fix: throttle Codex auto-resolve workflow

.github/workflows/codex-autofix-review-comments.yml

@@ -10,7 +10,7 @@ permissions:
   pull-requests: read
 
 concurrency:
-  group: codex-autoresolve-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}
+  group: codex-autoresolve-${{ github.event.pull_request.number }}
   cancel-in-progress: false
 
 jobs:
@@ -34,10 +34,20 @@ jobs:
               return;
             }
 
+            const sourceBody = reviewComment.body || "";
+            if (
+              sourceBody.includes("codex-autoresolve:") ||
+              sourceBody.includes("codex-autoresolve-pr:") ||
+              sourceBody.includes("@codex resolve all review comments")
+            ) {
+              core.notice("Skipping Codex auto-resolve request because the source comment already looks like an auto-resolve request.");
+              return;
+            }
+
             const owner = context.repo.owner;
             const repo = context.repo.repo;
             const issue_number = pr.number;
-            const marker = `<!-- codex-autoresolve:${pr.head.sha} -->`;
+            const marker = `<!-- codex-autoresolve-pr:${pr.number} -->`;
 
             const existingComments = await github.paginate(github.rest.issues.listComments, {
               owner,
@@ -47,7 +57,7 @@ jobs:
             });
 
             if (existingComments.some((comment) => (comment.body || "").includes(marker))) {
-              core.notice("Skipping duplicate Codex auto-resolve request for this PR head commit.");
+              core.notice("Skipping duplicate Codex auto-resolve request for this pull request.");
               return;
             }
 
@@ -57,9 +67,17 @@ jobs:
               "@codex resolve all review comments using the repository instructions. Always fix P0 and P1 findings. For P2 and lower findings, decide whether each is worth fixing automatically. Fix clear, scoped, low-risk issues with the best minimal change; otherwise reply explaining why the issue is deferred or not actionable. After each fix or decision, resolve the review conversation if supported. Do not use external APIs, paid services, credentials, dependency changes, or broad refactors unless explicitly authorized. Add targeted tests where behavior changes and run the narrowest relevant validation.",
             ].join("\n\n");
 
-            await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number,
-              body: prompt,
-            });
+            try {
+              await github.rest.issues.createComment({
+                owner,
+                repo,
+                issue_number,
+                body: prompt,
+              });
+            } catch (error) {
+              if (error.status === 403) {
+                core.warning("Skipping Codex auto-resolve request because this workflow token cannot comment on the pull request.");
+                return;
+              }
+              throw error;
+            }

AGENTS.md

@@ -338,9 +338,9 @@ When explicitly asked to fix or resolve review findings:
 Automatic Codex review is review-only by default. This repository includes `.github/workflows/codex-autofix-review-comments.yml`, which requests the resolve task automatically after Codex posts a top-level review comment.
 
 - The workflow must only trigger from Codex review bot comments on open pull requests.
-- The workflow must skip review-thread replies so Codex fix summaries do not re-trigger the workflow.
+- The workflow must skip review-thread replies and auto-resolve request comments so Codex fix summaries do not re-trigger the workflow.
 - The workflow must ask Codex to resolve all review comments using these repository instructions.
-- The workflow must avoid duplicate requests for the same pull request head commit.
+- The workflow must avoid duplicate requests for the same pull request, even after follow-up commits change the head SHA.
 - The workflow must not run Codex directly with API credentials.
 - P0 and P1 findings should always be fixed.
 - P2 and lower findings should be fixed only when clear, scoped, low-risk, and testable; otherwise explain the decision and resolve or mark ready for human resolution.