Auto-fix failing CI with the Codex GitHub Action

When your CI workflow fails, a second GitHub Actions workflow runs Codex on the failing commit, asks it to reproduce the failure and make the smallest fix, and opens a pull request with the patch. The job that runs Codex can only read the repository, and the job that pushes never sees the OpenAI API key.

The problem

A red CI run on a branch usually waits until someone has time to read the logs, reproduce the failure and push a fix, even when the fix is small. Handing that first attempt to an agent is useful, but running an agent in CI with write access and an API key in the same job exposes the key to build scripts, tests and dependency hooks.

Steps

1. Store your OpenAI API key as a repository secret named OPENAI_API_KEY; do not set it as a job-level environment variable in jobs that check out or run repository code.
2. Add a workflow that triggers on workflow_run for your main CI workflow with types [completed], and run its first job only when the run's conclusion is failure.
3. Give that job only contents read permission, check out the failing commit (workflow_run.head_sha) with persist-credentials set to false, and install dependencies before Codex starts.
4. Run openai/codex-action@v1 with a prompt that names the failed workflow and commit and tells Codex to reproduce the failure with your test command, implement only the minimal fix, rerun the tests and leave unrelated files alone.
5. Save Codex's local changes with git diff --binary into codex.patch and upload it as an artifact only when the patch is not empty.
6. In a second job with contents write and pull-requests write but no API key, download the patch, apply it with git apply --index, push a codex/auto-fix branch named after the run ID and open a pull request against the failing branch with gh pr create.
7. Adjust the setup and test commands to your stack (the docs example assumes Node.js), and review every generated pull request before merging.

From the official docs

- name: Run Codex
  uses: openai/codex-action@v1
  with:
    openai-api-key: ${{ secrets.OPENAI_API_KEY }}
    prompt: |
      The CI workflow "${{ github.event.workflow_run.name }}" failed for commit
      ${{ github.event.workflow_run.head_sha }}.
      Run `npm test --silent` to reproduce the failure. Identify the minimal
      change needed to make the tests pass, implement only that change, and
      run `npm test --silent` again.
      Do not refactor unrelated files.

Results

• Every failed CI run triggers a Codex attempt on the exact failing commit, and any fix is saved as a patch artifact.
• A separate job opens a pull request titled "Auto-fix failing CI via Codex" against the failing branch, with a note asking for review before merging.
• The Codex job only has read access to the repository, and the job with write access never receives the OpenAI API key.

As reported by the source (OpenAI Codex docs (non-interactive mode)); AgentGid did not measure these figures.

The agent used here

OpenAI CodexOpenAI · Terminal coding agents

OpenAI's coding agent, offered as an open-source terminal CLI, an IDE extension, a desktop app and a cloud agent that works on repositories. Users si…

Price

Free + $8/mo

Gid Score

84 #1 in Terminal

What it does, pricing, alternatives →

Similar use cases

Case studyEon

How Eon unified multi-cloud incident tooling behind one MCP Gateway on AgentCore

Eon, a cloud data protection vendor, replaced per-tool credentials and local MCP servers with a single authenticated MCP gateway on Amazon Bedrock AgentCore. Developers and an aut…

As reported by AWS (guest post co-written with Eon): developer onboarding dropped from 2 days to 2 minutes.

Claude CodeCursorOpenAI CodexAmazon Bedrock AgentCoreAgentCore GatewayIncident response · DevOps and CI

Showcase

Mod almost any PC game with Claude Code and the universal-modder plugin

An open-source GitHub project packages skills, a command-line tool, a shared knowledge base and the fal MCP server so AI coding agents such as Claude Code can mod PC games the use…

The repository ships three worked examples: a Terraria tModLoader weapon and boss pack with sprites made through fal, an Age of Empires II DE civiliz…

Claude CodeOpenAI CodexGemini CLIfal MCPCodexBuilding apps · Prototyping

ShowcaseWeave

Route between coding-agent models with the open-source Weave Router 2.0

The Weave team presented Weave Router 2.0 in a Show HN post. It is an open-source routing model that sits in front of coding agents and switches between LLMs per turn, and the aut…

As reported by the Weave author on Hacker News: on Terminal Bench 4.0 and SWE Atlas, the router had equivalent pass rates to GPT-6 Astra.

Claude CodeOpenAI CodexOpenCodeWeave RouterCodexDevOps and CI · Workflow automation