Git LFS fails to run correctly

Open 💬 4 comments Opened Mar 30, 2026 by alexaka1

What issue are you seeing?

GIT LFS does not work in Codex Web. LFS files are not checked out before setup scripts. During setup scripts LFS is not configured, so I can't even pull the files there. During the model run with internet access LFS files still cannot be pulled.

What steps can reproduce the bug?

add this to you setup script in a repo that has LFS files.

has_lfs_endpoint() {
  local endpoint
  endpoint="$(git lfs env 2>/dev/null | awk -F': ' '/Endpoint/{print $2; exit}')"
  [ -n "$endpoint" ] && printf '%s' "$endpoint" | grep -Eq '^[a-zA-Z][a-zA-Z0-9+.-]*://' 
}
if [ -f .gitattributes ] && grep -q "filter=lfs" .gitattributes && command -v git-lfs >/dev/null 2>&1; then
  log 'Enable Git LFS support'
  git lfs install --local
  if has_lfs_endpoint; then
    log 'Refresh Git LFS content'
    git lfs pull
  else
    log 'Skipping Git LFS content refresh (no LFS endpoint configured in this session)'
  fi
fi

This results in Skipping Git LFS content refresh (no LFS endpoint configured in this session).

What is the expected behavior?

Git LFS should work as this means any repo that relies on LFS files completely fails to work in Codex Web.

Additional information

Closed issue due to inactivity: https://github.com/openai/codex/issues/6135
The repo in question is a private github repo, that is authed through the Codex GitHub app.

View original on GitHub ↗

4 Comments

br3ndonland · 4 months ago

It looks like Codex is setting an empty Git remote.origin.url. I use a custom setup script to set the URL like this:

#!/usr/bin/env bash
set -euo pipefail

DEFAULT_ORIGIN_URL="https://github.com/org/repo.git"
ORIGIN_URL="$(git config --local --default '' --get remote.origin.url)"
if [[ -z "$ORIGIN_URL" ]]; then
  echo "[bootstrap] remote.origin.url is empty; setting it to $DEFAULT_ORIGIN_URL"
  git config remote.origin.url "$DEFAULT_ORIGIN_URL"
fi

echo "[bootstrap] Initializing Git LFS and pulling objects..."
git lfs install --local
if git lfs pull; then
  echo "[bootstrap] Git LFS objects are ready"
else
  echo "[bootstrap] ERROR: git lfs pull failed" >&2
  exit 1
fi

In the setup logs I see that the URL is empty:

++ git config --local --default '' --get remote.origin.url
+ ORIGIN_URL=
+ [[ -z '' ]]
+ echo '[bootstrap] remote.origin.url is empty; setting it to https://github.com/org/repo.git
[bootstrap] remote.origin.url is empty; setting it to https://github.com/org/repo.git

After setting remote.origin.url I am able to pull LFS objects.

Environment details:

Container image: universal
Agent internet access: On
Domain allowlist: Common dependencies
Allowed HTTP methods: GET, HEAD, and OPTIONS

alexaka1 · 4 months ago

@br3ndonland Do you use a public repo? I am using a private repo that is authed with the Codex (GitHub) app, and my setup script is the same as yours, I just added a bunch of debug assertions to confirm the issue.

br3ndonland · 4 months ago

@alexaka1 yes I'm using a public repo. I did some more testing, and I realized it was only working properly if I edited the environment and clicked "Connect interactive terminal." There, I can just run git lfs pull and it works fine.

When I launch a cloud task though, the problem is that Codex is setting an empty Git remote.origin.url. If I run git config remote.origin.url https://github.com/org/repo.git then I can pull LFS objects.

I updated my previous comment with this info.

alexaka1 · 4 months ago

I checked and this does not work with private repos. Git tries to HTTPS auth with username PAT combo. Which obviously fails and I refuse to set it up.