Codex CLI in CI/CD: GitHub Actions & Automation in Practice

name: Codex Automation Task

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  codex-task:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 2  # Fetch enough commit history

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Install Codex CLI
        run: npm install -g @openai/codex

      - name: Run Codex Task
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
        run: |
          codex exec --model gpt-4.1-mini \
            "Analyze the code changes in this PR and list potential bugs, performance issues, and style problems"

name: Auto Generate CHANGELOG

on:
  push:
    branches: [main]

jobs:
  changelog:
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - uses: actions/setup-node@v4
        with:
          node-version: '22'

      - run: npm install -g @openai/codex

      - name: Generate CHANGELOG entry
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
        run: |
          codex exec --model gpt-4.1-mini "Read the output of git diff HEAD~1, generate a concise CHANGELOG entry (format: ## vX.X.X - YYYY-MM-DD header followed by a bullet list of changes), and append it to CHANGELOG.md without removing existing content"

      - name: Commit CHANGELOG update
        run: |
          git config --global user.email "[email protected]"
          git config --global user.name "Codex CI Bot"
          git add CHANGELOG.md
          git diff --staged --quiet || git commit -m "chore: auto-update CHANGELOG [skip ci]"
          git push

name: AI Code Review

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  ai-review:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v4
        with:
          node-version: '22'

      - run: npm install -g @openai/codex

      - name: Run AI code review
        id: review
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
        run: |
          # Capture PR diff to a temp file
          git diff origin/${{ github.base_ref }}...HEAD > /tmp/pr_diff.txt

          # Let Codex review the diff, write results to a file
          codex exec --model gpt-4.1 \
            "Read /tmp/pr_diff.txt (a git diff of a pull request) and write a code review covering: 1) potential bugs and edge cases, 2) security vulnerabilities, 3) performance issues, 4) readability suggestions. Save the review to /tmp/review_result.txt"

          # Export review content to environment
          REVIEW_CONTENT=$(cat /tmp/review_result.txt)
          echo "REVIEW_CONTENT<> $GITHUB_ENV
          echo "$REVIEW_CONTENT" >> $GITHUB_ENV
          echo "EOF" >> $GITHUB_ENV

      - name: Post review comment
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `## 🤖 AI Code Review\n\n${process.env.REVIEW_CONTENT}`
            })

name: Auto Complete Unit Tests

on:
  workflow_dispatch:  # Manual trigger, or switch to schedule
  schedule:
    - cron: '0 2 * * 1'  # Every Monday at 2 AM UTC

jobs:
  test-completion:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '22'

      - run: npm install -g @openai/codex

      - name: Generate missing unit tests
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
        run: |
          codex exec --model gpt-4.1 \
            "Scan all .js and .ts files under src/, identify exported functions and classes, then check whether __tests__ or *.test.* files already cover them. For any exported function without a test, generate a Jest unit test. Place each test file in a __tests__ directory next to the source file, named [filename].test.js. Each test must include at least one happy-path case and one edge case."

      - name: Create PR with new tests
        run: |
          git config --global user.email "[email protected]"
          git config --global user.name "Codex CI Bot"
          git checkout -b feat/auto-tests-$(date +%Y%m%d)
          git add '**/__tests__/*.test.*'
          git diff --staged --quiet || \
            git commit -m "test: auto-generate missing unit tests" && \
            git push origin HEAD && \
            gh pr create --title "test: auto-generated unit tests" \
              --body "Unit tests automatically generated by Codex CI Bot. Please review before merging."
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# GitLab CI — Codex automated code review
stages:
  - ai-review

variables:
  NODE_VERSION: "22"

codex-code-review:
  stage: ai-review
  image: node:22-slim
  only:
    - merge_requests
  before_script:
    - npm install -g @openai/codex
    - git fetch origin $CI_MERGE_REQUEST_TARGET_BRANCH_NAME
  script:
    - git diff origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME...HEAD > /tmp/mr_diff.txt
    - codex exec --model gpt-4.1-mini
        "Read the git diff in /tmp/mr_diff.txt, identify potential bugs, security issues, and performance bottlenecks, then write a code review to /tmp/review.txt"
    - cat /tmp/review.txt
  variables:
    OPENAI_API_KEY: $OPENAI_API_KEY  # Read from CI/CD Variables
  artifacts:
    paths:
      - /tmp/review.txt
    expire_in: 1 week

codex-changelog:
  stage: ai-review
  image: node:22-slim
  only:
    - main
  before_script:
    - npm install -g @openai/codex
    - git config --global user.email "[email protected]"
    - git config --global user.name "Codex CI"
  script:
    - codex exec --model gpt-4.1-mini
        "Generate a CHANGELOG entry from git diff HEAD~1 and append it to CHANGELOG.md"
    - git add CHANGELOG.md
    - git diff --staged --quiet || git commit -m "chore: update CHANGELOG [skip ci]"
    - git push https://ci-token:$CI_JOB_TOKEN@$CI_SERVER_HOST/$CI_PROJECT_PATH.git HEAD:main
  variables:
    OPENAI_API_KEY: $OPENAI_API_KEY

# Read-only mode: Codex can only read files, not modify anything
# Ideal for pure review tasks — guarantees CI will never change code
codex exec --sandbox-mode read-only \
  "Analyze all files in src/ and identify potential security vulnerabilities"

# For simple CHANGELOG generation, mini is more than enough
codex exec --model gpt-4.1-mini \
  "Generate a concise CHANGELOG entry from git diff HEAD~1"

# For in-depth security analysis, use the full model
codex exec --model gpt-4.1 \
  "Thoroughly analyze this PR for security vulnerabilities including SQL injection and XSS"

on:
  push:
    branches: [main, develop]
    paths:
      - 'src/**'        # Only trigger when src/ changes
      - '!src/**/*.md'  # Exclude documentation files