breaking: rename AZURE_OPENAI_RESPONSES_ENDPOINT to AZURE_OPENAI_ENDPOINT

.github/workflows/fork-review.yml

@@ -44,7 +44,7 @@ on:
     secrets:
       azure_openai_api_key:
         required: true
-      azure_openai_responses_endpoint:
+      azure_openai_endpoint:
         required: true
 
 permissions: {}
@@ -152,7 +152,7 @@ jobs:
         shell: bash
         env:
           AZURE_OPENAI_API_KEY: ${{ secrets.azure_openai_api_key }}
-          AZURE_OPENAI_RESPONSES_ENDPOINT: ${{ secrets.azure_openai_responses_endpoint }}
+          AZURE_OPENAI_ENDPOINT: ${{ secrets.azure_openai_endpoint }}
           AZURE_OPENAI_CODEX_MODEL: ${{ inputs.codex_model }}
           CODEX_VERSION: ${{ inputs.codex_version }}
         run: |
@@ -164,7 +164,7 @@ jobs:
           missing=()
 
           [ -n "$AZURE_OPENAI_API_KEY" ] || missing+=("secret azure_openai_api_key")
-          [ -n "$AZURE_OPENAI_RESPONSES_ENDPOINT" ] || missing+=("secret azure_openai_responses_endpoint")
+          [ -n "$AZURE_OPENAI_ENDPOINT" ] || missing+=("secret azure_openai_endpoint")
           [ -n "$AZURE_OPENAI_CODEX_MODEL" ] || missing+=("input codex_model")
 
           if [ ${#missing[@]} -gt 0 ]; then
@@ -340,7 +340,7 @@ jobs:
         uses: openai/codex-action@c385816875cc2fc8e033ed9d1cba96f8c331210e
         with:
           openai-api-key: ${{ secrets.azure_openai_api_key }}
-          responses-api-endpoint: ${{ secrets.azure_openai_responses_endpoint }}
+          responses-api-endpoint: ${{ secrets.azure_openai_endpoint }}
           model: ${{ inputs.codex_model }}
           effort: ${{ inputs.codex_effort }}
           permission-profile: ":read-only"

.github/workflows/review.yml

@@ -59,7 +59,7 @@ on:
     secrets:
       azure_openai_api_key:
         required: true
-      azure_openai_responses_endpoint:
+      azure_openai_endpoint:
         required: true
 
 jobs:
@@ -158,13 +158,13 @@ jobs:
       - name: Validate Azure OpenAI configuration
         env:
           AZURE_OPENAI_API_KEY: ${{ secrets.azure_openai_api_key }}
-          AZURE_OPENAI_RESPONSES_ENDPOINT: ${{ secrets.azure_openai_responses_endpoint }}
+          AZURE_OPENAI_ENDPOINT: ${{ secrets.azure_openai_endpoint }}
           AZURE_OPENAI_CODEX_MODEL: ${{ inputs.codex_model }}
         run: |
           missing=()
 
           [ -n "$AZURE_OPENAI_API_KEY" ] || missing+=("secret azure_openai_api_key")
-          [ -n "$AZURE_OPENAI_RESPONSES_ENDPOINT" ] || missing+=("secret azure_openai_responses_endpoint")
+          [ -n "$AZURE_OPENAI_ENDPOINT" ] || missing+=("secret azure_openai_endpoint")
           [ -n "$AZURE_OPENAI_CODEX_MODEL" ] || missing+=("input codex_model")
 
           if [ ${#missing[@]} -gt 0 ]; then
@@ -178,7 +178,7 @@ jobs:
         uses: openai/codex-action@v1
         with:
           openai-api-key: ${{ secrets.azure_openai_api_key }}
-          responses-api-endpoint: ${{ secrets.azure_openai_responses_endpoint }}
+          responses-api-endpoint: ${{ secrets.azure_openai_endpoint }}
           model: ${{ inputs.codex_model }}
           effort: ${{ inputs.codex_effort }}
           sandbox: ${{ inputs.sandbox }}

README.md

@@ -23,7 +23,7 @@ Composite GitHub Action for running [`openai/codex-action`](https://github.com/o
 In the calling repository, configure:
 
 - Secret: `AZURE_OPENAI_API_KEY`
-- Secret: `AZURE_OPENAI_RESPONSES_ENDPOINT`
+- Secret: `AZURE_OPENAI_ENDPOINT`
 - A model/deployment name to pass as `codex_model`
 
 For Azure, the endpoint must be the full Responses API URL, for example:
@@ -32,6 +32,17 @@ For Azure, the endpoint must be the full Responses API URL, for example:
 https://centralus.api.cognitive.microsoft.com/openai/v1/responses
 ```
 
+### Breaking change: endpoint secret / input rename
+
+Callers must rename the repository secret and any action/workflow inputs that still use the old names:
+
+| Old | New |
+| --- | --- |
+| Secret `AZURE_OPENAI_RESPONSES_ENDPOINT` | `AZURE_OPENAI_ENDPOINT` |
+| Input / reusable-workflow secret `azure_openai_responses_endpoint` | `azure_openai_endpoint` |
+
+The value is unchanged (still the full Azure OpenAI Responses API URL). Downstream workflows that pass the old input or secret name will fail validation until updated.
+
 ## Recommended caller workflow
 
 Use a thin caller workflow in each repository. Keep triggers and permissions in the caller repo, then delegate the review steps here.
@@ -70,7 +81,7 @@ jobs:
           pr_number: ${{ github.event.pull_request.number }}
           codex_model: ${{ vars.AZURE_OPENAI_CODEX_MODEL }}
           azure_openai_api_key: ${{ secrets.AZURE_OPENAI_API_KEY }}
-          azure_openai_responses_endpoint: ${{ secrets.AZURE_OPENAI_RESPONSES_ENDPOINT }}
+          azure_openai_endpoint: ${{ secrets.AZURE_OPENAI_ENDPOINT }}
           node_version: "24"
           pnpm_version: "10.19.0"
           install_command: pnpm install --frozen-lockfile
@@ -151,7 +162,7 @@ That means:
 - `pr_number`: required PR number to review
 - `codex_model`: required Azure deployment name
 - `azure_openai_api_key`: required Azure OpenAI API key
-- `azure_openai_responses_endpoint`: required Azure OpenAI Responses API endpoint
+- `azure_openai_endpoint`: required Azure OpenAI Responses API endpoint
 - `working_directory`: checkout subdirectory to run from
 - `node_version`: Node.js version for `actions/setup-node`
 - `pnpm_version`: pnpm version for `pnpm/action-setup`
@@ -165,6 +176,11 @@ That means:
 
 ## Secrets
 
+When calling the composite action, pass the Azure credentials as inputs (`azure_openai_api_key`, `azure_openai_endpoint`). When calling the reusable workflows (`.github/workflows/fork-review.yml`, `.github/workflows/review.yml`), map repository secrets into:
+
+- `azure_openai_api_key` ← repository secret `AZURE_OPENAI_API_KEY`
+- `azure_openai_endpoint` ← repository secret `AZURE_OPENAI_ENDPOINT`
+
 ## Notes
 
 - The action expects `pnpm` by default, but the caller can override `install_command`, `node_version`, `pnpm_version`, and `working_directory`.

action.yml

@@ -14,8 +14,8 @@ inputs:
   azure_openai_api_key:
     description: Azure OpenAI API key.
     required: true
-  azure_openai_responses_endpoint:
-    description: Azure OpenAI Responses API endpoint.
+  azure_openai_endpoint:
+    description: Azure OpenAI endpoint (full Responses API URL).
     required: true
   working_directory:
     description: Working directory inside the repository checkout.
@@ -209,13 +209,13 @@ runs:
       shell: bash
       env:
         AZURE_OPENAI_API_KEY: ${{ inputs.azure_openai_api_key }}
-        AZURE_OPENAI_RESPONSES_ENDPOINT: ${{ inputs.azure_openai_responses_endpoint }}
+        AZURE_OPENAI_ENDPOINT: ${{ inputs.azure_openai_endpoint }}
         AZURE_OPENAI_CODEX_MODEL: ${{ inputs.codex_model }}
       run: |
         missing=()
 
         [ -n "$AZURE_OPENAI_API_KEY" ] || missing+=("input azure_openai_api_key")
-        [ -n "$AZURE_OPENAI_RESPONSES_ENDPOINT" ] || missing+=("input azure_openai_responses_endpoint")
+        [ -n "$AZURE_OPENAI_ENDPOINT" ] || missing+=("input azure_openai_endpoint")
