Just shippedBest skills for each job.See the picks →

Ask AgentFlows
CodexOtherNot executed· 1 caveat

Run Codex as an unprivileged user (hardened runner setup)

Example setup that runs the Codex action as an unprivileged user on the runner, so the agent cannot use sudo or read the runner's secrets. You start it manually.

workflow_dispatch (manual)

Copy agent promptGet the YAMLSource ↗

How it works

From event to result

1
Trigger
GitHub starts a run when you run it by hand.
2
Agent
Codex, via openai/codex-action.
3
What it does
Example setup that runs the Codex action as an unprivileged user on the runner, so the agent cannot use sudo or read the runner's secrets. You start it manually.
4
What you get
This listing does not state a pull request or a comment. Read the prompt, and treat the result as not executed.

Setup

Where to paste this

  1. Create .github/workflows/codex-action-unprivileged-user.yml
  2. Paste the workflow below into that file. The notes beside the YAML are not part of the file.
  3. Add this repository secret: OPENAI_API_KEY. The file reads it as secrets.NAME. Do not paste the key into the YAML.
  4. This file has no permissions block. The job uses the repository’s default Actions token.

Let your agent do it

Copy a prompt for Claude Code, Codex, or Cursor.

Paste it into your coding agent in this repo. It does the setup and asks before anything leaves your machine.

Runs the same job in your agent session, on the plan you are signed in with. No API key, no Action.

Do the job of the "Run Codex as an unprivileged user (hardened runner setup)" workflow from AgentFlows (https://agentflows.sh/flows/codex-action-unprivileged-user) right here, in this session, using the plan I'm signed in with. No API key and no GitHub Action.

What it does: Example setup that runs the Codex action as an unprivileged user on the runner, so the agent cannot use sudo or read the runner's secrets. You start it manually.

The workflow normally runs on: workflow_dispatch (manual). Instead, ask me which pull request, issue, or branch to work on, then follow these instructions:

```text
Report $USER, $HOME, and whoami.
```

Use the gh CLI for anything on GitHub, and show me what you plan to post or change before you do it.

The file

Workflow YAML

Copy the file as-is. The notes beside each block explain it.

.github/workflows/codex-action-unprivileged-user.yml

Name

The name GitHub shows in the Actions tab. The file path is under Where to paste this.

name: "Example: Run Codex as an unprivileged user"

Trigger

GitHub starts a run when you run it by hand.

on:  workflow_dispatch:

Jobs

Each job is one runner. The steps inside it run top to bottom.

jobs:  run-codex-with-unprivileged-user:    runs-on: ubuntu-latest

Steps

These steps run in order on that job.

    steps:      - name: Create unprivileged user        run: |          sudo adduser --system --home /home/guest --shell /bin/bash --group guest          # Ensure the default runner account can collaborate with the guest user.          sudo usermod -a -G guest runner          # Allow the guest user to traverse runner-owned directories.          # In particular, actions/checkout@v5 checks out code under          # /home/runner/work, but /home/runner has permissions 750.          sudo usermod -a -G runner guest      - uses: actions/checkout@v5      - name: Change ownership        run: |          # Change the group ownership of the checked-out files to the `guest` group.          sudo chown -R runner:guest "$GITHUB_WORKSPACE"          # Extend user permissions to the group.          sudo chmod -R g+rwX "$GITHUB_WORKSPACE"          # Set the setgid bit so new directories stay in the shared group.          sudo find "$GITHUB_WORKSPACE" -type d -exec chmod g+s {} +      - name: Run Codex as unprivileged user

Agent

Runs Codex with openai/codex-action@v1. Inputs: openai-api-key (the OpenAI API key secret); safety-strategy; codex-user; prompt (the task).

        uses: openai/codex-action@v1        with:          openai-api-key: ${{ secrets.OPENAI_API_KEY }}          safety-strategy: unprivileged-user          codex-user: guest          prompt: |            Report $USER, $HOME, and whoami.

Keep going

More workflows

All workflows
  • CodexPull request
    12

    Codex PR review posted as a comment

    Two-job split keeps the API key job read-only (README example pattern). `:read-only` profile per README Permission profiles.

    pull_request: opened

    Est. cost per run~$0.03 runner + OpenAI tokens (UNVERIFIED)Checked Oct 16, 2026

    Not executed· 3 caveats
  • CodexLabel
    13

    Codex implements an issue on label

    `:workspace` profile lets Codex edit the checkout (README). PR creation is plain git/gh, not an action input.

    issues: labeled == codex

    Est. cost per run~$0.09 runner + OpenAI tokens (UNVERIFIED)Checked Oct 16, 2026

    Not executed· 2 caveats
  • CodexIssue opened
    14

    Codex triage with JSON output schema

    `output-schema` is forwarded to `codex exec --output-schema` (README inputs table).

    issues: opened

    Est. cost per run~$0.01 runner + OpenAI tokens (UNVERIFIED)Checked Oct 16, 2026

    Not executed· 3 caveats