Merge pull request #1728 from abhayclasher/security-hardening-workflow

Security: Harden codex-review workflow against script injection

Author: rolandwalker

.github/workflows/codex-review.yml

@@ -36,6 +36,10 @@ jobs:
       - name: Run Codex review
         id: run_codex
         uses: openai/codex-action@v1
+        env:
+          # Use env variables to handle untrusted metadata safely
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_BODY: ${{ github.event.pull_request.body }}
         with:
           openai-api-key: ${{ secrets.OPENAI_API_KEY }}
           prompt: |
@@ -53,8 +57,8 @@ jobs:
 
             Pull request title and body:
             ----
-            ${{ github.event.pull_request.title }}
-            ${{ github.event.pull_request.body }}
+            $PR_TITLE
+            $PR_BODY
 
   post-feedback:
     runs-on: ubuntu-latest

changelog.md

@@ -1,3 +1,11 @@
+1.65.2 (2026/03/19)
+==============
+
+Security
+--------
+* Harden `codex-review` workflow against script injection from untrusted PR metadata.
+
+
 1.65.1 (2026/03/18)
 ==============
 

mycli/AUTHORS

@@ -113,6 +113,7 @@ Contributors:
   * tmijieux
   * Scott Nemes
   * Angelino Storm
+  * Abhay Kumar
 
 
 Created by: