ci: install Codex maintenance workflows

2026-11-01 04:47:03 +08:00 · 2026-09-20 19:42:38 +08:00
parent 82b840ff49
commit aea573b7c6
5 changed files with 203 additions and 12 deletions
--- a/.github/workflows/moviepilot-codex-ci.yml
+++ b/.github/workflows/moviepilot-codex-ci.yml
@@ -0,0 +1,45 @@
+# CI failure intake. This job has no OpenAI or Telegram secret.
+name: MoviePilot Codex CI intake
+
+on:
+  workflow_run:
+    workflows:
+      - Unit Tests
+      - Pylint Code Quality Check
+      - MoviePilot Builder v3
+    types: [completed]
+
+permissions:
+  actions: write
+  contents: read
+
+jobs:
+  dispatch:
+    if: ${{ github.event.workflow_run.conclusion == 'failure' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Dispatch trusted Codex CI run
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TARGET_WORKFLOW: moviepilot-codex-run.yml
+          TARGET_REF: ${{ github.event.repository.default_branch }}
+          SOURCE_EVENT: workflow_run
+          TARGET_KIND: ci
+          PROMPT_NAME: ci-fix
+          TARGET_BRANCH: ${{ github.event.workflow_run.head_branch || github.event.repository.default_branch }}
+          TARGET_SHA: ${{ github.event.workflow_run.head_sha }}
+          TARGET_RUN_ID: ${{ github.event.workflow_run.id }}
+        run: |
+          set -euo pipefail
+          gh workflow run "$TARGET_WORKFLOW" \
+            --repo "$GITHUB_REPOSITORY" \
+            --ref "$TARGET_REF" \
+            --field "prompt_name=$PROMPT_NAME" \
+            --field "source_event=$SOURCE_EVENT" \
+            --field "target_kind=$TARGET_KIND" \
+            --field "target_number=" \
+            --field "target_ref=$TARGET_BRANCH" \
+            --field "target_sha=$TARGET_SHA" \
+            --field "target_run_id=$TARGET_RUN_ID"
--- a/.github/workflows/moviepilot-codex-events.yml
+++ b/.github/workflows/moviepilot-codex-events.yml
@@ -0,0 +1,41 @@
+# MoviePilot Codex event intake. This job has no OpenAI or Telegram secret.
+name: MoviePilot Codex event intake
+
+on:
+  issues:
+    types: [opened, reopened, edited]
+  pull_request_target:
+    types: [opened, reopened, synchronize, ready_for_review, edited]
+
+permissions:
+  actions: write
+  contents: read
+
+jobs:
+  dispatch:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Dispatch trusted Codex run
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TARGET_WORKFLOW: moviepilot-codex-run.yml
+          TARGET_REF: ${{ github.event.repository.default_branch }}
+          SOURCE_EVENT: ${{ github.event_name }}
+          TARGET_KIND: ${{ github.event_name == 'issues' && 'issue' || 'pull_request' }}
+          PROMPT_NAME: ${{ github.event_name == 'issues' && 'issue-triage' || 'pr-review' }}
+          TARGET_NUMBER: ${{ github.event.issue.number || github.event.pull_request.number || '' }}
+          TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.event.repository.default_branch }}
+          TARGET_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          set -euo pipefail
+          gh workflow run "$TARGET_WORKFLOW" \
+            --repo "$GITHUB_REPOSITORY" \
+            --ref "$TARGET_REF" \
+            --field "prompt_name=$PROMPT_NAME" \
+            --field "source_event=$SOURCE_EVENT" \
+            --field "target_kind=$TARGET_KIND" \
+            --field "target_number=$TARGET_NUMBER" \
+            --field "target_ref=$TARGET_BRANCH" \
+            --field "target_sha=$TARGET_SHA"
--- a/.github/workflows/moviepilot-codex-fix.yml
+++ b/.github/workflows/moviepilot-codex-fix.yml
@@ -0,0 +1,39 @@
+# Manual fix dispatch. Codex receives write permissions only in the reusable workflow.
+name: MoviePilot Codex fix
+
+on:
+  workflow_dispatch:
+    inputs:
+      issue_number:
+        description: Issue or PR number to investigate.
+        required: true
+        type: string
+      prompt_name:
+        description: issue-fix, ci-fix, or delivery.
+        required: false
+        default: issue-fix
+        type: string
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  codex:
