Repository navigation
Conversation
Replace the App-key dispatcher with OIDC-only Worker intake. No App key and no token mints remain in this workflow. The App webhook remains the independent route; the Worker owns eligibility and best-effort acknowledgements. Canonical migration: openclaw/clawsweeper#2062 Validated with actionlint, zizmor --offline (zero template-injection findings), no secrets. references, and independent autoreview.
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9b417783bd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| env: | ||
| GH_TOKEN: ${{ steps.token.outputs.token }} | ||
| TARGET_REPO: ${{ github.repository }} | ||
| TARGET_BRANCH: ${{ github.event.repository.default_branch }} |
There was a problem hiding this comment.
When a pull request targets a non-default branch, its pull_request_target OIDC identity uses that base branch, while this payload always claims the repository default branch (GitHub documents that pull_request_target uses the base ref). The intake verifier therefore rejects the request, and the new 4xx path exits successfully without the former repository_dispatch fallback, leaving this workflow unable to deliver such PR events. Set TARGET_BRANCH from github.base_ref/github.event.pull_request.base.ref for PR events and retain the default for issue events.
Useful? React with 👍 / 👎.
clawsweeper
Bot
added
clawsweeper:intake:feature
|
Codex review: blocked before merge. What this changesThis PR replaces target-held App credentials and relay dispatch with GitHub Actions OIDC intake and Worker-owned acknowledgements. Example: A collaborator posts @clawsweeper stop on openclaw/rfcs issue 57.
Review scores
ProductKind: Refactor · Worth it: Yes · Fix scope: Complete Merge readiness⛔ Blocked before merge - 1 item remains Keep this PR open: it applies the approved keyless dispatcher migration, which remains absent from this repository’s main branch; no introduced code defect was found. Priority: P2 Before merge
FindingsNone. Tests
Agent review detailsHow this fits togetherGitHub issue, PR, and command events enter the target workflow, which forwards them to the central Worker and its existing review queue or command router. flowchart TD
A[GitHub events] --> B[Target dispatcher]
B --> C[OIDC Worker intake]
A --> D[Signed App webhook]
C --> E[Live GitHub authority]
E --> F[Shared queue and router]
D --> F
F --> G[Reviews and acknowledgements]
Technical reviewBest possible solution: Adopt the canonical keyless workflow after verifying this target’s required App event subscriptions. Do we have a high-confidence way to reproduce the issue? Current-main source passes the central App private key to token-minting actions for target acknowledgements and relay delivery; no target code was executed. Is this the best way to solve the issue? The patch follows the merged canonical migration and reuses existing Worker authorization, acknowledgement, queue, and router owners. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against 967d9aac7472. Merge-risk optionsMaintainer options:
Provenance checked
TestingProof path: in-process harness. SecurityNone. EvidenceWhat I checked:
LabelsLabel changes:
Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment Reviewed October 18, 2026, 10:15 PM ET / October 19, 2026, 02:15 UTC. |
1 participant
The target dispatcher currently depends on App credentials or legacy delivery.
Replace the App-key dispatcher with OIDC-only Worker intake. No App key and no token mints remain in this workflow. The App webhook remains the independent route; the Worker owns eligibility and best-effort acknowledgements.
Canonical migration: openclaw/clawsweeper#2062
Validated with actionlint, zizmor --offline (zero template-injection findings), no secrets. references, and independent autoreview.
Only
.github/workflows/clawsweeper-dispatch.ymlchanges.