OpenAICodex Action is a GitHub Action that runs the Codex CLI non-interactively (codex exec) inside a GitHub Actions workflow. It installs the CLI, starts a proxy to the OpenAI Responses API so the API key is not handed to Codex directly, runs a prompt against the checked-out repository, and returns the final Codex message as a step output that later steps can use.
A typical use is a custom pull request review bot: a workflow triggered on a new pull request fetches the base and head refs, runs Codex with a prompt describing the change, and posts the output as a comment. The prompt comes inline or from a file, and an optional JSON schema constrains the structure of the final message.
Access control has two layers. Codex permission profiles describe filesystem and network access (:workspace for editing the checkout, :read-only for review), and a separate safety strategy decides what the runner user may do. The default drop-sudo strategy revokes sudo, blocks root-owned service sockets such as the Docker daemon, and starts Codex with no capabilities. Other strategies run Codex as a dedicated unprivileged user, in a read-only sandbox, or with no restrictions, which is the only option on Windows runners. Protected runs reject CLI overrides that would change permissions, trust, model providers, or command execution.
Only users with write access to the repository, plus explicitly listed users and bots, can trigger the action. A custom Responses API endpoint lets the action use OpenAI models hosted on Azure.
Features
- Codex in CI: runs codex exec with a prompt or prompt file and exposes the final message as a step output
- Responses API proxy: the API key goes to a proxy rather than straight into the Codex process
- Permission profiles: built-in :workspace and :read-only profiles, or named profiles from a trusted configuration
- Safety strategies: drop-sudo, unprivileged-user, read-only, and unsafe modes control the runner's privileges
- Argument validation: protected runs reject overrides that change permissions, trust, providers, or command execution
- Trigger allowlist: only repository writers and listed users or bots can start a run
- Structured output: an inline or file-based schema shapes the final Codex message
- Model and effort: inputs choose the model and reasoning effort, or leave Codex's defaults
- Azure endpoint: a Responses API endpoint override targets OpenAI models hosted on Azure
