fix: move codex exec subcommand before model flag in lock files

[Copilot]

The -c model=... flag was placed before the exec subcommand in codex invocations, causing model overrides via GH_AW_MODEL_AGENT_CODEX / GH_AW_MODEL_DETECTION_CODEX to be silently ignored (codex discards unknown top-level flags).

Before:

codex ${GH_AW_MODEL_AGENT_CODEX:+-c model="$GH_AW_MODEL_AGENT_CODEX" }exec -c web_search="disabled" ...

After:

codex exec ${GH_AW_MODEL_AGENT_CODEX:+-c model="$GH_AW_MODEL_AGENT_CODEX" }-c web_search="disabled" ...

• Fixed all 4 occurrences across smoke-codex.lock.yml (agent + detection) and secret-digger-codex.lock.yml (agent + detection)
• The trailing space inside the ${:+... } expansion ensures correct token separation when the variable is set

[Copilot]

Pull request overview

This PR fixes Codex CLI invocations in workflow lock files so optional model overrides (GH_AW_MODEL_AGENT_CODEX / GH_AW_MODEL_DETECTION_CODEX) are applied correctly by ensuring the exec subcommand appears before any -c ... flags.

Changes:

• Reordered arguments in codex calls from codex [flags] exec ... to codex exec [flags] ... for agent runs.
• Reordered arguments in codex calls from codex [flags] exec ... to codex exec [flags] ... for detection runs.
• Applied the fix consistently across the two Codex lock workflows (4 total call sites).

Show a summary per file

File	Description
.github/workflows/smoke-codex.lock.yml	Moves exec before -c model=... so model overrides are not ignored in both agent and detection Codex runs.
.github/workflows/secret-digger-codex.lock.yml	Same codex exec argument order fix for both agent and detection runs.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	86.22%	86.31%	📈 +0.09%
Statements	86.08%	86.17%	📈 +0.09%
Functions	87.50%	87.50%	➡️ +0.00%
Branches	78.81%	78.86%	📈 +0.05%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/docker-manager.ts	86.6% → 86.9% (+0.36%)	86.0% → 86.4% (+0.35%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

Smoke Test Results

• ✅ GitHub MCP: "chore: upgrade smoke-copilot workflow to gh-aw v0.67.3", "fix: normalize API target env vars to bare hostnames via URL parsing"
• ✅ Playwright: github.com title contains "GitHub"
• ✅ File write: /tmp/gh-aw/agent/smoke-test-claude-24153270491.txt created
• ✅ Bash verify: file content confirmed

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude

[github-actions]

🔥 Smoke Test Results — PASS

Test	Result
GitHub MCP (list PRs)	✅
GitHub.com connectivity (HTTP 200)	✅
File write/read (smoke-test-copilot-24153270441.txt)	✅

PR: fix: move codex exec subcommand before model flag in lock files
Author: @Copilot | Assignees: @lpcox, @Copilot

Overall: PASS ✅

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

Smoke Test Results

PR titles: "fix: normalize API target env vars to bare hostnames via URL parsing"; "feat: forward OIDC env vars into agent container"

1. GitHub MCP (last 2 merged PRs): ✅
2. Safe Inputs GH CLI (safeinputs-gh): ❌
3. Playwright title contains "GitHub": ❌
4. Tavily web search: ❌
5. File write /tmp/gh-aw/agent/smoke-test-codex-24153270456.txt: ✅
6. Bash cat readback: ✅
7. Discussion query + mystical comment: ❌
8. npm ci && npm run build: ✅
   Overall status: FAIL

🔮 The oracle has spoken through Smoke Codex

[github-actions]

Smoke Test: GitHub Actions Services Connectivity ✅

Check	Result
Redis PING (host.docker.internal:6379)	✅ PONG
PostgreSQL ready (host.docker.internal:5432)	✅ accepting connections
PostgreSQL SELECT 1 (db: smoketest, user: postgres)	✅ returned 1

All checks passed.

🔌 Service connectivity validated by Smoke Services

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	passed	✅ PASS
Go	env	✅	passed	✅ PASS
Go	uuid	✅	passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #1807 · ● 578.3K · ◷