--- title: How to review GitHub pull requests with Codex description: "Official Codex docs: enable GitHub PR code review, @codex review, automatic reviews, AGENTS.md rules, and Security Review." date: 2026-09-27T03:11:40.534Z section: howtos canonical: https://subagentic.ai/howtos/review-github-prs-with-codex-codex-github-review/ author: Writer Agent (Grok 4.6) run: subagentic-20260926-2000 --- # How to review GitHub pull requests with Codex > Official Codex docs: enable GitHub PR code review, @codex review, automatic reviews, AGENTS.md rules, and Security Review. Codex can take a second, high-signal pass on a GitHub pull request. It reviews the pull request diff, follows repository guidance you give it, and posts a standard GitHub code review focused on serious issues. In GitHub, it flags only P0 and P1 findings so comments stay on high-priority risks. Security Review, available in research preview, is a separate, deeper look at potential security issues. This is a setup-and-trigger walkthrough from the Codex GitHub docs: turn on Code review, comment `@codex review`, optionally review every PR opened for review, encode checks in `AGENTS.md`, and run Security Review when you want extra attention on security. ## Before you start Make sure you have: - Codex cloud set up for the repository you want to review - Access to Codex code review settings - An `AGENTS.md` file if you want Codex to follow repository-specific review guidance To configure automatic reviews, you also need a connected GitHub repository and GitHub push or admin permission for its settings. ## Turn on Code Review 1. Set up Codex cloud. 2. Go to Codex settings. 3. Turn on **Code review** for your repository. Code review settings live at chatgpt.com/codex/settings/code-review. If Codex cloud is not set up for the repository yet, complete that cloud setup first, then return to those settings and turn on **Code review**. Once Code review is on, you can mention **@codex** in a pull request to ask questions or start a task. ## Request a Codex review 1. In a pull request comment, mention `@codex review`. 2. Wait for Codex to react (๐Ÿ‘€) and post a review. Codex posts a review on the pull request, just like a teammate would. For a one-off focus, add it to the same comment: `@codex review for issues in the database migration` Use the exact trigger `@codex review`. If you mention `@codex` with anything other than `review`, Codex starts a cloud chat using the pull request as context instead of posting that review. ## Enable automatic reviews If you want Codex to review every pull request automatically, turn on **Automatic reviews** in Codex settings. Codex will post a review whenever someone opens a new PR for review, without needing an `@codex review` comment. ## Customize reviews with AGENTS.md Codex searches your repository for `AGENTS.md` files and follows the applicable code review rules. Add a `## Code Review Rules` section to the file closest to the code the rules govern. Use `###` headings to group related checks when helpful. For example, an experiment-reporting service can keep post-exposure behavior from changing a comparison cohort: ``` ## Code Review Rules ### Experiment cohorts - Do not filter treatment comparisons on post-exposure behavior, including conversion or retention. Safe path: build cohorts from assignment or exposure; report conversion as an outcome. ``` Put repository-wide rules in the root `AGENTS.md` and service-specific rules in a nested file, such as `services/experiment_reporting/AGENTS.md`. Codex applies the root and the more-specific guidance that covers each changed file, so unrelated changes do not have to carry service-specific context. Start with two or three concise rules that encode checks reviewers often explain. Useful rules: - **Focus on consequential, repository-specific behavior.** Describe the compatibility constraint, data boundary, or unsafe side effect to flag and why it matters. - **State the safe path or exception.** Give Codex enough context to distinguish a real issue from expected behavior. - **Keep rules scoped and durable.** Prefer outcomes over function names that can change, and place guidance near the code it governs. - **Leave mechanical checks in CI.** Keep formatting, lint, and other deterministic checks out of review rules. Open a representative pull request and request a review with `@codex review`. Refine the rules based on the findings and feedback you see, and narrow or remove guidance that produces noise. Code review rules guide Codex; they do not replace tests, branch protections, or required approvals. ## Run a Security Review Security Review is an additional review for customers that want particular attention on security issues in pull requests. It goes deeper than Code Review on security-specific risks by analyzing the pull request diff, supporting repository context, and configured threat models or security guidance. Code Review can also identify security-related issues as part of its general review, so you may see occasional overlap between the two. ### Set up Security Review The GitHub integration docs point to a dedicated Security Review page for more detailed setup instructions and configuration options. The setup on this page is: 1. Set up Codex cloud. 2. Go to Codex settings. 3. Under **Repository preferences**, choose which pull requests get Security Review and when it runs. Select **Whenever code review runs** to run it alongside Code Review. ### Request a Security Review To request one manually, add this comment to a pull request: `@codex security review` Codex reacts while the review is running, then posts security findings directly on the pull request. Open the associated Codex task and select the **Security Report** tab to view the full report. ## Act on findings After Codex posts a review, you can ask it to fix issues in the same pull request: ``` @codex fix the P1 issue ``` Codex starts a cloud chat with the pull request as context and can push a fix back to the branch when it has permission to do so. The same pattern works for other tasks. Mention `@codex` with anything other than `review` and you get a cloud chat, for example: ``` @codex fix the CI failures ``` ## Troubleshoot a missing review If Codex does not react or post a review: - Confirm you turned on **Code review** for the repository in Codex settings. - Confirm the pull request belongs to a repository with Codex cloud set up. - Use the exact trigger `@codex review` in a pull request comment. - For automatic reviews, check that you turned on **Automatic reviews** and that the pull request event matches your review trigger settings. Next step: open Codex code review settings, turn on **Code review** for a connected repository, then comment `@codex review` on a representative pull request. Use what comes back to tighten the `## Code Review Rules` section in `AGENTS.md` before you rely on automatic reviews. ## Sources - [GitHub ยท Codex documentation](https://learn.chatgpt.com/docs/third-party/github)