         [ -n "$AZURE_OPENAI_CODEX_MODEL" ] || missing+=("input codex_model")
 
         if [ ${#missing[@]} -gt 0 ]; then
@@ -393,7 +393,7 @@ runs:
       uses: openai/codex-action@c385816875cc2fc8e033ed9d1cba96f8c331210e
       with:
         openai-api-key: ${{ inputs.azure_openai_api_key }}
-        responses-api-endpoint: ${{ inputs.azure_openai_responses_endpoint }}
+        responses-api-endpoint: ${{ inputs.azure_openai_endpoint }}
         model: ${{ inputs.codex_model }}
         effort: ${{ inputs.codex_effort }}
         permission-profile: ${{ inputs.permission_profile }}
@@ -409,7 +409,7 @@ runs:
       uses: openai/codex-action@c385816875cc2fc8e033ed9d1cba96f8c331210e
       with:
         openai-api-key: ${{ inputs.azure_openai_api_key }}
-        responses-api-endpoint: ${{ inputs.azure_openai_responses_endpoint }}
+        responses-api-endpoint: ${{ inputs.azure_openai_endpoint }}
         model: ${{ inputs.codex_model }}
         effort: ${{ inputs.codex_effort }}
         sandbox: ${{ inputs.sandbox }}

examples/codex-review-command-arc-codemods.yml

@@ -104,7 +104,7 @@ jobs:
           pr_number: ${{ github.event.issue.number }}
           codex_model: ${{ vars.AZURE_OPENAI_CODEX_MODEL }}
           azure_openai_api_key: ${{ secrets.AZURE_OPENAI_API_KEY }}
-          azure_openai_responses_endpoint: ${{ secrets.AZURE_OPENAI_RESPONSES_ENDPOINT }}
+          azure_openai_endpoint: ${{ secrets.AZURE_OPENAI_ENDPOINT }}
           node_version: "24"
           pnpm_version: "10.15.0"
           install_command: pnpm install --no-frozen-lockfile --ignore-scripts
@@ -149,4 +149,4 @@ jobs:
         Ignore style-only nits and do not review intentionally vulnerable input fixtures as if they were production code.
     secrets:
       azure_openai_api_key: ${{ secrets.AZURE_OPENAI_API_KEY }}
-      azure_openai_responses_endpoint: ${{ secrets.AZURE_OPENAI_RESPONSES_ENDPOINT }}
+      azure_openai_endpoint: ${{ secrets.AZURE_OPENAI_ENDPOINT }}

examples/codex-review-command.yml

@@ -104,7 +104,7 @@ jobs:
           pr_number: ${{ github.event.issue.number }}
           codex_model: ${{ vars.AZURE_OPENAI_CODEX_MODEL }}
           azure_openai_api_key: ${{ secrets.AZURE_OPENAI_API_KEY }}
-          azure_openai_responses_endpoint: ${{ secrets.AZURE_OPENAI_RESPONSES_ENDPOINT }}
+          azure_openai_endpoint: ${{ secrets.AZURE_OPENAI_ENDPOINT }}
           node_version: "24"
           # Read pnpm from the reviewed checkout's packageManager field.
           pnpm_version: ""
@@ -146,4 +146,4 @@ jobs:
         Follow repository-specific review guidance from the trusted base checkout when present.
     secrets:
       azure_openai_api_key: ${{ secrets.AZURE_OPENAI_API_KEY }}
-      azure_openai_responses_endpoint: ${{ secrets.AZURE_OPENAI_RESPONSES_ENDPOINT }}
+      azure_openai_endpoint: ${{ secrets.AZURE_OPENAI_ENDPOINT }}

tests/fork-review.test.cjs

@@ -191,7 +191,7 @@ test('runtime version validation accepts only exact stable versions', () => {
   for (const version of ['0.160.0', '1.2.3', '', 'latest', '^0.160.0', '0.160.0 || touch marker']) {
     const result = spawnSync('bash', ['-c', validation], { encoding: 'utf8', env: {
       PATH: process.env.PATH, CODEX_VERSION: version,
-      AZURE_OPENAI_API_KEY: 'fake', AZURE_OPENAI_RESPONSES_ENDPOINT: 'fake', AZURE_OPENAI_CODEX_MODEL: 'fake',
+      AZURE_OPENAI_API_KEY: 'fake', AZURE_OPENAI_ENDPOINT: 'fake', AZURE_OPENAI_CODEX_MODEL: 'fake',
     } });
     assert.equal(result.status === 0, ['0.160.0', '1.2.3'].includes(version), version);
   }