Skip to content

feat: publish reviewed finding selections - #484

Open
mldangelo-oai wants to merge 3 commits into
mainfrom
mdangelo/codex/select-publication-findings
Open

feat: publish reviewed finding selections#484
mldangelo-oai wants to merge 3 commits into
mainfrom
mdangelo/codex/select-publication-findings

Conversation

@mldangelo-oai

@mldangelo-oai mldangelo-oai commented Aug 16, 2026

Copy link
Copy Markdown
Collaborator

Summary

Let callers publish a reviewed subset of a completed scan and detect payload changes before creating Linear issues.

Changes

  • Add repeatable --finding selection and SDK findingIds.
  • Return a stable payloadDigest and accept --expect-digest / expectedDigest.
  • Bind the digest to the selected content, scan identity, destination, and requested assignee. Assigned approvals use HMAC-SHA-256 with the selected Linear API credential; neither the credential nor assignee identity is exposed in preview output.
  • Omit the automatic wall-clock upload timestamp from new issue descriptions.
  • Keep the complete sealed scan for local-history validation while sending only selected findings to Linear.
  • Document the preview workflow and keep the default publish-all/create-new behavior.

Testing

  • Six focused publication, publisher, CLI, store, and SQLite integration test files: 150 passed, 0 failed.
  • The SQLite-backed CLI test publishes one selected finding, verifies its stored association and receipt, and confirms sealed artifacts are unchanged.
  • Tests cover changed content, destination, scan identity, selection, assignee, unknown IDs, empty selections, and credential-free previews. The keyed-digest follow-up passed 86 focused publisher/CLI tests with 895 assertions.
  • pnpm run types, pnpm run format, and git diff --check passed.
  • Full and randomized package suites at 6f789c3e each passed 1,300 tests, with 11 expected skips, 0 failures, and 9,214 assertions.
  • Built and packed the current head; the installed-package smoke passed, including selected-preview replay, assigned-credential rotation, digest-mismatch rejection, and identity/credential privacy checks.
  • Re-ran the local PR review, deslop PR review, and code-simplification passes. The late assigned-approval review is fixed additively; a new exact-head Codex review is requested.

Risk and rollout

Selection and digest checking are opt-in. Assigned approvals require the same selected Linear API credential; changing it requires a new preview. Existing unassigned digests are preserved. A digest confirms the prepared request, not Linear permissions or the final remote representation. Receipt verification is handled separately in #482. Existing database verification remains strict; there is no schema migration, dependency change, or automatic retry.

Public disclosure review

  • No customer, partner, prospect, or user identities, data, or identifying details are included.
  • No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
  • I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review the exact head f15825c, especially selected-only remote writes, full-scan history validation, and the opt-in preview digest contract.

@github-actions github-actions Bot added the enhancement New feature or request label Aug 16, 2026
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: f15825ca40

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review the new exact head 0ae2930. The installed-package smoke caught an existing privacy contract: results must not echo the requested assignee identity. The follow-up removes that output while keeping the assignee bound into the digest. The rebuilt installed-package smoke now passes, including matching and mismatched digest checks; full and randomized suites are running.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: 0ae2930f16

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector

Copy link
Copy Markdown

Security review completed. No security issues were found in this pull request.

Reviewed commit: 0ae2930f16

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@mldangelo-oai
mldangelo-oai marked this pull request as ready for review August 16, 2026 08:04
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Final validation and ready-for-review update; the head remains 0ae2930. Both local full-suite orders passed 1,300 tests, the installed-package smoke passed, and the isolated macOS CI rerun is green. Please retain review on this exact head.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0ae2930f16

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/src/publish.ts Outdated
@chatgpt-codex-connector

Copy link
Copy Markdown

Security review completed. No security issues were found in this pull request.

Reviewed commit: 0ae2930f16

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@mldangelo-oai
mldangelo-oai marked this pull request as draft August 16, 2026 08:29
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review Exact current head is 0ae2930. I have returned this PR to draft while addressing the assigned-digest privacy feedback; a new exact-head review will follow the additive fix.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 0ae2930f16

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector

Copy link
Copy Markdown

Security review completed. No security issues were found in this pull request.

Reviewed commit: 0ae2930f16

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review Please review exact head 6f789c3. The assigned-approval privacy feedback is fixed additively; full and randomized suites each passed 1,300 tests, and the fresh installed-package smoke passed.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 6f789c3ede

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector

Copy link
Copy Markdown

Security review completed. No security issues were found in this pull request.

Reviewed commit: 6f789c3ede

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@mldangelo-oai
mldangelo-oai marked this pull request as ready for review August 16, 2026 08:46
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review Current head 6f789c3 is ready again. The targeted Windows retry and all current-head checks passed; please retain review on this exact SHA.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 6f789c3ede

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector

Copy link
Copy Markdown

Security review completed. No security issues were found in this pull request.

Reviewed commit: 6f789c3ede

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant