Just shippedOur pick for the best security, implementation, and planning skills.Best skills for each job.See the picks →
Workflows
GitHub Actions you can paste into a repo. Filter by the coding agent that runs and by what starts the run, then open a workflow for the YAML and the setup.
15 workflows
Two-job split keeps the API key job read-only (README example pattern). `:read-only` profile per README Permission profiles.
pull_request: opened
Est. cost per run~$0.03 runner + OpenAI tokens (UNVERIFIED)Checked Oct 16, 2026
Not executed· 3 caveats`:workspace` profile lets Codex edit the checkout (README). PR creation is plain git/gh, not an action input.
issues: labeled == codex
Est. cost per run~$0.09 runner + OpenAI tokens (UNVERIFIED)Checked Oct 16, 2026
Not executed· 2 caveats`output-schema` is forwarded to `codex exec --output-schema` (README inputs table).
issues: opened
Est. cost per run~$0.01 runner + OpenAI tokens (UNVERIFIED)Checked Oct 16, 2026
Not executed· 3 caveatsCodex security-reviews pull requests to main in an isolated read-only job, then posts an advisory review. Untrusted PRs are only reviewed after a maintainer comment command. Used in Block's buzz repository.
pull_request_target: opened, reopened, ready_for_review, synchronize (+ push to main, repository_dispatch, issue replies)
Est. cost per runUnknown (not estimated)Checked Oct 17, 2026
Not executed· 1 caveatA manual test showing why Codex's drop-sudo and read-only safety strategies matter. It checks that the agent cannot read or exfiltrate API keys from the runner.
workflow_dispatch (manual)
Est. cost per runUnknown (not estimated)Checked Oct 17, 2026
Not executed· 1 caveatExample setup that runs the Codex action as an unprivileged user on the runner, so the agent cannot use sudo or read the runner's secrets. You start it manually.
workflow_dispatch (manual)
Est. cost per runUnknown (not estimated)Checked Oct 17, 2026
Not executed· 1 caveatRuns daily. Codex migrates a small batch of JavaScript files to TypeScript and opens a pull request, so a large migration happens incrementally.
schedule: daily (cron) + push + workflow_dispatch
Est. cost per runUnknown (not estimated)Checked Oct 17, 2026
Not executed· 1 caveatRuns weekly. Codex finds dependency security vulnerabilities, fixes those above a severity threshold, and opens pull requests. It supports a dry-run mode that only reports.
schedule: weekly (cron) + workflow_dispatch
Est. cost per runUnknown (not estimated)Checked Oct 17, 2026
Not executed· 1 caveatOnce a month, Codex compares the repository's supported Node.js versions with the official Node.js release schedule. If anything has drifted, it makes the edits, validates them, and opens a draft PR for human review.
schedule: monthly (cron) + workflow_dispatch
Est. cost per runUnknown (not estimated)Checked Oct 17, 2026
Not executed· 1 caveatRuns weekly. Codex finds TODO comments whose dates have passed and keeps a tracking issue listing them. It supports a dry run. Used in the OpenClaw repository.
schedule: weekly (cron) + workflow_dispatch
Est. cost per runUnknown (not estimated)Checked Oct 17, 2026
Not executed· 1 caveatAfter CI passes on main, Codex checks whether the docs still match the code and repairs them, at most once an hour. Used in the OpenClaw repository.
after CI succeeds on main (workflow run event) + workflow_dispatch
Est. cost per runUnknown (not estimated)Checked Oct 17, 2026
Not executed· 1 caveatWhen CI fails, Codex reads the failure, makes a fix, and opens a pull request with it.
workflow_run: CI completed (failure)
Est. cost per runUnknown (not estimated)Checked Oct 17, 2026
Not executed· 1 caveatWhen someone comments on an issue, Codex folds the useful parts into the issue's maintainer context summary so it stays current. Used in the uv repository.
issue_comment: created
Est. cost per runUnknown (not estimated)Checked Oct 17, 2026
Not executed· 1 caveatWhen a video.js core release is published, Codex writes readable changelog prose for it. It can also be run manually to backfill an older release.
release: published + workflow_dispatch
Est. cost per runUnknown (not estimated)Checked Oct 17, 2026
Not executed· 1 caveatLabel an issue agent:pr and Codex implements it and opens a pull request. Used in the video.js repository.
issues: labeled == agent:pr
Est. cost per runUnknown (not estimated)Checked Oct 17, 2026
Not executed· 1 caveat