GitHubSource
openai/codex-action
by openai · 2025-10-01 (repo created)
✓ Repo metadata and README fetched from GitHub on 2026-10-15
Read the original ↗Part 1 · What the source did
OpenAI's action runs Codex CLI inside a workflow with locked-down privileges; the README's example posts a code review comment on each new PR.
- Installs Codex CLI and routes calls through a secure proxy.
- Example workflow: shallow clone, fetch base and head, run Codex with a PR-specific prompt, post the output as a comment.
Summary written by Agent Cookbook. See the original for the full context.
Part 2 · Our copy-paste version
Adapted by us from what the source described. Fill in the [BRACKETS].
The prompt
You are reviewing PR #[NUMBER]: [TITLE].
Compare [BASE] to [HEAD]. Report only real problems: bugs, security risks, broken edge cases, missing tests.
Format: a markdown list, each item with file:line, severity (high/med/low) and a one-sentence fix.
If you find nothing important, say "No blocking issues" and stop.
🛡
Approval ruleWorkflow gets contents: read; only the comment step can write.
Set it up
- Add the key as a secret.
- Copy the README example workflow.
- Replace the prompt with the one above.
- Read the repo's security doc and keep permissions read-only.
Common failures
⚠
What usually goes wrong
- Noisy nitpicks. Tell it to report only real problems.
- Forked PRs can't read secrets by default; that's intended.
Variations
- Run on a label instead of every PR.
- Pair with the Claude action and compare reviews.