Refs/heads/codexfix failing workflows in sei chain repo

.github/workflows/auto-merge-dependabot.yml

@@ -0,0 +1,37 @@
+name: Auto-Merge Dependabot Updates
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - labeled
+      - synchronize
+
+permissions:
+  pull-requests: write
+  contents: read
+
+jobs:
+  automerge:
+   if: github.actor == 'dependabot[bot]' && contains(github.event.pull_request.labels.*.name, 'safe-to-merge')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Enable auto-merge for patch/minor updates
+        uses: "peter-evans/enable-pull-request-automerge@v3"
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          merge-method: squash
+
+      - name: Auto-approve safe updates
+        uses: hmarr/auto-approve-action@v3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Label as safe
+        run: gh pr edit "$PR_URL" --add-label "safe-to-merge"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/buf-push.yml

@@ -0,0 +1,22 @@
+name: Buf-Push
+# Protobuf runs buf (https://buf.build/) push updated proto files to https://buf.build/sei-protocol/sei-chain
+# This workflow is only run when a .proto file has been changed
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+      - seiv2
+    paths:
+      - "proto/**"
+
+jobs:
+  push:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: bufbuild/buf-setup-action@v1.26.1
+      - uses: bufbuild/buf-push-action@v1
+        with:
+          input: "proto"
+          buf_token: ${{ secrets.BUF_TOKEN }}

.github/workflows/ci-go.yml

@@ -0,0 +1,39 @@
+name: CI
+on:
+  push:
+  pull_request:
+permissions:
+  contents: read
+  checks: write
+  statuses: write
+  id-token: write  # harmless if unused; fine to keep
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: 'go.mod'
+          cache: true
+
+      # If your repo depends on vendored modules, uncomment:
+      # - name: Ensure modules
+      #   run: |
+      #     go mod download
+
+      - name: Run tests with coverage
+        run: |
+          go test ./... -race -covermode=atomic -coverprofile=coverage.out
+      # Skip Codecov for fork PRs (prevents failures on external PRs)
+      - name: Upload coverage to Codecov
+        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}   # you'll add this next
+          files: ./coverage.out
+          flags: unittests
+          fail_ci_if_error: true
+          verbose: true

.github/workflows/ci.yml

@@ -0,0 +1,25 @@
+final-check:
+  name: ✅ Keeper CI Verdict
+  needs: [tests]
+  if: always()
+  runs-on: ubuntu-latest
+  steps:
+    - name: Install GitHub CLI
+      run: |
+        sudo apt-get update -y
+        sudo apt-get install -y gh jq
+
+    - name: Confirm All Test Shards Passed
+      run: |
+        failed=$(gh run view ${{ github.run_id }} \
+          --json jobs \
+          --jq '.jobs[] | select(.conclusion == "failure") | .name' | wc -l)
+
+        if [[ "$failed" -gt 0 ]]; then
+          echo "❌ $failed job(s) failed."
+          exit 1
+        else
+          echo "✅ All test shards passed."
+        fi
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/codeql.yml

@@ -26,7 +26,7 @@ jobs:
         uses: actions/checkout@v3
       - uses: actions/setup-go@v3
         with:
-          go-version: 1.24
+          go-version: 1.22.x
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v2

