🤖 fix: accept Resolved mark on Codex summary findings

[ThomasK33]

Summary

scripts/check_codex_comments.sh now accepts the · **Resolved** suffix that Codex appends to finding lines in its review-summary card. A finding marked Resolved, or whose review thread is resolved, no longer fails the Codex Comments check. Unresolved findings still fail.

Background

Codex now writes resolved findings in the summary card as, for example:

- 🟡 [Title](https://github.com/coder/coder-k8s/pull/212#discussion_r4173840086) · **Medium** · **Resolved**

The finding regex required the line to end right after the severity (· \*\*(Critical|High|Medium|Low)\*\*$). A marked line did not match, so the whole card counted as an unresolved comment. This turned the non-required Codex Comments check red on #212 (run 37137600873), although all 11 Codex threads on that PR were resolved.

Implementation

• finding_regex takes an optional · \*\*Resolved\*\* group after the severity, anchored at end of line.
• is_resolved_finding clears a finding that links to this PR when the exact Resolved mark is present, or (as before) when its linked thread is a resolved thread the bot started.
• The Resolved mark alone clears a finding, even when its thread is missing from the thread list. This trusts the bot-authored card, as requested. An open bot thread still blocks through the separate thread count.
• Unchanged: the card shape checks, the same-repo/same-PR link check, the finding count check, and the separate count of unresolved bot threads. A finding marked Resolved whose thread is still open keeps the check red through that thread count.

Validation

• Tests first: the new cases failed on origin/main (3 of 68 failed), then passed with the fix (68 of 68).
• New frozen fixture summary-security-advisory-findings-resolved-pr212.txt: the 🤖 docs: add GitOps health rules for CoderTemplateTest #212 summary card (comment 5970636463) with only the two finding titles replaced. It has one marked and one unmarked finding, as in the failing run.
• New cases: marked + thread resolved (pass), marked + thread missing (pass), real 🤖 docs: add GitOps health rules for CoderTemplateTest #212 card with both threads resolved (pass); unmarked 🤖 docs: add GitOps health rules for CoderTemplateTest #212 finding with an unresolved or missing thread (fail), marked finding with an unresolved thread (fail), marked finding linking another PR (fail), and lookalike marks **Unresolved**, **resolved**, unbolded, repeated, trailing text (all fail).
• make test-scripts, and shellcheck 0.11.0 on both scripts. No workflow changed, so actionlint was not needed.

Risks

Low. Only the non-required Codex Comments check uses this parser. The change widens one exact, end-anchored suffix, and only on bot-authored cards that already pass the structural checks.

---

Generated with mux • Model: anthropic:claude-opus-5-5 • Thinking: high

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-03T17:57:12.355837Z	93a7b7d	Manual request
🔒 Security Review	✅ Completed 2026-10-03T17:49:52.358979Z	93a7b7d	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 93a7b7d3d5

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[ThomasK33]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 93a7b7d3d5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".