ci: Require admin approval for large PR reviews #47

Background

The shared reviewer now enforces a 100,000,000-byte complete-diff ceiling. Its automatic pull_request_target path and public @codex review comment path can otherwise make an external contributor trigger hundreds of sequential review chunks. The caller repository needs a bounded automatic path and an explicit admin decision for larger diffs, with policy implemented once in the reusable workflow.

Goal

Automatically review complete PR diffs up to 5,000,000 bytes. For a diff above 5,000,000 and no more than 100,000,000 bytes, start model work only when a repository admin posts an unquoted @codex review approve <current 40-character head SHA> comment on that PR. Verify admin permission in the caller repository and match the exact live head. Keep existing caller workflows and their review inputs compatible across organizations and personal repositories.

Non-goals

Do not add GitHub Environment approval, change repository settings or plans, execute fork code, grant comment authors access to secrets, or make a previous approval carry over to another head commit. The existing 100,000,000-byte total ceiling remains.

Code Changes Tree

.github/
├── workflows/
│   └── codex-openai-review.yml       # verify current-head admin request in the caller repo and pass approval state to diff preparation
└── scripts/
    ├── review-request/
    │   ├── common.mjs                # recognize an unquoted, explicit approval command with an exact head SHA
    │   └── test.mjs                  # cover valid, quoted, stale, malformed and non-admin approval conditions
    └── pr-review/
        ├── prepare.mjs               # reject over-5MB automatic diffs before model execution while preserving the 100MB hard cap
        └── test.mjs                  # exercise automatic rejection, approved continuation and workflow policy wiring
README.md                             # document the threshold, admin comment command, head binding and cross-repository behavior

Design

The trusted resolve job determines the live PR head and recognizes an approval command only on an issue_comment review request. It asks GitHub for the comment author's permission on the caller repository, accepts only admin, and compares the command SHA to the live PR head. The resulting boolean is an output of the trusted resolve job, never an untrusted caller input. The diff preparation step measures the same complete merge-base diff used for review: above 100,000,000 bytes always fails; above 5,000,000 bytes without the trusted approval fails before Codex bootstrap. A new commit changes the required SHA. Existing @codex review comments continue to request reviews within the automatic size bound. If GitHub cannot establish permission, fail closed.

Test And Acceptance Criteria

Acceptance Criteria

• Diffs at or below 5,000,000 bytes keep the existing automatic path.
• Diffs above 5,000,000 bytes do not invoke Codex until an admin of the caller repository requests review for the current head with the explicit command.
• A writer without admin access, a quoted or malformed command, or a command for an older SHA does not approve large diff review.
• Diffs above 100,000,000 bytes always fail, even with admin approval.
• Existing caller YAML needs no new environment, secret, event or permission configuration.

Validation

Run the review-request and pr-review tests, pr-readiness and issue-review tests, actionlint, and git diff --check. Verify the PR's native same-repository closing-Issue relationship and the current-head CI checks.