v2.4.1

Release notes v2.4.1

• Range: v2.4.0..v2.4.1
• Compare: v2.4.0...v2.4.1
• Generated: 2026-11-12 19:01 UTC

Summary

Cache-Free Python CI

Reusable Python CI workflows no longer accept dependency-cache inputs, helping caller workflows comply with the repository’s no-cache policy.

Cache-Free TypeScript CI

Reusable TypeScript CI workflows no longer accept cache configuration inputs, helping caller workflows avoid prohibited dependency caching.

Consistent CI Caching

Dependency caching remains disabled across reusable workflow setup steps, giving caller workflows consistent cache-free execution.

What changed

Infra / Deps

• Disable CI Caching: Removed dependency-cache inputs from the reusable Python and TypeScript CI workflows and disabled cache restoration and saving in all setup steps.

Upgrade notes

• Remove Cache Inputs: Caller workflows must stop passing enable-cache to python-ci.yml and cache or cache-dependency-path to ts-ci.yml; these inputs are no longer accepted.

.github/actions/release-notes/action.yml diff

No changes in .github/actions/release-notes/action.yml.

.github/actions/codex-review-prepare/action.yml diff

No changes in .github/actions/codex-review-prepare/action.yml.

.github/actions/codex-review-pass/action.yml diff

No changes in .github/actions/codex-review-pass/action.yml.

.github/actions/codex-post-review/action.yml diff

No changes in .github/actions/codex-post-review/action.yml.

.github/workflows/codex-pr-review.yml diff

No changes in .github/workflows/codex-pr-review.yml.

v2.4.0

Release notes v2.4.0

• Range: v2.3.6..v2.4.0
• Compare: v2.3.6...v2.4.0
• Generated: 2026-11-12 17:04 UTC

Summary

Prevented Skip-CI Suppression

Pull requests containing text that could suppress CI after squash merges are now blocked with guidance, preventing required post-merge CI and release workflows from being silently skipped.

What changed

Infra / Deps

• Blocked Skip-CI Markers: The required security scan now checks pull request titles, bodies, and merge-queue commit messages for GitHub skip-CI markers. Matching text fails the check with guidance, preventing post-merge CI and release workflows from being silently skipped; the check runs without checkout or token permissions.

Upgrade notes

• No explicit upgrade notes detected from the diff digest.

.github/actions/release-notes/action.yml diff

No changes in .github/actions/release-notes/action.yml.

.github/actions/codex-review-prepare/action.yml diff

No changes in .github/actions/codex-review-prepare/action.yml.

.github/actions/codex-review-pass/action.yml diff

No changes in .github/actions/codex-review-pass/action.yml.

.github/actions/codex-post-review/action.yml diff

No changes in .github/actions/codex-post-review/action.yml.

.github/workflows/codex-pr-review.yml diff

No changes in .github/workflows/codex-pr-review.yml.

v2.3.6

Release notes v2.3.6

• Range: v2.3.5..v2.3.6
• Compare: v2.3.5...v2.3.6
• Generated: 2026-11-12 14:28 UTC

Summary

What changed

Infra / Deps

• Update PR Review Dependency: Updated the dependency used by automated PR reviews to a newer release, keeping review workflows current.

Upgrade notes

• Action and workflow interface: Composite action or reusable workflow inputs, secrets, or outputs changed; review the diff section and update caller workflows if needed.

.github/actions/release-notes/action.yml diff

No changes in .github/actions/release-notes/action.yml.

.github/actions/codex-review-prepare/action.yml diff

No changes in .github/actions/codex-review-prepare/action.yml.

.github/actions/codex-review-pass/action.yml diff

diff --git a/.github/actions/codex-review-pass/action.yml b/.github/actions/codex-review-pass/action.yml
index b34e603..c1e2374 100644
--- a/.github/actions/codex-review-pass/action.yml
+++ b/.github/actions/codex-review-pass/action.yml
@@ -27,7 +27,7 @@ inputs:
   codex_version:
     description: Codex CLI version pin
     required: false
-    default: "0.164.0"
+    default: "0.166.0"
 
 runs:
   using: composite

.github/actions/codex-post-review/action.yml diff

No changes in .github/actions/codex-post-review/action.yml.

