Just shippedBest skills for each job.See the picks →

Ask AgentFlows
CodexScheduleNot executed· 1 caveat

openai-node: monthly Codex review of supported Node.js versions

Once a month, Codex compares the repository's supported Node.js versions with the official Node.js release schedule. If anything has drifted, it makes the edits, validates them, and opens a draft PR for human review.

schedule: monthly (cron) + workflow_dispatch

Copy agent promptGet the YAMLSource ↗

How it works

From event to result

1
Trigger
GitHub starts a run when the schedule "17 14 1 * *" is due, or you run it by hand.
2
Agent
Codex, via openai/codex-action.
3
What it does
Once a month, Codex compares the repository's supported Node.js versions with the official Node.js release schedule. If anything has drifted, it makes the edits, validates them, and opens a draft PR for human review.
4
What you get
This listing does not state a pull request or a comment. Read the prompt, and treat the result as not executed.

Setup

Where to paste this

  1. Create .github/workflows/openai-node-node-version-review.yml
  2. Paste the workflow below into that file. The notes beside the YAML are not part of the file.
  3. Add this repository secret: OPENAI_API_KEY. The file reads it as secrets.NAME. Do not paste the key into the YAML.
  4. Steps that call gh with github.token use the token Actions already provides. You do not create that secret.

Let your agent do it

Copy a prompt for Claude Code, Codex, or Cursor.

Paste it into your coding agent in this repo. It does the setup and asks before anything leaves your machine.

Runs the same job in your agent session, on the plan you are signed in with. No API key, no Action.

Do the job of the "openai-node: monthly Codex review of supported Node.js versions" workflow from AgentFlows (https://agentflows.sh/flows/openai-node-node-version-review) right here, in this session, using the plan I'm signed in with. No API key and no GitHub Action.

What it does: Once a month, Codex compares the repository's supported Node.js versions with the official Node.js release schedule. If anything has drifted, it makes the edits, validates them, and opens a draft PR for human review.

The workflow normally runs on: schedule: monthly (cron) + workflow_dispatch. Instead, ask me which pull request, issue, or branch to work on, then follow these instructions:

```text
Once a month, Codex compares the repository's supported Node.js versions with the official Node.js release schedule. If anything has drifted, it makes the edits, validates them, and opens a draft PR for human review.
```

Use the gh CLI for anything on GitHub, and show me what you plan to post or change before you do it.

The file

Workflow YAML

Copy the file as-is. The notes beside each block explain it.

.github/workflows/openai-node-node-version-review.yml

File

The rest of the file, including the prompt the engine reads.

# Asks Codex once a month to compare this repository with the official Node.js# lifecycle, make any needed support-policy edits, validate them, and open a# draft pull request. If nothing has drifted, the run makes no pull request.# Human review is always required before merge.

Name

The name GitHub shows in the Actions tab. The file path is under Where to paste this.

name: Monthly Node.js version review

Trigger

GitHub starts a run when the schedule "17 14 1 * *" is due, or you run it by hand.

on:  schedule:    - cron: '17 14 1 * *'  workflow_dispatch:concurrency:  group: monthly-node-version-review  cancel-in-progress: false# Proposal generation and validation never receive repository write authority.

Permissions

Token scope for this block. Anything not listed is not granted.

permissions: {}

Jobs

Each job is one runner. The steps inside it run top to bottom.

jobs:  propose:    if: github.repository == 'openai/openai-node' && github.ref == 'refs/heads/main'    runs-on: ubuntu-latest    timeout-minutes: 30

Permissions

This token may read the repo, and environment: ci. Anything not listed is not granted.

    permissions:      contents: read    environment: ci    outputs:      artifact-id: ${{ steps.upload.outputs.artifact-id }}

Steps

These steps run in order on that job.

    steps:      - name: Check out the workflow commit        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6        with:          ref: ${{ github.sha }}          persist-credentials: false      - name: Set up Node        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4        with:          node-version-file: '.nvmrc'      - name: Ask Codex to review Node.js support        id: codex

Agent

Runs Codex with openai/codex-action@52fe01ec70a42f454c9d2ebd47598f9fd6893d56. Inputs: openai-api-key (the OpenAI API key secret); prompt-file; codex-version; codex-args; permission-profile (what Codex may do in the checkout); safety-strategy.

        uses: openai/codex-action@52fe01ec70a42f454c9d2ebd47598f9fd6893d56 # v1        with:          openai-api-key: ${{ secrets.OPENAI_API_KEY }}          prompt-file: .github/codex/prompts/node-version-review.md          codex-version: '0.144.6'          codex-args: '["--config","web_search=\"live\"","--ephemeral"]'          permission-profile: ':workspace'          safety-strategy: drop-sudo      - name: Export the untrusted proposal as JSON        env:          EXPECTED_BASE_SHA: ${{ github.sha }}          PROPOSAL_PATH: ${{ runner.temp }}/node-review-export/proposal.json          REVIEW_BODY: ${{ steps.codex.outputs.final-message }}        run: |          python3 scripts/node-version-review.py export \            --base-sha "$EXPECTED_BASE_SHA" \            --proposal "$PROPOSAL_PATH"      - name: Upload the original proposal        id: upload        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1        with:          name: node-review-proposal-${{ github.run_id }}-${{ github.run_attempt }}          path: ${{ runner.temp }}/node-review-export/proposal.json          if-no-files-found: error          retention-days: 1  validate:    needs: propose    if: github.repository == 'openai/openai-node' && github.ref == 'refs/heads/main'    runs-on: ubuntu-latest    timeout-minutes: 30

