[codex] Trigger GCP lab from maintainer label

[adamcohenhillel]

Summary

• add a pull_request_target label trigger for run-gcp-lab
• keep trusted workflow checkout on the base SHA for PR events
• read PR clone/ref metadata from the GitHub event payload before running code only inside the disposable GCP VM

Validation

• Ruby/Psych workflow YAML parse
• ./scripts/check.sh
• git diff --check

Notes

This is the follow-up for the skipped/action-required approved-review run on PR #51. After this lands, maintainers can apply run-gcp-lab to an approved public PR to trigger the disposable GCP emulator lab.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openphone-docs	Ready	Preview, Comment	Jul 1, 2026 11:02am

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fb0575cb98

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restrict the label trigger to trusted maintainers

When this workflow is enabled on repos that grant non-maintainers triage access, this condition lets them trigger the GCP lab just by applying run-gcp-lab—GitHub documents that anyone with triage access can apply labels. That label path has id-token: write and eventually scripts/lab/gcp/run-smoke.sh clones and executes the PR head on a GCP VM, so the approval/maintainer association check used for pull_request_review should also be enforced here or verified through the API before starting cloud resources.

Useful? React with 👍 / 👎.