Codex Team Workflow: worktrees, reviews, and CI integration

Using Codex CLI well in a team comes down to workflow design — not just "let Codex write code", but "let Codex write code without breaking team flow". This article gives a copyable team practice, from single-task workflow to CI integration.

1. Single-task workflow: independent worktree

Run each Codex task in its own git worktree:

# Create a worktree from main (-b names the new branch explicitly)
git worktree add -b codex-fix-bug ../codex-fix-bug main

# Let Codex work inside the worktree
cd ../codex-fix-bug
codex "Fix the NPE in src/foo.ts"

Benefits:

• Main branch work continues uninterrupted
• Codex running commands in the worktree doesn't affect you
• After diff review, merge directly back to main
• Multiple Codex tasks can run concurrently without interference

2. Sensitive-path protection (two layers)

Layer 1: hooks block automated writes

Sample .githooks/pre-push script:

#!/bin/bash
# Block pushes that touch sensitive paths
SENSITIVE='package-lock\.json|pnpm-lock\.yaml|yarn\.lock|\.github/|migrations/|Dockerfile|docker-compose'
DIFF_FILES=$(git diff --name-only HEAD~1)
if echo "$DIFF_FILES" | grep -qE "$SENSITIVE"; then
  echo "✗ Sensitive-path changes detected, please review manually:"
  echo "$DIFF_FILES" | grep -E "$SENSITIVE"
  exit 1
fi

Layer 2: CODEOWNERS gating

.github/CODEOWNERS:

# Default owner
*                    @team-lead

# Sensitive paths must be approved by their owners
package-lock.json    @team-lead
pnpm-lock.yaml       @team-lead
.github/             @team-lead
migrations/          @db-team
Dockerfile           @infra-team
src/auth/            @security-team

Once Codex changes trigger a PR, GitHub auto-requests review; nothing merges without owner approval.

3. Who reviews Codex changes

After CODEOWNERS triggers, owners look at Codex diffs through this lens:

Tip: require Codex to self-check in the prompt:

After writing the code, self-check:
1. Any unrelated changes? If so, revert them.
2. Is new logic covered by tests? If not, add them.
3. Do comments explain "why" instead of just "what"?
4. Are there any unnecessary console.log / debugger statements?
5. Does the diff scope match the task description exactly?

4. Run multiple Codex tasks concurrently

Yes — give each its own worktree + branch:

git worktree add -b codex-fix-bug      ../codex-fix-bug      main
git worktree add -b codex-add-feature  ../codex-add-feature  main
git worktree add -b codex-update-deps  ../codex-update-deps  main

Caveats:

• Concurrency burns through Codex quota fast (billed per token / call)
• Tasks must not modify overlapping files (avoid merge conflicts)
• Plan the merge order — usually bug fixes first, then features, then deps

5. CI integration

Must run: lint + unit tests + type check

# .github/workflows/ci.yml
on: pull_request
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pnpm install
      - run: pnpm lint
      - run: pnpm test
      - run: pnpm typecheck

CI must pass to merge. If Codex changes fail lint or tests, the PR is auto-flagged red.

Optional: let Codex write the PR description

.github/pull_request_template.md:

## Summary of changes
<!-- Codex auto-fills -->

## Related issue
<!-- link issue -->

## Test environment
<!-- which Node version, which browser -->

## Test coverage
<!-- tests added for new logic -->

## Screenshots / recordings
<!-- required for UI changes -->

When Codex writes a PR, it follows the template — changelog, linked issue, and test environment are immediately visible to the reviewer.

6. Security checklist

7. Team rollout pace

• Week 1: One developer starts, establishes the workflow
• Week 2: 2-3 more developers join, iterate the flow
• Week 3: CODEOWNERS + CI running, full team onboarded
• Monthly: review Codex change quality, tune prompt templates and CODEOWNERS

8. What's Next

• Getting started with OpenAI Codex CLI: from install to daily use
• Function Calling with the OpenAI API: A Complete Guide to Tool Use in the Responses API
• Build Your Own MCP Server: From Zero to Published