OpenAI Codex review pane QA workflows help when a pull request already has feedback and the next step is not a full rewrite, but a careful pass through specific test issues. Instead of rerunning a broad agent task, a QA engineer can use the review pane, inspect line-level findings, add inline comments, and ask for smaller follow-up fixes that are easier to verify.

This tutorial focuses on a practical use case: a test automation pull request has review findings for selectors, assertions, or missing coverage, and you want to work through those findings one by one without losing pull-request context. The official Codex docs support this pattern through review-pane findings, inline comments, pull-request context, and repository guidance in AGENTS.md.

What the current Codex docs support

OpenAI’s Codex app review documentation says review findings appear as inline comments in the review pane. The same docs say inline comments are a fast way to guide Codex because the feedback is attached to specific lines in the diff. They also document that reviews can run in the current task by default or as detached review tasks.

OpenAI’s pull-request review docs also describe GitHub review triggers such as @codex review and automatic reviews. Those docs say Codex can follow repository review guidance from AGENTS.md, using the closest file to the changed code. Together, these features support a QA workflow where Codex helps inspect a test diff, the QA engineer adds line-specific guidance, and the final fix is validated with real commands and evidence.

Why the review pane matters for QA

Many AI review workflows break down after the first review because the next prompt becomes too broad. A QA engineer does not need the agent to rethink the whole branch every time. They need to answer narrower questions such as:

  • Is this assertion proving the business outcome or only the page state?
  • Does this selector look stable enough for the real application?
  • Is there a missing negative or boundary test here?
  • Should this fix stay in the test file, fixture, or helper?
  • What exact validation command proves the updated behavior?

The review pane helps because each comment stays tied to the relevant lines. That keeps the conversation grounded in the actual diff instead of drifting into generic advice.

Step 1: Make your review guidance explicit

Before working through feedback, make sure the repository has useful review rules. Codex review docs say AGENTS.md is where repository-specific review guidance should live. For QA changes, the file should define what counts as a weak test change.

## Review guidelines

- Flag assertions that check only visibility or status.
- Flag selectors that depend on unstable text, order, or layout.
- Flag missing negative scenarios as P1.
- Require one focused validation command per fix.
- Do not claim tests passed without output.

This improves both the original review and the follow-up cycle. When the guidance is stable, the review pane becomes more consistent from pull request to pull request.

Step 2: Open the review pane and sort the findings

Start with the highest-signal comments. A useful order for QA teams is business-risk findings first, then coverage gaps, then maintainability issues. If Codex flags a weak assertion on a checkout test and a naming issue in a helper, handle the assertion first. The review pane is strongest when it helps narrow scope, not when it becomes a place to batch every possible cleanup.

As you read each finding, decide whether it is:

  • Valid and actionable: make or request the smallest fix.
  • Valid but larger than this pull request: file a separate follow-up task.
  • Incorrect or low value: dismiss it and move on.

Step 3: Add inline comments that guide a smaller fix

The Codex app review docs say line-specific inline comments often guide Codex more precisely than a broad instruction. That matters for QA. A comment such as “fix the tests” is too loose. A better inline comment names the exact risk and the expected boundary.

Address this inline comment with the smallest safe change.
The current assertion proves the page loaded, but not that the order was saved.
Update the test to verify the user-visible success outcome.
Do not change unrelated fixtures.
Tell me the exact command I should run after the edit.

This comment does four useful things. It points to the line, explains why the current check is weak, constrains the scope, and asks for a deterministic validation step.

Step 4: Keep fixes local to the actual problem

Review-pane work should usually produce smaller diffs than an open-ended rewrite task. If the issue is a brittle selector, the fix should usually stay in the locator or page object. If the issue is missing negative coverage, the fix should usually be one additional test or one assertion change. If the issue is a fixture dependency, the fix may belong in shared setup rather than the spec file.

Small fixes are easier to review twice: once by Codex and once by a human QA engineer. They also make it easier to decide whether the change still belongs in the same pull request.

Step 5: Use pull-request context without over-trusting it

OpenAI’s review docs say the desktop app can show pull-request context and reviewer feedback alongside the diff. That is useful because you can work through reviewer comments and Codex findings in the same task. But context is not proof. If a reviewer says a case is missing, verify the requirement. If Codex says a helper is unsafe, inspect the helper. If the branch passed CI earlier, rerun the smallest relevant check after the new change.

Step 6: Validate each accepted fix with real evidence

The final gate stays the same. Run the smallest relevant command and check the real output yourself. For Playwright, that may be a single spec or grep target plus trace evidence. For API tests, it may be one contract test file plus the failing and passing response data. For unit-level test helpers, it may be a focused unit test command.

  1. Accept only the findings you agree with.
  2. Request or make the smallest fix.
  3. Run the exact validation command.
  4. Inspect the output, screenshot, trace, or CI evidence.
  5. Merge only after normal human review is satisfied.

That sequence is what keeps the review pane useful for QA instead of turning it into a trust shortcut.

Screenshot checklist

  • The AGENTS.md review-guidelines section for test changes.
  • The Codex review pane showing inline findings on a test diff.
  • An inline comment added to a specific assertion or selector line.
  • The follow-up Codex response addressing that one comment.
  • The executed validation command output or CI evidence after the fix.

Common mistakes to avoid

  • Replying with broad prompts: keep feedback line-specific when possible.
  • Fixing too many things at once: one review comment should usually map to one narrow fix.
  • Ignoring AGENTS.md: stable repository guidance improves repeated review quality.
  • Using the review pane as proof: always run the relevant tests or checks yourself.
  • Keeping unrelated fixes in the branch: split larger cleanup into a follow-up task.

Final takeaway

OpenAI Codex review pane QA is most useful when you treat it as a controlled follow-up workflow for pull-request feedback. Use AGENTS.md to define what good test reviews should flag, use inline comments to constrain each fix, and keep the final decision tied to executed evidence plus human QA judgment.

Frequently asked questions

When should QA use inline comments instead of a broad follow-up prompt?

Use inline comments when the issue is tied to a specific line or small code area. They help Codex respond with a smaller and more precise fix.

Can the review pane replace GitHub review comments from humans?

No. It helps work through feedback faster, but human reviewers still provide product context, release judgment, and approval authority.

What is the best type of QA finding for review-pane follow-up?

The best candidates are weak assertions, brittle selectors, small coverage gaps, risky fixtures, and missing validation steps that can be fixed with a narrow change.

Should QA rerun the full suite after every small fix?

Start with the smallest relevant deterministic command. Run broader validation only when the change scope or repository policy requires it.

Official sources