jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-10-27 04:30:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add gated security reviews (#6816)

Browse Source 
Add a gated Codex security review for Buzz pull requests.

Reviews run automatically for Block organization members. External PRs
require a `@buzz-security-review` comment from a Block member, and every
new external push invalidates the previous result.

Codex reviews the PR SHA in a read-only, network-restricted job with no
write GitHub token. A separate trusted job validates and sanitizes
structured findings before posting them. The workflow uses the dedicated
`CODEX_REVIEW_API_KEY` secret.

---------

Signed-off-by: Jordan Mecom <jm@squareup.com>
This commit is contained in:
Jordan Mecom
2026-08-26 15:52:06 -07:00
committed by GitHub
parent ceb8ba605f
commit cdab765748
5 changed files with 1802 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
Justfile
View File

@@ -93,7 +93,12 @@ build-release:
cargo build --workspace --release
# Run repo lint, formatting, and repository policy checks
check: fmt-check clippy desktop-check desktop-tauri-fmt-check desktop-tauri-clippy web-check mobile-check file-size-check
check: fmt-check clippy desktop-check desktop-tauri-fmt-check desktop-tauri-clippy web-check mobile-check security-review-check file-size-check
# Validate the trusted security-review workflow support and renderer contract.
security-review-check:
node --check .github/scripts/codex-security-review.js
node --test .github/scripts/codex-security-review.test.js
# Run the repository-wide differential file-size ratchet and its policy tests.
# The ratchet inspects only files changed from the merge base, so this stays