From 3da01304cfb84a0147ad372f452da0af7e9b362d Mon Sep 17 00:00:00 2001 From: ericjypark Date: Thu, 10 Sep 2026 21:24:30 -0500 Subject: [PATCH 1/2] fix(ci): migrate PR reviews to Codex --- .github/workflows/claude.yml | 81 --------------------------------- .github/workflows/pr-checks.yml | 46 +++++++++++++++++++ .gitignore | 2 + AGENTS.md | 22 +++++++++ CONTRIBUTING.md | 14 ++++++ 5 files changed, 84 insertions(+), 81 deletions(-) delete mode 100644 .github/workflows/claude.yml create mode 100644 .github/workflows/pr-checks.yml create mode 100644 AGENTS.md diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml deleted file mode 100644 index 947b1f55..00000000 --- a/.github/workflows/claude.yml +++ /dev/null @@ -1,81 +0,0 @@ -name: Claude Code - -on: - issue_comment: - types: [created] - pull_request_review_comment: - types: [created] - pull_request_review: - types: [submitted] - issues: - types: [opened, assigned] - pull_request: - types: [opened, ready_for_review] - -jobs: - claude: - if: github.event_name != 'pull_request' - runs-on: ubuntu-latest - permissions: - contents: read - pull-requests: write - issues: write - id-token: write - actions: read - steps: - - name: Checkout repository - uses: actions/checkout@v4 - with: - fetch-depth: 1 - - - name: Run Claude Code - uses: anthropics/claude-code-action@v1 - with: - claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} - show_full_output: true - - claude-auto-review: - if: github.event_name == 'pull_request' && github.event.pull_request.draft == false - runs-on: ubuntu-latest - permissions: - contents: read - pull-requests: write - id-token: write - actions: read - steps: - - name: Checkout repository - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - name: Run Claude Code review - uses: anthropics/claude-code-action@v1 - with: - claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} - show_full_output: true - prompt: | - Review this pull request (#${{ github.event.pull_request.number }} — - "${{ github.event.pull_request.title }}") and post your review as a - single comment on the PR using the available GitHub tools. - - This is Codex Island, a public Swift macOS menu-bar app shipping via - Sparkle auto-update. Read CLAUDE.md first — it documents hard rules - that have already broken auto-update once. - - Review priorities (highest first): - 1. Auto-update breakage. Flag any change to SU_PUBLIC_KEY, VERSION - format/parsing, CFBundleVersion, appcast generation, the EdDSA - signing flow, the homebrew-tap sync, or release.yml. - 2. Correctness bugs. Force-unwraps without justification, race - conditions, retain cycles, missing keychain refresh-token - rotation, polling below 5m, wrong User-Agent on Claude OAuth. - 3. Regressions in core flows. Notched-display window placement, - occlusion/Low-Power pause, provider error surfacing. - 4. Security. Token handling, network scope, code-signing. - - Skip style nits and refactors that aren't broken. Be terse. - - Output format: - - One-line verdict: SHIP / SHIP WITH NITS / NEEDS WORK / BLOCKED. - - Findings grouped by priority bucket above with `file:line` refs. - - If the PR is small and clean, say so in one sentence. diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml new file mode 100644 index 00000000..1f8baf99 --- /dev/null +++ b/.github/workflows/pr-checks.yml @@ -0,0 +1,46 @@ +name: PR Checks + +on: + pull_request: + types: [opened, synchronize, reopened, ready_for_review] + push: + branches: [main] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: pr-checks-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + workflows: + name: Workflow validation + runs-on: ubuntu-latest + timeout-minutes: 5 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Install actionlint + run: go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 + + - name: Validate GitHub Actions workflows + run: '"$(go env GOPATH)/bin/actionlint" -color' + + macos: + name: macOS tests and build + runs-on: macos-15 + timeout-minutes: 20 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run Swift regression tests + run: bash scripts/run-tests.sh + + - name: Build universal macOS app + run: ./build.sh diff --git a/.gitignore b/.gitignore index 1007673d..74118373 100644 --- a/.gitignore +++ b/.gitignore @@ -34,3 +34,5 @@ notes/ .agents/ skills-lock.json AGENTS.md +# Root guidance is shared with Codex code review. +!