Jeffery
fd59eb2729
codex exec 加上 -s danger-full-access 避免 runner 容器內 bubblewrap 因 無法建立 user namespace 而失敗；action 新增 email output（解析 auth.json id_token 的 email claim），CI 改用 steps.codex.outputs.email 比對 vars.CODEX_EMAIL，不再依賴模型自行回報帳號。
64 lines
2.0 KiB
YAML
64 lines
2.0 KiB
YAML
name: 'Codex CLI'
|
||
description: 'Codex CLI 工具'
|
||
author: 'Jeffery'
|
||
inputs:
|
||
prompt:
|
||
description: '傳給 Codex CLI 的提示詞'
|
||
required: false
|
||
default: "請自我介紹"
|
||
oauth:
|
||
description: 'base64 編碼的 Codex OAuth token 檔案內容'
|
||
required: true
|
||
outputs:
|
||
text:
|
||
description: '輸出的文字'
|
||
value: ${{ steps.codex.outputs.text }}
|
||
email:
|
||
description: '目前登入帳號的電子郵件（取自 OAuth id_token）'
|
||
value: ${{ steps.codex.outputs.email }}
|
||
runs:
|
||
using: 'composite'
|
||
steps:
|
||
- name: 安裝工具
|
||
env:
|
||
OAUTH: ${{ inputs.oauth }}
|
||
run: |
|
||
npm install -g @openai/codex
|
||
|
||
oauth_file="$HOME/.codex/auth.json"
|
||
install -d -m 700 "$(dirname "$oauth_file")"
|
||
printf '%s' "$OAUTH" | base64 -d > "$oauth_file"
|
||
chmod 600 "$oauth_file"
|
||
shell: bash
|
||
- name: 執行工具
|
||
id: codex
|
||
env:
|
||
MODEL: ${{ vars.CODEX_MODEL }}
|
||
PROMPT: ${{ inputs.prompt }}
|
||
run: |
|
||
if [ -z "$MODEL" ]; then
|
||
echo 'CODEX_MODEL repository variable is required.' >&2
|
||
exit 1
|
||
fi
|
||
|
||
text="$(codex exec --skip-git-repo-check -s danger-full-access --model "$MODEL" "$PROMPT")"
|
||
printf '%s\n' "$text"
|
||
|
||
# 從 OAuth id_token（JWT）解出目前登入帳號的 email；正規表示式對冒號後空白容錯
|
||
auth_file="$HOME/.codex/auth.json"
|
||
id_token="$(grep -oE -m1 '"id_token"[[:space:]]*:[[:space:]]*"[^"]*"' "$auth_file" | sed -E 's/.*:[[:space:]]*"//; s/"$//' || true)"
|
||
payload="$(printf '%s' "$id_token" | cut -d. -f2 | tr '_-' '/+')"
|
||
case $((${#payload} % 4)) in
|
||
2) payload="${payload}==" ;;
|
||
3) payload="${payload}=" ;;
|
||
esac
|
||
email="$(printf '%s' "$payload" | base64 -d 2>/dev/null | grep -oE -m1 '"email"[[:space:]]*:[[:space:]]*"[^"]*"' | sed -E 's/.*:[[:space:]]*"//; s/"$//' || true)"
|
||
|
||
{
|
||
echo 'text<<CODEX_OUTPUT'
|
||
printf '%s\n' "$text"
|
||
echo 'CODEX_OUTPUT'
|
||
echo "email=$email"
|
||
} >> "$GITHUB_OUTPUT"
|
||
shell: bash
|