chore(repo): bootstrap codex os guardrails by saagar210 · Pull Request #10 · saagar210/AssistSupport

saagar210 · 2026-02-17T05:56:20Z

What

Bootstraps global Codex Git/performance guardrails for this repository
Adds manifest, policy-aligned CI workflows, hooks, and perf baseline scaffolding

Why

Enforces consistent commit hygiene and proactive performance regression prevention by default

Testing

Bootstrap scaffolding only (structural validation)

Risk / Notes

Review any .codex/bootstrap-conflicts/*.new files and merge intentionally
Functional/perf budgets enforce during normal CI after merge

- add husky hooks, commitlint, and guard scripts for branch, atomicity, artifacts, and secrets - add deterministic helpers for branch-from-task and staged commit message proposals - add local perf scripts for bundle, build, memory, assets, API, and DB checks - wire commands into package scripts for deterministic local and CI execution Tests: pnpm git:guard:all && pnpm perf:build

- add git hygiene, lockfile rationale, perf foundation, perf enforcement, and release workflows - add PR template, release metadata, and changelog scaffolding for repeatable release flow - add side and production lighthouse profiles plus committed perf baselines for diff gating - add Codex DoD and repo skills for git workflow and performance budget execution Tests: while IFS= read -r cmd; do eval ""; done < .codex/verify.commands

- use existing lint command for ui static gate inputs on repos without extra eslint config - skip Playwright tagged runs when tests/ui specs are absent instead of failing hard - keep explicit skip output so missing UI coverage remains visible in logs Tests: while IFS= read -r cmd; do eval ""; done < .codex/verify.commands

- set GITHUB_TOKEN for gitleaks PR scans to satisfy current action requirements - keep secrets workflow deterministic under pull_request triggers Tests: not run (CI-only workflow change)

- set checkout fetch-depth to 0 for secrets job - avoid gitleaks commit-range resolution failures on shallow clones Tests: not run (CI-only workflow change)

- install global git and performance baseline payload - add codex-os manifest and verification contracts - align repo with global policies under /Users/d/.codex/policies Tests: not run (bootstrap scaffolding only)

gemini-code-assist · 2026-02-17T05:56:23Z

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

codacy-production · 2026-02-17T05:58:22Z

Codacy's Analysis Summary

100 new issues (≤ 0 issue)
0 new security issue
33 complexity
0 duplications

Review Pull Request in Codacy →

✨ AI Reviewer available: add the codacy-review label to get contextual insights without leaving GitHub.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fcfed6a144

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-02-17T05:59:49Z

.codex/verify.commands

@@ -0,0 +1,6 @@
+pnpm ui:gate:static
+pnpm ui:gate:regression
+pnpm git:guard:all


Remove local branch guard from CI verify sequence

quality-gates runs .codex/scripts/run_verify_commands.sh, and that file currently includes pnpm git:guard:all, which invokes scripts/git/guard-branch.sh and fails unless git rev-parse --abbrev-ref HEAD matches codex/...; in GitHub Actions checkout contexts this value is typically HEAD (detached), so the workflow fails before reaching substantive checks. This makes the CI gate unreliable for every PR/push run that uses detached checkouts.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-02-17T05:59:49Z

.github/workflows/release-please.yml

+
+on:
+  push:
+    branches: [master]


Trigger release workflow on main branch pushes

The release workflow only listens to push events on master, so repositories using main as the default branch (including this one) will never execute release-please on normal release commits. That leaves automated version/changelog PR generation effectively disabled unless someone pushes to master.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-02-17T05:59:49Z

scripts/git/create-branch.sh

+
+task="${1:-}"
+kind="${2:-feat}"
+base="${3:-origin/master}"


Default branch creation base to origin/main

The branch bootstrap helper defaults base to origin/master, and later runs git checkout -b "$branch" "$base"; on repos that only have origin/main, this fails immediately and prevents branch creation unless callers override the third argument manually. The default should align with the repo’s primary branch to keep the helper usable out of the box.

Useful? React with 👍 / 👎.

.github/workflows/quality-gates.yml

+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Policy checks
+        run: node scripts/ci/require-tests-and-docs.mjs
+
+      - name: Verify commands
+        run: bash .codex/scripts/run_verify_commands.sh
+
+      - name: Diff coverage
+        run: |
+          python -m pip install --upgrade pip diff-cover
+          diff-cover coverage/lcov.info --compare-branch=origin/main --fail-under=90
+
+      - name: Upload test artifacts on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-artifacts
+          path: |
+            playwright-report/
+            test-results/
+            coverage/


In general, the fix is to add an explicit permissions: block to the workflow, ideally at the root level so it applies to all jobs, and restrict the GITHUB_TOKEN to the least privileges required. For this workflow, the steps only need to read the repository contents (for actions/checkout and scripts) and upload artifacts on failure. Uploading artifacts does not require repository write permissions; it uses its own actions: write permission scope. No steps create or modify pull requests, issues, or releases.

The best fix is to add a top-level permissions: block after the name: and on: section, before jobs:, specifying contents: read and actions: write. contents: read is sufficient for checking out code and reading files; actions: write is needed so actions/upload-artifact@v4 can successfully upload artifacts. We do not need to modify any job steps or introduce new dependencies. No existing functionality should change, because these scopes cover everything the workflow is already doing while avoiding broad repository write access.

Concretely, in .github/workflows/quality-gates.yml, insert:

permissions: contents: read actions: write

between the on: block and the jobs: block.

sonarqubecloud · 2026-02-17T09:37:13Z

Quality Gate failed

Failed conditions
3 Security Hotspots

See analysis details on SonarQube Cloud

codacy-production · 2026-02-17T09:37:43Z

scripts/perf/summarize.mjs

@@ -0,0 +1,14 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+
+const readJson = (file) => (existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : null);


Codacy has a fix for the issue: ES2015 arrow function expressions are forbidden.

Suggested change

const readJson = (file) => (existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : null);

const readJson = function(file) { return (existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : null) };

codacy-production · 2026-02-17T09:37:44Z

scripts/perf/compare-metric.mjs

+      threshold: allowed,
+    },
+    null,
+    2,


Codacy has a fix for the issue: ES2017 trailing commas in parameter/argument lists are forbidden.

Suggested change

2,

2

codacy-production · 2026-02-17T09:37:45Z

scripts/ci/require-tests-and-docs.mjs

+  .map((line) => line.trim())
+  .filter(Boolean);
+
+const isProdCode = (file) => /^(src|app|server|api)\//.test(file) && !/\.(test|spec)\.[cm]?[jt]sx?$/.test(file);


Codacy has a fix for the issue: ES2015 arrow function expressions are forbidden.

Suggested change

const isProdCode = (file) => /^(src|app|server|api)\//.test(file) && !/\.(test|spec)\.[cm]?[jt]sx?$/.test(file);

const isProdCode = function(file) { return /^(src|app|server|api)\//.test(file) && !/\.(test|spec)\.[cm]?[jt]sx?$/.test(file) };

codacy-production · 2026-02-17T09:37:46Z

scripts/ci/require-tests-and-docs.mjs

+
+const isProdCode = (file) => /^(src|app|server|api)\//.test(file) && !/\.(test|spec)\.[cm]?[jt]sx?$/.test(file);
+const isTest = (file) => /^tests\//.test(file) || /\.(test|spec)\.[cm]?[jt]sx?$/.test(file);
+const isDoc = (file) => /^docs\//.test(file) || /^openapi\//.test(file) || file === 'README.md';


Codacy has a fix for the issue: ES2015 arrow function expressions are forbidden.

Suggested change

const isDoc = (file) => /^docs\//.test(file) || /^openapi\//.test(file) || file === 'README.md';

const isDoc = function(file) { return /^docs\//.test(file) || /^openapi\//.test(file) || file === 'README.md' };

codacy-production · 2026-02-17T09:37:47Z

scripts/perf/compare-metric.mjs

+    },
+    null,
+    2,
+  ),


Codacy has a fix for the issue: ES2017 trailing commas in parameter/argument lists are forbidden.

Suggested change

),

)

saagar210 added 9 commits February 16, 2026 20:33

fix(ci): pass GITHUB_TOKEN to gitleaks action

516c33f

- set GITHUB_TOKEN for gitleaks PR scans to satisfy current action requirements - keep secrets workflow deterministic under pull_request triggers Tests: not run (CI-only workflow change)

fix(ci): fetch full history for gitleaks PR scan

5cb3317

- set checkout fetch-depth to 0 for secrets job - avoid gitleaks commit-range resolution failures on shallow clones Tests: not run (CI-only workflow change)

fix(ci): pin workflow actions to immutable SHAs

e33563d

fix(repo): harden script process execution

b2ebdbe

fix(ci): harden workflow permissions and branch checks

d8da7cd

chore(repo): bootstrap codex os guardrails

fcfed6a

- install global git and performance baseline payload - add codex-os manifest and verification contracts - align repo with global policies under /Users/d/.codex/policies Tests: not run (bootstrap scaffolding only)

chatgpt-codex-connector bot reviewed Feb 17, 2026

View reviewed changes

github-advanced-security bot found potential problems Feb 17, 2026

View reviewed changes

saagar210 added 2 commits February 17, 2026 01:29

chore(repo): finalize codex os bootstrap baseline

d0a4244

chore(repo): finalize codex os bootstrap baseline

917997b

codacy-production bot reviewed Feb 17, 2026

View reviewed changes

@@ -5,6 +5,10 @@
               push:
                 branches: [main, master]
+            permissions:
+              contents: read
+              actions: write
             jobs:
               quality:
                 runs-on: ubuntu-latest

		@@ -0,0 +1,14 @@
		import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

		const readJson = (file) => (existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : null);

	const readJson = (file) => (existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : null);
	const readJson = function(file) { return (existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : null) };

	const isProdCode = (file) => /^(src\|app\|server\|api)\//.test(file) && !/\.(test\|spec)\.[cm]?[jt]sx?$/.test(file);
	const isProdCode = function(file) { return /^(src\|app\|server\|api)\//.test(file) && !/\.(test\|spec)\.[cm]?[jt]sx?$/.test(file) };

	const isDoc = (file) => /^docs\//.test(file) \|\| /^openapi\//.test(file) \|\| file === 'README.md';
	const isDoc = function(file) { return /^docs\//.test(file) \|\| /^openapi\//.test(file) \|\| file === 'README.md' };

+                  },
+                  null,
+,
+                ),

Conversation

saagar210 commented Feb 17, 2026

What

Why

Testing

Risk / Notes

Uh oh!

gemini-code-assist bot commented Feb 17, 2026

Uh oh!

codacy-production bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codacy's Analysis Summary

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Check warning

Copilot Autofix

sonarqubecloud bot commented Feb 17, 2026

Quality Gate failed

Uh oh!

codacy-production bot Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production bot Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production bot Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production bot Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production bot Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Comments

codacy-production bot commented Feb 17, 2026 •

edited

Loading