Publish codex-action to GitHub Marketplace and request verified creator status

Motivation

Enterprise GitHub organizations commonly restrict workflows to GitHub-authored actions and GitHub Marketplace actions from verified creators.

In an enterprise configured this way, a workflow using openai/codex-action was rejected at workflow startup even though the action was pinned to a full immutable commit SHA. The repository is not currently published through GitHub Marketplace and therefore cannot qualify under the verified Marketplace creator policy.

Administrators can explicitly allowlist openai/codex-action, but that requires a separate security or administrative exception in every enterprise. Publishing the action and obtaining verified creator status would improve discoverability and reduce friction for enterprise adoption while still allowing consumers to pin releases to immutable SHAs.

Proposed steps

• Confirm that the OpenAI organization has accepted the GitHub Marketplace Developer Agreement.
• Create a GitHub Release from the current version tag, or the next intended release tag.
• During release creation, select Publish this Action to the GitHub Marketplace for the root action.yml metadata file.
• Resolve any Marketplace metadata validation warnings and select the appropriate categories.
• Publish the release and confirm that the Marketplace listing is available.
• Contact partnerships@github.com to request the verified creator badge for the OpenAI organization.
• Confirm that the verified creator badge appears on the action listing.
• Link the Marketplace listing from the README while continuing to recommend full-SHA pinning for production use.

Suggested acceptance criteria

• The Codex action has a public GitHub Marketplace listing.
• The listing displays the verified creator badge for OpenAI.
• Workflows can use the action in enterprises configured to allow Marketplace actions from verified creators without requiring an explicit openai/codex-action exception.
• The README links to the Marketplace listing and documents immutable SHA pinning.

References

• Publishing actions in GitHub Marketplace
• Limiting GitHub Actions in an organization

Start with the root action.yml metadata and the current version tag, then follow GitHub's Marketplace publishing guidance linked in the issue. Confirm the Developer Agreement, publish the release, request OpenAI's verified creator badge, and update the README; done means the listing and badge are visible and the README links to it while documenting full-SHA pinning.