Jordan Mecom cdab765748 Add gated security reviews (#6816) ...

Add a gated Codex security review for Buzz pull requests.

Reviews run automatically for Block organization members. External PRs
require a `@buzz-security-review` comment from a Block member, and every
new external push invalidates the previous result.

Codex reviews the PR SHA in a read-only, network-restricted job with no
write GitHub token. A separate trusted job validates and sanitizes
structured findings before posting them. The workflow uses the dedicated
`CODEX_REVIEW_API_KEY` secret.

---------

Signed-off-by: Jordan Mecom <jm@squareup.com>

2026-08-26 15:52:06 -07:00

..

auto-tag-on-release-pr-merge.yml

fix(release): tag immutable desktop candidates (#4811)

2026-08-05 11:00:14 -07:00

benchmark-harbor.yml

Add Buzz-native collaboration benchmarks (#6264)

2026-08-20 10:14:39 -04:00

ci.yml

Add gated security reviews (#6816)

2026-08-26 15:52:06 -07:00

codex-security-review.yml

Add gated security reviews (#6816)

2026-08-26 15:52:06 -07:00

desktop-release-cache-proof.yml

chore(deps): update ubuntu:24.04 docker digest to 561618e (#5442)

2026-08-21 18:27:17 -06:00

desktop-release-candidate.yml

fix(release): tag immutable desktop candidates (#4811)

2026-08-05 11:00:14 -07:00

docker.yml

fix(ci): check out source in docker.yml merge job (#6833)

2026-08-25 18:50:47 -04:00

helm-chart.yml

feat(k8s): Kubernetes backend plugin + desktop deploy path (#4289)

2026-08-02 14:39:27 -04:00

linux-canary.yml

chore(deps): update ubuntu:24.04 docker digest to 561618e (#5442)

2026-08-21 18:27:17 -06:00

macos-intel-canary.yml

ci: add guarded desktop release cache prewarm (#4575)

2026-08-03 13:03:26 -07:00

mesh-lifecycle.yml

fix(ci): prevent poisoned Rust caches (#6618)

2026-08-24 16:21:31 -06:00

mobile-release-candidate.yml

chore(mobile): lighter-weight release process (#2144)

2026-07-23 15:05:59 -07:00

promote-oss-desktop-release.yml

ci(release): gate OSS desktop auto-update promotion (#5398)

2026-08-10 09:05:32 -07:00

push-gateway-helm-chart.yml

feat(push): add public APNs gateway (#1770)

2026-07-14 11:17:21 -04:00

release.yml

fix(ci): prevent poisoned Rust caches (#6618)

2026-08-24 16:21:31 -06:00

signed-macos-canary.yml

ci: add guarded desktop release cache prewarm (#4575)

2026-08-03 13:03:26 -07:00

sprig-image.yml

feat(k8s): Kubernetes backend plugin + desktop deploy path (#4289)

2026-08-02 14:39:27 -04:00

sprig.yml

feat(k8s): Kubernetes backend plugin + desktop deploy path (#4289)

2026-08-02 14:39:27 -04:00

staging-dev-relay-image.yml

Add staging dev relay image workflow (#6709)

2026-08-25 11:23:17 -04:00

windows-canary.yml

ci: add guarded desktop release cache prewarm (#4575)

2026-08-03 13:03:26 -07:00