feat: harden Codex runtime and automate edge updates - #14
Conversation
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
|
Warning Review limit reached
Next review available in: 35 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (9)
WalkthroughThe PR adds daily stable-upstream automation with synchronized Codex pins, automatic edge publishing triggers, bubblewrap installation and verification, persistent credential permission hardening, tmux configuration, and updated release documentation. ChangesRelease and runtime hardening
Estimated code review effort: 3 (Moderate) | ~30 minutes Sequence Diagram(s)sequenceDiagram
participant UpstreamWorkflow as check-upstream workflow
participant Releases as GitHub Releases
participant VersionPins as version pins
participant AutomationPR as automation pull request
participant EdgeWorkflow as publish-edge-amd64 workflow
UpstreamWorkflow->>Releases: detect stable upstream versions
UpstreamWorkflow->>VersionPins: synchronize versions.env and Codex Dockerfile
UpstreamWorkflow->>AutomationPR: update or create pull request
AutomationPR->>EdgeWorkflow: merge to main triggers edge publication
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 280d1dd59f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/check-upstream.yml:
- Around line 32-35: Validate latest_gh, latest_ttyd, and latest_mise against
the exact tag formats expected by their consumers before writing them to
versions.env, alongside the existing latest_codex validation. Ensure the
versions.env write path safely escapes validated values, or change both
workflows that source it to parse the file as data rather than executable shell;
do not write raw gh api output.
- Around line 40-52: Update the existing-update-PR early-exit logic around the
versions.env comparisons to also inspect the branch’s images/codex/Dockerfile
pin and compare it with the latest Codex release. Only exit when both
versions.env and the Dockerfile are current; otherwise allow the existing
validation or repair flow to run.
In `@images/base/Dockerfile`:
- Line 49: Pin the bubblewrap dependency in the Dockerfile by defining an exact
package version alongside the existing runtime version pins and installing that
version explicitly in the apt package list. Keep the current package
installation flow unchanged apart from replacing the unversioned bubblewrap
entry.
In `@scripts/secure-persistent-state.sh`:
- Around line 32-41: Update the SSH permission logic around secure_file and the
public-key loop to apply 0600 to every non-public id_* file, including ECDSA,
FIDO-backed, and other private key types, while preserving 0644 for *.pub files.
Also add conditional 0600 handling for /root/.ssh/config when present.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: e8ad6b40-2e4d-466b-908f-0b298cdc1310
📒 Files selected for processing (16)
.github/workflows/check-upstream.yml.github/workflows/publish-edge-amd64.ymlCHANGELOG.mdconfig/tmux.confdocs/releases.mdimages/base/Dockerfileimages/codex/Dockerfilescripts/base-verify.shscripts/codex-doctor.shscripts/codex-menu.shscripts/runtime-smoke-test.shscripts/secure-persistent-state.shscripts/smoke-test.shscripts/start-codex-web.shscripts/validate-version-pins.shversions.env
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: build
🧰 Additional context used
📓 Path-based instructions (4)
scripts/**/*.sh
⚙️ CodeRabbit configuration file
scripts/**/*.sh: Review as production Bash. Check quoting, set -euo pipefail behavior, cleanup traps,
bounded retries and timeouts, non-interactive execution, idempotency and useful failure messages.
Flag commands that can hang, leak credentials, silently ignore failures or mutate persistent data unexpectedly.
Files:
scripts/smoke-test.shscripts/base-verify.shscripts/codex-menu.shscripts/validate-version-pins.shscripts/runtime-smoke-test.shscripts/secure-persistent-state.shscripts/codex-doctor.shscripts/start-codex-web.sh
.github/workflows/**
⚙️ CodeRabbit configuration file
.github/workflows/**: Review GitHub Actions for least-privilege permissions, safe event triggers, untrusted input handling,
accidental publication, tag-channel correctness, secret exposure, reproducible builds, SBOM/provenance
generation and appropriate validation before pushing images.
Files:
.github/workflows/publish-edge-amd64.yml.github/workflows/check-upstream.yml
**/*.md
⚙️ CodeRabbit configuration file
**/*.md: Check that documentation matches the implemented behavior and clearly distinguishes experimental edge builds
from stable releases. Flag outdated versions, unsafe deployment guidance and claims not proven by CI or testing.
Files:
docs/releases.mdCHANGELOG.md
images/**/Dockerfile
⚙️ CodeRabbit configuration file
images/**/Dockerfile: Review for reproducibility, supply-chain security and minimal image growth.
Require pinned upstream versions and checksum or digest verification for downloaded binaries.
