admin/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-08-14 08:52:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: pass Codex API key to ClawScan shadow

Browse Source 
Pass CODEX_API_KEY into the security scan worker so the nested ClawScan Docker judge can authenticate Codex.
This commit is contained in:
Patrick Erichsen
2026-07-07 09:35:14 -05:00
committed by GitHub
parent 3cab981b0b
commit a1cb59ecec
3 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/security-scan-codex.yml
+1
View File
@@ -95,6 +95,7 @@ jobs:
- name: Run Codex security worker
env:
CODEX_API_KEY: ${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY }}
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
SECURITY_SCAN_WORKER_TOKEN: ${{ secrets.SECURITY_SCAN_WORKER_TOKEN }}
run: |
scripts/lib/workerRedaction.ts
+1
View File
@@ -48,6 +48,7 @@ export function maskKnownWorkerSecrets(
) {
const secretKeys = [
"SECURITY_SCAN_WORKER_TOKEN",
"CODEX_API_KEY",
"OPENAI_API_KEY",
"GH_TOKEN",
"GITHUB_TOKEN",
scripts/security/security-scan-worker-workflow.test.ts
+4
View File
@@ -70,12 +70,15 @@ describe("security-scan-codex workflow", () => {
"${{ vars.CODEX_SECURITY_SCAN_TIMEOUT_MS || '240000' }}",
);
expect(jobEnv).not.toHaveProperty("OPENAI_API_KEY");
expect(jobEnv).not.toHaveProperty("CODEX_API_KEY");
expect(jobEnv).not.toHaveProperty("SECURITY_SCAN_WORKER_TOKEN");
expectSecretStepAllowlist(steps, "CODEX_API_KEY", ["Run Codex security worker"]);
expectSecretStepAllowlist(steps, "OPENAI_API_KEY", [
"Authenticate Codex CLI",
"Run Codex security worker",
]);
expectSecretStepAllowlist(steps, "SECURITY_SCAN_WORKER_TOKEN", ["Run Codex security worker"]);
expect(scanStep?.env ?? {}).not.toHaveProperty("CODEX_API_KEY");
expect(scanStep?.env ?? {}).not.toHaveProperty("OPENAI_API_KEY");
expect(scanStep?.env ?? {}).not.toHaveProperty("SECURITY_SCAN_WORKER_TOKEN");
expect(steps.find((step) => step.name === "Check configuration")).toBeUndefined();
@@ -86,6 +89,7 @@ describe("security-scan-codex workflow", () => {
expect(skillspectorInstall).toContain("git+https://github.com/NVIDIA/skillspector.git@8f37cfa");
expect(skillspectorInstall).not.toContain("git+https://github.com/NVIDIA/skillspector.git'");
expect(steps.find((step) => step.name === "Run Codex security worker")?.env).toEqual({
CODEX_API_KEY: "${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY }}",
OPENAI_API_KEY: "${{ secrets.OPENAI_API_KEY }}",
SECURITY_SCAN_WORKER_TOKEN: "${{ secrets.SECURITY_SCAN_WORKER_TOKEN }}",
});