Code Review Workflows

# Fast: review the patch alone
git diff main...HEAD | codex exec \
  --ask-for-approval never --sandbox read-only \
  "Review for bugs, security, and missing tests. Format:
   [SEVERITY] desc (file:line)" \
  --output-last-message > review.md

# In-context: full file + diff
codex exec --ask-for-approval never --sandbox read-only \
  "Read src/auth.ts in full, then review the staged changes
   in context. Flag any newly-introduced inconsistencies." \
  > review.md

name: Codex Review
on:
  pull_request: { types: [opened, synchronize] }

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - run: npm install -g @openai/codex
      - name: Run review
        env: { OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} }
        run: |
          git diff origin/main...HEAD | codex exec \
            --ask-for-approval never --sandbox read-only \
            "PR review: bugs, security, perf, style." \
            --output-last-message > review.md
      - uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const review = fs.readFileSync('review.md', 'utf8');
            github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: '## Codex Review\n' + review
            });