openai/codex-action

Public

v1.9

Find a branch or tag

HTTPS

examples/unprivileged-user.yml

40lines · modecode

unknown

1	`name: "Example: Run Codex as an unprivileged user"`
2	`on:`
3	`workflow_dispatch:`
4
5	`jobs:`
6	`run-codex-with-unprivileged-user:`
7	`runs-on: ubuntu-latest`
8	`steps:`
9	`- name: Create unprivileged user`
10	`run: \|`
11	`sudo adduser --system --home /home/guest --shell /bin/bash --group guest`
12	`# Ensure the default runner account can collaborate with the guest user.`
13	`sudo usermod -a -G guest runner`
14
15	`# Allow the guest user to traverse runner-owned directories.`
16	`# In particular, actions/checkout@v5 checks out code under`
17	`# /home/runner/work, but /home/runner has permissions 750.`
18	`sudo usermod -a -G runner guest`
19
20	`- uses: actions/checkout@v5`
21
22	`- name: Change ownership`
23	`run: \|`
24	# Change the group ownership of the checked-out files to the `guest` group.
25	`sudo chown -R runner:guest "$GITHUB_WORKSPACE"`
26
27	`# Extend user permissions to the group.`
28	`sudo chmod -R g+rwX "$GITHUB_WORKSPACE"`
29
30	`# Set the setgid bit so new directories stay in the shared group.`
31	`sudo find "$GITHUB_WORKSPACE" -type d -exec chmod g+s {} +`
32
33	`- name: Run Codex as unprivileged user`
34	`uses: openai/codex-action@v1`
35	`with:`
36	`openai-api-key: ${{ secrets.OPENAI_API_KEY }}`
37	`safety-strategy: unprivileged-user`
38	`codex-user: guest`
39	`prompt: \|`
40	`Report $USER, $HOME, and whoami.`
41