Just shippedOur pick for the best security, implementation, and planning skills.Best skills for each job.See the picks →
Workflows
GitHub Actions you can paste into a repo. Filter by the coding agent that runs and by what starts the run, then open a workflow for the YAML and the setup.
4 workflows
A manual test showing why Codex's drop-sudo and read-only safety strategies matter. It checks that the agent cannot read or exfiltrate API keys from the runner.
workflow_dispatch (manual)
Est. cost per runUnknown (not estimated)Checked Oct 17, 2026
Not executed· 1 caveatExample setup that runs the Codex action as an unprivileged user on the runner, so the agent cannot use sudo or read the runner's secrets. You start it manually.
workflow_dispatch (manual)
Est. cost per runUnknown (not estimated)Checked Oct 17, 2026
Not executed· 1 caveatAfter CI passes on main, Codex checks whether the docs still match the code and repairs them, at most once an hour. Used in the OpenClaw repository.
after CI succeeds on main (workflow run event) + workflow_dispatch
Est. cost per runUnknown (not estimated)Checked Oct 17, 2026
Not executed· 1 caveatWhen a video.js core release is published, Codex writes readable changelog prose for it. It can also be run manually to backfill an older release.
release: published + workflow_dispatch
Est. cost per runUnknown (not estimated)Checked Oct 17, 2026
Not executed· 1 caveat