Flag secrets, floating base tags, unsafe remote-script execution, broken multi-architecture logic,
cache misuse, unnecessary packages and changes that weaken the secure-by-default runtime.
Files:
images/base/Dockerfileimages/codex/Dockerfile
🔇 Additional comments (17)
images/base/Dockerfile (1)
153-157: LGTM!scripts/base-verify.sh (1)
4-4: LGTM!Also applies to: 31-31
scripts/codex-doctor.sh (1)
27-47: LGTM!Also applies to: 85-85
scripts/runtime-smoke-test.sh (1)
39-39: LGTM!Also applies to: 48-50
scripts/smoke-test.sh (1)
19-19: LGTM!scripts/secure-persistent-state.sh (1)
1-31: LGTM!Also applies to: 40-42
scripts/start-codex-web.sh (1)
6-6: LGTM!Also applies to: 20-20
scripts/codex-menu.sh (1)
21-53: LGTM!config/tmux.conf (1)
1-5: LGTM!scripts/validate-version-pins.sh (1)
9-9: LGTM!Also applies to: 31-52
versions.env (1)
1-7: LGTM!images/codex/Dockerfile (1)
6-6: LGTM!Also applies to: 53-69
.github/workflows/check-upstream.yml (1)
5-5: LGTM!Also applies to: 37-39, 60-66, 67-73, 74-93
.github/workflows/publish-edge-amd64.yml (2)
4-13: 🗄️ Data Integrity & IntegrationVerify that automatic publication is gated by required checks.
The new
pushtrigger starts this workflow for any matchingmaincommit, while the supplied workflow does not check AMD64/runtime/review statuses beforepush: true. If branch protection is the intended gate, make those checks mandatory and block direct writes tomain; otherwise add an explicit status or workflow gate.As per path instructions, “Review GitHub Actions for … appropriate validation before pushing images.”
Source: Path instructions
74-120: LGTM!docs/releases.md (1)
7-7: LGTM!Also applies to: 19-20
CHANGELOG.md (1)
17-25: LGTM!Also applies to: 34-37, 40-50
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7768861edb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9fd070288e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 58fbd9b231
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| chmod 700 /root/.ssh 2>/dev/null || true | ||
| chmod 600 /root/.ssh/id_ed25519 /root/.ssh/id_rsa 2>/dev/null || true | ||
| chmod 644 /root/.ssh/*.pub /root/.ssh/known_hosts 2>/dev/null || true | ||
| /usr/local/bin/secure-persistent-state |
There was a problem hiding this comment.
When a deployment uses the supported START_MODE=codex or START_MODE=shell, this hardening runs only during container startup; the tmux commands at lines 65–69 still exec Codex or Bash without invoking secure-persistent-state afterward. On hosts with the permissive dataset ACL described by this change, a token refresh or codex login from those modes can therefore leave auth.json group-readable until the whole container restarts. The fresh wrapper fix is confined to codex-menu.sh, so wrap the direct start-mode commands with the same post-session hardening.
Useful? React with 👍 / 👎.
1 participant
What changed
0.144.4to stable0.145.0.bubblewrapand report whether the outer host permits a nested Codex sandbox.main.Why
TrueNAS validation found three concrete issues:
bubblewrapwas missing, so even read-only commands required approval outside the sandbox.auth.jsonto be created with mode770until corrected manually.Codex also reported stable
0.145.0while the image remained pinned to0.144.4.Nested sandbox boundary
The image now contains Ubuntu's pinned
bubblewrappackage, but a sandbox inside Docker also depends on the outer host allowing the required user namespaces and AppArmor behavior. GitHub Actions blocks that namespace creation even though the package is correctly installed. The runtime test therefore verifies the binary, reports the compatibility result, and keepsno-new-privileges; it does not add privileged mode,SYS_ADMINor an unconfined seccomp profile merely to force the probe green. The final behavior must be tested on the target TrueNAS host.Update policy
The updater consumes GitHub's
releases/latestendpoint and validates every external tag against an exact expected stable format before writing it. Updates open or recover a pull request; they are never merged or published silently. Build AMD64 is explicitly dispatched for the automation branch so it does not depend on approval-gated pull-request events created byGITHUB_TOKEN, and failed or cancelled validations are retried. After the required build and review pass and the PR is merged, only the public experimental edge channel is rebuilt automatically. Stable and latest project tags remain release-tag controlled.Validation
bash -n, version-pin validation and Compose validation).9fd070288e2cb1fd2d851c3048f53b426d86c012(run chore: update stable upstream versions and runtime lock #52).Security
0700; sensitive files are set to0600when present.id_*key and SSH config is hardened.no-new-privilegesremains enabled.