Fix Codex environment variable override for custom API keys

[Copilot]

Fixes issue #668 where Codex workflows could not properly override the default OPENAI_API_KEY secret, preventing organizations from using custom API keys without secret duplication.

Problem

The codex login command was hardcoded to use ${{ secrets.OPENAI_API_KEY }}, ignoring any custom environment variable overrides specified in the engine configuration:

engine:
  id: codex
  env:
    OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY_CI }}  # This was ignored

This caused authentication failures when users tried to use organization-specific API keys, as the login command would always use the default secret regardless of the environment variable override.

Solution

Modified the Codex engine to use the environment variable $OPENAI_API_KEY instead of the hardcoded secret reference in the login command:

# Before
codex login --api-key "${{ secrets.OPENAI_API_KEY }}"

# After  
codex login --api-key "$OPENAI_API_KEY"

This change allows the login command to respect custom environment variable overrides while maintaining backward compatibility for existing workflows.

Changes

1. Engine Fix: Updated pkg/workflow/codex_engine.go to use environment variable in login command
2. Test Workflow: Added pkg/cli/workflows/test-codex-custom-env.md demonstrating the override functionality
3. Documentation: Enhanced docs/src/content/docs/reference/frontmatter.md with detailed examples of secret overrides

Example Usage

Organizations can now override the default API key:

---
engine:
  id: codex
  model: gpt-4
  env:
    OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY_CI }}
---

# Your workflow content here

The generated workflow will use the custom secret for both the login command and the execution environment, enabling proper authentication with organization-specific API keys.

Backward Compatibility

Existing workflows continue to work unchanged - they still use the default OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} environment variable, which now properly flows through to the login command.

Closes #668

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• api.contoso.com
  • Triggering command: /tmp/go-build2070014085/b279/cli.test -test.testlogfile=/tmp/go-build2070014085/b279/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
  • Triggering command: /tmp/go-build2880104756/b279/cli.test -test.testlogfile=/tmp/go-build2880104756/b279/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
  • Triggering command: /tmp/go-build2129480747/b279/cli.test -test.testlogfile=/tmp/go-build2129480747/b279/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[pelikhan]

@dsyme fyi