GitHub issue-comment metadata causes false PR-target ambiguity in automatic approval

Abierto Apto para principiantes
  • ¿Algo no está bien?
#54,821 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
76/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
json, rust
Área
developer-experience, security

Línea de trabajo

Lee codex-rs/core/assets/consequential_tool_message_templates.json y compara la entrada add_comment_to_issue con el contrato de la herramienta expuesto. Actualiza la etiqueta de destino y la pregunta de aprobación para que se refieran a un issue o pull request, conservando el campo pr_number, y verifica ambos tipos de destino mediante el Production Connector e inspecciona las URLs canónicas devueltas. El cambio por sí solo en la plantilla pública no demuestra que la decisión automática de aprobación esté corregida.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug tool-calls

Summary
The managed GitHub tool github_add_comment_to_issue advertises a PR-only target, although its name, body description and observed behavior include ordinary issues. Automatic approval can therefore approve one ordinary-issue comment and reject a later comment to the same verified issue as an unauthorized target ambiguity.

This report is sanitized. Repository names, issuer names, private report content, account identifiers, credentials and complete conversation logs are excluded.

Exposed tool metadata
Description: "Create a top-level PR Conversation comment (Issue comment)."
Parameters:

  • repo_full_name: string
  • pr_number: number; description "Pull request number in the repository."
  • comment: string; description "Top-level comment body to add to the issue thread."

Reproduction from October 17, 2026 UTC

  1. Fetch an ordinary issue from a private repository; confirm the issue number and canonical /issues/ URL.
  2. Add a claim comment with github_add_comment_to_issue using that repository and number in pr_number. It succeeds.
  3. Later submit a handoff comment through the same tool to the same ordinary issue.
  4. Automatic approval rejects the request with this rationale, identifiers sanitized:
    "This externally visible comment is intended for issue #17, but the tool argument is explicitly pr_number: 17 and the target type is ambiguous, creating a material risk of posting to the wrong PR or failing; the user has not authorized that exact target ambiguity."

Expected behavior
The tool contract and approval presentation should state that the target can be either an issue or a pull request. Once the repository and numbered issue are verified, the misleading legacy argument name should not create a second, fictitious target.

Primary evidence
GitHub documents that issue comments and PR conversation comments share the Issues endpoints:
https://docs.github.com/en/rest/issues/comments#create-an-issue-comment

OpenAI Codex source at ce0323f2f2d3b25e82806cd555237da3db4e1897 also labels this managed GitHub tool's target "Pull request" and asks to comment "on a pull request":
https://github.com/openai/codex/blob/ce0323f2f2d3b25e82806cd555237da3db4e1897/codex-rs/core/assets/consequential_tool_message_templates.json
Relevant entry: tool_title add_comment_to_issue; connector_id connector_76869538009648d5b282a4bb21c3d157; source_tool_index 0.

Smallest correction

  1. Managed connector description: "Create a top-level conversation comment on a GitHub issue or pull request."
  2. Keep the existing pr_number wire field for compatibility; describe it as the issue or pull-request number, documenting its legacy name.
  3. Update the bundled approval label and question to "Issue or pull request" / "an issue or pull request".
  4. Verify ordinary-issue and PR conversation comments through the same production connector, checking the returned canonical target URL. Preserve normal approval checks.

The accompanying patch changes only the public Codex approval presentation. It does not modify the managed connector schema, and applying it alone must not be claimed to resolve automatic-review decisions.

Separate incident
A branch-create attempt returned "Automatic approval review failed: authorization changed before approval could be applied". Public Codex source maps that message to StaleAuthorization when authorization or review-context revisions change during review. The branch and PR subsequently succeeded. This is distinct from the comment metadata problem; the original internal attempt count and precise changing evidence were not retained, so no specific race is claimed proven.

Source:
https://github.com/openai/codex/blob/ce0323f2f2d3b25e82806cd555237da3db4e1897/codex-rs/core/src/guardian/review_request.rs
https://github.com/openai/codex/blob/ce0323f2f2d3b25e82806cd555237da3db4e1897/codex-rs/ext/guardian-reviewer/src/retry.rs

Public Codex approval-template patch

diff --git a/codex-rs/core/assets/consequential_tool_message_templates.json b/codex-rs/core/assets/consequential_tool_message_templates.json
--- a/codex-rs/core/assets/consequential_tool_message_templates.json
+++ b/codex-rs/core/assets/consequential_tool_message_templates.json
@@ -9,7 +9,7 @@
       "template_params": [
         {
           "name": "pr_number",
-          "label": "Pull request"
+          "label": "Issue or pull request"
         },
         {
           "name": "repo_full_name",
@@ -20,7 +20,7 @@
           "label": "Comment"
         }
       ],
-      "template": "Allow {connector_name} to add a comment to a pull request?"
+      "template": "Allow {connector_name} to add a comment to an issue or pull request?"
     },
     {
       "source_tool_index": 1,
Lenguaje dominante
Rust
Estrellas
131k
Forks
20.7k
Merge medio
1 min
PR fusionados (30 d)
997

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de openai/codex

Todos los issues de openai/codex

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.