From 765fef2cd96636470c3001b394bb504dcb9d0ea0 Mon Sep 17 00:00:00 2001
From: Jacob Ransom <jacob@innocraft.com>
Date: Mon, 14 Sep 2026 10:28:29 +1200
Subject: [PATCH] Add the codex review wrapper [ignore_release]

Points at the shared workflow in plugin-ci-workflows rather than the private one: GitHub resolves a reusable workflow from the callee repository access policy at parse time, so a public caller cannot be granted access to a private repository. The wrapper is label-gated and does nothing until the codex-review label is added.
---
 .github/workflows/codex-review.yml | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 .github/workflows/codex-review.yml

diff --git a/.github/workflows/codex-review.yml b/.github/workflows/codex-review.yml
new file mode 100644
index 0000000..765dab1
--- /dev/null
+++ b/.github/workflows/codex-review.yml
@@ -0,0 +1,27 @@
+name: Codex Review
+
+on:
+  # nosec — label-gated; this wrapper runs no PR code, see matomo-org/plugin-ci-workflows README.md
+  pull_request_target:
+    types: [labeled]
+
+permissions:
+  contents: none
+
+jobs:
+  codex-review:
+    # The shared workflow gates every one of its own jobs on this label, but it also carries a
+    # cancel-in-progress concurrency group. Without this condition an unrelated label would still
+    # instantiate it, claim that group, and cancel a review already running on this pull request.
+    if: ${{ github.event.label.name == 'codex-review' }}
+    uses: matomo-org/plugin-ci-workflows/.github/workflows/plugin-codex-review.yml@main
+    permissions:
+      actions: read
+      contents: read
+      issues: write
+      pull-requests: write
+    with:
+      plugin-name: CustomVariables
+    secrets:
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      TESTS_ACCESS_TOKEN: ${{ secrets.TESTS_ACCESS_TOKEN }}