From f483e0317e4cae7e8d44c0d3c49fa31ec7b6e3b7 Mon Sep 17 00:00:00 2001 From: Ayrat Hudaygulov Date: Wed, 2 Sep 2026 12:25:18 +0100 Subject: [PATCH] CI: move codex network_access into trusted codex-home config openai/codex-action@v1 commit 86365089 rejects codex-args overrides of sandbox_workspace_write under safety-strategy: drop-sudo. Move the network_access setting into a committed .github/codex/config.toml and point the four agent workflows at it via the codex-home input. Co-Authored-By: Claude Code --- .github/codex/config.toml | 4 ++++ .github/workflows/_sre-agent.yml | 2 +- .github/workflows/monitor.yml | 2 +- .github/workflows/product.yml | 2 +- .github/workflows/project.yml | 2 +- 5 files changed, 8 insertions(+), 4 deletions(-) create mode 100644 .github/codex/config.toml diff --git a/.github/codex/config.toml b/.github/codex/config.toml new file mode 100644 index 00000000..75098fa2 --- /dev/null +++ b/.github/codex/config.toml @@ -0,0 +1,4 @@ +# Trusted by codex-action@v1 (not sanitized by its codex-args validation). +# Enables network inside the workspace-write sandbox for the agent workflows. +[sandbox_workspace_write] +network_access = true diff --git a/.github/workflows/_sre-agent.yml b/.github/workflows/_sre-agent.yml index 91d604ce..4ff60b09 100644 --- a/.github/workflows/_sre-agent.yml +++ b/.github/workflows/_sre-agent.yml @@ -95,7 +95,7 @@ jobs: sandbox: workspace-write safety-strategy: drop-sudo effort: high - codex-args: '--config sandbox_workspace_write.network_access=true' + codex-home: ${{ github.workspace }}/.github/codex prompt: | ${{ env.AGENT_PROMPT }} diff --git a/.github/workflows/monitor.yml b/.github/workflows/monitor.yml index 9f241a9d..b2d5db17 100644 --- a/.github/workflows/monitor.yml +++ b/.github/workflows/monitor.yml @@ -570,7 +570,7 @@ jobs: sandbox: workspace-write safety-strategy: drop-sudo effort: high - codex-args: '--config sandbox_workspace_write.network_access=true' + codex-home: ${{ github.workspace }}/.github/codex prompt: | ${{ env.AGENT_PROMPT }} diff --git a/.github/workflows/product.yml b/.github/workflows/product.yml index 7077b9c5..4e5a638d 100644 --- a/.github/workflows/product.yml +++ b/.github/workflows/product.yml @@ -299,7 +299,7 @@ jobs: sandbox: workspace-write safety-strategy: drop-sudo effort: medium - codex-args: '--config sandbox_workspace_write.network_access=true' + codex-home: ${{ github.workspace }}/.github/codex prompt: | ${{ env.AGENT_PROMPT }} diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml index 5a212a20..a56a8105 100644 --- a/.github/workflows/project.yml +++ b/.github/workflows/project.yml @@ -99,7 +99,7 @@ jobs: sandbox: workspace-write safety-strategy: drop-sudo effort: medium - codex-args: '--config sandbox_workspace_write.network_access=true' + codex-home: ${{ github.workspace }}/.github/codex prompt: | ${{ env.AGENT_PROMPT }}