Codex Pr Review

Codex PR review gate

Review the PR diff with the local Codex CLI and report the verdict to GitHub as a codex-review commit status, so the merge can gate on it. Repo-agnostic: gh auto-detects the repo; the diff base is the repo's default branch.

Procedure

1. Identify the head and base:

``sh SHA=$(git rev-parse HEAD) BASE=$(gh repo view --json defaultBranchRef --jq .defaultBranchRef.name) ``

1. Review the diff (read-only):

``sh git diff "origin/$BASE...HEAD" | codex exec --sandbox read-only --skip-git-repo-check \ 'Review this PR diff for BLOCKING bugs only — correctness and security (P1/P2). For each, give file:line and a one-line description. List nits separately under a NITS heading. If there are no blocking issues, reply with exactly: CLEAN' ``

1. Judge (apply superpowers:receiving-code-review):

• Blocking P1/P2 present → fix on the branch, re-push, and re-run from

step 1. Cap at 3 rounds.

• CLEAN (or only nits) → go to step 4 (success).
• 3 rounds with blockers still open → step 5 (failure), then STOP and

surface to the user. Do not create/merge the PR.

1. Post success + comment (PR number ``):

``sh gh api -X POST "repos/{owner}/{repo}/statuses/$SHA" \ -f state=success -f context=codex-review -f description="Codex: clean" gh pr comment --body "Codex review: clean." ``

1. Post failure + comment (only if stopping at the cap):

``sh gh api -X POST "repos/{owner}/{repo}/statuses/$SHA" \ -f state=failure -f context=codex-review -f description="Codex: blocking" gh pr comment --body "Codex review: blocking issue(s):" ``

1. Proceed to merge (only after success). Pick the merge command by whether

the repo has branch protection with required checks — check once: gh api "repos/{owner}/{repo}/branches/$BASE/protection" (a 404 means unprotected).

• Protected (required checks exist): gh pr merge --auto --squash.

GitHub waits for the required checks — which include codex-review where enforced — and merges when all are green. Fire-and-forget; survives the agent exiting.

• Unprotected (no required checks): do NOT use --auto — with

nothing to wait for it merges immediately, before CI runs. Poll the CI runs (gh run list --branch + gh run view --json conclusion) and merge by hand once green: gh pr merge --squash.

Rules

• Threshold: only P1/P2 (correctness/security) block. Nits go in the comment.
• Self-attestation: you both run Codex and post the status — the PR comment

is the durable record. The cloud Codex integration is a bonus second opinion.

• Runs on every PR; in repos that require codex-review it gates, elsewhere the

status is a harmless extra.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: raccrompton
• Source: raccrompton/claude-codex-skills
• License: MIT

Install and usage instructions live in the source repository linked above.