From b9d1dfd17ca6e6348c9a243a1711ad65098c21ae Mon Sep 17 00:00:00 2001 From: Colum Ferry Date: Wed, 23 Sep 2026 12:31:23 +0100 Subject: [PATCH 1/2] ci(repo): move the AI review pipeline to gpt-6-sol gpt-6-sol supersedes gpt-5.6-sol for complex coding and agentic work, at half the token price ($2/$10 per M vs $4/$20) and a 1.05M context window. The model only entered the Codex CLI's model catalog in 0.156.1, so the `codex-version` pin moves with it. The action itself stays pinned to the v1.11 commit, since openai/codex-action#151 and #160 are both still open and `codex-version` is an independent input. `codex exec`'s flag surface is unchanged between 0.150.1 and 0.156.1, so everything the pinned action passes still parses, and 0.156's new background daemon is TUI-only. Co-Authored-By: Claude Opus 5 --- .github/workflows/ai-review.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml index a386875f9d..dda8278831 100644 --- a/.github/workflows/ai-review.yml +++ b/.github/workflows/ai-review.yml @@ -28,7 +28,7 @@ permissions: {} # post-review's footer all read these instead of hardcoding them separately. env: CLAUDE_MODEL: claude-opus-5 - CODEX_MODEL: gpt-5.6-sol + CODEX_MODEL: gpt-6-sol # Non-command issue_comment events fire for every comment on every PR, so grouping by PR number # alone would let any comment cancel an in-flight review; give those runs their own per-run @@ -307,7 +307,8 @@ jobs: effort: high output-schema-file: /tmp/ai-review/findings.schema.json output-file: /tmp/ai-review/codex-findings.json - codex-version: "0.150.1" + # 0.156.1 is the first stable CLI whose model catalog carries gpt-6-sol. + codex-version: "0.156.1" working-directory: ${{ github.workspace }} safety-strategy: drop-sudo sandbox: read-only @@ -458,7 +459,7 @@ jobs: effort: high output-schema-file: /tmp/ai-review/merged-review.schema.json output-file: /tmp/ai-review/merged-review.json - codex-version: "0.150.1" + codex-version: "0.156.1" working-directory: ${{ github.workspace }} safety-strategy: drop-sudo sandbox: read-only From 9267ef424e1a28bbf1a6d114ad4a7a7fa04d60b7 Mon Sep 17 00:00:00 2001 From: Colum Ferry Date: Wed, 23 Sep 2026 12:42:16 +0100 Subject: [PATCH 2/2] ci(repo): share the Codex CLI version pin between both codex jobs Anchors `codex-version` in codex-review and aliases it from adjudicate, matching how the action pin is already shared, so a future bump can't update one job and miss the other. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ai-review.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml index dda8278831..8a3399b0a9 100644 --- a/.github/workflows/ai-review.yml +++ b/.github/workflows/ai-review.yml @@ -308,7 +308,7 @@ jobs: output-schema-file: /tmp/ai-review/findings.schema.json output-file: /tmp/ai-review/codex-findings.json # 0.156.1 is the first stable CLI whose model catalog carries gpt-6-sol. - codex-version: "0.156.1" + codex-version: &codex-cli-version "0.156.1" working-directory: ${{ github.workspace }} safety-strategy: drop-sudo sandbox: read-only @@ -449,8 +449,8 @@ jobs: # `working-directory` is the workspace root so Codex's cwd holds no untrusted AGENTS.md/ # config; it reads the PR from `pr/` and executes nothing from it. - name: Run Codex adjudication - # Same v1.11 pin as codex-review's step above (see its comment for the full rationale); - # YAML-aliased so the SHA only needs to change in one place. + # Same v1.11 action pin and Codex CLI version as codex-review's step above (see its + # comments for the rationale); both are YAML-aliased so each changes in one place only. uses: *codex-action-pin with: openai-api-key: ${{ secrets.OPENAI_API_KEY }} @@ -459,7 +459,7 @@ jobs: effort: high output-schema-file: /tmp/ai-review/merged-review.schema.json output-file: /tmp/ai-review/merged-review.json - codex-version: "0.156.1" + codex-version: *codex-cli-version working-directory: ${{ github.workspace }} safety-strategy: drop-sudo sandbox: read-only