From d05610d4e56bb4cca1f86977a66b1e8e36036faf Mon Sep 17 00:00:00 2001
From: Jeffery <h3285@evertrust.com.tw>
Date: Mon, 29 Jun 2026 12:56:00 +0800
Subject: [PATCH] =?UTF-8?q?refactor(codex):=20oauth=20=E6=94=B9=E5=BE=9E?=
 =?UTF-8?q?=20secrets=20=E5=8F=96=E5=BE=97=E3=80=81=E5=B8=B3=E8=99=9F?=
 =?UTF-8?q?=E9=A9=97=E8=AD=89=E6=94=B6=E9=80=B2=20action=20=E5=85=A7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

oauth 不再經由 inputs 傳入，action 直接讀 secrets.CODEX_OAUTH（與
vars.CODEX_MODEL 相同模式）。登入帳號驗證移入 action：讀 vars.CODEX_EMAIL
與 app-server 取得的 email 比對，不再輸出 email 到 outputs、不在 CI 端比對。
---
 .gitea/workflows/ci.yaml |  4 ----
 action.yml               | 24 ++++++++++++++----------
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 373af0d..40ec896 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -28,8 +28,4 @@ jobs:
       id: codex
       uses: https://gitea.jsc.idv.tw/composite-actions/codex@v${{ needs.release-tag-version.outputs.version }}
       with:
-        oauth: ${{ secrets.CODEX_OAUTH }}
         prompt: "請自我介紹"
-    - name: 檢查登入帳號
-      if: ${{ steps.codex.outputs.email != vars.CODEX_EMAIL }}
-      run: exit 1
diff --git a/action.yml b/action.yml
index 0a325e9..2886409 100644
--- a/action.yml
+++ b/action.yml
@@ -6,22 +6,16 @@ inputs:
     description: '傳給 Codex CLI 的提示詞'
     required: false
     default: "請自我介紹"
-  oauth:
-    description: 'base64 編碼的 Codex OAuth token 檔案內容'
-    required: true
 outputs:
   text:
     description: '輸出的文字'
     value: ${{ steps.codex.outputs.text }}
-  email:
-    description: '目前登入帳號的電子郵件（由 codex app-server account/read 取得）'
-    value: ${{ steps.account.outputs.email }}
 runs:
   using: 'composite'
   steps:
   - name: 安裝工具
     env:
-      OAUTH: ${{ inputs.oauth }}
+      OAUTH: ${{ secrets.CODEX_OAUTH }}
     run: |
       npm install -g @openai/codex
 
@@ -49,9 +43,19 @@ runs:
         echo 'CODEX_OUTPUT'
       } >> "$GITHUB_OUTPUT"
     shell: bash
-  - name: 取得登入帳號
-    id: account
+  - name: 驗證登入帳號
+    env:
+      EXPECTED_EMAIL: ${{ vars.CODEX_EMAIL }}
     run: |
+      if [ -z "$EXPECTED_EMAIL" ]; then
+        echo 'CODEX_EMAIL repository variable is required.' >&2
+        exit 1
+      fi
+
       email="$(python3 "$GITHUB_ACTION_PATH/app/codex_account.py")"
-      printf 'email=%s\n' "$email" >> "$GITHUB_OUTPUT"
+      if [ "$email" != "$EXPECTED_EMAIL" ]; then
+        echo '登入帳號與 CODEX_EMAIL 不符' >&2
+        exit 1
+      fi
+      echo '登入帳號驗證通過'
     shell: bash