openai/Codex Exec Action
Run `codex exec` with a prompt.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 4, 2026
- License
- Apache 2.0
Pinned Snippet
uses: openai/codex-action@52fe01ec70a42f454c9d2ebd47598f9fd6893d56 # v1.11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| prompt | Prompt to pass to Codex. `prompt` or `prompt-file` must be provided. | no | "" |
| prompt-file | Path to file that contains the prompt to pass to Codex. `prompt` or `prompt-file` must be provided. | no | "" |
| output-file | File where the final Codex message is written. Leave empty to skip writing a file. | no | "" |
| openai-api-key | OpenAI API key used by Codex. | no | "" |
| responses-api-endpoint | Optional Responses API endpoint override, e.g. https://example.openai.azure.com/openai/v1/responses. Defaults to the proxy's built-in endpoint when empty. | no | "" |
| working-directory | Working directory that Codex should use. Defaults to the repository root. | no | "" |
| sandbox | Legacy sandbox mode for Codex. One of `workspace-write`, `read-only` or `danger-full-access`. Prefer `permission-profile: ":workspace"` for new workflows. Leave empty to use the legacy `workspace-write` fallback unless `permission-profile` is set. | no | "" |
| permission-profile | Codex permission profile to select through `default_permissions`, such as `:read-only`, `:workspace`, or a named profile defined in `codex-home/config.toml`. Mutually exclusive with `sandbox`. See https://developers.openai.com/codex/permissions. | no | "" |
| codex-version | Version of `@openai/codex` to install. | no | "" |
| codex-args | Additional args to pass through to `codex exec`. If this value starts with `[`, it will be parsed as a JSON array; otherwise, it will be parsed as a shell-like string. | no | "" |
| output-schema | Inline schema contents to use with `codex exec --output-schema`. | no | "" |
| output-schema-file | File path to the schema that should be passed to `codex exec --output-schema`. | no | "" |
| model | Model the agent should use. | no | "" |
| effort | Reasoning effort the agent should use. | no | "" |
| codex-home | Directory to use as the Codex home directory. If empty, the default Codex home directory will be used. | no | "" |
| safety-strategy | Specify one of the following options (on Windows, the only supported option is `unsafe`): * `drop-sudo` (default, IRREVERSIBLE) Drop sudo privileges (if any) from the default user before running Codex, and run Codex as that user. This is only supported on Linux and macOS runners. This option is irreversible: if the default user has sudo privileges, they will be removed permanently for the duration of the job. * `unprivileged-user` Run Codex as the specified user specified by the `codex-user` option (the user must already exist). Note the caller is responsible for ensuring the specified user has the privileges it needs to perform the requested actions. For example, the copy of the repo created by `actions/checkout` is not world-readable by default. * `read-only` Run Codex in a sandbox that can read any file on disk, but cannot write to disk or access the network. Note Codex will still run as the default user for this Action, which likely has sudo privileges, so it could read `openai-api-key` from memory and reveal it by printing it to the output of the GitHub Action. * `unsafe` (NOT RECOMMENDED) Do not try to restrict Codex's privileges at all. This is extremely dangerous, as the default user for this Action likely has sudo privileges, which means it can read secrets stored in memory (such as the value of `openai-api-key`) and print them to the output of the GitHub Action or exfiltrate them in other ways. | no | drop-sudo |
| codex-user | If `safety-strategy` is set to `unprivileged-user`, this specifies the UNIX username to run Codex as. | no | "" |
| allow-users | Comma-separated list of GitHub usernames who can run this action, or '*' to allow all users. Note users who have write access to the GitHub repo have access by default and do not need to be listed here. | no | "" |
| allow-bots | Allow runs triggered by trusted GitHub bot accounts (github-actions[bot]) to bypass the write-access check. | no | false |
| allow-bot-users | Comma-separated list of GitHub bot usernames that can bypass the write-access check. '*' is not supported; list trusted bots explicitly. Entries may include or omit the trailing [bot] suffix. | no | "" |
Outputs
| name | description |
|---|---|
| final-message | Raw output emitted by `codex exec`. |