fix: require scoped Codex auto-resolve command

.github/workflows/ci.yml

@@ -26,12 +26,12 @@ jobs:
   # Intended as a required status check on main together with ui-smoke,
   # Gitleaks, and one migration replay gate.
   verify:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 25
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -42,6 +42,9 @@ jobs:
           cache: npm
           cache-dependency-path: package-lock.json
 
+      - name: Workflow action pin check
+        run: npm run check:github-actions
+
       - name: Setup Deno
         uses: denoland/setup-deno@v2
         with:
@@ -99,12 +102,12 @@ jobs:
   # rerun does not repeat them. The runner boots its own dev server, so no
   # build step is needed here.
   ui-smoke:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 25
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -146,12 +149,12 @@ jobs:
   # required and reliable, keep this advisory or path-filtered rather than
   # requiring both replay gates on every PR.
   db-reset-verify:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -193,12 +196,12 @@ jobs:
   release-browser-matrix:
     if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')
     needs: [verify, ui-smoke, db-reset-verify]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 70
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 

.github/workflows/codex-autofix-review-comments.yml

@@ -16,7 +16,7 @@ concurrency:
 jobs:
   request-codex-autoresolve:
     name: Request Codex auto-resolve
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: >
       github.event.pull_request.state == 'open' &&
       contains(github.event.comment.user.login, 'chatgpt-codex-connector')
@@ -38,7 +38,7 @@ jobs:
             if (
               sourceBody.includes("codex-autoresolve:") ||
               sourceBody.includes("codex-autoresolve-pr:") ||
-              sourceBody.includes("@codex resolve all review comments")
+              sourceBody.includes("@codex resolve actionable Codex review findings for this pull request and current head")
             ) {
               core.notice("Skipping Codex auto-resolve request because the source comment already looks like an auto-resolve request.");
               return;
@@ -75,7 +75,7 @@ jobs:
             const prompt = [
               marker,
               `<!-- codex-autoresolve-source-review-comment:${reviewComment.id} -->`,
-              "@codex resolve all review comments using the repository instructions. Always fix P0 and P1 findings. For P2 and lower findings, decide whether each is worth fixing automatically. Fix clear, scoped, low-risk issues with the best minimal change; otherwise reply explaining why the issue is deferred or not actionable. After each fix or decision, resolve the review conversation if supported. Do not use external APIs, paid services, credentials, dependency changes, or broad refactors unless explicitly authorized. Add targeted tests where behavior changes and run the narrowest relevant validation.",
+              "@codex resolve actionable Codex review findings for this pull request and current head using the repository instructions. Always fix P0 and P1 findings. For P2 and lower findings, decide whether each is worth fixing automatically. Fix clear, scoped, low-risk issues with the best minimal change; otherwise reply explaining why the issue is deferred or not actionable. Do not update the branch from main, address unrelated reviews, broaden scope, or create more than one scoped fix commit unless explicitly asked. After each fix or decision, resolve the review conversation if supported. Do not use external APIs, paid services, credentials, dependency changes, or broad refactors unless explicitly authorized. Add targeted tests where behavior changes and run the narrowest relevant validation.",
             ].join("\n\n");
 
             try {

.github/workflows/docker-image.yml

@@ -47,11 +47,11 @@ permissions:
 
 jobs:
   app-image:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -72,11 +72,11 @@ jobs:
             NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=placeholder-ci-publishable-key
 
   worker-image:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 

.github/workflows/eval-canary.yml

@@ -55,12 +55,12 @@ env:
 
 jobs:
   eval-canary:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 

.github/workflows/live-drift.yml

@@ -23,12 +23,12 @@ env:
 
 jobs:
   live-drift:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 

.github/workflows/sast.yml

@@ -24,13 +24,13 @@ jobs:
   # the merge. Runs OSS-engine only — no Semgrep account or token required.
   semgrep:
     name: Semgrep
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     container:
       image: semgrep/semgrep:1.168.0
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 

.github/workflows/secret-scan.yml

@@ -20,11 +20,11 @@ permissions:
 jobs:
   gitleaks:
     name: Gitleaks
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
           persist-credentials: false

.github/workflows/summary.yml

@@ -10,7 +10,7 @@ concurrency:
 
 jobs:
   summary:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     permissions:
       issues: write
@@ -49,7 +49,7 @@ jobs:
 
       - name: Comment with AI summary
         if: github.event.issue.state == 'open'
-        uses: peter-evans/create-or-update-comment@v6
+        uses: peter-evans/create-or-update-comment@v5
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           issue-number: ${{ github.event.issue.number }}

package.json

@@ -22,10 +22,11 @@
     "test:e2e:accessibility": "node scripts/run-playwright.mjs tests/ui-accessibility.spec.ts --project=chromium",
     "test:e2e:chromium": "node scripts/run-playwright.mjs --project=chromium",
     "test:e2e:visual": "node scripts/run-playwright.mjs --config=playwright.visual.config.ts",
-    "verify:cheap": "npm run check:runtime && npm run sitemap:check && npm run lint && npm run typecheck && npm run test",
+    "verify:cheap": "npm run check:runtime && npm run check:github-actions && npm run sitemap:check && npm run lint && npm run typecheck && npm run test",
     "verify:ui": "npm run check:runtime && npm run test:e2e:chromium",
     "verify:release": "npm run check:runtime && npm run lint && npm run typecheck && npm run test && npm run build && npm run test:e2e && npm run check:production-readiness && npm run governance:release && npm run eval:quality:release",
     "ci:env-check": "node scripts/check-ci-env.mjs",
+    "check:github-actions": "node scripts/check-github-action-pins.mjs",
     "sitemap:update": "tsx scripts/generate-site-map.ts",
     "sitemap:check": "tsx scripts/generate-site-map.ts --check",
     "check:runtime": "tsx scripts/check-runtime.ts",

scripts/check-codex-autofix-workflow.mjs

@@ -4,6 +4,8 @@ const workflowPath = ".github/workflows/codex-autofix-review-comments.yml";
 const workflow = fs.readFileSync(workflowPath, "utf8");
 
 const failures = [];
+const scopedResolveCommand = "@codex resolve actionable Codex review findings for this pull request and current head";
+const scopedResolvePrompt = `${scopedResolveCommand} using the repository instructions. Always fix P0 and P1 findings. For P2 and lower findings, decide whether each is worth fixing automatically. Fix clear, scoped, low-risk issues with the best minimal change; otherwise reply explaining why the issue is deferred or not actionable. Do not update the branch from main, address unrelated reviews, broaden scope, or create more than one scoped fix commit unless explicitly asked. After each fix or decision, resolve the review conversation if supported. Do not use external APIs, paid services, credentials, dependency changes, or broad refactors unless explicitly authorized. Add targeted tests where behavior changes and run the narrowest relevant validation.`;
 
 const forbiddenPatterns = [
   {
@@ -22,6 +24,10 @@ const forbiddenPatterns = [
     pattern: /^\s*pull_request_review:/m,
     message: "Do not trigger Codex auto-resolve from whole pull_request_review events.",
   },
+  {
+    pattern: /@codex resolve all review comments/,
+    message: "Do not use the broad Codex resolve-all command; use the scoped actionable-findings command.",
+  },
 ];
 
 for (const { pattern, message } of forbiddenPatterns) {
@@ -38,8 +44,12 @@ if (!workflow.includes("codex-autoresolve-pr:${pr.number}")) {
   failures.push("Codex auto-resolve marker must be scoped to the pull request, not the head SHA.");
 }
 
-if (!workflow.includes('sourceBody.includes("@codex resolve all review comments")')) {
-  failures.push("Codex auto-resolve workflow must skip comments that already look like resolve requests.");
+if (!workflow.includes(`sourceBody.includes("${scopedResolveCommand}")`)) {
+  failures.push("Codex auto-resolve workflow must skip comments that already look like scoped resolve requests.");
+}
+
+if (!workflow.includes(`"${scopedResolvePrompt}"`)) {
+  failures.push("Codex auto-resolve workflow must emit the scoped actionable-findings resolve prompt.");
 }
 
 if (failures.length > 0) {

scripts/check-github-action-pins.mjs

@@ -0,0 +1,65 @@
+import { readdirSync, readFileSync } from "node:fs";
+import path from "node:path";
+
+const workflowDir = path.join(process.cwd(), ".github", "workflows");
+
+const supportedMajorRanges = new Map([
+  [
+    "actions/checkout",
+    {
+      min: 4,
+      max: 6,
+      reason:
+        "v6 is the currently supported and documented major that this repo has vetted; upgrading to v7 should be a deliberate, reviewed decision.",
+    },
+  ],
+  [
+    "peter-evans/create-or-update-comment",
+    {
+      min: 5,
+      max: 5,
+      reason: "create-or-update-comment v6 is not a documented published major for this workflow.",
+    },
+  ],
+]);
+
+const usesPattern = /^\s*uses:\s*([^@\s]+)@v(\d+)\s*(?:#.*)?$/;
+const runsOnLatestPattern = /^\s*runs-on:\s*ubuntu-latest\s*(?:#.*)?$/;
+const failures = [];
+
+for (const fileName of readdirSync(workflowDir)
+  .filter((name) => /\.ya?ml$/i.test(name))
+  .sort()) {
+  const filePath = path.join(workflowDir, fileName);
+  const lines = readFileSync(filePath, "utf8").split(/\r?\n/);
+
+  lines.forEach((line, index) => {
+    if (runsOnLatestPattern.test(line)) {
+      failures.push(
+        `${fileName}:${index + 1}: runs-on uses ubuntu-latest. Pin GitHub-hosted Linux jobs to ubuntu-24.04 so CI is not tied to the moving ubuntu-latest alias.`,
+      );
+    }
+
+    const match = line.match(usesPattern);
+    if (!match) return;
+
+    const [, action, rawMajor] = match;
+    const range = supportedMajorRanges.get(action);
+    if (!range) return;
+
+    const major = Number(rawMajor);
+    if (!Number.isInteger(major) || major < range.min || major > range.max) {
+      failures.push(
+        `${fileName}:${index + 1}: ${action}@v${rawMajor} is outside supported range v${range.min}-v${range.max}. ${range.reason}`,
+      );
+    }
+  });
+}
+
+if (failures.length > 0) {
+  console.error("GitHub Actions pin check failed:");
+  for (const failure of failures) console.error(`- ${failure}`);
+  process.exit(1);
+}
+
+console.log("GitHub Actions pin check passed.");