Codex Cloud GitLab Support: DevDay Features Stay GitHub-Only

What OpenAI shipped, and who it skipped

Two of the most practical launches at OpenAI's DevDay 2026, reusable cloud environments for Codex and a scheduled scanning service called Codex Security Cloud, share a limitation. Both connect to GitHub, and nothing else. Teams that keep their code on GitLab, whether hosted or self-managed, will need workarounds that fall well short of the experience OpenAI showed on stage.

The cloud environments are built around a GitHub connection. A developer links a repository, Codex reads the code to figure out which software versions the project depends on, and it drafts an install script and service startup checks from that analysis. Further adjustments happen through conversation with the agent. 1 Those environments let developers kick off remote tasks from other devices instead of being tied to a local machine. 5 Codex Security Cloud uses the same approach for security work. It scans GitHub repositories on a schedule and prepares fixes while the developer's own computer is switched off. 1 According to InfoQ's recap, it can also scan new commits, investigate findings, and remove duplicate results before proposing patches. 5

SiliconANGLE states the gap plainly: Codex cannot yet work with repositories on GitLab, or on self-hosted GitHub Enterprise Server. 1 That second exclusion matters as much as the first. It means even some GitHub customers, typically larger and more regulated organizations running their own instances, are also left out.

A confusing split in GitLab support

The picture is murkier than a simple "GitHub only," because parts of the DevDay package do reach GitLab. InfoQ reports that a new code-review workflow can analyze diffs and flag potential issues in both GitHub pull requests and GitLab merge requests. 5 A reader could easily assume that support extends to the security product as well.

It does not. A setup guide for Codex Security warns that general Codex support for GitLab merge requests says nothing about Security Cloud, whose current setup connects only GitHub. 3 The guide recommends that GitLab teams start with the Codex Security CLI. The CLI runs local scans, pre-commit checks, and CI jobs that produce portable reports, and there is a documented path for running it inside GitLab CI/CD pipelines. 3 That path works, but it is a different product. The team has to provision and maintain the pipeline itself. With Security Cloud, OpenAI runs the scanning on its own infrastructure.

For broader agent work, GitLab has offered its own bridge. The company's official MCP server, which appeared as an experiment in GitLab 18.3 and has been in beta since 18.6, lets Codex pull issue context, read merge requests, and open new ones from a terminal session. 2 GitLab even published a walkthrough of fixing bugs with Codex in May 2026. 2 But one analysis describes this as a developer-run setup from start to finish. It is limited to session-scoped coding, so Codex will not monitor pipelines overnight or send merge-request digests. 2 Background, always-on work is exactly what the new cloud features are meant to provide.

Why GitLab users care

Demand is not hypothetical. A thread on OpenAI's developer forum asks for the Codex cloud agent to support GitLab, especially self-hosted instances. The poster cites data sovereignty and tighter DevOps integration as reasons organizations keep code there. 4 The same post argues the CLI is a weak substitute. It lacks the integrated cloud experience and adds API usage costs that are hard to justify for developers who already pay for IDE-native tools such as Cursor. 4 The request lists concrete needs: authentication through GitLab personal access tokens or OAuth, the ability to browse and edit repositories, and codebase Q&A over private repos. 4

The self-hosted angle is the hardest problem. Supporting gitlab.com is mostly an integration task. Reaching code behind a corporate firewall means solving network access and trust issues that OpenAI has not yet addressed even for its own GitHub Enterprise Server users. 1

Context: a GitHub-first product from the start

The gap is not new. Codex has run tasks in the cloud since it launched as a research preview inside ChatGPT in May 2025. 1 Its cloud tasks, @codex mentions, and automatic pull-request reviews have always assumed a connected GitHub account. 2 DevDay extended that model rather than broadening it. Cloud environments are rolling out to ChatGPT Plus and Pro subscribers as well as Business, Enterprise, Edu, and Healthcare workspaces. Plus accounts get virtual machines with half the CPU and memory of higher tiers, and task state is recoverable for seven days by default. 1

The takeaway

I read DevDay as OpenAI deepening its bet on GitHub rather than signaling platform neutrality. The partial GitLab support in code review suggests the company is not hostile to other platforms. Still, the always-on cloud agents, which are the most differentiated part of the release, remain tied to one host. For GitLab shops, the realistic plan today is three separate tools: the Security CLI in CI pipelines, GitLab's MCP server for interactive work, and merge-request reviews. These cover a lot of the same ground. They still miss the hands-off, background automation that OpenAI is presenting as the future of Codex.