A `/aster-code-review …` comment (gated to owners/members/collaborators) drives
the skill on the PR, mirroring the skill interface:
diff / files review the PR, post inline comments
smoke `make smoke` — does the skill run?
benchmark `make benchmark` — recall (informational)
The workflow is split in two: a fast triage job parses the command with a
trusted, default-branch copy of the parser (scripts/parse_pr_command.sh), gates
on author association, and replies promptly; a run job re-validates every value,
runs the skill, and posts either inline review comments (findings off the PR diff
go in the review body) or a human-friendly status comment. Replaces the earlier
Codex-JSON-schema workflow (and drops codex-output-schema.json).
The previous approach used `git checkout "$BASE_SHA"` to restore the
schema file, which fails when the PR's base SHA predates the addition
of the schema file. Instead, fetch it from the upstream default branch
via the GitHub Contents API. This always works regardless of git
history and ensures the schema matches the workflow version on main.
The job-level contains() is a substring match, so comments like
"> @boterinas codex" (blockquote) or "don't run @boterinas codex"
(mid-sentence) would false-trigger. Add a validation step that
requires the command at the start of a line before proceeding.
Use POSIX-compatible grep -E instead of grep -P for portability.
- Remove the `pull_request_target` auto-trigger entirely. Codex
reviews are now triggered only via `@boterinas codex` comments
(gated to MEMBER/OWNER/COLLABORATOR) or `workflow_dispatch`.
This prevents untrusted fork code from running with secrets and
stops API-credit abuse from arbitrary PR opens.
- Always restore `.github/codex-output-schema.json` from the base
branch unconditionally. This fixes the "No such file or directory"
failure for PRs predating the schema file, and prevents fork PRs
from supplying a crafted schema.
Replace the `synchronize` trigger with an on-demand `@boterinas codex`
comment command so that Codex reviews are only run when explicitly
requested by repository members, avoiding wasted API credits on every
push. The workflow now reacts with an eyes emoji for immediate feedback
and restricts usage to MEMBER/OWNER/COLLABORATOR author associations.
Tate, Hongliang Tian