From 09e95c9d633797e205ea39a20181f7b0976da88f Mon Sep 17 00:00:00 2001
From: Cooper Gamble <cooper@openai.com>
Date: Wed, 17 Jun 2026 18:11:13 +0000
Subject: [PATCH] [codex] fix WIF auth test isolation [ci changed_files]

---
 codex-rs/core/config.schema.json      | 4 ++--
 codex-rs/login/src/auth/auth_tests.rs | 5 +++++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/codex-rs/core/config.schema.json b/codex-rs/core/config.schema.json
index 1c3e0f4928..359924dd4d 100644
--- a/codex-rs/core/config.schema.json
+++ b/codex-rs/core/config.schema.json
@@ -790,7 +790,7 @@
       "type": "object"
     },
     "CredentialSourceConfig": {
-      "description": "Supported runtime credential sources. Implementations are independently feature gated.",
+      "description": "Supported runtime credential sources. Implementations live in separate provider crates.",
       "oneOf": [
         {
           "additionalProperties": false,
@@ -5472,4 +5472,4 @@
   },
   "title": "ConfigToml",
   "type": "object"
-}
\ No newline at end of file
+}
diff --git a/codex-rs/login/src/auth/auth_tests.rs b/codex-rs/login/src/auth/auth_tests.rs
index b8dc9a9daa..1a8a248e6b 100644
--- a/codex-rs/login/src/auth/auth_tests.rs
+++ b/codex-rs/login/src/auth/auth_tests.rs
@@ -634,6 +634,7 @@ impl ExternalAuth for TestExternalChatgptAuth {
 }
 
 #[tokio::test]
+#[serial(codex_auth_env)]
 async fn external_chatgpt_auth_resolves_and_refreshes_without_writing_auth_file() {
     let codex_home = tempdir().expect("create temp codex home");
     let token = fake_jwt_for_auth_file_params(&AuthFileParams {
@@ -726,6 +727,7 @@ async fn external_chatgpt_auth_resolves_and_refreshes_without_writing_auth_file(
 }
 
 #[tokio::test]
+#[serial(codex_auth_env)]
 async fn external_chatgpt_auth_allows_host_to_change_account_during_refresh() {
     let codex_home = tempdir().expect("create temp codex home");
     let token = fake_jwt_for_auth_file_params(&AuthFileParams {
@@ -774,6 +776,7 @@ async fn external_chatgpt_auth_allows_host_to_change_account_during_refresh() {
 }
 
 #[tokio::test]
+#[serial(codex_auth_env)]
 async fn auth_result_preserves_external_auth_resolution_errors() {
     let manager = AuthManager::shared(
         PathBuf::from("non-existent"),
@@ -826,6 +829,7 @@ async fn optional_auth_does_not_resolve_required_external_auth() {
 }
 
 #[tokio::test]
+#[serial(codex_auth_env)]
 async fn replace_non_required_external_auth_preserves_required_provider() {
     let manager = AuthManager::shared(
         PathBuf::from("non-existent"),
@@ -852,6 +856,7 @@ async fn replace_non_required_external_auth_preserves_required_provider() {
 }
 
 #[tokio::test]
+#[serial(codex_auth_env)]
 async fn non_required_external_auth_cleanup_is_registration_scoped() {
     let manager = AuthManager::shared(
         PathBuf::from("non-existent"),