OpenAI puts Codex in CI — and takes away its sudo first

What it does It’s a GitHub Action that installs the Codex CLI and runs it as a workflow step — essentially codex exec with YAML plumbing around it. You supply a prompt (inline or from a file), and the agent’s final message comes back as the final-message output, ready to post on a PR, write to a file, or feed to the next job. The README’s showcase example is a DIY pull-request reviewer: trigger on PR open, point Codex at the diff, post its verdict as a comment.

The interesting bit The whole design assumes the agent is the threat. Your API key never goes to Codex directly — it starts a local proxy to the Responses API, and the agent talks to that. The default safety-strategy is drop-sudo: the runner user’s sudo membership is revoked before Codex launches, and it stays revoked for the rest of the job. Triggering is gated on repo write access, with allow-users and allow-bot-users as explicit exceptions. It’s an AI wrapper built like it doesn’t trust the AI — which, for anything triggered by arbitrary PR text, is the correct posture.

Key highlights

• Four privilege levels: drop-sudo (default), unprivileged-user for self-managed runners, a read-only sandbox, and unsafe
• Azure OpenAI works via a responses-api-endpoint override; the proxy still sends your bearer key upstream
• Structured output through output-schema / output-schema-file, so replies can be forced into a schema
• Doubles as a bootstrap: run it once with the key, then call codex directly in later steps of the same job
• Patches GitHub-hosted Linux runner quirks, enabling user namespaces and clearing the AppArmor gate that breaks Codex’s sandbox on newer images

Caveats

• Windows runners have no supported sandbox — unsafe is the only strategy there, and the action exits early if you try anything else
• drop-sudo is sticky: later steps in the same job that need sudo will fail; the README suggests continuing in a fresh job
• Codex’s default sandbox blocks network access, so dependencies must be installed before the Codex step, not by it

Verdict Worth a look if you want Codex reviewing PRs or doing chores in CI without handing a prompt-injected agent your API key. Skip it if you want a turnkey bot — this is plumbing, and you still write the workflow and the prompts yourself.