chore(ci): bump openai/codex-action from 1.11 to 1.12 - #6541
chore(ci): bump openai/codex-action from 1.11 to 1.12#6541dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [openai/codex-action](https://github.com/openai/codex-action) from 1.11 to 1.12. - [Changelog](https://github.com/openai/codex-action/blob/main/CHANGELOG.md) - [Commits](openai/codex-action@52fe01e...8636508) --- updated-dependencies: - dependency-name: openai/codex-action dependency-version: '1.12' dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![supabase-cli-releaser[bot]](https://avatars.githubusercontent.com/u/54469796?s=60&v=4){kind=small}
![depthfirst-app[bot]](https://avatars.githubusercontent.com/in/1021002?s=60&v=4){kind=small}
| # released fix above v1.12 as of 2026-09-09; re-verify both issues | ||
| # are closed before ever re-bumping this pin. | ||
| uses: &codex-action-pin openai/codex-action@52fe01ec70a42f454c9d2ebd47598f9fd6893d56 # v1.11 | ||
| uses: &codex-action-pin openai/codex-action@86365089eb2b84e0a8fb0717b304f8bdcb13b20e # v1.11 |
There was a problem hiding this comment.
⚪ Severity: LOW
The added SHA is the v1.12 release, not v1.11 as the inline annotation and surrounding security rationale state. This silently changes the privileged action wrapper used with untrusted PR content and OPENAI_API_KEY; the v1.11 isolation audit no longer applies, leaving a plausible path for a wrapper regression to expose the key.
Helpful? Add 👍 / 👎
💡 Fix Suggestion
Suggestion: Revert the SHA on line 347 back to the v1.11 SHA (52fe01ec70a42f454c9d2ebd47598f9fd6893d56). The PR accidentally bumped the pin to v1.12 (86365089eb2b84e0a8fb0717b304f8bdcb13b20e), which the surrounding comments (lines 330–346) explicitly forbid due to two confirmed upstream regressions (openai/codex-action#151 and #160) that hang or kill the job under this workflow's exact configuration. The dependabot.yml ignore entry for openai/codex-action exists precisely to prevent this bump, but it was overridden here.
⚠️ Experimental Feature: This code suggestion is automatically generated. Please review carefully.
| uses: &codex-action-pin openai/codex-action@86365089eb2b84e0a8fb0717b304f8bdcb13b20e # v1.11 | |
| uses: &codex-action-pin openai/codex-action@52fe01ec70a42f454c9d2ebd47598f9fd6893d56 # v1.11 |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
…ase#6542) ## What kind of change does this PR introduce? CI reliability fix (follow-up to supabase#6538). ## What is the current behavior? supabase#6538 re-pinned `openai/codex-action` to v1.11 and added a Dependabot ignore entry scoped to `versions: ["1.12.x"]`, intending to still let Dependabot propose v1.13+ once the upstream hang bugs (openai/codex-action#151, supabase#160) are fixed, while blocking the known-bad v1.12 line specifically. That scoping never actually worked. 9 minutes after supabase#6538 merged, Dependabot opened supabase#6541 proposing the exact v1.12 bump we were trying to block — config propagation wasn't the issue; the `versions` syntax was. The `github-actions` ecosystem's `ignore.versions` strings are parsed as Ruby `Gem::Requirement` (RubyGems comparator syntax: `>= x`, `~> x`, etc.), not npm-style semver ranges. `"1.12.x"` isn't a wildcard in that grammar — it parses as a literal version string with an implicit `=` operator, which never equals the real dependency version (`"1.12"`), so the ignore condition silently never matched anything. Verified directly against the actual parsing logic dependabot-core uses (`Dependabot::GithubActions::Requirement`, a thin wrapper around `Gem::Requirement`): ``` GithubActionsRequirement.new("1.12.x").satisfied_by?(Gem::Version.new("1.12")) # => false (bug) GithubActionsRequirement.new(">= 1.12, < 1.13").satisfied_by?(Gem::Version.new("1.12")) # => true GithubActionsRequirement.new(">= 1.12, < 1.13").satisfied_by?(Gem::Version.new("1.12.5")) # => true GithubActionsRequirement.new(">= 1.12, < 1.13").satisfied_by?(Gem::Version.new("1.11")) # => false GithubActionsRequirement.new(">= 1.12, < 1.13").satisfied_by?(Gem::Version.new("1.13")) # => false ``` ## What is the new behavior? Replace `versions: ["1.12.x"]` with `versions: [">= 1.12, < 1.13"]` — a real Gem::Requirement comparator range, confirmed to correctly match the 1.12 line (including any 1.12.x patch) while excluding v1.11 and v1.13+. supabase#6541 should be closed as superseded once this merges.
1 participant
Bumps openai/codex-action from 1.11 to 1.12.
Changelog
Sourced from openai/codex-action's changelog.
... (truncated)
Commits
8636508fix: improve runner setup and configuration handlingc385816Retry network errors/transient HTTP errors in GitHub API requests (#128)dd78cb6docs: update CHANGELOG for v1.11 (#117)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)