.github/workflows/codex-pr-review.yml diff

diff --git a/.github/workflows/codex-pr-review.yml b/.github/workflows/codex-pr-review.yml
index 6262a21..ad53c79 100644
--- a/.github/workflows/codex-pr-review.yml
+++ b/.github/workflows/codex-pr-review.yml
@@ -62,7 +62,7 @@ on:
       codex_version:
         description: Codex CLI version pin
         type: string
-        default: "0.164.0"
+        default: "0.166.0"
     secrets:
       AZURE_AI_API_KEY:
         description: Azure API key for Codex. Pass it by name; an environment secret with the same name in `environment` takes precedence.

v2.3.5

Release notes v2.3.5

• Range: v2.3.4..v2.3.5
• Compare: v2.3.4...v2.3.5
• Generated: 2026-11-12 11:33 UTC

Summary

What changed

Infra / Deps

• Update CI runtimes: Updated the CI runtime dependencies used by review automation, release-note generation, and tests, keeping repository automation on newer runtime and tooling releases.

Upgrade notes

• Action and workflow interface: Composite action or reusable workflow inputs, secrets, or outputs changed; review the diff section and update caller workflows if needed.

.github/actions/release-notes/action.yml diff

diff --git a/.github/actions/release-notes/action.yml b/.github/actions/release-notes/action.yml
index 3f6a328..d3519e1 100644
--- a/.github/actions/release-notes/action.yml
+++ b/.github/actions/release-notes/action.yml
@@ -71,7 +71,7 @@ runs:
     - name: Setup Python 3.12 + uv
       uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       with:
-        version: "0.13.6"
+        version: "0.13.7"
         enable-cache: false
         python-version: "3.12"

.github/actions/codex-review-prepare/action.yml diff

No changes in .github/actions/codex-review-prepare/action.yml.

.github/actions/codex-review-pass/action.yml diff

diff --git a/.github/actions/codex-review-pass/action.yml b/.github/actions/codex-review-pass/action.yml
index 92be219..b34e603 100644
--- a/.github/actions/codex-review-pass/action.yml
+++ b/.github/actions/codex-review-pass/action.yml
@@ -135,7 +135,7 @@ runs:
     - name: Set up Node for Codex sandbox preflight
       uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
-        node-version: "26.12.1"
+        node-version: "26.13.0"
         package-manager-cache: false
 
     - name: Preflight Codex sandbox

.github/actions/codex-post-review/action.yml diff

No changes in .github/actions/codex-post-review/action.yml.

.github/workflows/codex-pr-review.yml diff

No changes in .github/workflows/codex-pr-review.yml.

v2.3.4

Release notes v2.3.4

• Range: v2.3.3..v2.3.4
• Compare: v2.3.3...v2.3.4
• Generated: 2026-11-12 10:10 UTC

Summary

Cache-Free Release Notes

The release-notes action no longer enables uv dependency caching, preventing cache-poisoning exposure in caller workflows that use protected secrets.

Safer CI Caching

CI hardening now requires dependency caches to be disabled across all jobs, reducing the risk of poisoned cache entries being reused by caller workflows.

Safer Workflow Validation

Workflows with production or customer-facing effects are no longer manually triggered solely to validate changes; caller workflows use their next regular run instead.

Planned Infrastructure Merges

Infrastructure tooling updates now require human review of the generated plan before merging, helping callers assess real-world effects beyond formatting and validation results.

What changed

Fixes

• Disable Release Notes Cache: The release-notes composite action no longer turns on uv dependency caching during Python setup. This resolves the issue where callers could not disable caching in jobs containing LLM or issue-tracker credentials.

Infra / Deps

• Require Planned Infra Merges: Infrastructure hardening guidance now requires a person to review plans before merging updates to infrastructure tooling and dependencies, and prohibits automerge for these updates.
• Disable CI Caches: Dependency caches must now be disabled in every CI job. The pytest workflow also disables caching for both uv setup steps, reducing the chance of poisoned cache entries being reused across jobs.
• Safer Workflow Validation: Post-merge validation guidance now uses regular scheduled runs for jobs with production or customer-facing effects. Jobs without real-world effects may still be dispatched once after merging.

Upgrade notes

• Action and workflow interface: Composite action or reusable workflow inputs, secrets, or outputs changed; review the diff section and update caller workflows if needed.
• Update Action Pin: Update the release-notes action pin to a release containing the cache-disable fix.

.github/actions/release-notes/action.yml diff

diff --git a/.github/actions/release-notes/action.yml b/.github/actions/release-notes/action.yml
index a450046..3f6a328 100644
--- a/.github/actions/release-notes/action.yml
+++ b/.github/actions/release-notes/action.yml
@@ -72,7 +72,7 @@ runs:
       uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       with:
         version: "0.13.6"
-        enable-cache: true
+        enable-cache: false
         python-version: "3.12"
 
     - name: Install release-notes tool

.github/actions/codex-review-prepare/action.yml diff

No changes in .github/actions/codex-review-prepare/action.yml.

