[REA-3711] Review pull requests with Codex

Automated review runs on `openai/codex-action`, driven by one workflow that
keeps the trigger gate, the model, and the review prompt in the same file.

Review is limited to maintainers: it runs when an owner, member, or
collaborator opens a pull request, and on demand when one of them comments
`/review`. An outside contributor's pull request never reaches a runner, so
untrusted code is never checked out and no review budget is spent on it. The
action verifies that the actor has write access as well, which leaves the
trigger gate as the cheap first barrier rather than the only one.

The prompt carries the standards that ruff and ty cannot check: the rule
against assuming infrastructure this package does not ship, tests arriving
with the behaviour they cover, Google-style docstrings, and strict typing.
Findings land as inline comments on the offending lines, and a review that
finds nothing posts a single `lgtm` comment.

The job runs in a `codex-review` environment, which scopes access to the
`OPENAI_API_KEY` the review needs. Without that secret the review fails and
reports nothing, which leaves merges unaffected.

Signed-off-by: Dere-Wah <derexcontact@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Dere-Wah

.github/workflows/claude-code-review.yml .github/workflows/codex-review.yml.github/workflows/claude-code-review.yml renamed to .github/workflows/codex-review.yml

@@ -1,58 +1,100 @@
-name: Claude Code Review
+# Copyright (c) 2026 Reactor Technologies, Inc. All rights reserved.
+name: Codex Code Review
 
 on:
   pull_request:
     types: [opened, ready_for_review, reopened]
   issue_comment:
     types: [created]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to review'
+        required: true
+        type: string
 
 jobs:
-  claude-review:
+  codex-review:
     # Token-burning is gated to maintainers: review runs automatically on a
     # maintainer-authored PR, or on demand when a maintainer comments `/review`.
-    # Outside contributors never trigger it implicitly. The `claude-code-review`
-    # environment scopes access to the ANTHROPIC_API_KEY.
+    # Outside contributors never trigger it implicitly. codex-action re-checks
+    # that the actor has write access, but gating here keeps an outsider's PR
+    # from ever reaching a runner or being checked out. The `codex-review`
+    # environment scopes access to the OPENAI_API_KEY.
     if: |
       (
         github.event_name == 'pull_request' &&
         !github.event.pull_request.draft &&
-        !contains(github.event.pull_request.title, '[skip-claude]') &&
+        !contains(github.event.pull_request.title, '[skip-codex]') &&
         github.event.pull_request.user.login != 'dependabot[bot]' &&
         contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.pull_request.author_association)
       ) || (
         github.event_name == 'issue_comment' &&
         github.event.issue.pull_request &&
         github.event.comment.body == '/review' &&
         contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)
-      )
+      ) || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
-    environment: claude-code-review
+    environment: codex-review
     permissions:
       contents: read
       pull-requests: write
       issues: read
       id-token: write
 
     steps:
+      - name: Resolve PR metadata
+        id: pr
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          EVENT_NAME: ${{ github.event_name }}
+          PR_EVENT_NUMBER: ${{ github.event.pull_request.number }}
+          PR_EVENT_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          DISPATCH_PR_NUMBER: ${{ inputs.pr_number }}
+        run: |
+          set -euo pipefail
+          if [ "$EVENT_NAME" = "pull_request" ]; then
+            number="$PR_EVENT_NUMBER"
+            head_sha="$PR_EVENT_HEAD_SHA"
+          else
+            if [ "$EVENT_NAME" = "issue_comment" ]; then
+              number="$ISSUE_NUMBER"
+            else
+              number="$DISPATCH_PR_NUMBER"
+            fi
+            head_sha=$(gh pr view "$number" --json headRefOid --jq '.headRefOid')
+          fi
+          echo "number=$number" >> "$GITHUB_OUTPUT"
+          echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"
+
       - name: Checkout repository
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
-
-      - name: Run Claude Code Review
-        id: claude-review
-        uses: anthropics/claude-code-action@v1
+          ref: ${{ steps.pr.outputs.head_sha }}
+
+      - name: Run Codex Code Review
+        id: codex-review
+        uses: openai/codex-action@v1
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ steps.pr.outputs.number }}
+          PR_HEAD_SHA: ${{ steps.pr.outputs.head_sha }}
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          allowed_bots: "graphite-app"
-          track_progress: true
+          openai-api-key: ${{ secrets.OPENAI_API_KEY }}
+          model: gpt-5.6-sol
+          sandbox: danger-full-access
+          allow-bot-users: graphite-app
           prompt: |
             REPO: ${{ github.repository }}
-            PR NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
+            PR NUMBER: ${{ steps.pr.outputs.number }}
 
             You are a senior engineer reviewing this pull request. Act like a helpful team member who wants to improve code quality while being respectful of the author's work.
 
-            First, run `gh pr view <PR NUMBER> --json title,author` to get the PR title and author.
+            First, run `gh pr view $PR_NUMBER --json title,author` to get the PR title and author.
 
             ## What this repository is
 
@@ -63,10 +105,10 @@ jobs:
             ## Instructions
 
             1. **CRITICAL: Check for existing review comments BEFORE reviewing the code.**
-               Run: `gh api repos/${{ github.repository }}/pulls/<PR NUMBER>/comments`
-               Parse the JSON and note each comment's `path`, `line`/`original_line`, and `body`, and whether it is from a previous bot review (look for "claude" or "github-actions" in the user login). Build a mental map of issues that have ALREADY been flagged.
+               Run: `gh api repos/$REPO/pulls/$PR_NUMBER/comments`
+               Parse the JSON and note each comment's `path`, `line`/`original_line`, and `body`, and whether it is from a previous bot review (look for "github-actions" in the user login). Build a mental map of issues that have ALREADY been flagged.
 
-            2. Review the PR diff using `gh pr diff <PR NUMBER>`.
+            2. Review the PR diff using `gh pr diff $PR_NUMBER`.
 
             3. Focus your review on:
                - **Bugs & Logic Errors**: actual bugs, off-by-one, None handling, race conditions, async/await misuse
@@ -88,21 +130,26 @@ jobs:
 
             5. For each NEW issue you find (not previously commented on):
                - Double-check the existing comments list — if a similar issue exists on the same file/line, SKIP IT
-               - Use `mcp__github_inline_comment__create_inline_comment` to comment directly on the specific line of code
+               - Comment directly on the specific line of code:
+                 ```bash
+                 gh api repos/$REPO/pulls/$PR_NUMBER/comments \
+                   -f body="<your comment>" \
+                   -f commit_id="$PR_HEAD_SHA" \
+                   -f path="<file path>" \
+                   -F line=<line number> \
+                   -f side="RIGHT"
+                 ```
                - Keep comments concise (2-4 sentences max)
                - Be specific about what's wrong and why
                - Suggest a concrete fix when possible
 
             6. Decide how to close out the review based on what you found:
                - **If you found at least one new issue:** leave only the inline comments from step 5. Do not post a summary comment on top of them.
-               - **If you found no new issues at all:** post exactly one summary comment whose body is the single word `lgtm` (lowercase, nothing else). Before creating it, re-read the body you are about to submit and confirm it contains only `lgtm` — no preamble, no summary of the diff, no caveats, no extra whitespace or formatting — then create the comment with `gh pr comment <PR NUMBER> --body "lgtm"`.
+               - **If you found no new issues at all:** post exactly one summary comment whose body is the single word `lgtm` (lowercase, nothing else). Before creating it, re-read the body you are about to submit and confirm it contains only `lgtm` — no preamble, no summary of the diff, no caveats, no extra whitespace or formatting — then create the comment with `gh pr comment $PR_NUMBER --body "lgtm"`.
 
             ## Review Style
 
             - Be constructive, not critical
             - Explain the "why" behind suggestions
             - Ask questions if intent is unclear rather than assuming it's wrong
             - NEVER repeat yourself — if you've commented on something before, trust that the author saw it
-
-          claude_args: |
-            --allowedTools "Read,Glob,Grep,Bash(gh api:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr comment:*),mcp__github_inline_comment__create_inline_comment"