From 40f0236ed4f332c419b888be3ac1cfa1849095fe Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:28:08 +0000 Subject: [PATCH 1/7] Initial plan From 5a7eaed37112651166efee7d0f265241ac47cf8c Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:35:29 +0000 Subject: [PATCH 2/7] fix(ci): require dedicated CODEX_API_KEY for CI investigator --- .github/workflows/eventrelay-ci-investigator.md | 10 ++++++++++ tests/unit/test_gh_aw_workflow_governance.py | 15 +++++++++++++++ 2 files changed, 25 insertions(+) diff --git a/.github/workflows/eventrelay-ci-investigator.md b/.github/workflows/eventrelay-ci-investigator.md index 0c20c6bf5..924ec4994 100644 --- a/.github/workflows/eventrelay-ci-investigator.md +++ b/.github/workflows/eventrelay-ci-investigator.md @@ -24,6 +24,16 @@ engine: codex model: gpt-5.4 network: defaults +pre-agent-steps: + - name: Require dedicated Codex credential + env: + CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }} + run: | + if [ -z "${CODEX_API_KEY}" ]; then + echo "::error::Dedicated CODEX_API_KEY is required" + exit 1 + fi + safe-outputs: add-comment: max: 1 diff --git a/tests/unit/test_gh_aw_workflow_governance.py b/tests/unit/test_gh_aw_workflow_governance.py index 3414ca007..f4524abf2 100644 --- a/tests/unit/test_gh_aw_workflow_governance.py +++ b/tests/unit/test_gh_aw_workflow_governance.py @@ -104,6 +104,21 @@ def test_focused_coverage_controller_can_read_authoritative_runs() -> None: assert "requires a separate approved GitHub App canary" in source +def test_ci_investigator_requires_dedicated_codex_credential() -> None: + workflow = _load_frontmatter( + ROOT / ".github/workflows/eventrelay-ci-investigator.md" + ) + credential_gate = next( + step + for step in workflow["pre-agent-steps"] + if step.get("name") == "Require dedicated Codex credential" + ) + + assert credential_gate["env"]["CODEX_API_KEY"] == "${{ secrets.CODEX_API_KEY }}" + assert "Dedicated CODEX_API_KEY is required" in credential_gate["run"] + assert "OPENAI_API_KEY" not in credential_gate["run"] + + def test_live_smoke_modules_are_excluded_before_import(monkeypatch) -> None: monkeypatch.delenv("RUN_LIVE_E2E", raising=False) monkeypatch.delenv("RUN_LIVE_DEPLOY", raising=False) From efef1bc008b6b4176fd0d21ddd55b95bb015ba23 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:38:13 +0000 Subject: [PATCH 3/7] test(ci): enforce investigator Codex credential gate --- .github/workflows/AUDIT.md | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/AUDIT.md b/.github/workflows/AUDIT.md index 55c4cd66d..98f92cffb 100644 --- a/.github/workflows/AUDIT.md +++ b/.github/workflows/AUDIT.md @@ -24,6 +24,7 @@ concrete reason, verified against the actual repository tree. | `deploy.yml` | **DELETE** | References a non-existent `deployments/` tree (manifests/terraform); actual infra is `infrastructure/`. The validate job hard-`exit 1`s on missing manifests. Generic multi-cloud (AWS+Azure+Slack) scaffold that duplicates `deploy-cloud-run.yml`. | | `e2e-tests.yml` | **FIX** | Resolve the PR's Vercel preview deployment via the GitHub Deployments API before E2E runs, and skip the PR-comment step for forked `pull_request` runs where `GITHUB_TOKEN` is read-only (`Resource not accessible by integration`). Same-repo PRs still get comments. | | `emergency-stop.yml` | KEEP | Manual operational kill-switch with typed confirmation. | +| `eventrelay-ci-investigator.md` / `.lock.yml` | **FIX** | Require a dedicated `CODEX_API_KEY` credential in pre-agent steps so Codex-specific runs fail fast with an explicit key-missing error instead of ambiguous fallback behavior. | | `issue-triage.yml` | KEEP | Keyword auto-labeling + triage comment on new issues. | | `mcp-optimization.yml` | **DELETE** | Entire workflow targets `mcp-servers/mcp-profiling/` (requirements.txt, investigator_client.py, profiling_server.py) which does not exist — every run fails. | | `phase-goal-tracker.yml` | KEEP | Tracks markdown checklists on phase issues, keeps a single status comment updated, and auto-closes the issue when all checklist goals are complete. | From 3385d2e860d6fe933489347bfb44f8be0296cf78 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:50:08 +0000 Subject: [PATCH 4/7] ci: recompile eventrelay-ci-investigator lock via gh aw v0.82.14 --- .github/workflows/eventrelay-ci-investigator.lock.