From 7ee6921c638fa95597c5f2e97c4076e350fa6e06 Mon Sep 17 00:00:00 2001
From: Jeffery <h3285@evertrust.com.tw>
Date: Mon, 29 Jun 2026 12:35:35 +0800
Subject: [PATCH] =?UTF-8?q?fix(codex):=20=E6=94=B9=E4=BB=A5=20codex=20exec?=
 =?UTF-8?q?=20=E7=9C=9F=E5=AF=A6=E5=BE=80=E8=BF=94=E9=A9=97=E8=AD=89?=
 =?UTF-8?q?=E7=99=BB=E5=85=A5=EF=BC=8C=E7=A7=BB=E9=99=A4=E7=9B=B4=E6=8E=A5?=
 =?UTF-8?q?=E8=A7=A3=E6=9E=90=20OAuth=20token?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

不再解析 auth.json 的 id_token 來取得 email（只證明 secret 解得開、
無法確保工具真的登入成功）。改為透過 codex exec 實際呼叫模型：登入無效
或 token 過期時 codex exec 會直接失敗，CI 再以 steps.codex.outputs.text
是否為空做最終把關。action 移除 email output，保留 -s danger-full-access
以避免 runner 容器內 bubblewrap 沙箱失敗。
---
 .gitea/workflows/ci.yaml |  4 ++--
 action.yml               | 15 ---------------
 2 files changed, 2 insertions(+), 17 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 373af0d..6b8066b 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -30,6 +30,6 @@ jobs:
       with:
         oauth: ${{ secrets.CODEX_OAUTH }}
         prompt: "請自我介紹"
-    - name: 檢查登入帳號
-      if: ${{ steps.codex.outputs.email != vars.CODEX_EMAIL }}
+    - name: 檢查登入
+      if: ${{ steps.codex.outputs.text == '' }}
       run: exit 1
diff --git a/action.yml b/action.yml
index b18fc6d..78beab2 100644
--- a/action.yml
+++ b/action.yml
@@ -13,9 +13,6 @@ outputs:
   text:
     description: '輸出的文字'
     value: ${{ steps.codex.outputs.text }}
-  email:
-    description: '目前登入帳號的電子郵件（取自 OAuth id_token）'
-    value: ${{ steps.codex.outputs.email }}
 runs:
   using: 'composite'
   steps:
@@ -43,21 +40,9 @@ runs:
 
       text="$(codex exec --skip-git-repo-check -s danger-full-access --model "$MODEL" "$PROMPT")"
       printf '%s\n' "$text"
-
-      # 從 OAuth id_token（JWT）解出目前登入帳號的 email；正規表示式對冒號後空白容錯
-      auth_file="$HOME/.codex/auth.json"
-      id_token="$(grep -oE -m1 '"id_token"[[:space:]]*:[[:space:]]*"[^"]*"' "$auth_file" | sed -E 's/.*:[[:space:]]*"//; s/"$//' || true)"
-      payload="$(printf '%s' "$id_token" | cut -d. -f2 | tr '_-' '/+')"
-      case $((${#payload} % 4)) in
-        2) payload="${payload}==" ;;
-        3) payload="${payload}=" ;;
-      esac
-      email="$(printf '%s' "$payload" | base64 -d 2>/dev/null | grep -oE -m1 '"email"[[:space:]]*:[[:space:]]*"[^"]*"' | sed -E 's/.*:[[:space:]]*"//; s/"$//' || true)"
-
       {
         echo 'text<<CODEX_OUTPUT'
         printf '%s\n' "$text"
         echo 'CODEX_OUTPUT'
-        echo "email=$email"
       } >> "$GITHUB_OUTPUT"
     shell: bash