From 80177e4c8e97e7bf1f1a3760c4e3503aace22860 Mon Sep 17 00:00:00 2001 From: Will Pfleger Date: Thu, 27 Aug 2026 18:01:43 -0400 Subject: [PATCH] fix(ci): bump Codex CLI to 0.150.1 to unhang security review jobs (#6962) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Codex CLI 0.149.x can leave a PTY descendant holding `openai/codex-action`'s inherited stdio after the review turn completes. The action's runner waits on the child's stdio *streams closing* rather than on process exit ([`runCodexExec.ts`](https://github.com/openai/codex-action/blob/86365089/src/runCodexExec.ts#L322)), so the `Review pull request` step never returns — the job idles until its 30-minute `timeout-minutes` kills it and the already-written review result is discarded. Every `Run Codex Security Review` job since the workflow merged has hung this way: the final JSON result and `tokens used` count are the last log lines, with no step-end marker. Heavy runs (`gpt-5.6-sol` at `max` effort, ~295k tokens) sit firmly in the failing regime. Upstream: [openai/codex-action#150](https://github.com/openai/codex-action/issues/150), fixed in Codex CLI 0.150.0 by [openai/codex@bf3eb2e](https://github.com/openai/codex/commit/bf3eb2ec91fb150ad62561578666532b2e1c1c8f) ("Prevent Unix PTY I/O from blocking runtime shutdown"). The fix commit is in the `rust-v0.150.x` line and not in `0.149.x`. The action pin (`v1.12`) is unchanged — only the `codex-version` CLI pin moves from `0.149.0` to `0.150.1` (latest stable). Signed-off-by: Will Pfleger Co-authored-by: Duncan --- .github/workflows/codex-security-review.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codex-security-review.yml b/.github/workflows/codex-security-review.yml index 0496809f5f..df558a877d 100644 --- a/.github/workflows/codex-security-review.yml +++ b/.github/workflows/codex-security-review.yml @@ -298,7 +298,7 @@ jobs: ACTIONS_ID_TOKEN_REQUEST_URL: '' with: openai-api-key: ${{ secrets.CODEX_REVIEW_API_KEY }} - codex-version: '0.149.0' + codex-version: '0.150.1' model: ${{ env.CODEX_MODEL }} codex-args: '["-c","model_reasoning_effort=${{ env.CODEX_REASONING_EFFORT }}"]' # The trusted authorization job already enforced repository membership.