.github/actions/codex-review-pass/action.yml diff

No changes in .github/actions/codex-review-pass/action.yml.

.github/actions/codex-post-review/action.yml diff

No changes in .github/actions/codex-post-review/action.yml.

.github/workflows/codex-pr-review.yml diff

No changes in .github/workflows/codex-pr-review.yml.

v2.3.3

Release notes v2.3.3

• Range: v2.3.2..v2.3.3
• Compare: v2.3.2...v2.3.3
• Generated: 2026-11-10 15:36 UTC

Summary

Detect Missing Coverage

The hardening audit now reports NOT SHOWN when a repository has neither a Renovate pull request nor a Dependency Dashboard issue, preventing missing Renovate coverage from being treated as confirmed coverage.

Safer Update Handover

The hardening guidance now defines an ordered handover from Dependabot to Renovate, including merging available Renovate updates first while keeping security alerts enabled.

Handle Consumer Blocks

The hardening guidance now explains how to review lockfile changes when a locked consumer prevents a vulnerability fix, including when to merge, apply a timestamped exemption, or leave the pull request open.

What changed

Infra / Deps

• Handle Consumer Blocks: The gha-hardening guidance now covers vulnerability fixes blocked by locked consumers. Maintainers are directed to inspect the full lockfile diff and document whether to merge, apply a timestamped exemption, or leave the pull request open, avoiding silent consumer downgrades.
• Renovate Handover Process: The gha-hardening guidance now instructs maintainers to run Renovate and merge its Actions, grouped, and lock-file maintenance updates before recreating remaining Dependabot updates and disabling Dependabot security updates. Security alerts remain enabled, and dependabot.yml is preserved during the handover.
• Accurate Renovate Audit: The GitHub Actions hardening audit now checks for either a Renovate pull request or a Dependency Dashboard issue. If neither exists, it reports NOT SHOWN and directs an organization owner to add the repository to the Renovate App.

Upgrade notes

• No explicit upgrade notes detected from the diff digest.

.github/actions/release-notes/action.yml diff

No changes in .github/actions/release-notes/action.yml.

.github/actions/codex-review-prepare/action.yml diff

No changes in .github/actions/codex-review-prepare/action.yml.

.github/actions/codex-review-pass/action.yml diff

No changes in .github/actions/codex-review-pass/action.yml.

.github/actions/codex-post-review/action.yml diff

No changes in .github/actions/codex-post-review/action.yml.

.github/workflows/codex-pr-review.yml diff

No changes in .github/workflows/codex-pr-review.yml.

v2.3.2

Release notes v2.3.2

• Range: v2.3.1..v2.3.2
• Compare: v2.3.1...v2.3.2
• Generated: 2026-11-09 23:24 UTC

Summary

Trusted PR Context

Codex PR reviews now include the redacted pull request body for trusted authors, allowing reviewers to account for documented manual or migration steps without exposing untrusted contributor content.

What changed

Fixes

• Trusted PR Context: Resolved missing review context for pull requests from owners, members, and collaborators by including their redacted pull request body, limited to 20,000 characters. Content from outside contributors remains excluded.

Upgrade notes

• No explicit upgrade notes detected from the diff digest.

.github/actions/release-notes/action.yml diff

No changes in .github/actions/release-notes/action.yml.

.github/actions/codex-review-prepare/action.yml diff

No changes in .github/actions/codex-review-prepare/action.yml.

.github/actions/codex-review-pass/action.yml diff

No changes in .github/actions/codex-review-pass/action.yml.

.github/actions/codex-post-review/action.yml diff

No changes in .github/actions/codex-post-review/action.yml.

.github/workflows/codex-pr-review.yml diff

No changes in .github/workflows/codex-pr-review.yml.

v2.3.1

Release notes v2.3.1

• Range: v2.3.0..v2.3.1
• Compare: v2.3.0...v2.3.1
• Generated: 2026-11-09 23:01 UTC

Summary

Accurate Codex reviews

Codex advisory reviews now provide repository-valid file links, supported rerun guidance, and accurate severity classifications, resolving broken references and incorrect blocking findings for caller workflows.

What changed

Fixes

• Accurate Codex review findings: Advisory reviews now rewrite runner-local file links to the assessed repository commit or provide safe inline references when repository context is unavailable. They also avoid assuming label-based reruns and classify documented trade-offs or explicitly migrated concerns as Informational instead of Must fix.

