From 7eb6e54213414a424eea84d075d1044e8f6832fb Mon Sep 17 00:00:00 2001
From: Robby Cochran <rcochran@redhat.com>
Date: Fri, 18 Sep 2026 16:41:43 -0700
Subject: [PATCH] feat: enable Codex PR reviews

---
 .github/workflows/ai-review.yml |  9 +++++++--
 test/pr_review_test.go          | 11 +++++++++++
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml
index 7244a19..a8a5738 100644
--- a/.github/workflows/ai-review.yml
+++ b/.github/workflows/ai-review.yml
@@ -9,13 +9,18 @@ permissions:
 
 jobs:
   review:
-    uses: stackrox/harness-openshell/.github/workflows/pr-review-reusable.yml@83fe9cb5690fadbd9078ac3d46cf83bc5cf8c5f7
+    uses: stackrox/harness-openshell/.github/workflows/pr-review-reusable.yml@709f4cc1744e82b8dbea887fa72af98ca539dc6c
     with:
       # `uses` pins the workflow adapter; harness-ref pins the checked-out
       # Harness CLI/scripts. Keep both at the same release commit.
-      harness-ref: 83fe9cb5690fadbd9078ac3d46cf83bc5cf8c5f7
+      harness-ref: 709f4cc1744e82b8dbea887fa72af98ca539dc6c
       review-label: stackrox-ai-review
       allow-draft-reviews: false
+      review-agent: codex
+      codex-inference-provider: openai-inference
+      codex-model: gpt-5.6-luna
+      codex-workspace: codex-review
+      required-providers: '["github-review", "openai-inference"]'
       openshell-github-app-client-id: ${{ vars.OPENSHELL_GITHUB_APP_CLIENT_ID }}
     secrets:
       VERTEX_AI_SERVICE_ACCOUNT_KEY: ${{ secrets.VERTEX_AI_SERVICE_ACCOUNT_KEY }}
diff --git a/test/pr_review_test.go b/test/pr_review_test.go
index 1075e99..e697f60 100644
--- a/test/pr_review_test.go
+++ b/test/pr_review_test.go
@@ -302,6 +302,17 @@ func TestGitHubAppTokenIsHostOnly(t *testing.T) {
 	if reviewJob.With["harness-ref"] != pinnedRef {
 		t.Fatalf("caller harness-ref does not match workflow pin %q", pinnedRef)
 	}
+	for name, want := range map[string]string{
+		"review-agent":             "codex",
+		"codex-inference-provider": "openai-inference",
+		"codex-model":              "gpt-5.6-luna",
+		"codex-workspace":          "codex-review",
+		"required-providers":       `["github-review", "openai-inference"]`,
+	} {
+		if reviewJob.With[name] != want {
+			t.Fatalf("caller input %s = %q, want %q", name, reviewJob.With[name], want)
+		}
+	}
 	if reviewJob.With["openshell-github-app-client-id"] != "${{ vars.OPENSHELL_GITHUB_APP_CLIENT_ID }}" {
 		t.Fatal("caller does not pass the GitHub App client ID variable")
 	}