fix: create custom Codex home before proxy setup

[sylvesterkaczmarek]

Summary

Ensure the resolved Codex home is usable before proxy setup, including the shared server-info path required by safety-strategy: unprivileged-user.

Fixes #135.

Problem

A user-supplied codex-home takes an early return from home resolution and may not exist yet. The composite action then immediately derives:

$CODEX_HOME/$GITHUB_RUN_ID.json

and starts codex-responses-api-proxy --server-info <that path>. A missing parent directory causes proxy setup to fail later with responses-api-proxy did not write server info.

There is a second ownership boundary for unprivileged-user: Codex home is intentionally owned by the unprivileged account, but the Responses proxy runs as the action's current user. A 0755 home owned by the Codex user therefore does not let the proxy create a new per-run server-info file. This also affects an existing unprivileged home when a new GitHub run produces a new $GITHUB_RUN_ID.json path.

Reproduction

A fresh custom path is enough:

- uses: openai/codex-action@v1
  with:
    openai-api-key: ${{ secrets.OPENAI_API_KEY }}
    codex-home: ${{ runner.temp }}/fresh-codex-home
    prompt: Say hello.

For unprivileged-user, the same failure can occur when the Codex home already exists but the current run's server-info file does not.

Fix

Add an explicit Ensure Codex home exists step immediately after home resolution.

For ordinary safety strategies, the helper recursively creates the resolved directory under the current runner identity.

For unprivileged-user, it mirrors the repository's existing shared-home model:

• create a missing home through sudo mkdir -p;
• assign the home to codex-user and keep mode 0755;
• derive $CODEX_HOME/$GITHUB_RUN_ID.json;
• if that per-run server-info file does not exist, pre-create it and temporarily set mode 0666 so the runner-owned proxy can write it.

The existing Wait for Responses API proxy step already hardens that server-info file back to root:0444 after startup.

Existing homes and existing server-info files are left untouched.

Regression coverage

Added dependency-free Node tests covering:

1. missing nested home creation for ordinary strategies;
2. creation of a new unprivileged home plus its writable per-run server-info file;
3. an already-existing unprivileged home receiving a new server-info file for a new GitHub run;
4. a clear error when codex-user is missing;
5. a clear error when GITHUB_RUN_ID is unavailable for the shared-file path.

The privilege tests use a fake sudo executable so exact command boundaries are asserted without requiring elevated local privileges.

Validation

• all 5/5 focused behavioural tests pass locally with Node's built-in test runner;
• branch is based directly on current upstream main (c385816875cc2fc8e033ed9d1cba96f8c331210e);
• no files under src/ are changed, so the checked-in dist/main.js bundle remains valid;
• scope remains limited to action.yml, scripts/ensureCodexHome.mjs, and test/ensureCodexHome.test.mjs.

Risk

Low. Existing valid homes and existing server-info files retain their current ownership and permissions. The new behaviour only prepares missing state that the action already expects to use, and follows the same temporary server-info permission model already used by the built-in unprivileged-home path.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[sylvesterkaczmarek]

I have read the CLA Document and I hereby sign the CLA