Permissions

This token may read the repo. Anything not listed is not granted.

    permissions:      contents: read

Steps

These steps run in order on that job.

    steps:      - name: Check out the workflow commit        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6        with:          ref: ${{ github.sha }}          persist-credentials: false      - name: Download the original proposal        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1        with:          artifact-ids: ${{ needs.propose.outputs.artifact-id }}          path: ${{ runner.temp }}/node-review-proposal          merge-multiple: true          digest-mismatch: error      - name: Verify and apply the proposal        id: proposal        env:          EXPECTED_BASE_SHA: ${{ github.sha }}          PROPOSAL_PATH: ${{ runner.temp }}/node-review-proposal/proposal.json          BODY_PATH: ${{ runner.temp }}/node-review-body.md        run: |          python3 scripts/node-version-review.py apply \            --base-sha "$EXPECTED_BASE_SHA" \            --proposal "$PROPOSAL_PATH" \            --body-output "$BODY_PATH"      - name: Set up pnpm        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4      - name: Set up Node        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4        with:          node-version-file: '.nvmrc'          cache: pnpm      - name: Install dependencies        run: |          pnpm install --frozen-lockfile          ./scripts/steady/install      - name: Check Node.js version policy        run: node --experimental-strip-types scripts/check-node-version-policy.ts      - name: Lint the repository        run: ./scripts/lint      - name: Build the repository        run: ./scripts/build      - name: Check published source types with TypeScript 4.9        run: ./node_modules/typescript-4-9/bin/tsc --project dist/src/tsconfig.json --noEmit      - name: Check published source types with TypeScript 6        run: ./node_modules/typescript/bin/tsc --project dist/src/tsconfig.json --noEmit      - name: Check packed browser and edge consumers        run: node --experimental-strip-types scripts/test-packed-package.ts      - name: Check TypeScript types        run: pnpm exec tsc      - name: Generate package type analysis        run: pnpm exec attw --pack dist -f json > .attw.json || true      - name: Check package types        run: node scripts/utils/attw-report.cjs      - name: Check the published package        run: pnpm exec publint dist      - name: Run tests        run: ./scripts/test  publish:    needs: [propose, validate]    if: github.repository == 'openai/openai-node' && github.ref == 'refs/heads/main'    runs-on: ubuntu-latest    timeout-minutes: 10

Permissions

This token may push commits, and comment on pull requests and open them. Anything not listed is not granted.

    permissions:      contents: write      pull-requests: write

Steps

These steps run in order on that job.

    steps:      - name: Check out the workflow commit        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6        with:          ref: ${{ github.sha }}          persist-credentials: false      # create-pull-request resets the working branch to origin/main. Keep both      # refs at the validated commit so a concurrent main update cannot rebase it.      - name: Preserve the validated base        env:          EXPECTED_BASE_SHA: ${{ github.sha }}        run: |          test "$(git rev-parse HEAD)" = "$EXPECTED_BASE_SHA"          git checkout -B main "$EXPECTED_BASE_SHA"          git update-ref refs/remotes/origin/main "$EXPECTED_BASE_SHA"      - name: Download the original proposal        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1        with:          artifact-ids: ${{ needs.propose.outputs.artifact-id }}          path: ${{ runner.temp }}/node-review-proposal          merge-multiple: true          digest-mismatch: error      - name: Verify and apply the proposal        id: proposal        env:          EXPECTED_BASE_SHA: ${{ github.sha }}          PROPOSAL_PATH: ${{ runner.temp }}/node-review-proposal/proposal.json          BODY_PATH: ${{ runner.temp }}/node-review-body.md        run: |          python3 scripts/node-version-review.py apply \            --base-sha "$EXPECTED_BASE_SHA" \            --proposal "$PROPOSAL_PATH" \            --body-output "$BODY_PATH"      - name: Open or update the draft pull request        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7        with:          token: ${{ github.token }}          base: main          branch: codex/monthly-node-version-update          delete-branch: true          draft: always-true          commit-message: 'chore(node): review supported Node.js versions'          title: 'chore(node): review supported Node.js versions'          body-path: ${{ runner.temp }}/node-review-body.md          add-paths: |            .nvmrc            package.json            README.md            .github/CONTRIBUTING.md            NODE_VERSION_POLICY.md

Keep going

More workflows

All workflows
  • CodexPull request
    12

    Codex PR review posted as a comment

    Two-job split keeps the API key job read-only (README example pattern). `:read-only` profile per README Permission profiles.

    pull_request: opened

    Est. cost per run~$0.03 runner + OpenAI tokens (UNVERIFIED)Checked Oct 16, 2026

    Not executed· 3 caveats
  • CodexLabel
    13

    Codex implements an issue on label

    `:workspace` profile lets Codex edit the checkout (README). PR creation is plain git/gh, not an action input.

    issues: labeled == codex

    Est. cost per run~$0.09 runner + OpenAI tokens (UNVERIFIED)Checked Oct 16, 2026

    Not executed· 2 caveats
  • CodexIssue opened
    14

    Codex triage with JSON output schema

    `output-schema` is forwarded to `codex exec --output-schema` (README inputs table).

    issues: opened

    Est. cost per run~$0.01 runner + OpenAI tokens (UNVERIFIED)Checked Oct 16, 2026

    Not executed· 3 caveats