fix(review): align interaction workflow authority (#468)

* fix(review): align interaction workflow authority

* chore(review): rotate Codex auth namespace

Author: 777genius

.github/workflows/reviewrouter-codex.yml

@@ -1,4 +1,4 @@
-name: ReviewRouter Codex OAuth [namespace=sns_3c555371c528609493a910486221e465;epoch=4;secret=REVIEWROUTER_CODEX_AUTH_JSON_R1163183284_Pc11a7080815e939d_E4_3c555371c528609493a910486221e465]
+name: ReviewRouter Codex OAuth [namespace=sns_69c382e2f47618c2e3b8922da21dee46;epoch=5;secret=REVIEWROUTER_CODEX_AUTH_JSON_R1163183284_Pc11a7080815e939d_E5_69c382e2f47618c2e3b8922da21dee46]
 
 run-name: ${{ format('ReviewRouter review PR {0} at {1}', github.event.pull_request.number, github.event.pull_request.head.sha) }}
 
@@ -33,7 +33,7 @@ jobs:
       max_changed_lines: ${{ vars.REVIEW_ROUTER_MAX_CHANGED_LINES }}
       review_timeout_minutes: ${{ fromJSON(vars.REVIEW_ROUTER_TIMEOUT_MINUTES || '60') }}
     secrets:
-      CODEX_AUTH_JSON: ${{ secrets.REVIEWROUTER_CODEX_AUTH_JSON_R1163183284_Pc11a7080815e939d_E4_3c555371c528609493a910486221e465 }}
+      CODEX_AUTH_JSON: ${{ secrets.REVIEWROUTER_CODEX_AUTH_JSON_R1163183284_Pc11a7080815e939d_E5_69c382e2f47618c2e3b8922da21dee46 }}
 
   codex-refresh:
     name: codex-refresh
@@ -54,4 +54,4 @@ jobs:
           api-url: "https://api.reviewrouter.site"
           provider-instance-id: "codex-rotating:1163183284"
           workflow-schema-version: "4"
-          auth-json: ${{ secrets.REVIEWROUTER_CODEX_AUTH_JSON_R1163183284_Pc11a7080815e939d_E4_3c555371c528609493a910486221e465 }}
+          auth-json: ${{ secrets.REVIEWROUTER_CODEX_AUTH_JSON_R1163183284_Pc11a7080815e939d_E5_69c382e2f47618c2e3b8922da21dee46 }}

.github/workflows/reviewrouter-interaction.yml

@@ -7,18 +7,18 @@ on:
     types: [created, edited]
   workflow_dispatch:
 
-permissions:
-  actions: write
-  contents: read
-  pull-requests: write
-  issues: write
-  id-token: write
+permissions: {}
 
 jobs:
   interaction:
     name: interaction
     runs-on: ubuntu-24.04
     if: ${{ github.event_name == 'workflow_dispatch' || ((github.event_name != 'issue_comment' || github.event.issue.pull_request) && github.event.comment.user.type != 'Bot') }}
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+      id-token: write
     env:
       RR_RUNTIME_REF: "a29e058d2614c469e9ad29f62b0201a57f3a2e15"
       REVIEWROUTER_API_URL: "https://api.reviewrouter.site"
@@ -35,15 +35,15 @@ jobs:
       REVIEW_ROUTER_MEMORY_COMMAND_ENDPOINT: "/api/action/v1/memory-commands"
     steps:
       - name: Checkout ReviewRouter interaction runtime
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
         with:
           repository: 777genius/review-router
           ref: ${{ env.RR_RUNTIME_REF }}
           path: .reviewrouter-runtime
           persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
           node-version: "24"