# Codex Guard

A GitHub Action quality gate for AI-generated pull requests that blocks leftover TODOs, leaked secrets, sloppy commit messages and failing CI before they reach the main branch.

Codex Guard is a GitHub Action that runs on pull requests, detects whether a PR looks AI-generated by label, branch prefix or title, and if so runs automated checks before it reaches main: a TODO scan flags TODO, FIXME, XXX, HACK or WIP markers on added lines only; a secret scan flags hardcoded credentials and connection strings for providers such as AWS, GitHub, Google, OpenAI, Anthropic, Slack and Stripe, redacting the actual values in its reports; a commit-hygiene check flags subjects that do not follow conventional commits or are empty; and a CI-status check flags failing checks on the pull request's head commit.

Each finding is posted as a check-run annotation at the exact file and line, plus a summary comment on the pull request. It distinguishes files it found no issues in from files it could not scan at all, for example because GitHub omitted a binary or very large file's patch, and reports that coverage explicitly rather than treating it as a clean pass.

It works with OpenAI Codex, Claude Code, Copilot and other agents that open pull requests, and is written in JavaScript under the MIT license.

Website: https://akimiya-z.github.io/codex-guard/