> exec & automation
codex exec is Codex without the TUI: it takes a prompt, does the work, prints the final message to stdout, and exits — built for scripts, cron jobs, and CI pipelines. This section covers piping context in, machine-readable output, structured extraction, resuming exec sessions, and running safely in CI. The key default to remember is that exec runs read-only unless you widen the sandbox.
// exec & automation
8 commands$ codex exec "fix the failing unit tests"$ cat error.log | codex exec "diagnose this stack trace"$ codex exec --json "list the top 5 risky files" | jq$ codex exec "write release notes for the last 10 commits" -o notes.md$ codex exec "extract project metadata" --output-schema schema.json -o meta.json$ codex exec resume --last "now fix the issues you found"$ printenv OPENAI_API_KEY | codex login --with-api-key$ codex cloud// faq
How do I use Codex in a script or CI pipeline?
Run codex exec "your task" (alias codex e). Authenticate non-interactively by piping a key: printenv OPENAI_API_KEY | codex login --with-api-key. Add --skip-git-repo-check for non-git directories and --sandbox workspace-write if it needs to edit. For GitHub Actions, the openai/codex-action handles credentials.
How do I pipe a file or command output into Codex?
Pipe it and add an instruction: cat error.log | codex exec "diagnose this" — stdin is appended to the prompt as context. To read the entire prompt from stdin instead, pass a lone dash: cat prompt.txt | codex exec -. Do not combine a prompt string with a trailing dash.
Can Codex return structured JSON?
Two ways. --json streams JSON Lines events (thread, turn, item) you can parse with jq. --output-schema schema.json constrains the final answer to a JSON Schema, and -o out.json saves just that answer to a file. Use --json for the full event stream, -o for the deliverable alone.
How do I continue an exec run later?
codex exec resume --last "next step" continues the most recent exec session; pass a session id to target a specific one. In a fresh CI checkout there is no prior session, so capture the session id from the first run if you need to chain across jobs.