From f3459c4e44946f7a33a5a11f85dcc51ce5351cb0 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Fri, 30 Oct 2026 20:10:16 +0000 Subject: [PATCH] breaking: rename AZURE_OPENAI_RESPONSES_ENDPOINT to AZURE_OPENAI_ENDPOINT Align action inputs, reusable-workflow secrets, examples, tests, and README with the shared AZURE_OPENAI_ENDPOINT name so callers can pass one secret consistently. Document the breaking rename for consumers. Co-authored-by: alex --- .github/workflows/fork-review.yml | 8 +++---- .github/workflows/review.yml | 8 +++---- README.md | 22 ++++++++++++++++--- action.yml | 12 +++++----- .../codex-review-command-arc-codemods.yml | 4 ++-- examples/codex-review-command.yml | 4 ++-- tests/fork-review.test.cjs | 2 +- 7 files changed, 38 insertions(+), 22 deletions(-) diff --git a/.github/workflows/fork-review.yml b/.github/workflows/fork-review.yml index 263de21..d23ab6c 100644 --- a/.github/workflows/fork-review.yml +++ b/.github/workflows/fork-review.yml @@ -44,7 +44,7 @@ on: secrets: azure_openai_api_key: required: true - azure_openai_responses_endpoint: + azure_openai_endpoint: required: true permissions: {} @@ -152,7 +152,7 @@ jobs: shell: bash env: AZURE_OPENAI_API_KEY: ${{ secrets.azure_openai_api_key }} - AZURE_OPENAI_RESPONSES_ENDPOINT: ${{ secrets.azure_openai_responses_endpoint }} + AZURE_OPENAI_ENDPOINT: ${{ secrets.azure_openai_endpoint }} AZURE_OPENAI_CODEX_MODEL: ${{ inputs.codex_model }} CODEX_VERSION: ${{ inputs.codex_version }} run: | @@ -164,7 +164,7 @@ jobs: missing=() [ -n "$AZURE_OPENAI_API_KEY" ] || missing+=("secret azure_openai_api_key") - [ -n "$AZURE_OPENAI_RESPONSES_ENDPOINT" ] || missing+=("secret azure_openai_responses_endpoint") + [ -n "$AZURE_OPENAI_ENDPOINT" ] || missing+=("secret azure_openai_endpoint") [ -n "$AZURE_OPENAI_CODEX_MODEL" ] || missing+=("input codex_model") if [ ${#missing[@]} -gt 0 ]; then @@ -340,7 +340,7 @@ jobs: uses: openai/codex-action@c385816875cc2fc8e033ed9d1cba96f8c331210e with: openai-api-key: ${{ secrets.azure_openai_api_key }} - responses-api-endpoint: ${{ secrets.azure_openai_responses_endpoint }} + responses-api-endpoint: ${{ secrets.azure_openai_endpoint }} model: ${{ inputs.codex_model }} effort: ${{ inputs.codex_effort }} permission-profile: ":read-only" diff --git a/.github/workflows/review.yml b/.github/workflows/review.yml index 3ce08eb..6d57421 100644 --- a/.github/workflows/review.yml +++ b/.github/workflows/review.yml @@ -59,7 +59,7 @@ on: secrets: azure_openai_api_key: required: true - azure_openai_responses_endpoint: + azure_openai_endpoint: required: true jobs: @@ -158,13 +158,13 @@ jobs: - name: Validate Azure OpenAI configuration env: AZURE_OPENAI_API_KEY: ${{ secrets.azure_openai_api_key }} - AZURE_OPENAI_RESPONSES_ENDPOINT: ${{ secrets.azure_openai_responses_endpoint }} + AZURE_OPENAI_ENDPOINT: ${{ secrets.azure_openai_endpoint }} AZURE_OPENAI_CODEX_MODEL: ${{ inputs.codex_model }} run: | missing=() [ -n "$AZURE_OPENAI_API_KEY" ] || missing+=("secret azure_openai_api_key") - [ -n "$AZURE_OPENAI_RESPONSES_ENDPOINT" ] || missing+=("secret azure_openai_responses_endpoint") + [ -n "$AZURE_OPENAI_ENDPOINT" ] || missing+=("secret azure_openai_endpoint") [ -n "$AZURE_OPENAI_CODEX_MODEL" ] || missing+=("input codex_model") if [ ${#missing[@]} -gt 0 ]; then @@ -178,7 +178,7 @@ jobs: uses: openai/codex-action@v1 with: openai-api-key: ${{ secrets.azure_openai_api_key }} - responses-api-endpoint: ${{ secrets.azure_openai_responses_endpoint }} + responses-api-endpoint: ${{ secrets.azure_openai_endpoint }} model: ${{ inputs.codex_model }} effort: ${{ inputs.codex_effort }} sandbox: ${{ inputs.sandbox }} diff --git a/README.md b/README.md index 40190a4..82d1661 100644 --- a/README.md +++ b/README.md @@ -23,7 +23,7 @@ Composite GitHub Action for running [`openai/codex-action`](https://github.com/o In the calling repository, configure: - Secret: `AZURE_OPENAI_API_KEY` -- Secret: `AZURE_OPENAI_RESPONSES_ENDPOINT` +- Secret: `AZURE_OPENAI_ENDPOINT` - A model/deployment name to pass as `codex_model` For Azure, the endpoint must be the full Responses API URL, for example: @@ -32,6 +32,17 @@ For Azure, the endpoint must be the full Responses API URL, for example: https://centralus.api.cognitive.microsoft.com/openai/v1/responses ``` +### Breaking change: endpoint secret / input rename + +Callers must rename the repository secret and any action/workflow inputs that still use the old names: + +| Old | New | +| --- | --- | +| Secret `AZURE_OPENAI_RESPONSES_ENDPOINT` | `AZURE_OPENAI_ENDPOINT` | +| Input / reusable-workflow secret `azure_openai_responses_endpoint` | `azure_openai_endpoint` | + +The value is unchanged (still the full Azure OpenAI Responses API URL). Downstream workflows that pass the old input or secret name will fail validation until updated. + ## Recommended caller workflow Use a thin caller workflow in each repository. Keep triggers and permissions in the caller repo, then delegate the review steps here. @@ -70,7 +81,7 @@ jobs: pr_number: ${{ github.event.pull_request.number }} codex_model: ${{ vars.AZURE_OPENAI_CODEX_MODEL }} azure_openai_api_key: ${{ secrets.AZURE_OPENAI_API_KEY }} - azure_openai_responses_endpoint: ${{ secrets.AZURE_OPENAI_RESPONSES_ENDPOINT }} + azure_openai_endpoint: ${{ secrets.AZURE_OPENAI_ENDPOINT }} node_version: "24" pnpm_version: "10.19.0" install_command: pnpm install --frozen-lockfile @@ -151,7 +162,7 @@ That means: - `pr_number`: required PR number to review - `codex_model`: required Azure deployment name - `azure_openai_api_key`: required Azure OpenAI API key -- `azure_openai_responses_endpoint`: required Azure OpenAI Responses API endpoint +- `azure_openai_endpoint`: required Azure OpenAI Responses API endpoint - `working_directory`: checkout subdirectory to run from - `node_version`: Node.js version for `actions/setup-node` - `pnpm_version`: pnpm version for `pnpm/action-setup` @@ -165,6 +176,11 @@ That means: ## Secrets +When calling the composite action, pass the Azure credentials as inputs (`azure_openai_api_key`, `azure_openai_endpoint`). When calling the reusable workflows (`.github/workflows/fork-review.yml`, `.github/workflows/review.yml`), map repository secrets into: + +- `azure_openai_api_key` ← repository secret `AZURE_OPENAI_API_KEY` +- `azure_openai_endpoint` ← repository secret `AZURE_OPENAI_ENDPOINT` + ## Notes - The action expects `pnpm` by default, but the caller can override `install_command`, `node_version`, `pnpm_version`, and `working_directory`. diff --git a/action.yml b/action.yml index daa5e0b..33fdbd5 100644 --- a/action.yml +++ b/action.yml @@ -14,8 +14,8 @@ inputs: azure_openai_api_key: description: Azure OpenAI API key. required: true - azure_openai_responses_endpoint: - description: Azure OpenAI Responses API endpoint. + azure_openai_endpoint: + description: Azure OpenAI endpoint (full Responses API URL). required: true working_directory: description: Working directory inside the repository checkout. @@ -209,13 +209,13 @@ runs: shell: bash env: AZURE_OPENAI_API_KEY: ${{ inputs.azure_openai_api_key }} - AZURE_OPENAI_RESPONSES_ENDPOINT: ${{ inputs.azure_openai_responses_endpoint }} + AZURE_OPENAI_ENDPOINT: ${{ inputs.azure_openai_endpoint }} AZURE_OPENAI_CODEX_MODEL: ${{ inputs.codex_model }} run: | missing=() [ -n "$AZURE_OPENAI_API_KEY" ] || missing+=("input azure_openai_api_key") - [ -n "$AZURE_OPENAI_RESPONSES_ENDPOINT" ] || missing+=("input azure_openai_responses_endpoint") + [ -n "$AZURE_OPENAI_ENDPOINT" ] || missing+=("input azure_openai_endpoint") [ -n "$AZURE_OPENAI_CODEX_MODEL" ] || missing+=("input codex_model") if [ ${#missing[@]} -gt 0 ]; then @@ -393,7 +393,7 @@ runs: uses: openai/codex-action@c385816875cc2fc8e033ed9d1cba96f8c331210e with: openai-api-key: ${{ inputs.azure_openai_api_key }} - responses-api-endpoint: ${{ inputs.azure_openai_responses_endpoint }} + responses-api-endpoint: ${{ inputs.azure_openai_endpoint }} model: ${{ inputs.codex_model }} effort: ${{ inputs.codex_effort }} permission-profile: ${{ inputs.permission_profile }} @@ -409,7 +409,7 @@ runs: uses: openai/codex-action@c385816875cc2fc8e033ed9d1cba96f8c331210e with: openai-api-key: ${{ inputs.azure_openai_api_key }} - responses-api-endpoint: ${{ inputs.azure_openai_responses_endpoint }} + responses-api-endpoint: ${{ inputs.azure_openai_endpoint }} model: ${{ inputs.codex_model }} effort: ${{ inputs.codex_effort }} sandbox: ${{ inputs.sandbox }} diff --git a/examples/codex-review-command-arc-codemods.yml b/examples/codex-review-command-arc-codemods.yml index a8c9bd9..a0ec255 100644 --- a/examples/codex-review-command-arc-codemods.yml +++ b/examples/codex-review-command-arc-codemods.yml @@ -104,7 +104,7 @@ jobs: pr_number: ${{ github.event.issue.number }} codex_model: ${{ vars.AZURE_OPENAI_CODEX_MODEL }} azure_openai_api_key: ${{ secrets.AZURE_OPENAI_API_KEY }} - azure_openai_responses_endpoint: ${{ secrets.AZURE_OPENAI_RESPONSES_ENDPOINT }} + azure_openai_endpoint: ${{ secrets.AZURE_OPENAI_ENDPOINT }} node_version: "24" pnpm_version: "10.15.0" install_command: pnpm install --no-frozen-lockfile --ignore-scripts @@ -149,4 +149,4 @@ jobs: Ignore style-only nits and do not review intentionally vulnerable input fixtures as if they were production code. secrets: azure_openai_api_key: ${{ secrets.AZURE_OPENAI_API_KEY }} - azure_openai_responses_endpoint: ${{ secrets.AZURE_OPENAI_RESPONSES_ENDPOINT }} + azure_openai_endpoint: ${{ secrets.AZURE_OPENAI_ENDPOINT }} diff --git a/examples/codex-review-command.yml b/examples/codex-review-command.yml index 08750d7..1a932a9 100644 --- a/examples/codex-review-command.yml +++ b/examples/codex-review-command.yml @@ -104,7 +104,7 @@ jobs: pr_number: ${{ github.event.issue.number }} codex_model: ${{ vars.AZURE_OPENAI_CODEX_MODEL }} azure_openai_api_key: ${{ secrets.AZURE_OPENAI_API_KEY }} - azure_openai_responses_endpoint: ${{ secrets.AZURE_OPENAI_RESPONSES_ENDPOINT }} + azure_openai_endpoint: ${{ secrets.AZURE_OPENAI_ENDPOINT }} node_version: "24" # Read pnpm from the reviewed checkout's packageManager field. pnpm_version: "" @@ -146,4 +146,4 @@ jobs: Follow repository-specific review guidance from the trusted base checkout when present. secrets: azure_openai_api_key: ${{ secrets.AZURE_OPENAI_API_KEY }} - azure_openai_responses_endpoint: ${{ secrets.AZURE_OPENAI_RESPONSES_ENDPOINT }} + azure_openai_endpoint: ${{ secrets.AZURE_OPENAI_ENDPOINT }} diff --git a/tests/fork-review.test.cjs b/tests/fork-review.test.cjs index 010f8a0..7a9487e 100644 --- a/tests/fork-review.test.cjs +++ b/tests/fork-review.test.cjs @@ -191,7 +191,7 @@ test('runtime version validation accepts only exact stable versions', () => { for (const version of ['0.160.0', '1.2.3', '', 'latest', '^0.160.0', '0.160.0 || touch marker']) { const result = spawnSync('bash', ['-c', validation], { encoding: 'utf8', env: { PATH: process.env.PATH, CODEX_VERSION: version, - AZURE_OPENAI_API_KEY: 'fake', AZURE_OPENAI_RESPONSES_ENDPOINT: 'fake', AZURE_OPENAI_CODEX_MODEL: 'fake', + AZURE_OPENAI_API_KEY: 'fake', AZURE_OPENAI_ENDPOINT: 'fake', AZURE_OPENAI_CODEX_MODEL: 'fake', } }); assert.equal(result.status === 0, ['0.160.0', '1.2.3'].includes(version), version); }