name: Codex Review
description: Reusable fail-closed Codex PR review gate with project-tunable prompts.
author: pingcap-inc

inputs:
  github-token:
    description: GitHub token used to read PR metadata, post review comments, and request auto-merge.
    required: false
    default: '${{ github.token }}'
  model:
    description: Codex model name.
    required: false
    default: gpt-5.6-luna
  sandbox:
    description: Codex sandbox mode. read-only prevents review tools from leaving workspace artifacts; writable modes are explicit opt-ins.
    required: false
    default: read-only
  passes:
    description: 'Comma or newline separated review passes to run: standard, adversarial.'
    required: false
    default: standard,adversarial
  parallel-passes:
    description: Run independent review passes concurrently. Requires sandbox=read-only.
    required: false
    default: 'false'
  policy-paths:
    description: Newline or comma separated project policy files from the checked-out pull request tree.
    required: false
    default: |
      AGENTS.md
      CLAUDE.md
      .github/codex-review/policy.md
  standard-prompt-path:
    description: Checked-out-tree prompt file for the standard review pass.
    required: false
    default: .github/codex-review/standard.md
  adversarial-prompt-path:
    description: Checked-out-tree prompt file for the adversarial review pass.
    required: false
    default: .github/codex-review/adversarial.md
  extra-instructions:
    description: Additional prompt text supplied by the workflow.
    required: false
    default: ''
  include-pr-comments:
    description: When true, include the latest PR issue comment beginning with /rebuttal in the review prompt. Other issue comments, review bodies, and inline review comments are never included.
    required: false
    default: 'true'
  post-comments:
    description: Post per-pass and aggregate review comments to the PR.
    required: false
    default: 'true'
  auto-merge:
    description: Request squash auto-merge via gh after APPROVE; failures are posted to the PR without failing the action.
    required: false
    default: 'false'
  fail-on-block:
    description: Mark the action failed when any review pass returns BLOCK.
    required: false
    default: 'true'
  pr-number:
    description: Pull request number. Defaults to the event pull_request number.
    required: false
    default: ''
  review-dir:
    description: Absent direct child of GITHUB_WORKSPACE where inert PR review inputs are staged and removed during post-job cleanup.
    required: false
    default: .codex-review
  output-dir:
    description: Caller-owned directory for prompts, schemas, outputs, and attempt logs. By default the action uses unique storage under RUNNER_TEMP and removes it during post-job cleanup.
    required: false
    default: ''
  max-snapshot-bytes:
    description: Maximum bytes to snapshot for each changed or external text file.
    required: false
    default: '1048576'
  max-total-snapshot-bytes:
    description: Maximum aggregate disk budget for changed-file and external-source snapshots, charging at least 4 KiB per stored file.
    required: false
    default: '52428800'
  max-diff-bytes:
    description: Maximum bytes for the exact staged pull request diff; larger diffs fail closed.
    required: false
    default: '52428800'
  max-diagnostic-bytes:
    description: Maximum aggregate bytes persisted from Codex stdout and stderr across all passes and attempts.
    required: false
    default: '52428800'
  max-review-metadata-bytes:
    description: Maximum aggregate bytes persisted for staged PR metadata, project prompts, and the review schema.
    required: false
    default: '16777216'
  max-review-output-bytes:
    description: Maximum bytes accepted from each final structured Codex review output.
    required: false
    default: '1048576'
  max-git-repository-bytes:
    description: Post-operation size guard for the temporary partial Git repository; use a filesystem quota for a hard transfer limit.
    required: false
    default: '1073741824'
  max-attempts:
    description: Maximum Codex attempts per pass for retryable transient failures.
    required: false
    default: '3'
  initial-backoff-seconds:
    description: Initial retry backoff in seconds.
    required: false
    default: '15'
  safe-path:
    description: PATH passed to Codex. Defaults to the runner PATH.
    required: false
    default: ''

outputs:
  verdict:
    description: Aggregate status, APPROVE, BLOCK, or FAILED when a pass produced no verdict.
  blocking-count:
    description: Number of blocking issues across review passes.
  head-sha:
    description: Reviewed PR head SHA.
  base-sha:
    description: Reviewed PR base SHA.
runs:
  using: node24
  main: dist/index.js
  post: dist/cleanup.js
  post-if: always()

branding:
  icon: check-circle
  color: blue