Codex CLI 接入 CI/CD：GitHub Actions 与自动化实战

name: Codex Automation Task

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  codex-task:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 2  # 获取足够的提交历史

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Install Codex CLI
        run: npm install -g @openai/codex

      - name: Run Codex Task
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
        run: |
          codex exec --model gpt-4.1-mini \
            "分析本次 PR 中的代码变更，列出潜在的 Bug、性能问题和代码风格问题"

name: Auto Generate CHANGELOG

on:
  push:
    branches: [main]

jobs:
  changelog:
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - uses: actions/setup-node@v4
        with:
          node-version: '22'

      - run: npm install -g @openai/codex

      - name: Generate CHANGELOG entry
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
        run: |
          codex exec --model gpt-4.1-mini "读取 git diff HEAD~1 的内容，用中文生成一条简洁的 CHANGELOG 条目（格式：## vX.X.X - YYYY-MM-DD 开头，后跟变更列表），追加到 CHANGELOG.md 末尾，不要删除已有内容"

      - name: Commit CHANGELOG update
        run: |
          git config --global user.email "[email protected]"
          git config --global user.name "Codex CI Bot"
          git add CHANGELOG.md
          git diff --staged --quiet || git commit -m "chore: auto-update CHANGELOG [skip ci]"
          git push

name: AI Code Review

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  ai-review:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v4
        with:
          node-version: '22'

      - run: npm install -g @openai/codex

      - name: Run AI code review
        id: review
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
        run: |
          # 获取 PR 变更内容并存入临时文件
          git diff origin/${{ github.base_ref }}...HEAD > /tmp/pr_diff.txt

          # 让 Codex 审查变更，结果写入文件
          codex exec --model gpt-4.1 \
            "读取 /tmp/pr_diff.txt 文件内容（这是一个 PR 的 git diff），以中文撰写代码审查报告，关注：1) 潜在 Bug 和边界情况，2) 安全漏洞，3) 性能问题，4) 代码可读性建议。将报告写入 /tmp/review_result.txt"

          # 将报告内容存为环境变量
          REVIEW_CONTENT=$(cat /tmp/review_result.txt)
          echo "REVIEW_CONTENT<> $GITHUB_ENV
          echo "$REVIEW_CONTENT" >> $GITHUB_ENV
          echo "EOF" >> $GITHUB_ENV

      - name: Post review comment
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `## 🤖 AI 代码审查\n\n${process.env.REVIEW_CONTENT}`
            })

name: Auto Complete Unit Tests

on:
  workflow_dispatch:  # 手动触发，也可改为 schedule
  schedule:
    - cron: '0 2 * * 1'  # 每周一凌晨 2 点运行

jobs:
  test-completion:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '22'

      - run: npm install -g @openai/codex

      - name: Generate missing unit tests
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
        run: |
          codex exec --model gpt-4.1 \
            "扫描 src/ 目录下所有 .js 和 .ts 文件，找出其中导出的函数或类，检查 __tests__ 或 *.test.* 文件中是否已有对应的测试用例。对于缺少测试的导出函数，生成对应的 Jest 单元测试，测试文件放在与源文件同级的 __tests__ 目录下，命名为 [原文件名].test.js。每个测试至少包含正常路径和边界情况各一个用例。"

      - name: Create PR with new tests
        run: |
          git config --global user.email "[email protected]"
          git config --global user.name "Codex CI Bot"
          git checkout -b feat/auto-tests-$(date +%Y%m%d)
          git add '**/__tests__/*.test.*'
          git diff --staged --quiet || \
            git commit -m "test: auto-generate missing unit tests" && \
            git push origin HEAD && \
            gh pr create --title "test: auto-generated unit tests" \
              --body "由 Codex CI Bot 自动生成的单元测试，请审查后合并。"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# GitLab CI — Codex 自动代码审查
stages:
  - ai-review

variables:
  NODE_VERSION: "22"

codex-code-review:
  stage: ai-review
  image: node:22-slim
  only:
    - merge_requests
  before_script:
    - npm install -g @openai/codex
    - git fetch origin $CI_MERGE_REQUEST_TARGET_BRANCH_NAME
  script:
    - git diff origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME...HEAD > /tmp/mr_diff.txt
    - codex exec --model gpt-4.1-mini
        "读取 /tmp/mr_diff.txt 的 git diff 内容，识别潜在 Bug、安全问题和性能瓶颈，用中文生成审查报告写入 /tmp/review.txt"
    - cat /tmp/review.txt
  variables:
    OPENAI_API_KEY: $OPENAI_API_KEY  # 从 CI/CD Variables 读取
  artifacts:
    paths:
      - /tmp/review.txt
    expire_in: 1 week

codex-changelog:
  stage: ai-review
  image: node:22-slim
  only:
    - main
  before_script:
    - npm install -g @openai/codex
    - git config --global user.email "[email protected]"
    - git config --global user.name "Codex CI"
  script:
    - codex exec --model gpt-4.1-mini
        "根据 git diff HEAD~1 生成 CHANGELOG 条目并追加到 CHANGELOG.md"
    - git add CHANGELOG.md
    - git diff --staged --quiet || git commit -m "chore: update CHANGELOG [skip ci]"
    - git push https://ci-token:$CI_JOB_TOKEN@$CI_SERVER_HOST/$CI_PROJECT_PATH.git HEAD:main
  variables:
    OPENAI_API_KEY: $OPENAI_API_KEY

# 只读模式：Codex 只能读取文件，不能做任何修改
# 适合纯审查任务，确保 CI 不会意外修改任何代码
codex exec --sandbox-mode read-only \
  "分析 src/ 目录下所有文件，识别可能的安全漏洞"

# 对于简单的 CHANGELOG 生成，mini 模型已经足够
codex exec --model gpt-4.1-mini \
  "根据 git diff HEAD~1 生成简洁的 CHANGELOG 条目"

# 对于需要深度分析的安全审查，使用完整模型
codex exec --model gpt-4.1 \
  "详细分析这次 PR 中的安全漏洞，包括 SQL 注入、XSS 等"

on:
  push:
    branches: [main, develop]
    paths:
      - 'src/**'        # 只有 src/ 有变更才触发
      - '!src/**/*.md'  # 排除文档文件