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/eventrelay-ci-investigator.lock.yml b/.github/workflows/eventrelay-ci-investigator.lock.yml index 4942d59ce..aed25c8ce 100644 --- a/.github/workflows/eventrelay-ci-investigator.lock.yml +++ b/.github/workflows/eventrelay-ci-investigator.lock.yml @@ -1,4 +1,4 @@ -# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"29e87b80b30f697a95953ee333814f783eb950bf33a815c3861ff2454700213c","body_hash":"db86ab41ca32e4ef5905d00ea66edbc4f150a3776b3a87011795bbf5997ed92b","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"b2d33486251c34d0b26e7899655001255e92979582c52fc80137f641dbc62405","body_hash":"db86ab41ca32e4ef5905d00ea66edbc4f150a3776b3a87011795bbf5997ed92b","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} # gh-aw-manifest: {"version":1,"secrets":["CODEX_API_KEY","COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN","OPENAI_API_KEY"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"b6d1443e05b8716267fa19425b99aa4f12006b4a","version":"v0.82.14"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37","digest":"sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37","digest":"sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37","digest":"sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]} # This file was automatically generated by gh-aw (v0.82.14). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # @@ -530,6 +530,15 @@ jobs: env: GH_AW_SKILL_DIR: ".codex/skills" run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh" + - env: + CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }} + name: Require dedicated Codex credential + run: |- + if [ -z "${CODEX_API_KEY}" ]; then + echo "::error::Dedicated CODEX_API_KEY is required" + exit 1 + fi + - name: Download container images run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317 ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32 ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3 - name: Generate Safe Outputs Config From 9e6d1964249156220635741eae3173999b724917 Mon Sep 17 00:00:00 2001 From: Hayden <154503486+groupthinking@users.noreply.github.com> Date: Wed, 22 Jul 2026 15:16:31 -0400 Subject: [PATCH 5/7] fix(ci): enforce Codex credential before investigator activation --- .../workflows/eventrelay-ci-investigator.md | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/eventrelay-ci-investigator.md b/.github/workflows/eventrelay-ci-investigator.md index 924ec4994..58c9f9d64 100644 --- a/.github/workflows/eventrelay-ci-investigator.md +++ b/.github/workflows/eventrelay-ci-investigator.md @@ -12,6 +12,16 @@ on: branches: - main workflow_dispatch: + steps: + - name: Require dedicated Codex credential + id: require_codex_credential + env: + CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }} + run: | + if [ -z "${CODEX_API_KEY}" ]; then + echo "::error::Dedicated CODEX_API_KEY is required" + exit 1 + fi permissions: actions: read @@ -24,16 +34,6 @@ engine: codex model: gpt-5.4 network: defaults -pre-agent-steps: - - name: Require dedicated Codex credential - env: - CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }} - run: | - if [ -z "${CODEX_API_KEY}" ]; then - echo "::error::Dedicated CODEX_API_KEY is required" - exit 1 - fi - safe-outputs: add-comment: max: 1 From 755202d12d456765e65a313fec33658f9e0ef7c1 Mon Sep 17 00:00:00 2001 From: Hayden <154503486+groupthinking@users.noreply.github.com> Date: Wed, 22 Jul 2026 15:16:33 -0400 Subject: [PATCH 6/7] fix(ci): enforce Codex credential before investigator activation --- tests/unit/test_gh_aw_workflow_governance.py | 26 +++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/tests/unit/test_gh_aw_workflow_governance.py b/tests/unit/test_gh_aw_workflow_governance.py index f4524abf2..868a2a5e0 100644 --- a/tests/unit/test_gh_aw_workflow_governance.py +++ b/tests/unit/test_gh_aw_workflow_governance.py @@ -108,16 +108,40 @@ def test_ci_investigator_requires_dedicated_codex_credential() -> None: workflow = _load_frontmatter( ROOT / ".github/workflows/eventrelay-ci-investigator.md" ) + triggers = workflow.get("on", workflow.get(True)) + assert triggers is not None credential_gate = next( step - for step in workflow["pre-agent-steps"] + for step in triggers["steps"] if step.get("name") == "Require dedicated Codex credential" ) + assert credential_gate["id"] == "require_codex_credential" assert credential_gate["env"]["CODEX_API_KEY"] == "${{ secrets.CODEX_API_KEY }}" assert "Dedicated CODEX_API_KEY is required" in credential_gate["run"] assert "OPENAI_API_KEY" not in credential_gate["run"] + compiled = _load_yaml( + ROOT / ".github/workflows/eventrelay-ci-investigator.lock.yml" + ) + pre_activation_steps = compiled["jobs"]["pre_activation"]["steps"] + activation = compiled["jobs"]["activation"] + agent_steps = compiled["jobs"]["agent"]["steps"] + + compiled_gate = next( + step + for step in pre_activation_steps + if step.get("id") == "require_codex_credential" + ) + assert compiled_gate["name"] == "Require dedicated Codex credential" + assert compiled_gate["env"]["CODEX_API_KEY"] == "${{ secrets.CODEX_API_KEY }}" + assert activation["needs"] == "pre_activation" + assert any(step.get("id") == "validate-secret" for step in activation["steps"]) + assert not any( + step.get("name") == "Require dedicated Codex credential" + for step in agent_steps + ) + def test_live_smoke_modules_are_excluded_before_import(monkeypatch) -> None: monkeypatch.delenv("RUN_LIVE_E2E", raising=False) From 5ab39e2e9d8567233bac388964080dff50edb300 Mon Sep 17 00:00:00 2001 From: Hayden <154503486+groupthinking@users.noreply.github.com> Date: Wed, 22 Jul 2026 15:16:35 -0400 Subject: [PATCH 7/7] fix(ci): enforce Codex credential before investigator activation --- .../eventrelay-ci-investigator.lock.yml | 31 +++++++++++++------ 1 file changed, 21 insertions(+), 10 deletions(-) diff --git a/.github/workflows/eventrelay-ci-investigator.lock.yml b/.github/workflows/eventrelay-ci-investigator.lock.yml index aed25c8ce..550e95a7e 100644 --- a/.github/workflows/eventrelay-ci-investigator.lock.yml +++ b/.github/workflows/eventrelay-ci-investigator.lock.yml @@ -1,4 +1,4 @@ -# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"b2d33486251c34d0b26e7899655001255e92979582c52fc80137f641dbc62405","body_hash":"db86ab41ca32e4ef5905d00ea66edbc4f150a3776b3a87011795bbf5997ed92b","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"ae74088a4ad234760e5514280445197a19fdc82bef5b48dd8ccd0b30ba0aea43","body_hash":"db86ab41ca32e4ef5905d00ea66edbc4f150a3776b3a87011795bbf5997ed92b","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} # gh-aw-manifest: {"version":1,"secrets":["CODEX_API_KEY","COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN","OPENAI_API_KEY"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"b6d1443e05b8716267fa19425b99aa4f12006b4a","version":"v0.82.14"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37","digest":"sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37","digest":"sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37","digest":"sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]} # This file was automatically generated by gh-aw (v0.82.14). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # @@ -53,6 +53,16 @@ name: "EventRelay CI Investigator (report-first)" on: + # steps: # Steps injected into pre-activation job + # - env: + # CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }} + # id: require_codex_credential + # name: Require dedicated Codex credential + # run: | + # if [ -z "${CODEX_API_KEY}" ]; then + # echo "::error::Dedicated CODEX_API_KEY is required" + # exit 1 + # fi workflow_dispatch: inputs: aw_context: @@ -530,15 +540,6 @@ jobs: env: GH_AW_SKILL_DIR: ".codex/skills" run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh" - - env: - CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }} - name: Require dedicated Codex credential - run: |- - if [ -z "${CODEX_API_KEY}" ]; then - echo "::error::Dedicated CODEX_API_KEY is required" - exit 1 - fi - - name: Download container images run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317 ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32 ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3 - name: Generate Safe Outputs Config @@ -1689,6 +1690,7 @@ jobs: outputs: activated: ${{ steps.check_membership.outputs.is_team_member == 'true' }} matched_command: '' + require_codex_credential_result: ${{ steps.require_codex_credential.outcome }} setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }} setup-span-id: ${{ steps.setup.outputs.span-id }} setup-trace-id: ${{ steps.setup.outputs.trace-id }} @@ -1717,6 +1719,15 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require('${{ runner.temp }}/gh-aw/actions/check_membership.cjs'); await main(); + - name: Require dedicated Codex credential + id: require_codex_credential + run: | + if [ -z "${CODEX_API_KEY}" ]; then + echo "::error::Dedicated CODEX_API_KEY is required" + exit 1 + fi + env: + CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }} safe_outputs: needs: