The fork-PR skip in both the job-level 'if:' and the
##   'Resolve PR head' step are deliberate - they prevent attacker-
##   controlled prompts/code on fork PRs from burning the paid
##   OPENAI_API_KEY. Maintainers can still review fork PRs via the
##   workflow_dispatch path with a 'pr_ref' input.
##
## ----- BEGIN ARCHIVED 'review:' JOB -----
##
##  review:
##    name: OpenAI Codex Review
##    runs-on: ubuntu-latest
##    timeout-minutes: ${{ inputs.timeout-minutes }}
##
##    ## Trigger surface:
##    ##   workflow_dispatch  - always allowed (maintainer-authorized).
##    ##   pull_request       - only same-repo PRs (fork skip; fork
##    ##                        review goes via workflow_dispatch).
##    ##   issue_comment / pull_request_review_comment - only when
##    ##                        the comment body contains '@codex
##    ##                        review' AND the actor is in the
##    ##                        roster (allow-bot-users). The
##    ##                        comment-triggered run also fork-skips
##    ##                        in the resolve step below.
##    if: |
##      github.event_name == 'workflow_dispatch' ||
##      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
##      (
##        contains(format(',{0},', inputs.allow-bot-users), format(',{0},', github.actor)) &&
##        (
##          (github.event_name == 'issue_comment' && github.event.issue.pull_request != null && contains(github.event.comment.body, '@codex review')) ||
##          (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@codex review'))
##        )
##      )
##
##    permissions:
##      contents: read
##      pull-requests: write
##
##    steps:
##      ## Comment-triggered path: resolve the PR head SHA via the
##      ## REST API (github.ref on issue_comment is the default
##      ## branch, not the PR head). Hard-fail on fork PRs - same
##      ## security stance as the pull_request fork skip in the
##      ## job-level if: above.
##      - name: Resolve PR head (comment-triggered)
##        id: resolve_pr
##        if: github.event_name == 'issue_comment' || github.event_name == 'pull_request_review_comment'
##        env:
##          GH_TOKEN: ${{ github.token }}
##          GH_EVENT_NAME: ${{ github.event_name }}
##          GH_ISSUE_PR_URL: ${{ github.event.issue.pull_request.url }}
##          GH_PR_URL: ${{ github.event.pull_request.url }}
##          GH_REPO: ${{ github.repository }}
##        run: |
##          case "${GH_EVENT_NAME}" in
##            issue_comment)
##              pr_url="${GH_ISSUE_PR_URL}"
##              ;;
##            pull_request_review_comment)
##              pr_url="${GH_PR_URL}"
##              ;;
##          esac
##          if [ -z "$pr_url" ]; then
##            echo "::error::Could not resolve PR URL from ${GH_EVENT_NAME} event"
##            exit 1
##          fi
##          json="$(gh api "$pr_url")"
##          head_repo="$(jq -r '.head.repo.full_name' <<<"$json")"
##          head_sha="$(jq -r '.head.sha' <<<"$json")"
##          if [ "$head_repo" != "${GH_REPO}" ]; then
##            echo "::error::PR is from fork '$head_repo'. Use workflow_dispatch with pr_ref to review fork PRs."
##            exit 1
##          fi
##          echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"
##
##      - name: Checkout repository
##        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
##        with:
##          ## Three checkout cases:
##          ##   comment-triggered  -> resolved PR head SHA
##          ##   workflow_dispatch  -> caller-supplied pr-ref
##          ##   pull_request       -> default github.ref (PR head)
##          ref: ${{ steps.resolve_pr.outputs.head_sha || inputs.pr-ref }}
##          persist-credentials: false
##          fetch-depth: 0
##
##      - name: Run Codex Review
##        uses: openai/codex-action@e0fdf01220eb9a88167c4898839d273e3f2609d1  # main @ 2026-05-06 (no stable tag yet)
##        with:
##          openai-api-key: ${{ secrets.OPENAI_API_KEY }}
##          allow-bot-users: ${{ inputs.allow-bot-users }}
##          sandbox: ${{ inputs.sandbox }}
##          prompt: ${{ inputs.prompt }}
##
## ----- END ARCHIVED 'review:' JOB -----
