Skip to content

build(deps): bump openai/codex-action from 1.7 to 1.8#5

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/openai/codex-action-1.8
Closed

build(deps): bump openai/codex-action from 1.7 to 1.8#5
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/openai/codex-action-1.8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 2, 2026

Copy link
Copy Markdown

Bumps openai/codex-action from 1.7 to 1.8.

Changelog

Sourced from openai/codex-action's changelog.

codex-action Changelog

v1.8 (2026-04-29)

  • #91 tighten what bots are allowed

v1.7 (2026-04-24)

  • #89 restrict bot permission bypass

v1.6 (2026-03-16)

  • #77 enable GitHub-hosted Linux bubblewrap support

v1.5 (2026-03-16)

  • #74 harden shell interpolation in action workflows

v1.4 (2025-11-19)

  • #58 revert #56 and use the latest stable version of Codex CLI again

v1.3 (2025-11-19)

  • #56 temporarily set the default version of Codex CLI to 0.58.0

v1.2 (2025-11-07)

  • #52 add baseUrl to Octokit constructor, if appropriate, for GHE

v1.1 (2025-11-05)

  • #47 added support for Azure via the new responses-api-endpoint parameter
  • #36 added effort parameter
  • #45 pin the commit hash of the actions/setup-node action used by openai/codex-action

v1.0 (2025-10-06)

  • Initial release (OpenAI DevDay 2025!)
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [openai/codex-action](https://github.com/openai/codex-action) from 1.7 to 1.8.
- [Changelog](https://github.com/openai/codex-action/blob/main/CHANGELOG.md)
- [Commits](openai/codex-action@5c3f4cc...e0fdf01)

---
updated-dependencies:
- dependency-name: openai/codex-action
  dependency-version: '1.8'
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 2, 2026
@nuntius-review

nuntius-review Bot commented Jun 2, 2026

Copy link
Copy Markdown
Vesper

Reviewed commits

Commit Summary
b806f8a build(deps): bump openai/codex-action from 1.7 to 1.8

An analysis of the changes in the provided diff shows that they are correct, secure, and follow GitHub Actions best practices.

Analysis

  1. Security & Best Practices:

    • Pinning GitHub Actions to a specific commit SHA (e.g., e0fdf01220eb9a88167c4898839d273e3f2609d1) instead of a mutable tag (like v1.8) is a recommended security best practice. This prevents potential "man-in-the-middle" or supply-chain attacks if a tag is maliciously reassigned.
    • The inline comments (e.g., # v1.8) are kept up-to-date with the new SHA, which aids readability and maintainability.
  2. Correctness:

    • The action version is consistently updated across both workflow files (issue-deduplicator.yml and issue-labeler.yml), ensuring consistency in the environment and behavior of the openai/codex-action runner.

No issues or vulnerabilities were identified in these changes. No modifications are required.

@dependabot @github

dependabot Bot commented on behalf of github Jul 18, 2026

Copy link
Copy Markdown
Author

Superseded by #16.

@dependabot dependabot Bot closed this Jul 18, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/openai/codex-action-1.8 branch July 18, 2026 06:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants