fix(entrypoint): 跳過 Codex repo 信任檢查並清理 auth

entrypoint.sh

@@ -2,49 +2,63 @@
 
 set -eo pipefail
 
-if [[ -z "${OAUTH:-}" ]]; then
-  echo "OAUTH is required: provide base64 encoded Codex auth.json." >&2
+die() {
+  echo "$1" >&2
   exit 1
+}
+
+cleanup() {
+  rm -f "${auth_file:-}" "${auth_path:-}" "${codex_output:-}"
+}
+
+trap cleanup EXIT
+
+if [[ -z "${OAUTH:-}" ]]; then
+  die "OAUTH is required: provide base64 encoded Codex auth.json."
 fi
 
 if [[ -z "${MODEL:-}" ]]; then
-  echo "MODEL is required." >&2
-  exit 1
+  die "MODEL is required."
 fi
 
 CODEX_HOME="${CODEX_HOME:-/root/.codex}"
 PROMPT="${PROMPT:-請自我介紹}"
-mkdir -p "$CODEX_HOME"
+mkdir -p "$CODEX_HOME" || die "Unable to create CODEX_HOME."
 
 auth_file="$(mktemp "$CODEX_HOME/auth.XXXXXX")"
-trap 'rm -f "$auth_file"' EXIT
+auth_path="$CODEX_HOME/auth.json"
 
-if ! printf '%s' "$OAUTH" | base64 -d > "$auth_file"; then
-  echo "OAUTH must be valid base64 encoded Codex auth.json." >&2
-  exit 1
+if [[ -e "$auth_path" ]]; then
+  die "Refusing to overwrite existing Codex auth.json."
+fi
+
+if ! printf '%s\n' "$OAUTH" | base64 -d > "$auth_file"; then
+  die "OAUTH must be valid base64 encoded Codex auth.json."
 fi
 
 if ! jq -e 'type == "object"' "$auth_file" >/dev/null; then
-  echo "Decoded OAUTH must be a JSON object." >&2
-  exit 1
+  die "Decoded OAUTH must be a JSON object."
 fi
 
-mv "$auth_file" "$CODEX_HOME/auth.json"
-chmod 600 "$CODEX_HOME/auth.json"
-trap - EXIT
+install -m 600 "$auth_file" "$auth_path"
+rm -f "$auth_file"
 
 codex_output="$(mktemp)"
-trap 'rm -f "$codex_output"' EXIT
 
 set +e
 codex exec \
+  --skip-git-repo-check \
   --model "$MODEL" \
   "$PROMPT" 2>&1 | tee "$codex_output"
 codex_status="${PIPESTATUS[0]}"
 set -e
 
 if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
-  output_delimiter="CODEX_OUTPUT_$(date +%s)_$$"
+  if [[ -r /proc/sys/kernel/random/uuid ]]; then
+    output_delimiter="CODEX_OUTPUT_$(cat /proc/sys/kernel/random/uuid)"
+  else
+    output_delimiter="CODEX_OUTPUT_$(mktemp -u XXXXXXXXXXXXXXXX)"
+  fi
 
   if [[ "$codex_status" -eq 0 ]]; then
     echo "status=completed" >> "$GITHUB_OUTPUT"