Just shippedOur pick for the best security, implementation, and planning skills.Best skills for each job.See the picks →
Runs weekly. Codex finds TODO comments whose dates have passed and keeps a tracking issue listing them. It supports a dry run. Used in the OpenClaw repository.
schedule: weekly (cron) + workflow_dispatch
How it works
Setup
.github/workflows/openclaw-dated-todo-sweep.ymlOPENAI_API_KEY, GH_APP_PRIVATE_KEY, GH_APP_PRIVATE_KEY_FALLBACK. The file reads them as secrets.NAME. Do not paste the key into the YAML.Let your agent do it
Paste it into your coding agent in this repo. It does the setup and asks before anything leaves your machine.
Runs the same job in your agent session, on the plan you are signed in with. No API key, no Action.
Do the job of the "OpenClaw: sweep expired dated TODOs in the codebase" workflow from AgentFlows (https://agentflows.sh/flows/openclaw-dated-todo-sweep) right here, in this session, using the plan I'm signed in with. No API key and no GitHub Action. What it does: Runs weekly. Codex finds TODO comments whose dates have passed and keeps a tracking issue listing them. It supports a dry run. Used in the OpenClaw repository. The workflow normally runs on: schedule: weekly (cron) + workflow_dispatch. Instead, ask me which pull request, issue, or branch to work on, then follow these instructions: ```text Runs weekly. Codex finds TODO comments whose dates have passed and keeps a tracking issue listing them. It supports a dry run. Used in the OpenClaw repository. ``` Use the gh CLI for anything on GitHub, and show me what you plan to post or change before you do it.
The file
Copy the file as-is. The notes beside each block explain it.
.github/workflows/openclaw-dated-todo-sweep.yml
Name
The name GitHub shows in the Actions tab. The file path is under Where to paste this.
name: Dated TODO sweepTrigger
GitHub starts a run when the schedule "23 6 * * 1" is due, or you run it by hand.
on: schedule: - cron: "23 6 * * 1" workflow_dispatch: inputs: dry_run: description: Log the fresh report without creating or updating the tracking issue. required: false default: false type: booleanPermissions
This token may read the repo, group: dated-todo-sweep, cancel-in-progress: false, and FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true". Anything not listed is not granted.
permissions: contents: readconcurrency: group: dated-todo-sweep cancel-in-progress: falseenv: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"Jobs
Each job is one runner. The steps inside it run top to bottom.
jobs: analyze: # Manual runs may select a ref; secrets are available only when that ref is # the trusted default branch. Scheduled runs already target that branch. if: github.repository == 'openclaw/openclaw' && (github.event_name != 'workflow_dispatch' || github.ref == format('refs/heads/{0}', github.event.repository.default_branch)) outputs: sweep-date: ${{ steps.sweep-date.outputs.date }} runs-on: ubuntu-24.04 timeout-minutes: 20Steps
These steps run in order on that job.
steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.sha }} persist-credentials: false - name: Setup Node environment uses: ./.github/actions/setup-node-env with: cache-mode: restore node-version: "24.x" install-bun: "false" - name: Collect dated TODO candidates run: node --import tsx scripts/dated-todo-scan.mts - name: Capture sweep date id: sweep-date run: echo "date=$(date -u +%F)" >> "$GITHUB_OUTPUT" - name: Run Codex dated TODO sweepAgent
Runs Codex with openai/codex-action@bdf19a4a223ec2549a3e2274a0cf61556bc07675. Inputs: openai-api-key (the OpenAI API key secret); prompt-file; model; effort; sandbox; safety-strategy.
