Fixes issue #668 where Codex workflows could not properly override the default OPENAI_API_KEY secret, preventing organizations from using custom API keys without secret duplication.

Problem

The codex login command was hardcoded to use ${{ secrets.OPENAI_API_KEY }}, ignoring any custom environment variable overrides specified in the engine configuration:

engine:
  id: codex
  env:
    OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY_CI }}  # This was ignored

This caused authentication failures when users tried to use organization-specific API keys, as the login command would always use the default secret regardless of the environment variable override.

Solution

Modified the Codex engine to use the environment variable $OPENAI_API_KEY instead of the hardcoded secret reference in the login command:

# Before
codex login --api-key "${{ secrets.OPENAI_API_KEY }}"

# After  
codex login --api-key "$OPENAI_API_KEY"

This change allows the login command to respect custom environment variable overrides while maintaining backward compatibility for existing workflows.

Changes

1. Engine Fix: Updated pkg/workflow/codex_engine.go to use environment variable in login command
2. Test Workflow: Added pkg/cli/workflows/test-codex-custom-env.md demonstrating the override functionality
3. Documentation: Enhanced docs/src/content/docs/reference/frontmatter.md with detailed examples of secret overrides

Example Usage

Organizations can now override the default API key:

---
engine:
  id: codex
  model: gpt-4
  env:
    OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY_CI }}
---

# Your workflow content here

The generated workflow will use the custom secret for both the login command and the execution environment, enabling proper authentication with organization-specific API keys.

Backward Compatibility

Existing workflows continue to work unchanged - they still use the default OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} environment variable, which now properly flows through to the login command.

Closes #668

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.