Skip to content

fix(codex-pr-review): embed review prompt, drop cross-repo checkout (… #2

fix(codex-pr-review): embed review prompt, drop cross-repo checkout (…

fix(codex-pr-review): embed review prompt, drop cross-repo checkout (… #2

# Guards against prompt drift. The review prompt lives in one file
# (.github/codex/prompts/codex-pr-review.md) but is embedded as base64
# (PROMPT_B64) in codex-pr-review.yml so consumers on internal repos can run
# the reviewer without a cross-repo checkout. This job fails if the embedded
# copy no longer matches the file, so the two can never silently diverge.
#
# To fix a failure, regenerate the blob and paste it as PROMPT_B64:
# base64 < .github/codex/prompts/codex-pr-review.md | tr -d '\n'
name: Check prompt embed
on:
pull_request:
paths:
- .github/codex/prompts/codex-pr-review.md
- .github/workflows/codex-pr-review.yml
- .github/workflows/check-prompt-embed.yml
push:
branches: [main]
paths:
- .github/codex/prompts/codex-pr-review.md
- .github/workflows/codex-pr-review.yml
permissions:
contents: read
jobs:
check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Embedded prompt matches the prompt file
shell: bash
run: |
set -euo pipefail
prompt=.github/codex/prompts/codex-pr-review.md
workflow=.github/workflows/codex-pr-review.yml
expected="$(base64 < "$prompt" | tr -d '\n')"
embedded="$(grep -oE 'PROMPT_B64: "[^"]+"' "$workflow" | sed -E 's/PROMPT_B64: "(.*)"/\1/')"
if [ -z "$embedded" ]; then
echo "::error::PROMPT_B64 not found in $workflow." >&2
exit 1
fi
if [ "$expected" != "$embedded" ]; then
echo "::error::PROMPT_B64 in $workflow is out of sync with $prompt." >&2
echo "Regenerate: base64 < $prompt | tr -d '\\n'" >&2
exit 1
fi
echo "Embedded prompt is in sync with $prompt."