fix(ci): bump Codex CLI to 0.150.1 to unhang security review jobs - #6962
Merged
Conversation
Codex CLI 0.149.x can leave a PTY descendant holding the action's inherited stdio after the turn completes, so the review step never returns and the job dies on its 30-minute timeout with the finished review discarded (openai/codex-action#150, fixed by openai/codex@bf3eb2e in 0.150.0). Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
wpfleger96
enabled auto-merge (squash)
August 27, 2026 21:40
github-actions
Bot
added
the
codex-security-review-current
🔐 Codex Security Review
Review SummaryOverall Risk: NONE
FindingsNo concrete security, correctness, or reliability findings were identified. Notes
Generated by Codex Security Review | |
jmecom
approved these changes
Aug 27, 2026
jmecom
left a comment
jmecom
left a comment
Collaborator
There was a problem hiding this comment.
Confirmed that Codex CLI 0.150.1 contains the upstream PTY shutdown fix from openai/codex-action#150. The workflow remains pinned and keeps the existing read-only, credential-stripped boundary. The review job also emitted its end-action marker and completed cleanly with 0.150.1.
wpfleger96
disabled auto-merge
August 27, 2026 22:01
wpfleger96
pushed a commit
that referenced
this pull request
Aug 27, 2026
…-history * origin/main: fix(ci): bump Codex CLI to 0.150.1 to unhang security review jobs (#6962) Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
wpfleger96
pushed a commit
that referenced
this pull request
Aug 27, 2026
…arer-auth * origin/main: fix(ci): bump Codex CLI to 0.150.1 to unhang security review jobs (#6962) feat(desktop): implement 30178 team catalog backend (#5112) feat(model-capabilities): humanize Databricks UC model families (#6955) feat(agent): discover Databricks Unity Catalog models (#6918) test(db): use canonical channel roster fixtures (#6819) preserve channel description paragraph breaks (#6946) Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
jrobotham-square
added a commit
that referenced
this pull request
Aug 28, 2026
…age-rw * origin/main: (21 commits) fix(desktop): resolve exact typed mentions on space (#6862) perf(desktop): restore project context during startup (#6939) fix(desktop): lift right auxiliary pane above shared header backdrop (#6966) fix(ci): bump Codex CLI to 0.150.1 to unhang security review jobs (#6962) feat(desktop): implement 30178 team catalog backend (#5112) feat(model-capabilities): humanize Databricks UC model families (#6955) feat(agent): discover Databricks Unity Catalog models (#6918) test(db): use canonical channel roster fixtures (#6819) preserve channel description paragraph breaks (#6946) fix(cli): enrich template cardinality error with per-candidate presence and profile hints (#4825) Fix Codex security review authorization (#6913) fix(db): disable heartbeat vacuum truncation (#6898) chore(deps): update rui314/setup-mold digest to 7e4f20a (#6663) chore(deps): update dependency vitest to v4.1.11 (#6667) chore(deps): update dependency @tanstack/react-virtual to v3.14.10 (#6666) chore(deps): update ubuntu:24.04 docker digest to 33ceb71 (#6664) fix(projects): allow owners to delete agent projects (#6533) Fade expanded video controls on hover (#6926) fix(db): exclude kind:30179 ciphertext from brownfield FTS (#6822) fix(client): resurface hidden DMs from live activity (#6885) ... Signed-off-by: Joel Robotham <jrobotham@squareup.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Codex CLI 0.149.x can leave a PTY descendant holding
openai/codex-action's inherited stdio after the review turn completes. The action's runner waits on the child's stdio streams closing rather than on process exit (runCodexExec.ts), so theReview pull requeststep never returns — the job idles until its 30-minutetimeout-minuteskills it and the already-written review result is discarded.Every
Run Codex Security Reviewjob since the workflow merged has hung this way: the final JSON result andtokens usedcount are the last log lines, with no step-end marker. Heavy runs (gpt-5.6-solatmaxeffort, ~295k tokens) sit firmly in the failing regime.Upstream: openai/codex-action#150, fixed in Codex CLI 0.150.0 by openai/codex@bf3eb2e ("Prevent Unix PTY I/O from blocking runtime shutdown"). The fix commit is in the
rust-v0.150.xline and not in0.149.x.The action pin (
v1.12) is unchanged — only thecodex-versionCLI pin moves from0.149.0to0.150.1(latest stable).