Skip to content

Fix Codex 0.99.0 config schema and add workflow invocation docs #47

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
clduab11 merged 2 commits into from
Feb 12, 2026
Merged

Fix Codex 0.99.0 config schema and add workflow invocation docs #47

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bd28edb
Initial plan
Copilot Feb 12, 2026
9785c32
Update Codex config for 0.99.0 schema and add workflow runbook
Copilot Feb 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions .github/codex/configs/mcp-full.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,7 @@

model = "gpt-5-codex"
approval_policy = "never"
sandbox_mode = "workspace-write"
web_search = "live"
sandbox_policy = "workspace-write"

[sandbox_workspace_write]
network_access = true
Expand Down
51 changes: 51 additions & 0 deletions docs/runbooks/github-codex-action-mcp.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,57 @@ Both use `openai/codex-action` with:
- a Codex home config at `.github/codex/configs/mcp-full.toml`
- artifact upload enabled for auditability

## How to run

### Codex PR Review workflow

**Automatic triggers:**
- Runs automatically on PR events: opened, synchronize, reopened, ready_for_review
- Only runs on non-draft PRs from non-fork branches (fork PRs are blocked to protect secrets)

@ghost ghost Feb 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The fork PR protection applies to both automatic and manual triggers, but the documentation only mentions it under "Automatic triggers". When manually triggering via workflow_dispatch, the workflow will still fail if the target PR is from a fork (see lines 36-54 in the workflow file where the fork check runs for both event types). This could confuse operators who attempt manual reviews on fork PRs expecting them to work.

Fix it with Roo Code or mention @roomote and request a fix.


**Manual trigger:**
1. Navigate to Actions → "Codex PR Review (MCP-Enhanced)"
2. Click "Run workflow"
3. Required input:
- `pr_number`: Pull request number to review (e.g., `42`)
4. Click "Run workflow" button

**Key configuration:**
- `safety-strategy: unsafe`
- `sandbox: workspace-write` with `network_access=true`
- Codex home: `.github/codex/configs/mcp-full.toml`
- Model: `gpt-5-codex` with `effort: high`

**Outputs:**
- Artifact: `codex-pr-review-{pr_number}` (retained 14 days)
- PR comment with review feedback (if Codex produces output)
- Logs available in workflow run details

### Codex Viral Growth Brief workflow

**Scheduled trigger:**
- Runs weekly on Mondays at 14:00 UTC (cron: `0 14 * * 1`)
- To change schedule, edit the `cron:` expression in `.github/workflows/codex-viral-growth-mcp.yml`

**Manual trigger:**
1. Navigate to Actions → "Codex Viral Growth Brief (MCP-Enhanced)"
2. Click "Run workflow"
3. Optional inputs:
- `focus`: Focus area for the brief (e.g., "developer adoption", "GitHub visibility", "enterprise GTM") - leave empty for general brief
- `post_issue`: Check this to create a GitHub issue with the generated brief (default: unchecked)
4. Click "Run workflow" button

**Key configuration:**
- `safety-strategy: unsafe`
- `sandbox: workspace-write` with `network_access=true`
- Codex home: `.github/codex/configs/mcp-full.toml`
- Model: `gpt-5-codex` with `effort: high`

**Outputs:**
- Artifact: `codex-viral-growth-brief` (retained 14 days)
- Optional GitHub issue (if `post_issue` input is true)
- Logs available in workflow run details

## Why dependencies are installed before Codex

`codex-action` runs Codex with sandboxing. In `workspace-write`, network is often disabled by default unless enabled in config. To avoid flaky runtime installs, workflows pre-install project and MCP dependencies before `Run Codex`.
Expand Down
Loading