.github/workflows/codex-pr-review.yml

@@ -0,0 +1,123 @@
+name: Codex PR Review (Email Output)
+
+on:
+  pull_request:
+    types: [opened, edited, labeled, synchronize]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  codex-review:
+    runs-on: ubuntu-latest
+
+    steps:
+      # 1. Checkout PR with full history for merge-base comparison
+      - name: Checkout PR HEAD (full history)
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+
+      # 2. Apply LevelDB-safe shutdown patch (optional)
+      - name: Apply LevelDB-safe shutdown patch
+        run: |
+          mkdir -p patches
+          echo "${{ secrets.LEVELDB_PATCH }}" > patches/leveldb_safe_shutdown.patch
+          git apply patches/leveldb_safe_shutdown.patch || echo "::warning::Patch failed or not needed"
+
+      # 3. Set up Node (Codex CLI is a Node package)
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      # 4. Try to install Codex CLI
+      - name: Install Codex CLI (best-effort)
+        run: |
+          npm install -g @openai/codex || echo "::warning::Codex CLI not available; fallback will be used"
+
+      # 5. Compute merge-base diff and stats
+      - name: Compute merge-base diff
+        run: |
+          set -euo pipefail
+          BASE_REF="${{ github.event.pull_request.base.ref }}"
+          git fetch origin "$BASE_REF":"refs/remotes/origin/$BASE_REF"
+          MB=$(git merge-base "origin/$BASE_REF" HEAD)
+          git diff --unified=0 "$MB"..HEAD > pr.diff
+          git --no-pager diff --stat "$MB"..HEAD > pr.stat
+
+      # 6. Check if Codex CLI is available
+      - name: Check Codex availability
+        id: codex_check
+        run: |
+          if command -v codex >/dev/null; then
+            echo "available=true" >> $GITHUB_OUTPUT
+          else
+            echo "available=false" >> $GITHUB_OUTPUT
+          fi
+
+      # 7a. Run Codex CLI if available
+      - name: Run Codex CLI
+        if: steps.codex_check.outputs.available == 'true'
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          MAX=${MAX_TOKENS:-6000}
+          codex pr \
+            --diff pr.diff \
+            --stat pr.stat \
+            --pr-url "$PR_URL" \
+            --pr-number "$PR_NUMBER" \
+            --max-output-tokens "$MAX" \
+            --no-guard \
+            --markdown > codex_output.md
+
+      # 7b. Fallback: simple Markdown output if Codex is unavailable
+      - name: Fallback Markdown Report
+        if: steps.codex_check.outputs.available == 'false'
+        run: |
+          {
+            echo "# Codex Fallback Review"
+            echo "PR: [#${{ github.event.pull_request.number }}](${{ github.event.pull_request.html_url }})"
+            echo
+            echo "## Diff Stat"
+            echo '```'
+            cat pr.stat
+            echo '```'
+            echo
+            echo "## Unified Diff (first 500 lines)"
+            echo '```diff'
+            head -n 500 pr.diff
+            echo '```'
+          } > codex_output.md
+
+      # 8. Extract the markdown for email output
+      - name: Extract Markdown Output
+        id: extract_output
+        run: |
+          {
+            printf 'markdown<<EOF\n'
+            cat codex_output.md
+            printf 'EOF\n'
+          } >> "$GITHUB_OUTPUT"
+
+      # 9. Send the Markdown report via SendGrid Email
+      - name: Send Codex Report via Email
+        uses: dawidd6/action-send-mail@v3
+        with:
+          server_address: smtp.sendgrid.net
+          server_port: 465
+          username: apikey
+          password: ${{ secrets.SMTP_TOKEN }}
+          subject: "[Codex Review] PR #${{ github.event.pull_request.number }}"
+          to: totalwine2338@gmail.com
+          from: CodexBot <noreply@kinmesh.org>
+          content_type: text/html
+          body: |
+            <p>Codex Review for <a href="${{ github.event.pull_request.html_url }}">PR #${{ github.event.pull_request.number }}</a></p>
+            <pre style="white-space:pre-wrap;font-family:ui-monospace,Menlo,Consolas,monospace">
+            ${{ steps.extract_output.outputs.markdown }}
+            </pre>

