Limit who can trigger the workflow, keep tokens least-privileged and treat PR text as untrusted input.
The decision behind the technique
A CI agent sees attacker-controlled branch names, issue text and repository changes. Safe automation separates data from instructions and avoids powerful credentials.
Limit who can trigger the workflow, keep tokens least-privileged and treat PR text as untrusted input.
A practical step-by-step workflow
Use this sequence as a default, then tighten or expand it only when the evidence changes.
- Restrict triggers to trusted actors or reviewed events
- Grant the minimum repository permissions
- Filter untrusted text before building prompts
- Place Codex after deterministic checks and block external writes by default
Failure boundary and finish line
Never expose production secrets to a workflow triggered by an untrusted fork.
Finish when another person can reproduce the check against the exact final state.
Frequently asked questions
What should I do first?+
Restrict triggers to trusted actors or reviewed events
What is the main failure mode?+
Never expose production secrets to a workflow triggered by an untrusted fork.
OFFICIAL SOURCES
Verify against the source
OpenAI Codex GitHub ActionThis guide provides general information, not an OpenAI allowance promise or support decision. Your account and official pages govern actual usage, benefits and recovery times.