Method GetExecutionSteps

pkg/workflow/codex_engine.go:177–488

GetExecutionSteps returns the GitHub Actions steps for executing Codex

(workflowData *WorkflowData, logFile string)

// GetExecutionSteps returns the GitHub Actions steps for executing Codex
func (e *CodexEngine) GetExecutionSteps(workflowData *WorkflowData, logFile string) []GitHubActionStep {
	modelConfigured := workflowData.EngineConfig != nil && workflowData.EngineConfig.Model != ""
	firewallEnabled := isFirewallEnabled(workflowData)
	codexEngineLog.Printf("Building Codex execution steps: workflow=%s, modelConfigured=%v, firewall=%v",
		workflowData.Name, modelConfigured, firewallEnabled)

	var steps []GitHubActionStep

	// Codex does not support a native model environment variable, so model selection
	// always uses GH_AW_MODEL_AGENT_CODEX or GH_AW_MODEL_DETECTION_CODEX with shell expansion
	// via the --model flag. This also correctly handles GitHub Actions expressions like ${{ inputs.model }}.
	// Note: Codex also supports config-layer model selection (config key `model`, including `-c model="..."`),
	// but `--model` is a direct CLI flag and avoids TOML quoting/parsing edge cases in automation.
	isDetectionJob := workflowData.SafeOutputs == nil
	var modelEnvVar string
	if isDetectionJob {
		modelEnvVar = constants.EnvVarModelDetectionCodex
	} else {
		modelEnvVar = constants.EnvVarModelAgentCodex
	}
	modelParam := fmt.Sprintf(`${%s:+ --model "$%s"}`, modelEnvVar, modelEnvVar)

	// Build search parameter: disable web search by default, enable only if web-search tool is present.
	// Codex enables web search by default, so we must explicitly set web_search="disabled" to disable it.
	// The --no-search flag does not exist; use the -c web_search="disabled" config option instead.
	// See https://developers.openai.com/codex/cli/features#web-search
	// Leading space is intentional: these params are concatenated directly and need their own separator.
	webSearchParam := ` -c web_search="disabled"`
	if workflowData.ParsedTools != nil && workflowData.ParsedTools.WebSearch != nil {
		// Web search is enabled by default in Codex; no extra flag needed.
		webSearchParam = ""
	}

	// Build fetch parameter: enforce AWF default-deny for fetch unless web-fetch tool is present.
	// Codex enables fetch by default, so this code explicitly sets fetch="disabled" unless web-fetch is configured.
	// Leading space is intentional: these params are concatenated directly and need their own separator.
	webFetchParam := ` -c fetch="disabled"`
	if workflowData.ParsedTools != nil && workflowData.ParsedTools.WebFetch != nil {
		// When web-fetch is configured, omit override so Codex default fetch behavior remains enabled.
		webFetchParam = ""
	}

	// See https://github.com/github/gh-aw/issues/892
	// In AWF mode we bypass Codex approvals/sandboxing because AWF provides the sandbox layer.
	// Outside AWF, keep Codex sandboxing enabled and disable approvals for non-interactive execution.
	executionPolicyParam := ` --sandbox workspace-write --skip-git-repo-check -c approval_policy="never" `
	if firewallEnabled {
		executionPolicyParam = " --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check "
	}

	// Build custom args parameter if specified in engineConfig
	var customArgsParam string
	if workflowData.EngineConfig != nil && len(workflowData.EngineConfig.Args) > 0 {
		var customArgsParamSb strings.Builder
		for _, arg := range workflowData.EngineConfig.Args {
			customArgsParamSb.WriteString(arg + " ")
		}
		customArgsParam += customArgsParamSb.String()