+    uses: jxxghp/MoviePilot-Maintenance/.github/workflows/codex-fix.yml@2d9823f44bb1d31e2bbcf9bddf9d14ad2c8f35be
+    with:
+      control_repository: jxxghp/MoviePilot-Maintenance
+      control_ref: 2d9823f44bb1d31e2bbcf9bddf9d14ad2c8f35be
+      prompt_name: ${{ inputs.prompt_name }}
+      codex_model: ${{ vars.CODEX_MODEL }}
+      codex_effort: ${{ vars.CODEX_EFFORT || 'high' }}
+      openai_base_url: ${{ vars.OPENAI_BASE_URL }}
+      publish_comments: true
+      autofix_enabled: ${{ vars.CODEX_AUTOFIX_ENABLED == 'true' }}
+      telegram_enabled: ${{ vars.TELEGRAM_ENABLED == 'true' }}
+      telegram_chat_id: ${{ vars.TELEGRAM_CHAT_ID }}
+    secrets:
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      MAINTENANCE_TARGET_GH_TOKEN: ${{ secrets.MAINTENANCE_TARGET_GH_TOKEN }}
+      TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
--- a/.github/workflows/moviepilot-codex-run.yml
+++ b/.github/workflows/moviepilot-codex-run.yml
@@ -0,0 +1,77 @@
+# Trusted run for jxxghp/MoviePilot. The control ref is immutable.
+name: MoviePilot Codex trusted run
+
+on:
+  workflow_dispatch:
+    inputs:
+      prompt_name:
+        required: true
+        type: string
+      source_event:
+        required: true
+        type: string
+      target_kind:
+        required: true
+        type: string
+      target_number:
+        required: false
+        type: string
+      target_ref:
+        required: false
+        type: string
+      target_sha:
+        required: false
+        type: string
+      target_run_id:
+        required: false
+        type: string
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: read
+
+jobs:
+  shadow:
+    if: ${{ vars.CODEX_ENABLED == 'true' && vars.CODEX_PUBLISH_COMMENTS != 'true' }}
+    uses: jxxghp/MoviePilot-Maintenance/.github/workflows/codex-event.yml@2d9823f44bb1d31e2bbcf9bddf9d14ad2c8f35be
+    with:
+      control_repository: jxxghp/MoviePilot-Maintenance
+      control_ref: 2d9823f44bb1d31e2bbcf9bddf9d14ad2c8f35be
+      prompt_name: ${{ inputs.prompt_name }}
+      codex_model: ${{ vars.CODEX_MODEL }}
+      codex_effort: ${{ vars.CODEX_EFFORT || 'medium' }}
+      openai_base_url: ${{ vars.OPENAI_BASE_URL }}
+      publish_comments: false
+      autofix_enabled: false
+      telegram_enabled: false
+      source_event: ${{ inputs.source_event }}
+      target_kind: ${{ inputs.target_kind }}
+      target_number: ${{ inputs.target_number }}
+      target_ref: ${{ inputs.target_ref }}
+      target_sha: ${{ inputs.target_sha }}
+      target_run_id: ${{ inputs.target_run_id }}
+    secrets:
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+
+  propose:
+    if: ${{ vars.CODEX_ENABLED == 'true' && vars.CODEX_PUBLISH_COMMENTS == 'true' }}
+    uses: jxxghp/MoviePilot-Maintenance/.github/workflows/codex-propose.yml@2d9823f44bb1d31e2bbcf9bddf9d14ad2c8f35be
+    with:
+      control_repository: jxxghp/MoviePilot-Maintenance
+      control_ref: 2d9823f44bb1d31e2bbcf9bddf9d14ad2c8f35be
+      prompt_name: ${{ inputs.prompt_name }}
+      codex_model: ${{ vars.CODEX_MODEL }}
+      codex_effort: ${{ vars.CODEX_EFFORT || 'medium' }}
+      openai_base_url: ${{ vars.OPENAI_BASE_URL }}
+      telegram_enabled: ${{ vars.TELEGRAM_ENABLED == 'true' }}
+      telegram_chat_id: ${{ vars.TELEGRAM_CHAT_ID }}
+      source_event: ${{ inputs.source_event }}
+      target_kind: ${{ inputs.target_kind }}
+      target_number: ${{ inputs.target_number }}
+      target_ref: ${{ inputs.target_ref }}
+      target_sha: ${{ inputs.target_sha }}
+      target_run_id: ${{ inputs.target_run_id }}
+    secrets:
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
--- a/.github/workflows/pr-agent.yml
+++ b/.github/workflows/pr-agent.yml
@@ -1,18 +1,7 @@
 name: PR-Agent

 on:
-  pull_request_target:
-    # Fork 审查需要目标仓库凭据；该 job 仅通过 GitHub API 读取 PR 内容，不 checkout 或执行 PR 分支代码。
-    types:
-      - opened
-      - reopened
-      - ready_for_review
-      - review_requested
-      - synchronize
-  issue_comment:
-    types:
-      - created
-      - edited
+  workflow_dispatch:

 permissions:
  contents: read