From 20da4c37c5a56f168118b4b1573b8bf749d3bece Mon Sep 17 00:00:00 2001 From: Eric Traut Date: Fri, 29 May 2026 12:06:55 -0700 Subject: [PATCH] ci: use issue triage environment for issue workflows (#25134) ## Summary This adds `environment: issue-triage` to the Codex-calling issue workflow jobs so they can read the GitHub Environment Secret while staying on GitHub-hosted runners for public issue-triggered workflows. --- .github/workflows/issue-deduplicator.yml | 2 ++ .github/workflows/issue-labeler.yml | 1 + 2 files changed, 3 insertions(+) diff --git a/.github/workflows/issue-deduplicator.yml b/.github/workflows/issue-deduplicator.yml index f15c19010..fea6348c4 100644 --- a/.github/workflows/issue-deduplicator.yml +++ b/.github/workflows/issue-deduplicator.yml @@ -12,6 +12,7 @@ jobs: # Prevent runs on forks (requires OpenAI API key, wastes Actions minutes) if: github.repository == 'openai/codex' && (github.event.action == 'opened' || (github.event.action == 'labeled' && github.event.label.name == 'codex-deduplicate')) runs-on: ubuntu-latest + environment: issue-triage permissions: contents: read outputs: @@ -157,6 +158,7 @@ jobs: needs: normalize-duplicates-all if: ${{ needs.normalize-duplicates-all.result == 'success' && needs.normalize-duplicates-all.outputs.has_matches != 'true' }} runs-on: ubuntu-latest + environment: issue-triage permissions: contents: read outputs: diff --git a/.github/workflows/issue-labeler.yml b/.github/workflows/issue-labeler.yml index 77fe5d07c..2c4eb6aa6 100644 --- a/.github/workflows/issue-labeler.yml +++ b/.github/workflows/issue-labeler.yml @@ -12,6 +12,7 @@ jobs: # Prevent runs on forks (requires OpenAI API key, wastes Actions minutes) if: github.repository == 'openai/codex' && (github.event.action == 'opened' || (github.event.action == 'labeled' && github.event.label.name == 'codex-label')) runs-on: ubuntu-latest + environment: issue-triage permissions: contents: read outputs: