[codex] Add X OAuth1 publisher support

[skyloevil]

Summary

• Add OAuth 1.0a User Context signing for the X publisher while preserving the existing OAuth 2.0 user bearer-token path.
• Update local config, .env.example, and README guidance to use api_key, api_key_secret, access_token, and access_token_secret instead of app-only bearer tokens.
• Extend config and publisher tests for OAuth 1.0a credential validation and signed request headers.

Why

X POST /2/tweets requires user-context authentication. App-only bearer tokens cannot publish tweets, and the previous implementation only sent a bearer token. OAuth 1.0a User Context matches the working credential flow from the X Developer Portal Access Token and Secret page.

Validation

• uv run ruff check backend/app/publishers/x/publisher.py backend/app/config/settings.py tests/test_config.py tests/test_publishers.py
• uv run pytest
• Live X API validation was performed locally with credentials passed only through the process environment. No secret files or real keys were committed.

Send verification succeeded.

Authentication result:

• Account: @skyloevil
• Name: Skyloevil
• user_id: 2868899598

Successfully created 1 test X Post:

• Tweet ID: 2062224863079903513
• URL: https://x.com/i/status/2062224863079903513

The local code now works with OAuth 1.0a User Context. Store the four credentials in your local .env or deployment environment variable X_PUBLISHER_CREDENTIALS, and do not commit them to the repository.

[gemini-code-assist]

Code Review

This pull request introduces support for OAuth 1.0a User Context credentials to the X (Twitter) publisher, updating documentation, configuration validation, and adding the signature generation logic along with corresponding tests. Feedback on these changes suggests adding defensive type checks for the credentials object to prevent potential AttributeErrors, passing digestmod as a keyword argument in hmac.new for robustness, and keeping the X publisher disabled by default in config/local.yaml to ensure local development safety.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.