For the complete documentation index, see llms.txt. Markdown versions of documentation pages are available by appending .md to the page URL.
Primary navigation
Theme

Suggested
API Dashboard
Try ChatGPT
Codex

Codex use case

Create custom review workflows with GitHub Actions

Run security checks on your own triggers and keep the results for review.

Difficulty Intermediate
Time horizon Long-running

Make security reviews a repeatable part of your development process. Configure a GitHub Actions workflow that runs Codex Security on proposed changes and saves the results for your team to inspect.

Best for

  • Platform and application security teams adding security checks to GitHub Actions.
  • Repository maintainers configuring custom review triggers and scan scope.
  • Teams that need repeatable reviews with saved findings, evidence, and coverage reports.

Contents

    ← All use cases

    Create custom review workflows with GitHub Actions

    Run security checks on your own triggers and keep the results for review.

    Make security reviews a repeatable part of your development process. Configure a GitHub Actions workflow that runs Codex Security on proposed changes and saves the results for your team to inspect.

    Intermediate
    Long-running
    Follow the setup

    Make security reviews a repeatable part of your development process. Configure a GitHub Actions workflow that runs Codex Security on proposed changes and saves the results for your team to inspect.

    Intermediate
    Long-running

    Related links

    Run Codex Security in GitHub Actions Save reports and upload SARIF results Explore CI/CD integrations and enforcement options

    Best for

    • Platform and application security teams adding security checks to GitHub Actions.
    • Repository maintainers configuring custom review triggers and scan scope.
    • Teams that need repeatable reviews with saved findings, evidence, and coverage reports.

    Instead of enforcing security reviews through Codex, it is also possible to create custom workflows that run the Codex Security CLI. We’ve packaged this workflow to easily be used as a GitHub Action.

    name: Codex Security review
on:
  workflow_dispatch:
  schedule:
    - cron: '23 7 * * 1' # Mondays at 07:23 UTC

permissions:
  contents: read

jobs:
  security:
    runs-on: ubuntu-24.04
    steps:
      - name: Set up the Ubuntu sandbox
        run: |
          sudo apt-get update
          sudo apt-get install --yes bubblewrap apparmor-profiles
          sudo apparmor_parser -r /usr/share/apparmor/extra-profiles/bwrap-userns-restrict

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: openai/codex-security@3f61e5150981a5087c32e4395bbaa8ce5ce0c3e3 # action-v0.3.0
        with:
          model: gpt-5.6-sol
          effort: high
        env:
          OPENAI_API_KEY: ${{ secrets.CODEX_SECURITY_API_KEY }}

    These workflows can also be applied to other source code management tools like GitLab, BitBucket, or Jenkins. Take a look at our documentation page to learn more: Run Codex Security in CI.

    Related use cases

    Automate security reviews in GitHub Cloud

    Connect a repository and configure review triggers with Codex Security Review.

    Security Engineering

    Automate security scans in CI

    Add the Codex Security CLI to your CI pipeline

    Security Engineering

    Manage supply chain risk in the CI/CD

    Assess how third-party dependencies affect your application’s security with Codex Security CLI

    Security Engineering