Codex: remove openai-proxy env_key requirement in postprocessed lock workflows

[Copilot]

Codex runs routed through the AWF OpenAI proxy were failing at startup because generated provider config required OPENAI_API_KEY, while the sandbox intentionally excludes real OpenAI/Codex keys. This change removes that hard requirement so proxy-authenticated Codex sessions can boot and route traffic through the sidecar.

• Codex provider generation (postprocess)

  • Updated scripts/ci/postprocess-smoke-workflows.ts to stop emitting env_key = "OPENAI_API_KEY" for [model_providers.openai-proxy].
  • Added a compatibility transform that strips legacy env_key lines from existing openai-proxy blocks during postprocessing.

• Lock-file outputs updated

  • Removed legacy env_key entries from Codex lock workflows where openai-proxy is injected:
    • .github/workflows/smoke-codex.lock.yml
    • .github/workflows/secret-digger-codex.lock.yml

• Regression coverage for postprocess rules

  • Extended scripts/ci/postprocess-smoke-workflows.test.ts to assert:
    • newly injected openai-proxy config omits env_key
    • legacy env_key lines are removed without disturbing the provider block

[model_providers.openai-proxy]
name = "OpenAI AWF proxy"
base_url = "http://172.30.0.30:10000"
supports_websockets = false

[Copilot]

Pull request overview

Removes the env_key = "OPENAI_API_KEY" requirement from the Codex openai-proxy provider config emitted by the smoke workflow postprocessor, since auth is handled by the AWF sidecar and forcing an env var caused Codex startup failures in the sandbox.

Changes:

• Stop emitting env_key when injecting the openai-proxy provider block in postprocess-smoke-workflows.ts, and add a regex transform that strips legacy env_key lines from existing blocks.
• Regenerate Codex lock workflows to drop the env_key line.
• Add Jest coverage for both the injection (no env_key) and legacy-removal cases.

Show a summary per file

File	Description
scripts/ci/postprocess-smoke-workflows.ts	Drop env_key from injected provider block; add compatibility regex to strip legacy lines.
scripts/ci/postprocess-smoke-workflows.test.ts	Add tests asserting injection omits env_key and legacy env_key is stripped.
.github/workflows/smoke-codex.lock.yml	Regenerated lock file with env_key removed.
.github/workflows/secret-digger-codex.lock.yml	Regenerated lock file with env_key removed in two provider blocks.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 4/4 changed files
• Comments generated: 0

[github-actions]

Smoke Test Results

Test	Result
GitHub API (list merged PRs)	❌ HTTP 401 (authentication unavailable)
Playwright (GitHub homepage)	✅ Page loaded, title contains 'GitHub'
File verify (smoke-test file)	✅ File exists with pass timestamp

Summary: 2/3 PASS — Playwright and file tests passed. GitHub API test requires gh CLI authentication in this environment.

💥 [THE END] — Illustrated by Smoke Claude

[github-actions]

Smoke Test: Copilot BYOK (Offline) Mode

Test	Result
GitHub MCP connectivity	❌ 401 — MCP token unavailable
GitHub.com HTTP	⚠️ Pre-step data not expanded
File write/read	⚠️ Pre-step data not expanded
BYOK inference (api-proxy → api.githubcopilot.com)	✅

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com.

Overall: FAIL — pre-step template variables were not substituted; GitHub MCP returned 401.

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

🔬 Smoke Test Results

Test	Status
GitHub MCP connectivity	❌ (401 Bad credentials)
GitHub.com HTTP connectivity	⚠️ (pre-step data not expanded)
File write/read	⚠️ (pre-step data not expanded)

Overall: FAIL — GitHub MCP auth unavailable; workflow template variables were not expanded at runtime.

Note: ${{ steps.smoke-data.outputs.* }} variables were not substituted, indicating the pre-step did not run or data was not passed correctly.

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

Smoke test: FAIL
Merged PR titles: ❌ unavailable (safeinputs-gh missing; gh 401)
Safe Inputs GH CLI: ❌ safeinputs-gh not found
Playwright GitHub title: ✅
Tavily search: ❌ no search tool available
File write/read: ✅
Discussion query/comment: ❌ github-discussion-query not found
Build: ✅ npm ci && npm run build
Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions]

Smoke Test: GitHub Actions Services Connectivity

Check	Result
Redis PING	❌ Timeout/no response
PostgreSQL pg_isready	❌ No response
PostgreSQL SELECT 1	❌ No response (pg_isready failed)

Overall: FAIL — host.docker.internal is not reachable from this runner environment. Service containers appear unreachable.

🔌 Service connectivity validated by Smoke Services

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #3234 · ● 5M · ◷

[github-actions]

Gemini Engine Smoke Test Results

• GitHub MCP Testing: ❌ (Failed to list PRs: 401 Bad credentials from GitHub API)
• GitHub.com Connectivity: ❌ (SSL error 35; Squid proxy returned 400 for HTTP)
• File Writing Testing: ✅ (Successfully wrote to /tmp/gh-aw/agent/smoke-test-gemini-25939634364.txt)
• Bash Tool Testing: ✅ (Successfully verified file content)

Overall Status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini