From 1c2ef8fb13d1b312c830b781c49d29c560b9f9b5 Mon Sep 17 00:00:00 2001 From: Jonathan Zhang Date: Fri, 1 May 2026 13:12:04 -0700 Subject: [PATCH] chore(codex): skip codex track on bootstrap-paths MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bootstrap-paths (.github/workflows/**, Dockerfile, etc.) are deliberately classified as risk:blocked by pr-classify.yml — the classifier exits 1 to require admin-merge for these privilege- escalation paths. That's correct behavior for the gating signal, but in the Codex track it surfaces as: PR Codex Review / classify FAILING after 11s PR Codex Review / review SKIPPED (cascades from classify) Both are noise. Bootstrap-path PRs already require explicit admin action; a secondary Codex review adds no signal because nothing about the workflow-file diff benefits from the second-model read. Add paths-ignore so the whole Codex workflow doesn't run on these paths — no failing check appears. Verified safe: ci-workflows main ruleset requires only `review / Claude Review`. The Codex classify/review checks are NOT required, so paths-ignore does NOT create a merge deadlock. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/pr-codex-review.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.github/workflows/pr-codex-review.yml b/.github/workflows/pr-codex-review.yml index 798dffc..e269373 100644 --- a/.github/workflows/pr-codex-review.yml +++ b/.github/workflows/pr-codex-review.yml @@ -8,6 +8,22 @@ name: PR Codex Review on: pull_request: types: [opened, synchronize] + # Skip the entire Codex track on bootstrap-paths. The classifier flags + # these as risk:blocked and exits 1, which would surface as a failing + # `PR Codex Review / classify` check + a cascading-skipped review job. + # Both are noise — bootstrap-path PRs always require admin merge by + # design, so a secondary review adds no signal. + # + # SAFETY: Codex review is NOT in the required-checks ruleset on + # ci-workflows main (verified: only `review / Claude Review` is + # required), so paths-ignore here does NOT create a deadlock. If you + # add this check to a ruleset later, drop these excludes. + paths-ignore: + - ".github/workflows/**" + - ".github/dependabot.yml" + - ".github/risk-paths.yml" + - ".github/CODEOWNERS" + - "Dockerfile" permissions: contents: read