Codex: Codex 自動化と CI/CD

# .github/workflows/codex-review.yml
name: Codex Code Review

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Codex Review
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
        run: |
          npm install -g @openai/codex
          git diff origin/main...HEAD | codex --quiet --sandbox readonly \
            "Review this PR's changes, focusing on: 1. Security vulnerabilities 2. Performance issues 3. Code style" \
            > review-comment.md
      - name: Post Review
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const comment = fs.readFileSync('review-comment.md', 'utf8');
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: comment
            });

# Alice の PR レビューパイプライン
name: Auto Review

on:
  pull_request:

jobs:
  security-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Security Scan
        run: |
          codex --quiet --sandbox readonly \
            "Scan code for security vulnerabilities: SQL injection, XSS, sensitive data leaks"

  performance-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Performance Check
        run: |
          codex --quiet --sandbox readonly \
            "Analyze code performance issues: N+1 queries, memory leaks, unnecessary computation"

name: Generate Tests

on:
  pull_request:
    paths:
      - 'src/**'

jobs:
  generate-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Check Coverage
        run: |
          npm test -- --coverage
          COVERAGE=$(cat coverage/coverage-summary.json | jq '.total.lines.pct')
          if [ "$COVERAGE" -lt 80 ]; then
            echo "Coverage below 80%, generating tests..."
            codex --full-auto \
              "Supplement unit tests for files with insufficient coverage, target 80%"
          fi

name: Weekly Test Update

on:
  schedule:
    - cron: '0 2 * * 1'  # 毎週月曜日の午前2時

jobs:
  update-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Update Tests
        run: |
          codex --full-auto \
            "Check all source files, generate unit tests for files lacking them"

name: Quality Gate

on:
  pull_request:

jobs:
  quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Quality Check
        run: |
          RESULT=$(codex --quiet --sandbox readonly \
            "Evaluate code quality, score 1-10, criteria: readability, maintainability, security, performance")
          echo "$RESULT"
          SCORE=$(echo "$RESULT" | grep -oP 'Score: \K\d+')
          if [ "$SCORE" -lt 7 ]; then
            echo "Quality score below 7, blocking PR"
            exit 1
          fi

name: Auto Fix and Review

on:
  pull_request:

jobs:
  auto-fix:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Auto Fix
        run: |
          codex --auto-edit \
            "Fix all lint errors and formatting issues"
          git diff > auto-fixes.patch
      - name: Upload Patch
        uses: actions/upload-artifact@v4
        with:
          name: auto-fixes
          path: auto-fixes.patch

name: Security Scan

on:
  push:
    branches: [main]
  pull_request:

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Security Audit
        run: |
          codex --quiet --sandbox readonly \
            "Perform security audit:
            1. Check for hardcoded keys and credentials
            2. Check SQL injection risks
            3. Check XSS risks
            4. Check insecure dependencies
            5. Check insecure API calls
            Output risk levels and remediation suggestions"