From 95d5cfab775bb4f20de068093c9c755cda51420b Mon Sep 17 00:00:00 2001 From: Jonathan Zhang Date: Sat, 2 May 2026 18:30:43 -0700 Subject: [PATCH] fix(codex): bypass internal sandbox in CI to unbreak diff inspection MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `codex review` runs shell commands (git diff, find, cat) inside Codex's own bubblewrap sandbox. On GitHub Actions runners — themselves nested containers — bwrap can't open a loopback network namespace, so every spawned command fails with: bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted The review then has nothing to inspect, but Codex sometimes still emits "no regressions found" — silently giving false confidence on the highest-risk PRs. Verified across whois-api-llc/wxa-jake-ai PRs #177, #184, #203, #210 (all risk:sensitive, all blind comments since ~Apr 30). Add `--dangerously-bypass-approvals-and-sandbox` to skip Codex's sandbox layer entirely. The flag is documented as the canonical CI escape hatch: "Intended solely for running in environments that are externally sandboxed" — GHA runners are ephemeral VMs that satisfy that condition. Tested locally with codex-cli 0.128.0 (the version the workflow installs): the bypass flag is accepted by `codex review`, runs the same prompt pattern this workflow uses (Pattern B), and produces a coherent verdict after successfully invoking git/find/sed in the working tree. The first risk:sensitive PR after this lands will validate end-to-end on the Linux runner. Auto-Merge-Risk: standard Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/codex-review.yml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codex-review.yml b/.github/workflows/codex-review.yml index be495a8..733d03b 100644 --- a/.github/workflows/codex-review.yml +++ b/.github/workflows/codex-review.yml @@ -88,7 +88,19 @@ jobs: Be brief. Do not perform general bug-hunting; the first pass already did." - codex review "$PROMPT" 2>&1 | tee /tmp/codex.out + # --dangerously-bypass-approvals-and-sandbox: skip Codex's internal + # bubblewrap (Linux) / Seatbelt (macOS) sandbox. Required in CI: + # GitHub Actions runners are nested containers where bwrap cannot + # set up a loopback network namespace, producing + # "bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted" + # on every shell command Codex tries to execute (git diff, find, + # cat). The sandbox failure silently degrades the review — Codex + # often still posts "no regressions found" even though it never + # read the diff (false confidence on the highest-risk PRs). + # The flag is documented as the canonical CI escape hatch: + # "Intended solely for running in environments that are externally + # sandboxed" — which GHA runners are (ephemeral VMs). + codex --dangerously-bypass-approvals-and-sandbox review "$PROMPT" 2>&1 | tee /tmp/codex.out # Extract verdict: Codex streams reasoning, then prints the literal # token `codex` on its own line followed by the verdict. Grab the