name: Codex Security repository
on:
  workflow_dispatch:
  schedule:
    - cron: "23 7 * * 1" # Mondays at 07:23 UTC

permissions:
  contents: read

jobs:
  security:
    runs-on: ubuntu-24.04
    timeout-minutes: 120
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Scan the repository
        id: security
        # Choose the distribution SHA as described at https://github.com/openai/codex-security/tree/main/github-action#quick-start
        uses: openai/codex-security@REPLACE_WITH_REVIEWED_COMMIT
        with:
          scope: repository
          model: gpt-5.6-sol
          effort: high
          max-cost: "5"
          fail-on-severity: none
        env:
          OPENAI_API_KEY: ${{ secrets.CODEX_SECURITY_API_KEY }}