Codex publication boundary
Treat repository review, local edits, pushing a branch, opening or updating a PR, and merging as distinct effects. Verify the target repository and current user authorization for each external write. If push or PR publication is not yet authorized, complete the local branch, diff, checks, and draft PR text so approval is the final step. Do not merge unless separately requested. Preserve the upstream review and CI workflow within those boundaries.
Loop on CITrigger
Need to watch a branch or pull request and iterate on CI failures until all required checks are green.
Use gh pr checks as the source of truth. It includes all PR-attached checks, while gh run list only covers GitHub Actions.
Workflow
- Resolve the PR for the current branch.
- Inspect current PR checks before waiting.
- If checks already failed, diagnose those failures first.
- If checks are pending, watch with
gh pr checks --watch --fail-fast. - After each push, re-check the full PR check set and repeat until green.
Commands
# Resolve the active PR
gh pr view --json number,url,headRefName
# Inspect all attached checks
gh pr checks --json name,bucket,state,workflow,link
# Watch pending checks and fail fast
gh pr checks --watch --fail-fast
# GitHub Actions logs, when the failing check links to a GHA run
gh run view <run-id> --log-failed
Guardrails
- Keep each fix scoped to a single failure cause when possible.
- Do not bypass hooks (
--no-verify) to force progress. - If the failure is clearly unrelated to the PR and appears fixed on main, merge latest main instead of bloating the PR with unrelated fixes.
- If failures are flaky, retry once and report flake evidence.
- Re-run
gh pr checks --json name,bucket,state,workflow,linkafter every push; the check set can change.
Output
- Current CI status
- Failure summary and fixes applied
- PR URL once checks are green