/AGENTS.md diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 00000000..9bd30366 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,22 @@ +# CodexIsland + +Read [CLAUDE.md](CLAUDE.md) before editing this repository. It contains the +shared release, credential-handling, build, documentation, and style rules. + +## Code Review Rules + +- Report actionable P0-P2 bugs introduced by the PR, with the triggering scenario, + impact, and a precise changed-line reference. Skip style nits and speculative + refactors. Distinguish unavailable review services from failing app tests. +- Preserve Sparkle update compatibility: the signing key, monotonic semver, + bundle identity, signed appcast generation, and CI-owned Homebrew sync must + continue to work for existing installations. A normal version bump is not + itself a defect. +- Claude credentials are owned by Claude Code. Flag app-side OAuth refresh + calls or credential-store writes; never recommend adding them. Re-reading + credentials and letting the CLI refresh its own credentials are allowed. + Preserve the documented usage headers and minimum five-minute polling. +- Check display changes, notched-screen placement, idle and Low Power behavior, + concurrency, and provider error states when affected. Keep missing quota + readings distinct from a real zero, and API-equivalent value distinct from + actual billing. Persistent usage history must survive missing source logs. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 819b230b..e419bbfb 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -24,6 +24,20 @@ open build/CodexIsland.app No Xcode project, no SwiftPM. Just `swiftc Sources/**/*.swift`. +## Pull request checks and reviews + +Every pull request runs the Swift regression suite, builds the universal macOS +app, and validates the GitHub Actions workflows. These checks run again after +new commits and also run on `main`. Forks use the same checks without repository +secrets. Run `bash scripts/run-tests.sh` and `./build.sh` locally before opening +a PR; workflow edits can be checked with `actionlint`. + +Codex reviews pull requests through the GitHub integration and follows the +`Code Review Rules` in `AGENTS.md`. To request another review, comment +`@codex review` on the PR. Resolve findings and wait for checks on the latest +commit before merging. A review service being unavailable does not establish +whether the app builds or passes tests. + ## Code style - **Lowercase Conventional Commits.** `feat(scope): summary`, `fix(scope): summary`, `chore: summary`. Body explains the *why*, not the *what*. The diff is the what. See git log for examples. From c375752459ff65f2db125d5da8a28951a2092b92 Mon Sep 17 00:00:00 2001 From: ericjypark Date: Thu, 10 Sep 2026 21:30:47 -0500 Subject: [PATCH 2/2] fix(ci): smoke-launch the app in PR checks --- .github/workflows/pr-checks.yml | 4 ++-- CONTRIBUTING.md | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 1f8baf99..9c4dacfb 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -42,5 +42,5 @@ jobs: - name: Run Swift regression tests run: bash scripts/run-tests.sh - - name: Build universal macOS app - run: ./build.sh + - name: Build and smoke-launch universal macOS app + run: ./scripts/verify.sh diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index e419bbfb..0cf74d25 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -26,10 +26,10 @@ No Xcode project, no SwiftPM. Just `swiftc Sources/**/*.swift`. ## Pull request checks and reviews -Every pull request runs the Swift regression suite, builds the universal macOS -app, and validates the GitHub Actions workflows. These checks run again after +Every pull request runs the Swift regression suite, builds and smoke-launches +the universal macOS app, and validates the GitHub Actions workflows. These checks run again after new commits and also run on `main`. Forks use the same checks without repository -secrets. Run `bash scripts/run-tests.sh` and `./build.sh` locally before opening +secrets. Run `bash scripts/run-tests.sh` and `./scripts/verify.sh` locally before opening a PR; workflow edits can be checked with `actionlint`. Codex reviews pull requests through the GitHub integration and follows the