jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-10-30 22:11:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: authorize team security reviews automatically

Browse Source 
Signed-off-by: Jordan Mecom <jm@squareup.com>
This commit is contained in:
Jordan Mecom
2026-08-27 12:22:22 -07:00
parent 0808ab485c
commit b0303286cb
3 changed files with 78 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
.github/workflows/codex-security-review.yml vendored
View File

@@ -16,10 +16,11 @@ jobs:
name: Authorize Security Review
# This workflow posts an advisory review; its skipped jobs are not a merge
# gate and must not be configured as required status checks.
# MEMBER and OWNER are GitHub's associations for members of the `block`
# organization. The trusted prepare step checks the live PR instead of the
# event snapshot. Outside contributors require this exact command from one
# of those members: @buzz-security-review <full-head-sha>
# Authors with live write or admin access to `block/buzz` are reviewed
# automatically. This calculated repository permission includes direct,
# team, organization, and enterprise grants. Outside contributors require
# this exact command from a Block organization member:
# @buzz-security-review <full-head-sha>
if: >-
github.repository == 'block/buzz' && (
(
@@ -301,7 +302,7 @@ jobs:
codex-version: '0.149.0'
model: ${{ env.CODEX_MODEL }}
codex-args: '["-c","model_reasoning_effort=${{ env.CODEX_REASONING_EFFORT }}"]'
# The trusted authorization job already enforced repository membership.
# The trusted authorization job already enforced repository write access.
allow-users: '*'
safety-strategy: drop-sudo
permission-profile: ':read-only'