From ab3a5899de7702b32cb79875308f832dc747fab3 Mon Sep 17 00:00:00 2001
From: Carlos Polop <carlospolop@gmail.com>
Date: Wed, 21 Jan 2026 01:04:06 +0100
Subject: [PATCH] Gate codex fixer job on PR author

---
 .../workflows/pr-failure-codex-dispatch.yml   | 51 ++++++++++---------
 1 file changed, 28 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/pr-failure-codex-dispatch.yml b/.github/workflows/pr-failure-codex-dispatch.yml
index a197efd..28de88c 100644
--- a/.github/workflows/pr-failure-codex-dispatch.yml
+++ b/.github/workflows/pr-failure-codex-dispatch.yml
@@ -6,7 +6,7 @@ on:
     types: [completed]
 
 jobs:
-  codex_on_failure:
+  resolve_pr_context:
     if: >
       ${{ github.event.workflow_run.conclusion == 'failure' &&
           github.event.workflow_run.pull_requests &&
@@ -14,11 +14,14 @@ jobs:
           !startsWith(github.event.workflow_run.head_commit.message, 'Fix CI failures for PR #') }}
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      pull-requests: write
-      issues: write
-      actions: read
-
+      pull-requests: read
+      issues: read
+    outputs:
+      number: ${{ steps.pr_context.outputs.number }}
+      author: ${{ steps.pr_context.outputs.author }}
+      head_repo: ${{ steps.pr_context.outputs.head_repo }}
+      head_branch: ${{ steps.pr_context.outputs.head_branch }}
+      should_run: ${{ steps.pr_context.outputs.should_run }}
     steps:
       - name: Resolve PR context
         id: pr_context
@@ -52,11 +55,20 @@ jobs:
             echo "should_run=${should_run}"
           } >> "$GITHUB_OUTPUT"
 
+  codex_on_failure:
+    needs: resolve_pr_context
+    if: ${{ needs.resolve_pr_context.outputs.author == 'carlospolop' && needs.resolve_pr_context.outputs.should_run == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+      actions: read
+    steps:
       - name: Comment on PR with failure info
-        if: ${{ steps.pr_context.outputs.author == 'carlospolop' && steps.pr_context.outputs.should_run == 'true' }}
         uses: actions/github-script@v7
         env:
-          PR_NUMBER: ${{ steps.pr_context.outputs.number }}
+          PR_NUMBER: ${{ needs.resolve_pr_context.outputs.number }}
           RUN_URL: ${{ github.event.workflow_run.html_url }}
           WORKFLOW_NAME: ${{ github.event.workflow_run.name }}
         with:
@@ -72,9 +84,8 @@ jobs:
             });
 
       - name: Mark fix attempt
-        if: ${{ steps.pr_context.outputs.author == 'carlospolop' && steps.pr_context.outputs.should_run == 'true' }}
         env:
-          PR_NUMBER: ${{ steps.pr_context.outputs.number }}
+          PR_NUMBER: ${{ needs.resolve_pr_context.outputs.number }}
           GH_TOKEN: ${{ github.token }}
         run: |
           gh api -X POST -H "Accept: application/vnd.github+json" \
@@ -82,23 +93,20 @@ jobs:
             -f labels='["codex-fix-attempted"]'
 
       - name: Checkout PR head
-        if: ${{ steps.pr_context.outputs.author == 'carlospolop' && steps.pr_context.outputs.should_run == 'true' }}
         uses: actions/checkout@v5
         with:
-          repository: ${{ steps.pr_context.outputs.head_repo }}
+          repository: ${{ needs.resolve_pr_context.outputs.head_repo }}
           ref: ${{ github.event.workflow_run.head_sha }}
           fetch-depth: 0
           persist-credentials: true
           token: ${{ secrets.CODEX_FIXER_TOKEN }}
 
       - name: Configure git author
-        if: ${{ steps.pr_context.outputs.author == 'carlospolop' && steps.pr_context.outputs.should_run == 'true' }}
         run: |
           git config user.name "codex-action"
           git config user.email "codex-action@users.noreply.github.com"
 
       - name: Fetch failure summary
-        if: ${{ steps.pr_context.outputs.author == 'carlospolop' && steps.pr_context.outputs.should_run == 'true' }}
         env:
           GH_TOKEN: ${{ github.token }}
           RUN_ID: ${{ github.event.workflow_run.id }}
@@ -126,11 +134,10 @@ jobs:
           PY
 
       - name: Create Codex prompt
-        if: ${{ steps.pr_context.outputs.author == 'carlospolop' && steps.pr_context.outputs.should_run == 'true' }}
         env:
-          PR_NUMBER: ${{ steps.pr_context.outputs.number }}
+          PR_NUMBER: ${{ needs.resolve_pr_context.outputs.number }}
           RUN_URL: ${{ github.event.workflow_run.html_url }}
-          HEAD_BRANCH: ${{ steps.pr_context.outputs.head_branch }}
+          HEAD_BRANCH: ${{ needs.resolve_pr_context.outputs.head_branch }}
         run: |
           {
             echo "You are fixing CI failures for PR #${PR_NUMBER} in ${{ github.repository }}."
@@ -146,7 +153,6 @@ jobs:
           } > codex_prompt.txt
 
       - name: Run Codex
-        if: ${{ steps.pr_context.outputs.author == 'carlospolop' && steps.pr_context.outputs.should_run == 'true' }}
         id: run_codex
         uses: openai/codex-action@v1
         with:
@@ -156,10 +162,9 @@ jobs:
           model: gpt-5.2-codex
 
       - name: Commit and push if changed
-        if: ${{ steps.pr_context.outputs.author == 'carlospolop' && steps.pr_context.outputs.should_run == 'true' }}
         env:
-          TARGET_BRANCH: ${{ steps.pr_context.outputs.head_branch }}
-          PR_NUMBER: ${{ steps.pr_context.outputs.number }}
+          TARGET_BRANCH: ${{ needs.resolve_pr_context.outputs.head_branch }}
+          PR_NUMBER: ${{ needs.resolve_pr_context.outputs.number }}
         run: |
           if git diff --quiet; then
             echo "No changes to commit."
@@ -172,10 +177,10 @@ jobs:
           git push origin HEAD:${TARGET_BRANCH}
 
       - name: Comment with Codex result
-        if: ${{ steps.pr_context.outputs.author == 'carlospolop' && steps.pr_context.outputs.should_run == 'true' && steps.run_codex.outputs.final-message != '' }}
+        if: ${{ steps.run_codex.outputs.final-message != '' }}
         uses: actions/github-script@v7
         env:
-          PR_NUMBER: ${{ steps.pr_context.outputs.number }}
+          PR_NUMBER: ${{ needs.resolve_pr_context.outputs.number }}
           CODEX_MESSAGE: ${{ steps.run_codex.outputs.final-message }}
         with:
           github-token: ${{ github.token }}