Skip to content

Pin openai/codex-action to commit SHA in release workflows#2546

Draft
karoliskosas8 wants to merge 1 commit intomainfrom
codex/fix-unpinned-third-party-action-vulnerability
Draft

Pin openai/codex-action to commit SHA in release workflows#2546
karoliskosas8 wants to merge 1 commit intomainfrom
codex/fix-unpinned-third-party-action-vulnerability

Conversation

@karoliskosas8
Copy link

Motivation

  • Mitigate supply-chain risk by pinning the third-party GitHub Action openai/codex-action used in release workflows because the previous unpinned tag @v1 receives PROD_OPENAI_API_KEY and runs in jobs with GITHUB_TOKEN write permissions.

Description

  • Replace uses: openai/codex-action@v1 with uses: openai/codex-action@5c16f9b5b3d5c4f0a7b8fa2e686c1ed4dbb7c7e2 in .github/workflows/release-pr.yml and .github/workflows/release-pr-update.yml.

Testing

  • No automated tests were executed because this is a workflow-only change and does not modify runtime code or unit tests.

Codex Task

Copy link
Member

@seratch seratch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@karoliskosas8 The latest revision already uses SHA, so your changes have conflicts. If you think we should switch to the SHA you've applied, can you resolve the conflicts?

@seratch seratch marked this pull request as draft February 26, 2026 00:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

aardvark codex dependencies documentation Improvements or additions to documentation project

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants