ci: codex 0.115.0 changes

Author: seratch

.github/workflows/pr-labels.yml

@@ -130,6 +130,9 @@ jobs:
           prompt-file: .github/codex/prompts/pr-labels.md
           output-file: ${{ steps.codex-output.outputs.output_file }}
           output-schema-file: .github/codex/schemas/pr-labels.json
+          # Keep the legacy Linux sandbox path until the default bubblewrap path
+          # works reliably on GitHub-hosted Ubuntu runners.
+          codex-args: '["--enable","use_legacy_landlock"]'
           safety-strategy: drop-sudo
           sandbox: read-only
       - name: Apply labels

.github/workflows/release-pr-update.yml

@@ -79,6 +79,9 @@ jobs:
           openai-api-key: ${{ secrets.PROD_OPENAI_API_KEY }}
           prompt-file: .github/codex/prompts/release-review.md
           output-file: ${{ steps.codex-output.outputs.output_file }}
+          # Keep the legacy Linux sandbox path until the default bubblewrap path
+          # works reliably on GitHub-hosted Ubuntu runners.
+          codex-args: '["--enable","use_legacy_landlock"]'
           safety-strategy: drop-sudo
           sandbox: read-only
       - name: Update PR body and push

.github/workflows/release-pr.yml

@@ -106,6 +106,9 @@ jobs:
           openai-api-key: ${{ secrets.PROD_OPENAI_API_KEY }}
           prompt-file: .github/codex/prompts/release-review.md
           output-file: ${{ steps.codex-output.outputs.output_file }}
+          # Keep the legacy Linux sandbox path until the default bubblewrap path
+          # works reliably on GitHub-hosted Ubuntu runners.
+          codex-args: '["--enable","use_legacy_landlock"]'
           safety-strategy: drop-sudo
           sandbox: read-only
       - name: Build PR body