Repository navigation
ci(governance): adopt the canonical risk gate - #705
Conversation
The organization copy publishes no ai-review context, so the Codex receipt is decorative. Replace it with the tested canonical gate: approver from RISK_GATE_OWNER, ai-review on the current head, ancestry drift, shared-head fail-closed and protected paths.
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
The canonical gate dispatches per-PR evaluations from its push and scheduled sweeps, and those runs complete as workflow_dispatch runs with no pull request in the payload. Only pull_request_target runs carry a PR head, so the submit selector admits only those.
|
@codex review |
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
A synchronize can move one pull request off a shared head even when its own evaluation fails, which leaves the released sibling on a stale collision error until another event or the six-hour sweep. Run the sibling refresh in a finally block and keep a refresh failure from masking the evaluation error.
|
@codex review |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Pigbibi
added
the
owner-approved
|
@codex review |
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
AI assistance
Qoder implemented the existing governance changes. Codex synchronized main and verified the resulting candidate under the current owner authorization.
What changed
Publish ai-review from the completed Codex receipt for the current head, check base ancestry and shared-head collisions, and preserve fail-closed handling for protected paths. Keep owner and agent approval descriptions distinct. Limit automatic dot review selection to pull_request_target runs. Update AGENTS.md to describe these checks.
The branch was synchronized using git merge origin/main without conflicts. No additional implementation edits were needed; there were no unresolved review threads at the initial readback.
How verified
Central publication scan: publication-check/2.0-advisory, build 83d9d1130377; 1461 advisory matches across 1450 matching lines in the complete tracked tree. These are repository-wide advisory results, not a zero-match claim. The first 20 masked matches are listed below.
.env.example:21:TELEGRAM_TOKEN=<<HOST>>.github/CODEOWNERS:7:/.env.example @<PROJECT_ID>.github/CODEOWNERS:8:/.github/CODEOWNERS @<PROJECT_ID>.github/CODEOWNERS:9:/.github/workflows/ @<PROJECT_ID>.github/CODEOWNERS:10:/application/account_new_risk_gate_support.py @<PROJECT_ID>.github/CODEOWNERS:11:/application/durable_execution_commands.py @<PROJECT_ID>.github/CODEOWNERS:12:/application/execution_receipt_adapter.py @<PROJECT_ID>.github/CODEOWNERS:13:/application/execution_service.py @<PROJECT_ID>.github/CODEOWNERS:14:/application/execution_state.py @<PROJECT_ID>.github/CODEOWNERS:15:/application/longbridge_execution.py @<PROJECT_ID>.github/CODEOWNERS:16:/application/paper_execution_command_consumer.py @<PROJECT_ID>.github/CODEOWNERS:17:/application/paper_strategy_risk_state.py @<PROJECT_ID>.github/CODEOWNERS:18:/runtime_execution_policy.py @<PROJECT_ID>.github/CODEOWNERS:19:/scripts/execution_report_heartbeat.py @<PROJECT_ID>.github/dot-review/review.cjs:106:const token = <REDACTED> core.getIDToken(audienceText); // Exact bytes; URL normalization may change an audience..github/dot-review/review.cjs:190:const <PROJECT_ID> = {...pr,head:{...pr.head,sha:pair.target},base:{...pr.base,sha:pair.base}};.github/dot-review/review.cjs:191:const binding = {...b.binding({repository:trust.repo.full_name,pr:<PROJECT_ID>,policyCommit:trust.commit,files},trust.policySha),.github/dot-review/test-review.cjs:81:const content='<PROJECT_ID> source\n', sourceSHA='d'.repeat(40);.github/dot-review/test-review.cjs:82:const pr={number:7,changed_files:1,commits:1,title:'<PROJECT_ID> change',body:'<PROJECT_ID> body',.github/dot-review/test-review.cjs:100:assert.equal(audience,'https://audience.example.test');return '<PROJECT_ID>-only';},summary};Risk
This changes pull-request governance status publication. Preserve existing required checks and approval labels. The operational task separately authorizes normal squash merge followed by adding required ai-review while preserving every existing context, application binding and strictness setting. No deploy, secret, IAM or runtime switch change is included.