Jordan Mecom cdab765748 Add gated security reviews (#6816) ...

Add a gated Codex security review for Buzz pull requests.

Reviews run automatically for Block organization members. External PRs
require a `@buzz-security-review` comment from a Block member, and every
new external push invalidates the previous result.

Codex reviews the PR SHA in a read-only, network-restricted job with no
write GitHub token. A separate trusted job validates and sanitizes
structured findings before posting them. The workflow uses the dedicated
`CODEX_REVIEW_API_KEY` secret.

---------

Signed-off-by: Jordan Mecom <jm@squareup.com>

2026-08-26 15:52:06 -07:00

..

ISSUE_TEMPLATE

docs(security): route reports through private advisories (#6728)

2026-08-24 15:07:08 -07:00

scripts

Add gated security reviews (#6816)

2026-08-26 15:52:06 -07:00

workflows

Add gated security reviews (#6816)

2026-08-26 15:52:06 -07:00

CODEOWNERS

chore: cleanup CODEOWNERS comment

2026-07-09 12:16:51 -04:00

PULL_REQUEST_TEMPLATE.md

docs(contributing): set PR expectations and require UI screenshots (#3140)

2026-07-27 11:57:09 -04:00