[mldangelo-oai]

Summary

The GitHub Action forced OpenAI even though the scan CLI supports other inference providers. Add a provider input matching scan --provider: openai, amazon-bedrock, openrouter, and fireworks. OpenAI and its existing model remain the defaults.

Changes

• Forward provider and model selections to the CLI, which owns provider configuration and model requirements.
• Capture only the selected provider's credentials before setup. Bedrock uses native AWS authentication; OpenRouter and Fireworks use their existing CLI API-key environment variables. Installation and dry runs remain credential-free.
• Keep automatic-auth SDK preflight and CLI dry runs credential-free for OpenRouter and Fireworks, including the packed 0.3.0 CLI. Real scans and explicit api-key/chatgpt modes still require the selected provider’s key.
• Add an AWS OIDC workflow, an OpenRouter step example, provider setup guidance, and the rebuilt Action distribution.
• Cover both scan modes, CLI model-validation errors, credential isolation, PR severity outcomes, and fresh/resumed Deep Scan discovery and reducer launches. Add hosted smoke tests for the OpenAI default and Bedrock.

Testing

• Action tests: 152 passed locally on macOS. The Linux-only installer fixture was excluded locally and remains enabled in Action CI.
• Action typecheck, metadata contract, generated documentation, and distribution checks passed.
• Integration checks against both the published CLI 0.2.0 and a freshly packed CLI 0.3.0 passed without model calls, including credential-free provider previews, provider selection and missing-model errors in standard and Deep modes, reports, severity exits, sandbox enforcement, and runtime helpers.
• SDK regression tests passed for credential-free previews, strict real-scan authentication, and explicit authentication in both scan modes; the new preview cases failed before the fix. SDK type/schema and formatting checks passed.
• Full Deep Scan executor suite and MCP schema/type checks passed. Tests verify temporary AWS credentials and selected API-provider credentials at fresh/resumed worker launches, including retained per-scan settings.
• Plugin Ruff lint/format checks, worker-test formatting, SDK portable-check compilation, source compatibility checks, and all 9 compatibility-check tests passed.
• Action workflow lint and security lint passed; git diff --check passed.
• A full local SDK run was interrupted after a timeout and host environment failures. Cancellation and runtime tests passed targeted reruns; a hook-installation test is blocked locally by a managed global Git hook. The full suite still needs a clean CI run.
• No live provider authentication, OIDC exchange, or model inference was performed.

Risk and rollout

Existing workflows retain the OpenAI provider, gpt-5.6-sol model, and API-key authentication. Other providers require an explicit model ID and an Action revision containing this change; action-v0.3.0 supports OpenAI only. The existing CLI release pin is unchanged. In the SDK and CLI, automatic-auth preflight (scan --dry-run, with the default --auth auto) can describe external-provider configuration without credentials; no flags or defaults were added or changed.

Temporary AWS credentials must last for the scan; the Action does not refresh exported credentials. AWS profiles require explicit configuration/credential file paths because the Action retains its isolated home. GitHub-specific checkout, report, and credential-isolation behavior stays in the Action; provider setup and model validation stay in the CLI.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T17:46:27.796369Z	2a5a2cc	New commits
🔒 Security Review	✅ Completed 2026-10-16T17:49:08.256339Z	2a5a2cc	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[dans-oai]

Looks good. Definitely a good call to expose this input