fix(Codex CLI): 強化認證驗證與安全執行

Dockerfile

@@ -1,7 +1,7 @@
 FROM alpine:latest
 
 # 安裝必要的工具
-RUN apk add --no-cache --no-check-certificate bash ca-certificates curl git
+RUN apk add --no-cache --no-check-certificate bash ca-certificates curl git jq
 
 # 設定安裝用的環境變數
 ENV CODEX_NON_INTERACTIVE=1
@@ -9,14 +9,17 @@ ENV CODEX_INSTALL_DIR=/usr/local/bin
 ENV CODEX_HOME=/root/.codex
 
 # 安裝 Codex CLI 工具
-RUN curl -fsSL https://chatgpt.com/codex/install.sh | sh
+RUN install_script="$(mktemp)" \
+    && curl -fsSL --retry 3 --retry-delay 2 --max-time 120 \
+        https://chatgpt.com/codex/install.sh \
+        -o "$install_script" \
+    && sh "$install_script" \
+    && rm -f "$install_script"
 
-# 安裝 doc 技能
+# 安裝技能
 RUN codex plugin marketplace add https://gitea.jsc.idv.tw/plugins/doc.git \
-    && codex plugin add jsc@doc
-
-# 安裝 code-review 技能
-RUN codex plugin marketplace add https://gitea.jsc.idv.tw/plugins/code-review.git \
+    && codex plugin add jsc@doc \
+    && codex plugin marketplace add https://gitea.jsc.idv.tw/plugins/code-review.git \
     && codex plugin add jsc@code-review
 
 COPY entrypoint.sh /entrypoint.sh

action.yaml

@@ -13,7 +13,7 @@ inputs:
     required: false
     default: '請自我介紹'
 outputs:
-  text:
+  status:
     description: 'Execution result status'
 runs:
   using: 'docker'

entrypoint.sh

@@ -15,11 +15,28 @@ fi
 CODEX_HOME="${CODEX_HOME:-/root/.codex}"
 PROMPT="${PROMPT:-請自我介紹}"
 mkdir -p "$CODEX_HOME"
-printf '%s' "$OAUTH" | base64 -d > "$CODEX_HOME/auth.json"
-chmod 600 "$CODEX_HOME/auth.json"
 
-codex exec --dangerously-bypass-approvals-and-sandbox --model "$MODEL" "$PROMPT"
+auth_file="$(mktemp "$CODEX_HOME/auth.XXXXXX")"
+trap 'rm -f "$auth_file"' EXIT
+
+if ! printf '%s' "$OAUTH" | base64 -d > "$auth_file"; then
+  echo "OAUTH must be valid base64 encoded Codex auth.json." >&2
+  exit 1
+fi
+
+if ! jq -e 'type == "object"' "$auth_file" >/dev/null; then
+  echo "Decoded OAUTH must be a JSON object." >&2
+  exit 1
+fi
+
+mv "$auth_file" "$CODEX_HOME/auth.json"
+chmod 600 "$CODEX_HOME/auth.json"
+trap - EXIT
+
+codex exec \
+  --model "$MODEL" \
+  "$PROMPT"
 
 if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
-  echo "text=completed" >> "$GITHUB_OUTPUT"
+  echo "status=completed" >> "$GITHUB_OUTPUT"
 fi