Every reusable workflow follows this structure:
on.workflow_callwith standard inputs (runner) + secrets (OPENAI_API_KEY,OPENAI_BASE_URL,CODEX_MODEL,CODEX_REASONING_EFFORT)- Job runs on
node:20-bullseyecontainer with runner auto-detection - Steps: checkout target repo → checkout prompts (sparse) → setup node → install deps → optional data prep → run codex → post-process with
actions/github-script@v7
mkdir -p "$CODEX_HOME"
MODEL="${{ secrets.CODEX_MODEL }}"
MODEL="${MODEL:-gpt-5.4}"
EFFORT="${{ secrets.CODEX_REASONING_EFFORT }}"
EFFORT="${EFFORT:-xhigh}"
cat > "$CODEX_HOME/config.toml" << TOML
model = "$MODEL"
model_reasoning_effort = "$EFFORT"
TOML
echo "{\"OPENAI_API_KEY\": \"${{ secrets.OPENAI_API_KEY }}\"}" > "$CODEX_HOME/auth.json"
PROMPT=$(cat .codex-actions/.github/prompts/<name>.md)
codex exec --skip-git-repo-check --full-auto --output-last-message /tmp/codex-output.json "$PROMPT" || trueUse ${VAR} placeholders in prompt .md files, replace with bash:
PROMPT="${PROMPT//\$\{SCAN_PATHS\}/$SCAN_PATHS}"- Check
/tmp/codex-output.jsonexists JSON.parsewith try-catch (return on failure)- Ensure labels exist (getLabel → createLabel on 404)
- Process results with GitHub API calls
Embed fingerprint as HTML comment <!-- fingerprint:xxx --> in issue body. Query existing issues by label, regex-extract fingerprints, skip duplicates.
<type>: <short description>
Types: feat, chore, fix. No Co-Authored-By lines.
v1tag is a floating tag, force-updated on new featuresv1.x.xtags are immutable point releases- Consumer workflows reference
@v1for auto-updates