workflows: report a withheld review payload instead of crashing

[idy]

Closes #28

Problem

codex-openai-review.yml lost a completed review on GizClaw/gizclaw#1068 and reported a misleading reason.

The review job finished and produced a full review payload. GitHub then refused to set the job output:

##[warning]Skip output 'review' since it may contain secret

A job output is withheld when its value matches a registered repository or organization secret. needs.review.outputs.review was therefore empty, and the publish step's first statements ran:

const review = JSON.parse(process.env.REVIEW);
const readiness = JSON.parse(process.env.READINESS_EVIDENCE);

JSON.parse('') threw SyntaxError: Unexpected end of JSON input, the step failed, and the job's failure_reason fell through to the generic GitHub could not publish the generated pull-request review. The review, its findings and the credits spent producing it were all lost, and nothing in the reported reason pointed at the real cause.

Neighbouring parses in the same script already guard their input (JSON.parse(process.env.USAGE_JSON || '{}')); these two did not.

Change

Both payloads go through one requirePayload helper that fails with an explicit reason naming the withheld output and pointing at the Skip output warning, and reports a malformed payload separately from a missing one. No behaviour changes when the payload is present.

Not addressed here

The underlying trigger is that a registered secret's value occurs inside ordinary review prose, which suggests the secret is stored with stray whitespace or is otherwise short enough to collide with English text. The review payload is model-generated prose about a diff and never contains the API key, so this is a false positive rather than a leak. Re-saving the secret as a single-line exact value stops the masking; encoding the payload to slip past the masker would defeat a protection that exists for good reason, so it is deliberately not done here.

Validation

• actionlint .github/workflows/codex-openai-review.yml reports only the pre-existing job.workflow_repository / job.workflow_sha warnings, none at the changed lines.
• The patched inline script extracts and passes node --check.

🤖 Generated with Claude Code

[github-actions]

❌ OpenAI PR Review: FAIL

Conclusion: Not ready. 1 readiness blocker must be resolved before merge.

Review checks

Check	Result
PR format	❌ FAIL
Issue design	✅ PASS
Code & plan conformance	✅ PASS

Scope: a612f21eff · 7954cfd6b5..a612f21eff · full · 1 diff chunk

Usage: 23s · 83,047 tokens · 70.6% cache hit · 2.464 credits

Blockers

• pr-linkage Pull request must natively close at least one same-repository Issue.

Summary

No actionable code findings or plan-conformance blockers remain after aggregating the completed chunk review.

Review metadata

• Commit: a612f21eff
• Range: 7954cfd6b5..a612f21eff
• Mode: full
• Diff chunks: 1
• Model: gpt-5.6-terra
• Reasoning effort: medium
• Session: repo-1309321116-pr-27-v2
• Generation: 325e7cfb3d52acb1d7fa46b6793e8f57f6da6ac2e827efb6f1f27a3b81a180a4
• Evidence: 4f277b9c6b7686149fbbf009624022aa0b4f80b01cf62687580579fdb4f7e2a3

Totals

• Input: 81,427
• Cached input: 57,469
• Cache write: 23,937
• Output: 1,620
• Reasoning: 446
• Total: 83,047
• Estimated credits: 2.464
• Credit rate per 1M tokens: 62.5 input / 6.25 cached / 375 output

Token and cache details

Stage	Mode	Target	Time	Input	Cached	Hit	Output	Total	Credits
pr	deterministic	format rules	0s	0	0	0.0%	0	0	0.000
pr	full	pr	6s	19,555	9,280	47.5%	281	19,836	0.806
code	full	chunk 1/1	12s	35,069	22,518	64.2%	1,096	36,165	1.336
code	full	aggregate	5s	26,803	25,671	95.8%	243	27,046	0.322