Add MCP configuration and Codex GitHub Actions workflows new codex PR from Codex for macOS - #46
Conversation
Summary of ChangesHello @clduab11, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the repository's automation capabilities by integrating robust Codex GitHub Actions workflows. It introduces automated PR reviews and strategic growth brief generation, both powered by a sophisticated Multi-tool Coordination Protocol (MCP) setup. The changes streamline development processes and provide data-driven insights, while also clearly documenting the configuration and security implications for maintainers. Highlights
Changelog
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds robust GitHub Action workflows for Codex, integrating multiple MCP (Model Control Protocol) providers for enhanced PR reviews and automated growth analysis. The changes are well-organized, including workflow definitions, TOML configuration for MCP servers, detailed prompt templates, and a comprehensive runbook. My review focuses on the correctness of the configuration and the accuracy of the documentation. I've found a likely misconfiguration in the MCP server settings and a broken link in the runbook, which should be addressed to ensure the new workflows function as intended.
clduab11
added
enhancement
📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds an MCP TOML configuration, two Codex prompt directives, two GitHub Actions workflows that run Codex with sandboxed MCP servers, and a runbook documenting usage, secrets, MCP server entries, and security considerations. (≤50 words) Changes
Sequence Diagram(s)sequenceDiagram
actor User
participant GH as "GitHub Actions"
participant Repo as "Repository (code & prompts)"
participant Codex as "openai/codex-action"
participant MCP as "MCP Servers (context7, brave, ...)"
participant GHAPI as "GitHub API"
User->>GH: trigger workflow (PR event / dispatch / schedule)
GH->>Repo: checkout repo & PR merge ref
GH->>Codex: invoke Codex action (prompt, sandbox, MCP config)
Codex->>MCP: query configured MCP servers (in order)
MCP-->>Codex: return context/tool responses
Codex->>Codex: synthesize final message (review/brief)
Codex-->>GH: upload artifact (final message)
GH->>GHAPI: post comment or create issue (if configured)
GHAPI-->>GH: confirmation
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
No actionable comments were generated in the recent review. 🎉 Comment |
|
@coderabbitai help |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6021426bfd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
coderabbitai
Bot
added
the
documentation
This comment was marked as resolved.
This comment was marked as resolved.
clduab11
changed the title
clduab11
changed the title
Add an explicit fork guard in the PR metadata resolution step so workflow_dispatch cannot run Codex on fork-backed pull requests. The step now reads .head.repo.fork from the GitHub API response and exits before checkout/Codex execution when true. Also replace fixed heredoc terminators for title/body outputs with UUID-based delimiters to prevent accidental truncation or output injection when PR markdown contains standalone EOF lines.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In @.github/codex/configs/mcp-full.toml:
- Around line 1-6: Update the top-level config keys to match Codex 0.99.0:
rename the sandbox_mode entry to sandbox_policy and remove the web_search entry
entirely; ensure the remaining top-level keys are only model, model_provider (if
needed), approval_policy, sandbox_policy, mcp_servers, and otel so the config
(symbols: sandbox_mode -> sandbox_policy, web_search) is valid and the action
can start without error.
In `@docs/runbooks/github-codex-action-mcp.md`:
- Around line 3-14: Add a short "How to run" section to this runbook that tells
operators how to invoke the two workflows
`.github/workflows/codex-pr-review-mcp.yml` and
`.github/workflows/codex-viral-growth-mcp.yml`: include manual trigger
instructions (how to use the GitHub Actions "Run workflow" UI and required input
names/expected values), the scheduled/crontab schedule (if any) and how to
change it, the important inputs passed to openai/codex-action such as
`safety-strategy: unsafe`, `sandbox: workspace-write`, the Codex home config
location `.github/codex/configs/mcp-full.toml`, and mention artifact upload is
enabled for auditability; keep it compact with an example of the minimal input
set to run each workflow and a short note on where to find logs/artifacts.
🧹 Nitpick comments (3)
.github/codex/prompts/pr-review.md (1)
21-26: Reduce repetitive “Include” phrasing for readability.
LanguageTool flagged the repeated sentence starts; a slight reword keeps the contract crisp.✏️ Suggested wording
- - Include a `#### Suggested Fixes` section with concrete next actions. - - Include a `#### MCP Usage` section listing which of the five MCP servers were used and for what. + - Provide a `#### Suggested Fixes` section with concrete next actions. + - List MCP usage (which of the five servers were used and for what) under `#### MCP Usage`..github/workflows/codex-viral-growth-mcp.yml (1)
43-50: Guardnpm ciwhen a lockfile isn’t present.
If a consumer runs this workflow withoutpackage-lock.json,npm ciwill fail. Consider a small file check to make the step resilient.♻️ Suggested guard
- npm ci + if [ -f package-lock.json ]; then + npm ci + fi.github/workflows/codex-pr-review-mcp.yml (1)
88-95: Consider the samenpm ciguard here.
Unconditionalnpm ciwill fail if a lockfile isn’t present; a small check keeps manual runs more robust.♻️ Suggested guard
- npm ci + if [ -f package-lock.json ]; then + npm ci + fi
|
@copilot , isolate observed issues and execute the following fixes... In @.github/codex/configs/mcp-full.toml:
In
|
coderabbitai
Bot
changed the title
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 648bfc83c0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| mkdir -p "${codex_home}" | ||
| cp ".github/codex/configs/mcp-full.toml" "${codex_home}/config.toml" | ||
|
|
||
| { | ||
| cat ".github/codex/prompts/pr-review.md" |
There was a problem hiding this comment.
This job checks out refs/pull/<n>/merge and then reads both .github/codex/configs/mcp-full.toml and .github/codex/prompts/pr-review.md from that untrusted tree before running openai/codex-action with OPENAI_API_KEY and other secrets. A same-repo PR can modify those files to steer Codex into executing/exfiltrating secrets (especially with safety-strategy: unsafe), so the review boundary is not actually trusted. Read these workflow assets from a trusted base revision (or embed/pin them) instead of the PR merge ref.
Useful? React with 👍 / 👎.
| is_fork="$(jq -r '.head.repo.fork' <<<"$pr_json")" | ||
| if [ "$is_fork" = "true" ]; then | ||
| echo "Refusing to run Codex on fork PR #${pr_number} to protect secrets." >&2 | ||
| exit 1 |
There was a problem hiding this comment.
The fork guard only blocks when .head.repo.fork is exactly "true"; if GitHub returns null for head.repo (which can happen on orphaned/deleted source repos), this check passes and the workflow still checks out refs/pull/<n>/merge and runs with secrets. To keep the manual-dispatch secret boundary intact, fail closed unless the source repo is explicitly the current repository (or .head.repo.fork is explicitly false).
Useful? React with 👍 / 👎.
Codex PR ReviewFindings
Suggested Fixes
MCP Usage
|
Review complete. All previously identified issues have been resolved.
Mention @roomote in a comment to request specific changes to this pull request or fix all unresolved issues. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 24e56f6f76
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Co-authored-by: roomote[bot] <219738659+roomote[bot]@users.noreply.github.com>
Codex PR ReviewFindings
Suggested Fixes
MCP Usage
|
Summary
openai/codex-actionwith MCP-integrated configurationIncluded Files
.github/workflows/codex-pr-review-mcp.yml.github/workflows/codex-viral-growth-mcp.yml.github/codex/configs/mcp-full.toml.github/codex/prompts/pr-review.md.github/codex/prompts/viral-growth-brief.mddocs/runbooks/github-codex-action-mcp.mdNotes
safety-strategy: unsafe(per request)Run Codexto avoid sandbox/network fetch failuresContinue Tasks:▶️ 5 queued — View all