Upgrade notes

• Action and workflow interface: Composite action or reusable workflow inputs, secrets, or outputs changed; review the diff section and update caller workflows if needed.

.github/actions/release-notes/action.yml diff

No changes in .github/actions/release-notes/action.yml.

.github/actions/codex-review-prepare/action.yml diff

No changes in .github/actions/codex-review-prepare/action.yml.

.github/actions/codex-review-pass/action.yml diff

diff --git a/.github/actions/codex-review-pass/action.yml b/.github/actions/codex-review-pass/action.yml
index cc7f44c..92be219 100644
--- a/.github/actions/codex-review-pass/action.yml
+++ b/.github/actions/codex-review-pass/action.yml
@@ -229,6 +229,7 @@ runs:
         --input review-pass/final-review.md
         --output assessment/final-review.md
         --title "Codex advisory code review"
+        --context assessment/review-context.json
       shell: bash
 
     - name: Key Leak Check

.github/actions/codex-post-review/action.yml diff

No changes in .github/actions/codex-post-review/action.yml.

.github/workflows/codex-pr-review.yml diff

No changes in .github/workflows/codex-pr-review.yml.

v2.3.0

Release notes v2.3.0

• Range: v2.2.0..v2.3.0
• Compare: v2.2.0...v2.3.0
• Generated: 2026-11-09 22:18 UTC

Summary

What changed

Infra / Deps

• GHA Hardening Skill: Added a reusable GitHub Actions hardening skill with workflow audits, contract checks, action pinning, secret-environment migration guidance, lockfile comparison, and Gate scans. It also adds ShellCheck coverage for repository shell scripts, helping maintainers identify workflow security and dependency-management issues consistently.

Upgrade notes

• Action and workflow interface: Composite action or reusable workflow inputs, secrets, or outputs changed; review the diff section and update caller workflows if needed.

.github/actions/release-notes/action.yml diff

No changes in .github/actions/release-notes/action.yml.

.github/actions/codex-review-prepare/action.yml diff

No changes in .github/actions/codex-review-prepare/action.yml.

.github/actions/codex-review-pass/action.yml diff

No changes in .github/actions/codex-review-pass/action.yml.

.github/actions/codex-post-review/action.yml diff

No changes in .github/actions/codex-post-review/action.yml.

.github/workflows/codex-pr-review.yml diff

diff --git a/.github/workflows/codex-pr-review.yml b/.github/workflows/codex-pr-review.yml
index 3de71f2..6262a21 100644
--- a/.github/workflows/codex-pr-review.yml
+++ b/.github/workflows/codex-pr-review.yml
@@ -12,7 +12,7 @@ on:
   workflow_call:
     inputs:
       environment:
-        description: Caller-repository environment holding the AZURE_AI_API_KEY secret and AZURE_AI_RESPONSES_BASE variable (for example `ci`)
+        description: Caller-repository environment holding the AZURE_AI_API_KEY secret and AZURE_AI_RESPONSES_BASE variable (for example `azure-codex-review`)
         type: string
         required: true
       runner:

v2.2.0

Release notes v2.2.0

• Range: v2.1.1..v2.2.0
• Compare: v2.1.1...v2.2.0
• Generated: 2026-11-09 20:25 UTC

Summary

Safer Workflow Scans

Repository operators can now detect unsafe workflow paths, symlinks, YAML-to-committed-byte mismatches, and unverifiable newly added pins before merging. The scan is also compatible with ruleset-required workflows.

What changed

Infra / Deps

• Harden Zizmor Scans: Zizmor scanning now uses a shared, commit-pinned script with the auditor persona and checks for unsafe workflow paths, symlinks, and mismatches between YAML files and their committed bytes. A new job validates newly added action, reusable-workflow, and pre-commit references against online repository history, including commits without history. Removing cancel-in-progress allows the scan to run as a ruleset-required workflow.

Upgrade notes

• No explicit upgrade notes detected from the diff digest.

.github/actions/release-notes/action.yml diff

No changes in .github/actions/release-notes/action.yml.

.github/actions/codex-review-prepare/action.yml diff

No changes in .github/actions/codex-review-prepare/action.yml.

.github/actions/codex-review-pass/action.yml diff

No changes in .github/actions/codex-review-pass/action.yml.

.github/actions/codex-post-review/action.yml diff

No changes in .github/actions/codex-post-review/action.yml.

.github/workflows/codex-pr-review.yml diff

No changes in .github/workflows/codex-pr-review.yml.