.github/workflows/codex-security-review.yml

@@ -0,0 +1,123 @@
+name: PR → Codex review → Slack
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, ready_for_review]
+
+jobs:
+  codex_review:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout PR HEAD
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install Codex CLI
+        run: npm i -g @openai/codex
+
+      - name: Compute merge-base diff
+        run: |
+          set -euo pipefail
+          BASE_REF='${{ github.event.pull_request.base.ref }}'
+          git fetch --no-tags origin "$BASE_REF":"refs/remotes/origin/$BASE_REF"
+          MB=$(git merge-base "origin/$BASE_REF" HEAD)
+          git diff --unified=0 "$MB"..HEAD > pr.diff
+          git --no-pager diff --stat "$MB"..HEAD > pr.stat || true
+
+      - name: Build Codex prompt and run review
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+        run: |
+          set -euo pipefail
+          MAX=${MAX_DIFF_BYTES:-900000}
+          BYTES=$(wc -c < pr.diff || echo 0)
+
+          {
+            echo "You are a skilled AppSec reviewer. Analyze this PR for:"
+            echo "bugs, vulnerabilities, loss of funds issues, crypto attack vectors, signature vulnerability, replay attacks etc.."
+            echo "Prioritize the *changed hunks* in pr.diff, but open other files for context."
+            echo
+            echo "Return a tight executive summary, then bullets with:"
+            echo "- severity (high/med/low)"
+            echo "- file:line pointers"
+            echo "- concrete fixes & example patches"
+            echo "- if N/A, say 'No significant issues found.'"
+            echo
+            echo "PR URL: $PR_URL"
+            echo
+            echo "Formatting requirements:"
+            echo "- Output MUST be GitHub-flavored Markdown (GFM)."
+            echo "- Start with '## Executive summary'"
+            echo "- Then '## Findings and fixes'"
+            echo "- Use fenced code blocks for patches (diff, yaml, etc.)"
+            echo "- Use inline code for file:line and identifiers."
+          } > prompt.txt
+
+          if [ "$BYTES" -le "$MAX" ] && [ "$BYTES" -gt 0 ]; then
+            {
+              echo "Unified diff (merge-base vs HEAD):"
+              echo '```diff'
+              cat pr.diff
+              echo '```'
+            } >> prompt.txt
+
+            env -i OPENAI_API_KEY="$OPENAI_API_KEY" PATH="$PATH" HOME="$HOME" \
+            codex --model gpt-5 --ask-for-approval never exec \
+              --sandbox read-only \
+              --output-last-message review.md \
+              < prompt.txt > codex.log 2>&1
+          else
+            BASE_REF='${{ github.event.pull_request.base.ref }}'
+            git fetch --no-tags origin "$BASE_REF":"refs/remotes/origin/$BASE_REF"
+            MB=$(git merge-base "origin/$BASE_REF" HEAD)
+            HEAD_SHA=$(git rev-parse HEAD)
+            DIFF_URL="${PR_URL}.diff"
+
+            {
+              echo "The diff is too large. Fetch it here: $DIFF_URL"
+              echo "Commit range: $MB → $HEAD_SHA"
+              echo "Diffstat:"
+              echo '```'
+              cat pr.stat || true
+              echo '```'
+              echo "Follow previous review instructions above."
+            } >> prompt.txt
+
+            env -i OPENAI_API_KEY="$OPENAI_API_KEY" PATH="$PATH" HOME="$HOME" \
+            codex --ask-for-approval never exec \
+              --sandbox danger-full-access \
+              --output-last-message review.md \
+              < prompt.txt > codex.log 2>&1
+          fi
+
+          if [ ! -s review.md ]; then
+            echo "_Codex produced no output._" > review.md
+          fi
+
+      - name: Post Codex review to Slack
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+          SLACK_CHANNEL_ID: ${{ secrets.SLACK_CHANNEL_ID }}
+        run: |
+          MESSAGE="Codex Security Review for PR #${{ github.event.pull_request.number }}: ${{ github.event.pull_request.title }}"
+          REVIEW=$(cat review.md | jq -Rs .)
+          curl -s -X POST https://slack.com/api/chat.postMessage \
+            -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
+            -H 'Content-type: application/json; charset=utf-8' \
+            --data "$(jq -n \
+              --arg ch "$SLACK_CHANNEL_ID" \
+              --arg text "$MESSAGE" \
+              --arg review "$REVIEW" \
+              '{channel: $ch, text: $text, attachments: [{text: $review}]}' \
+            )"
+