bug: Run comment-triggered review on the pull-request head ref

[idy]

Background

The shared OpenAI PR review workflow accepts @codex commands from pull-request comments through the issue_comment event. GitHub associates that event's workflow run with the repository default branch, so the actual Codex review run is shown against main even though the comment belongs to a specific pull request and the workflow resolves that pull request's head SHA.

For example, a command on h2vivi/firmwares#393 reviewed the correct pull-request diff, but the OpenAI PR Review Actions run was attached to main rather than the pull request's current head ref/SHA.

Reaction feedback is already the intended interface: 👀 while processing, 🚀 on success, and 👎 on failure. This bug does not request GitHub Check Runs or a different feedback mechanism.

Goal

Ensure that the actual comment-triggered Codex review run executes on and is associated with the ref/SHA of the pull request containing the @codex comment, rather than the caller repository's default branch.

A minimal listener/dispatcher run may remain on the default branch because issue_comment is a repository-level event. The model review job must run in a separately dispatched workflow run targeting the resolved internal pull request's current head ref. Existing reaction behavior and native review publication remain unchanged.

Code Changes Tree

.github/workflows/
├── openai-pr-review-dispatch.yml          # resolve comment PR and dispatch review to its head ref
└── codex-openai-review.yml                # run the dispatched review for the resolved PR inputs
README.md                                  # document caller event/dispatch wiring and run association

Design

Comment listener and dispatch

• Keep issue_comment: created as the single command trigger for @codex comments.
• The listener validates the existing command grammar and collaborator permission, resolves the open non-draft internal pull request, and reads its current head.ref and head.sha.
• Instead of executing the Codex review in the issue_comment run, dispatch a review workflow with ref set to the resolved pull-request head ref and explicit inputs for pull-request number, expected head SHA, and triggering comment ID.
• The dispatched workflow verifies that the pull request is still open, internal, non-draft, and still points to the expected head SHA before reviewing. A stale dispatch must stop without reviewing a newer or different revision.
• Concurrency remains keyed by repository and pull-request number so a newer @codex request cancels or supersedes the older review.

Run association

• The listener may appear under main; it performs only command validation and dispatch.
• The workflow run containing the Codex model review must be created with the pull-request head ref and must report that head SHA in Actions metadata.
• The review still uses the resolved pull-request diff and publishes the native review against the exact expected head commit.

Feedback and errors

• Preserve the current reaction-only progress/result contract: 👀 during processing, 🚀 after successful review publication, and 👎 on any dispatch, validation, model, or publication failure.
• Do not add or require GitHub Check Runs, checks: write, PR status checks, or additional failure comments.
• If dispatch cannot target the head ref, the listener records failure through the existing reaction behavior and must not silently fall back to running the model review on main.

Caller contract

• Document the required caller workflow events, workflow_dispatch inputs, permissions, secret forwarding, and same-repository PR limitation.
• Keep the shared entrypoint versionable so consuming repositories can pin a release tag.

Test And Acceptance Criteria

• Commenting @codex or @codex review on an eligible internal pull request creates a listener run on the default branch and a separate model-review run associated with that pull request's current head ref/SHA.
• The model-review run is not shown as a main run and does not execute in the original issue_comment run.
• The dispatched run reviews and publishes against the exact head SHA resolved for the triggering comment.
• If the PR head changes between resolution and execution, the stale run exits without reviewing the new head; a new command targets the new head.
• Reaction behavior remains 👀/🚀/👎, with no Check Run or checks: write requirement.
• Ineligible commands, unauthorized commenters, draft/closed PRs, and fork PRs do not start the model-review run.
• Dispatch or review failure never falls back to executing the model on main.
• actionlint passes for all changed workflows.
• A live integration test in a consuming repository confirms the Actions run branch/SHA, reaction lifecycle, and native review commit ID.

[idy]

Resolved on main by 0cd55cd and follow-up 73b6559.

The implementation follows the clarified design from this discussion: the trusted default-branch workflow continues to execute the model review, while a custom OpenAI PR review Check Run is created on the exact PR head SHA and linked to the real Actions run. Existing request reactions and native review publication remain intact.

Live validation: PR #7, comment 5055152081, Actions run 29984881625. The run executed on main@73b6559, the Check Run on PR head 0452907 completed successfully, the request reaction finalized as 🚀, and the native review was published.