Repository navigation
Conversation
Replace the inline gate with the pinned v2 composite action, move the repo policy into .github/governance/policy.json, and relay fork review events through the permissionless signal workflow. Status check contexts are unchanged: risk-gate, ai-review, pr-template, clearing-label.
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a45fab5a2e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "app_id": 1144995, | ||
| "user_id": 199175422, | ||
| "login": "chatgpt-codex-connector[bot]" |
There was a problem hiding this comment.
Move the reviewer account identifiers into repository variables
This tracked policy publishes the reviewer's actual app ID, user ID and account login, contrary to the public-content boundary in AGENTS.md, which requires account identifiers to come from variables, the environment or protected configuration. Keeping the file outside site/ does not remove those identifiers from public source. Remove these literals and configure the RISK_GATE_REVIEWER_* variables already wired into the evaluation job.
AGENTS.md reference: AGENTS.md:L6-L11
Useful? React with 👍 / 👎.
| statuses: write | ||
| steps: | ||
| - name: Record label head | ||
| uses: QuantStrategyLab/.github/pr-governance@873eb5afc59a56a394dabe8261e0e2ab5b8f769f |
There was a problem hiding this comment.
Keep the real governance commit identifier out of public source
Both action invocations publish the real governance repository and an exact commit identifier. The repository's content-boundary rule explicitly excludes commit IDs that lead back to real objects, so SHA-pinning this reference does not satisfy that rule. Use an approved public-facing governance distribution, keeping the restricted implementation reference in protected configuration or orchestration rather than publishing it in this workflow.
AGENTS.md reference: AGENTS.md:L12-L14
Useful? React with 👍 / 👎.
|
Closed without merging. This repository's AGENTS.md content-boundary rule forbids committing commit identifiers that resolve to real objects, which conflicts with pinning the shared action by full SHA. The shared gate therefore stays out of this repository; it has no required checks and its only published workflow is the Pages deploy. |
AI assistance
Qoder agent (Claude) performed the migration and the checks below.
What changed
Replace the inline gate with the organization's shared
QuantStrategyLab/.github/pr-governanceaction pinned to873eb5afc59a56a394dabe8261e0e2ab5b8f769f(tagv2):.github/workflows/risk-gate.ymlis now the rendered shared template..github/governance/policy.jsonholds the repo policy (r0_paths,r2_paths, reviewer identity)..github/workflows/pr-review-signal.ymlrelays fork review events to the trusted run.Required status contexts are unchanged:
risk-gate,ai-review,pr-template,clearing-label.How verified
actionlintpasses on both workflows..github/**path, manifests, and credential/runtime/strategy paths are R2; prose indocs/andREADMEis R0; the Codex receipt and clearing-label binding are unchanged.