tool-containers
Search docs…Ctrl K
Menu
GitHub (opens in new tab)

Run Codex CLI with GitHub Actions

workflow.yml reviews each pull request with Codex and writes the review to the job summary. It pipes the diff into codex exec, which treats piped input as context for the prompt.

Images
  • GHCRghcr.io/hambn/codex
  • Docker Hubdocker.io/hambn/codex
Use case
Code review in CI on GitHub pull requests
Upstream
github.com/openai/codex (opens in new tab)
Source
tools/ai/codex/docs/github-actions (opens in new tab)
On this page

Prerequisites

Set up

Shell
mkdir -p .github/workflows
cp workflow.yml .github/workflows/codex-review.yml

It runs on every pull request opened from a branch of the same repository.

The workflow runs ghcr.io/hambn/codex:ubuntu. Replace the tag with @sha256:<digest> to pin one build.

Variables

Variable Required Purpose
CODEX_API_KEY yes Repository secret: OpenAI API key, passed to the review step only. codex exec reads this variable, not OPENAI_API_KEY.

Workspace

The runner checks out the pull request merge commit and its first parent. The review container mounts the checkout read-only at /workspace and runs as sysadmin (UID 1000); it does not receive the job's GitHub token. Because the checkout belongs to the runner user, the step passes GIT_CONFIG_* variables that mark /workspace as a Git safe directory.

Files

Limitations

  • Pull requests from forks are skipped, because GitHub does not pass secrets to workflows they trigger.
  • The review is advisory: the job does not comment on the pull request or fail on findings. Read it in the job summary.
  • The diff is untrusted model input. The step has a read-only mount and no GitHub token, which limits what a crafted change can make the agent do.
  • Codex runs with --sandbox danger-full-access because its own sandbox may not work inside a container, as the Codex security docs (opens in new tab) describe. The container is the only isolation: it can reach the network, and a crafted change can make Codex read CODEX_API_KEY.

File contents

workflow.yml42 lines
# Copy to .github/workflows/codex-review.yml and add a CODEX_API_KEY repository secret.
name: codex review

on:
  pull_request:

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  review:
    name: Review with Codex
    # GitHub does not pass secrets to workflows triggered from forks, so skip those pull requests.
    if: github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # The pull request merge commit and its first parent, the base branch, cover the diff.
          fetch-depth: 2
          persist-credentials: false
      - name: Review
        # An explicit bash shell adds pipefail, so a failed git diff fails the step.
        shell: bash
        env:
          CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
        run: |
          # The checkout belongs to the runner user, so Git in the container needs it marked safe.
          # Codex's own sandbox may not work inside Docker; the container and read-only mount isolate it.
          git diff HEAD^1 HEAD |
            docker run --rm -i -e CODEX_API_KEY \
              -e GIT_CONFIG_COUNT=1 -e GIT_CONFIG_KEY_0=safe.directory -e GIT_CONFIG_VALUE_0=/workspace \
              -v "$GITHUB_WORKSPACE:/workspace:ro" \
              ghcr.io/hambn/codex:ubuntu \
              exec --sandbox danger-full-access "Review this pull request diff for bugs, security issues, and missing tests. Reply in Markdown." \
            >> "$GITHUB_STEP_SUMMARY"

Topics