fix: pass codex api key to clawhub judge

Patrick-Erichsen · Patrick-Erichsen · commit 5cec0b347af8 · 2026-06-26T19:09:14.000-07:00
diff --git a/.github/workflows/run-clawscan-benchmark.yml b/.github/workflows/run-clawscan-benchmark.yml
@@ -125,6 +125,8 @@ on:
         required: false
       ANTHROPIC_API_KEY:
         required: false
+      CODEX_API_KEY:
+        required: false
       OPENAI_API_KEY:
         required: false
       SNYK_TOKEN:
@@ -189,6 +191,7 @@ jobs:
           AIG_MODEL_API_KEY: ${{ secrets.AIG_MODEL_API_KEY }}
           AIG_MODEL_BASE_URL: ${{ secrets.AIG_MODEL_BASE_URL }}
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          CODEX_API_KEY: ${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
           SOCKET_CLI_API_TOKEN: ${{ secrets.SOCKET_CLI_API_TOKEN }}
diff --git a/README.md b/README.md
@@ -232,6 +232,7 @@ profiles:
     sandbox:
       env:
         - OPENAI_API_KEY
+        - CODEX_API_KEY
     judge:
       command: >
         codex exec --cd {{ workspace }}
diff --git a/docs/profiles.md b/docs/profiles.md
@@ -39,6 +39,7 @@ profiles:
     sandbox:
       env:
         - OPENAI_API_KEY
+        - CODEX_API_KEY
     judge:
       command: >
         codex exec --cd {{ workspace }}
diff --git a/internal/profiles/clawhub/clawscan.yml b/internal/profiles/clawhub/clawscan.yml
@@ -8,6 +8,7 @@ profiles:
     sandbox:
       env:
         - OPENAI_API_KEY
+        - CODEX_API_KEY
     judge:
       command: >-
         codex exec --cd {{ workspace }}
diff --git a/internal/profiles/resolver_test.go b/internal/profiles/resolver_test.go
@@ -47,7 +47,7 @@ func TestResolveArgsUsesEmbeddedClawHubProfile(t *testing.T) {
 	if string(opts.Judge.Files["clawhub/output.schema.json"]) == "" {
 		t.Fatal("expected embedded clawhub output schema file")
 	}
-	if got := strings.Join(opts.Sandbox.Env, ","); got != "OPENAI_API_KEY" {
+	if got := strings.Join(opts.Sandbox.Env, ","); got != "OPENAI_API_KEY,CODEX_API_KEY" {
 		t.Fatalf("sandbox env = %q", got)
 	}
 }
@@ -390,7 +390,7 @@ func TestResolveArgsAppliesCLIOverrides(t *testing.T) {
 	if opts.Sandbox.Image != "ghcr.io/acme/runtime:v1" {
 		t.Fatalf("sandbox image = %q", opts.Sandbox.Image)
 	}
-	if got := strings.Join(opts.Sandbox.Env, ","); got != "OPENAI_API_KEY,ANTHROPIC_API_KEY" {
+	if got := strings.Join(opts.Sandbox.Env, ","); got != "OPENAI_API_KEY,CODEX_API_KEY,ANTHROPIC_API_KEY" {
 		t.Fatalf("sandbox env = %q", got)
 	}
 }
diff --git a/skills/clawscan-cli/SKILL.md b/skills/clawscan-cli/SKILL.md
@@ -106,6 +106,7 @@ sandbox:
   mode: docker
   env:
     - OPENAI_API_KEY
+    - CODEX_API_KEY
 profiles:
   review:
     scanners:

Original file line number	Diff line number	Diff line change
`@@ -47,7 +47,7 @@ func TestResolveArgsUsesEmbeddedClawHubProfile(t *testing.T) {`
`47`	`47`	`if string(opts.Judge.Files["clawhub/output.schema.json"]) == "" {`
`48`	`48`	`t.Fatal("expected embedded clawhub output schema file")`
`49`	`49`	`}`
`50`		`- if got := strings.Join(opts.Sandbox.Env, ","); got != "OPENAI_API_KEY" {`
	`50`	`+ if got := strings.Join(opts.Sandbox.Env, ","); got != "OPENAI_API_KEY,CODEX_API_KEY" {`
`51`	`51`	`t.Fatalf("sandbox env = %q", got)`
`52`	`52`	`}`
`53`	`53`	`}`
`@@ -390,7 +390,7 @@ func TestResolveArgsAppliesCLIOverrides(t *testing.T) {`
`390`	`390`	`if opts.Sandbox.Image != "ghcr.io/acme/runtime:v1" {`
`391`	`391`	`t.Fatalf("sandbox image = %q", opts.Sandbox.Image)`
`392`	`392`	`}`
`393`		`- if got := strings.Join(opts.Sandbox.Env, ","); got != "OPENAI_API_KEY,ANTHROPIC_API_KEY" {`
	`393`	`+ if got := strings.Join(opts.Sandbox.Env, ","); got != "OPENAI_API_KEY,CODEX_API_KEY,ANTHROPIC_API_KEY" {`
`394`	`394`	`t.Fatalf("sandbox env = %q", got)`
`395`	`395`	`}`
`396`	`396`	`}`