uses: openai/codex-action@bdf19a4a223ec2549a3e2274a0cf61556bc07675 # v1.13 env: DATED_TODO_SWEEP_DATE: ${{ steps.sweep-date.outputs.date }} with: openai-api-key: ${{ secrets.OPENAI_API_KEY }} prompt-file: .github/codex/prompts/dated-todo-sweep.md model: ${{ vars.OPENCLAW_CI_OPENAI_MODEL_BARE }} effort: medium sandbox: workspace-write safety-strategy: drop-sudo # Only the report crosses into the privileged job. The app token is minted # on a fresh runner and checkout, never beside Codex or its child processes. - name: Upload dated TODO report uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: dated-todo-report path: .artifacts/dated-todo-report.md if-no-files-found: error include-hidden-files: true retention-days: 7 upsert: if: github.event_name != 'workflow_dispatch' || github.ref == format('refs/heads/{0}', github.event.repository.default_branch) needs: analyze runs-on: ubuntu-24.04 timeout-minutes: 10Steps
These steps run in order on that job.
steps: - name: Checkout trusted workflow code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.sha }} persist-credentials: false - name: Download dated TODO report uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: dated-todo-report path: .artifacts - name: Setup supported Node runtime uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "24.21.0" package-manager-cache: false - name: Validate dated TODO report env: DATED_TODO_SWEEP_DATE: ${{ needs.analyze.outputs.sweep-date }} shell: bash run: | set -euo pipefail node --input-type=module <<'NODE' import fs from "node:fs"; import { pathToFileURL } from "node:url"; const reportPath = ".artifacts/dated-todo-report.md"; const report = fs.readFileSync(reportPath, "utf8"); const moduleUrl = pathToFileURL( `${process.env.GITHUB_WORKSPACE}/scripts/github/dated-todo-upsert.mjs`, ); const { validateDatedTodoReport } = await import(moduleUrl.href); validateDatedTodoReport(report, { expectedDate: process.env.DATED_TODO_SWEEP_DATE, repoRoot: process.env.GITHUB_WORKSPACE, }); NODE - name: Log dry-run report if: github.event_name == 'workflow_dispatch' && inputs.dry_run run: cat .artifacts/dated-todo-report.md # No permission-* subset here: requesting a permission the installation # does not grant fails token minting outright. No inputs uses the app's # full granted set, matching the proven Barnacle fallback workflow. - name: Create Barnacle app token if: github.event_name != 'workflow_dispatch' || !inputs.dry_run uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # zizmor: ignore[github-app] v3 id: app-token continue-on-error: true with: app-id: "2729701" private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} - name: Create fallback Barnacle app token uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # zizmor: ignore[github-app] v3 id: app-token-fallback if: (github.event_name != 'workflow_dispatch' || !inputs.dry_run) && steps.app-token.outcome == 'failure' with: app-id: "2971289" private-key: ${{ secrets.GH_APP_PRIVATE_KEY_FALLBACK }} - name: Upsert dated TODO tracking issue if: github.event_name != 'workflow_dispatch' || !inputs.dry_run uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 with: github-token: ${{ steps.app-token.outputs.token || steps.app-token-fallback.outputs.token }} script: | const { pathToFileURL } = require("node:url"); const moduleUrl = pathToFileURL( `${process.env.GITHUB_WORKSPACE}/scripts/github/dated-todo-upsert.mjs`, ); const { runDatedTodoUpsert } = await import(moduleUrl.href); await runDatedTodoUpsert({ github, context, core, });Keep going
Two-job split keeps the API key job read-only (README example pattern). `:read-only` profile per README Permission profiles.
pull_request: opened
Est. cost per run~$0.03 runner + OpenAI tokens (UNVERIFIED)Checked Oct 16, 2026
Not executed· 3 caveats`:workspace` profile lets Codex edit the checkout (README). PR creation is plain git/gh, not an action input.
issues: labeled == codex
Est. cost per run~$0.09 runner + OpenAI tokens (UNVERIFIED)Checked Oct 16, 2026
Not executed· 2 caveats`output-schema` is forwarded to `codex exec --output-schema` (README inputs table).
issues: opened
Est. cost per run~$0.01 runner + OpenAI tokens (UNVERIFIED)Checked Oct 16, 2026
Not executed· 3 caveats