Codex and GitHub: reviews, mentions, and the Action

Which of the three do you want

The repository

The Codex CLI is open source at github.com/openai/codex, written in Rust, licensed Apache 2.0. Releases are tagged rust-v<version> and each one publishes per-platform archives plus a DotSlash file, which is how you pin a whole team to one version.

git clone https://github.com/openai/codex.git
cd codex/codex-rs

# Rust toolchain if you do not have one
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
source "$HOME/.cargo/env"

cargo build
cargo run --bin codex -- "explain this codebase to me"

Codex reviewing your pull requests

This is the integration most people mean. Codex reads a pull request diff, applies whatever guidance your repository carries, and comments with findings ranked P0 and P1.

@codex review

The mention commands

Teaching it your standards

Codex reads AGENTS.md for review guidance, under a dedicated heading. Nested files apply too: it uses the AGENTS.md closest to the code a change touches, so a monorepo can hold different rules per service.

## Code Review Rules

- Flag any new database query that is not behind the repository layer.
- Reject `any` in TypeScript unless the line carries a justification comment.
- Public API changes must update `docs/api.md` in the same pull request.
- Do not comment on formatting. The formatter owns that.

Starting work from GitHub

Once GitHub is connected, Codex cloud tasks can start from a pull request or an issue rather than from the web interface. Linear and Slack connect the same way. The task runs in a cloud environment you configure at chatgpt.com/codex/settings/environments, against a clone of the repository.

The GitHub Action

Separate from the review bot. openai/codex-action@v1 installs the CLI on a runner and executes codex exec with a prompt, which is how you get Codex into a workflow you control.

name: Codex review

on:
  pull_request:

jobs:
  review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4

      - name: Run Codex
        id: run_codex
        uses: openai/codex-action@v1
        with:
          openai-api-key: ${{ secrets.OPENAI_API_KEY }}
          prompt-file: .github/codex/prompts/review.md
          sandbox: read-only
          output-file: codex-output.md

      - name: Comment
        run: gh pr comment "$PR" --body-file codex-output.md
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR: ${{ github.event.pull_request.number }}

The action also exposes the agent's final message as the final-message output, so you can branch on it or post it without writing a file. Check out the repository before the action runs, or Codex has nothing to read. Linux and macOS runners work as-is; Windows runners need safety-strategy: unsafe, which is exactly as blunt as it sounds.

Reviewing locally before any of this

The CLI has its own review command, which costs nothing extra on a subscription and catches the embarrassing findings before a reviewer sees them.

# review the working tree against the base branch
codex review

# a focused, non-interactive pass you can pipe
codex exec -s read-only "review the staged diff for security issues, P0 and P1 only"

Questions people ask

Keep reading