diff --git a/.github/dotslash-config.json b/.github/dotslash-config.json index 8e948bc373..9f180d3776 100644 --- a/.github/dotslash-config.json +++ b/.github/dotslash-config.json @@ -131,6 +131,58 @@ "path": "codex-windows-sandbox-service.exe" } } + }, + "codex-bazel": { + "platforms": { + "macos-aarch64": { + "regex": "^codex-package-aarch64-apple-darwin-bazel\\.tar\\.zst$", + "path": "bin/codex" + }, + "macos-x86_64": { + "regex": "^codex-package-x86_64-apple-darwin-bazel\\.tar\\.zst$", + "path": "bin/codex" + }, + "linux-x86_64": { + "regex": "^codex-package-x86_64-unknown-linux-musl-bazel\\.tar\\.zst$", + "path": "bin/codex" + }, + "linux-aarch64": { + "regex": "^codex-package-aarch64-unknown-linux-musl-bazel\\.tar\\.zst$", + "path": "bin/codex" + }, + "windows-x86_64": { + "regex": "^codex-package-x86_64-pc-windows-msvc-bazel\\.tar\\.zst$", + "path": "bin/codex.exe" + }, + "windows-aarch64": { + "regex": "^codex-package-aarch64-pc-windows-msvc-bazel\\.tar\\.zst$", + "path": "bin/codex.exe" + } + } + }, + "codex-command-runner-bazel": { + "platforms": { + "windows-x86_64": { + "regex": "^codex-command-runner-x86_64-pc-windows-msvc-bazel\\.exe\\.zst$", + "path": "codex-command-runner.exe" + }, + "windows-aarch64": { + "regex": "^codex-command-runner-aarch64-pc-windows-msvc-bazel\\.exe\\.zst$", + "path": "codex-command-runner.exe" + } + } + }, + "codex-windows-sandbox-setup-bazel": { + "platforms": { + "windows-x86_64": { + "regex": "^codex-windows-sandbox-setup-x86_64-pc-windows-msvc-bazel\\.exe\\.zst$", + "path": "codex-windows-sandbox-setup.exe" + }, + "windows-aarch64": { + "regex": "^codex-windows-sandbox-setup-aarch64-pc-windows-msvc-bazel\\.exe\\.zst$", + "path": "codex-windows-sandbox-setup.exe" + } + } } } } diff --git a/.github/dotslash-provisioned-config.json b/.github/dotslash-provisioned-config.json index 2f7363ed06..25062f7afb 100644 --- a/.github/dotslash-provisioned-config.json +++ b/.github/dotslash-provisioned-config.json @@ -11,6 +11,18 @@ "path": "bin/codex" } } + }, + "codex-provisioned-bazel": { + "platforms": { + "macos-aarch64": { + "regex": "^codex-provisioned-package-aarch64-apple-darwin-bazel\\.tar\\.gz$", + "path": "bin/codex" + }, + "macos-x86_64": { + "regex": "^codex-provisioned-package-x86_64-apple-darwin-bazel\\.tar\\.gz$", + "path": "bin/codex" + } + } } } } diff --git a/.github/workflows/rust-release-provisioned-macos.yml b/.github/workflows/rust-release-provisioned-macos.yml index 9a1008d8e6..9f306e8375 100644 --- a/.github/workflows/rust-release-provisioned-macos.yml +++ b/.github/workflows/rust-release-provisioned-macos.yml @@ -1,4 +1,4 @@ -# Verified side packages, published by rust-release.yml when enabled. +# Verified Cargo and Bazel side packages, published by rust-release.yml when enabled. # The legacy CLI, npm, installer and DMG packages are unchanged. # Required secrets in the codesigning environment: # - CODEX_CLI_PROVISIONING_PROFILE_BASE64: profile approved for public distribution. @@ -32,9 +32,11 @@ jobs: strategy: fail-fast: false matrix: + build-system: [cargo, bazel] target: [aarch64-apple-darwin, x86_64-apple-darwin] env: TARGET: ${{ matrix.target }} + ARTIFACT_SUFFIX: ${{ matrix.build-system == 'bazel' && '-bazel' || '' }} PROVISIONED_MACOS: "true" PROFILE_SHA256: ${{ secrets.CODEX_CLI_PROVISIONING_PROFILE_SHA256 }} CERTIFICATE_SHA256: ${{ secrets.AKV_CODESIGN_CERTIFICATE_SHA256 }} @@ -62,7 +64,7 @@ jobs: --certificate-sha256 "$CERTIFICATE_SHA256" --team-id "$TEAM_ID" - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: - name: ${{ matrix.target }} + name: ${{ matrix.target }}${{ env.ARTIFACT_SUFFIX }} path: standard - name: Extract the verified package from this tag-release run run: | @@ -71,7 +73,7 @@ jobs: import os import tarfile from pathlib import Path - with tarfile.open(f"standard/codex-package-{os.environ['TARGET']}.tar.gz") as archive: + with tarfile.open(f"standard/codex-package-{os.environ['TARGET']}{os.environ['ARTIFACT_SUFFIX']}.tar.gz") as archive: archive.extractall("package", filter="data") metadata = json.loads(Path("package/codex-package.json").read_text()) if metadata["target"] != os.environ["TARGET"]: @@ -100,18 +102,18 @@ jobs: --profile "$RUNNER_TEMP/codex-cli.provisionprofile" --profile-sha256 "$PROFILE_SHA256" \ --certificate-sha256 "$CERTIFICATE_SHA256" --team-id "$TEAM_ID" mkdir signed - tar -czf "signed/codex-provisioned-package-$TARGET.tar.gz" -C package \ + tar -czf "signed/codex-provisioned-package-$TARGET$ARTIFACT_SUFFIX.tar.gz" -C package \ bin codex-resources codex-path codex-package.json CodexCLI.app - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: - name: provisioned-macos-signed-candidate-${{ matrix.target }} + name: provisioned-macos-signed-candidate-${{ matrix.target }}${{ env.ARTIFACT_SUFFIX }} path: signed/*.tar.gz if-no-files-found: error - name: Retain signing reports if: always() uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: - name: provisioned-macos-signing-reports-${{ matrix.target }} + name: provisioned-macos-signing-reports-${{ matrix.target }}${{ env.ARTIFACT_SUFFIX }} path: signing-verification/ if-no-files-found: warn @@ -129,6 +131,8 @@ jobs: strategy: fail-fast: false matrix: + build-system: [cargo, bazel] + target: [aarch64-apple-darwin, x86_64-apple-darwin] include: - target: aarch64-apple-darwin runner: macos-15-xlarge @@ -136,6 +140,7 @@ jobs: runner: macos-15-intel env: TARGET: ${{ matrix.target }} + ARTIFACT_SUFFIX: ${{ matrix.build-system == 'bazel' && '-bazel' || '' }} PROVISIONED_MACOS: "true" PROFILE_SHA256: ${{ secrets.CODEX_CLI_PROVISIONING_PROFILE_SHA256 }} CERTIFICATE_SHA256: ${{ secrets.AKV_CODESIGN_CERTIFICATE_SHA256 }} @@ -149,7 +154,7 @@ jobs: python-version: "3.12" - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: - name: provisioned-macos-signed-candidate-${{ matrix.target }} + name: provisioned-macos-signed-candidate-${{ matrix.target }}${{ env.ARTIFACT_SUFFIX }} path: signed - name: Extract candidate and load independent verification profile env: @@ -162,7 +167,7 @@ jobs: from pathlib import Path profile = Path(os.environ["RUNNER_TEMP"]) / "codex-cli.provisionprofile" profile.write_bytes(base64.b64decode("".join(os.environ["PROFILE_BASE64"].split()), validate=True)) - with tarfile.open(f"signed/codex-provisioned-package-{os.environ['TARGET']}.tar.gz") as archive: + with tarfile.open(f"signed/codex-provisioned-package-{os.environ['TARGET']}{os.environ['ARTIFACT_SUFFIX']}.tar.gz") as archive: archive.extractall("package", filter="data") PY - name: Verify signatures, profile, architecture, stapling and Gatekeeper @@ -176,20 +181,20 @@ jobs: spctl --assess --type execute --verbose=4 package/CodexCLI.app python3 .github/scripts/macos-signing/sign_macos_cli_package.py verify package "${profile_args[@]}" mkdir verified - tar -czf "verified/codex-provisioned-package-$TARGET.tar.gz" -C package \ + tar -czf "verified/codex-provisioned-package-$TARGET$ARTIFACT_SUFFIX.tar.gz" -C package \ bin codex-resources codex-path codex-package.json CodexCLI.app - (cd verified && shasum -a 256 "codex-provisioned-package-$TARGET.tar.gz" > SHA256SUMS) + (cd verified && shasum -a 256 "codex-provisioned-package-$TARGET$ARTIFACT_SUFFIX.tar.gz" > SHA256SUMS) - uses: ./.github/actions/setup-ci - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 with: version: "0.13.5" - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: - name: ${{ matrix.target }}-app-server + name: ${{ matrix.target }}-app-server${{ env.ARTIFACT_SUFFIX }} path: app-server - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: - name: ${{ matrix.target }}-symbols + name: ${{ matrix.target }}-symbols${{ env.ARTIFACT_SUFFIX }} path: symbols - name: Test the exact verified package, including sandboxed code mode working-directory: scripts/codex_package/smoke_tests @@ -199,20 +204,20 @@ jobs: # This repackaging does not change debug code. The normal release's # primary symbols omit app-server symbols, so skip symbol-only tests. uv run --frozen pytest -v --compression gzip --package-target "$TARGET" \ - --cli-archive "$CODEX_REPO_ROOT/verified/codex-provisioned-package-$TARGET.tar.gz" \ - --app-server-archive "$CODEX_REPO_ROOT/app-server/codex-app-server-package-$TARGET.tar.gz" \ - --symbols-archive "$CODEX_REPO_ROOT/symbols/codex-symbols-$TARGET.tar.gz" \ + --cli-archive "$CODEX_REPO_ROOT/verified/codex-provisioned-package-$TARGET$ARTIFACT_SUFFIX.tar.gz" \ + --app-server-archive "$CODEX_REPO_ROOT/app-server/codex-app-server-package-$TARGET$ARTIFACT_SUFFIX.tar.gz" \ + --symbols-archive "$CODEX_REPO_ROOT/symbols/codex-symbols-$TARGET$ARTIFACT_SUFFIX.tar.gz" \ test_codex_package.py -k 'not debug_symbols' - name: Retain verified candidate only after package tests pass uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: - name: provisioned-macos-verified-candidate-${{ matrix.target }} + name: provisioned-macos-verified-candidate-${{ matrix.target }}${{ env.ARTIFACT_SUFFIX }} path: verified/* if-no-files-found: error - name: Retain verification reports if: always() uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: - name: provisioned-macos-verification-reports-${{ matrix.target }} + name: provisioned-macos-verification-reports-${{ matrix.target }}${{ env.ARTIFACT_SUFFIX }} path: signing-verification/ if-no-files-found: warn diff --git a/.github/workflows/rust-release-windows.yml b/.github/workflows/rust-release-windows.yml index ae435ae4af..058ed9feb3 100644 --- a/.github/workflows/rust-release-windows.yml +++ b/.github/workflows/rust-release-windows.yml @@ -9,8 +9,7 @@ env: jobs: build-windows-binaries: name: Build Windows binaries - ${{ matrix.runner }} - ${{ matrix.target }} - ${{ matrix.bundle }} - ${{ matrix.build-system }} - # Parallel Bazel artifacts are advisory while Cargo remains the release path. - continue-on-error: ${{ matrix.build-system == 'bazel' }} + # Desktop consumers require successful Cargo and Bazel release artifacts. runs-on: ${{ matrix.runs_on }} environment: name: bazel @@ -309,7 +308,6 @@ jobs: needs: - build-windows-binaries name: Build Windows symbols - ${{ matrix.target }} - ${{ matrix.build-system }} - continue-on-error: ${{ matrix.build-system == 'bazel' }} runs-on: ubuntu-24.04 timeout-minutes: 15 permissions: @@ -370,7 +368,6 @@ jobs: - build-windows-binaries - build-windows-voice name: Build - ${{ matrix.runner }} - ${{ matrix.target }} - ${{ matrix.build-system }} - continue-on-error: ${{ matrix.build-system == 'bazel' }} runs-on: ${{ matrix.runs_on }} environment: name: azure-artifact-signing diff --git a/.github/workflows/rust-release.yml b/.github/workflows/rust-release.yml index 6a4a2dcaca..267fc3dd85 100644 --- a/.github/workflows/rust-release.yml +++ b/.github/workflows/rust-release.yml @@ -59,8 +59,7 @@ jobs: build: needs: tag-check name: Build - ${{ matrix.runner }} - ${{ matrix.target }} - ${{ matrix.bundle }} - ${{ matrix.build-system }} - # Parallel Bazel artifacts are advisory while Cargo remains the release path. - continue-on-error: ${{ matrix.build-system == 'bazel' }} + # Desktop consumers require successful Cargo and Bazel release artifacts. runs-on: ${{ matrix.runner }} environment: name: bazel @@ -637,7 +636,6 @@ jobs: needs: [build, build-macos-voice] if: ${{ always() && needs.build.result == 'success' && needs.build-macos-voice.result == 'success' }} name: Sign macOS binaries - ${{ matrix.target }} - ${{ matrix.bundle }} - ${{ matrix.build-system }} - continue-on-error: ${{ matrix.build-system == 'bazel' }} runs-on: ubuntu-latest timeout-minutes: 45 environment: @@ -883,7 +881,6 @@ jobs: package-macos: needs: sign-macos-binaries name: Package macOS artifacts - ${{ matrix.target }} - ${{ matrix.bundle }} - ${{ matrix.build-system }} - continue-on-error: ${{ matrix.build-system == 'bazel' }} runs-on: macos-15-xlarge timeout-minutes: 45 permissions: @@ -1171,7 +1168,6 @@ jobs: sign-macos-dmg: needs: package-macos name: Sign macOS DMG - ${{ matrix.target }} - ${{ matrix.build-system }} - continue-on-error: ${{ matrix.build-system == 'bazel' }} runs-on: ubuntu-latest timeout-minutes: 45 environment: @@ -1276,7 +1272,6 @@ jobs: - package-macos - sign-macos-dmg name: Verify macOS artifacts - ${{ matrix.target }} - ${{ matrix.bundle }} - ${{ matrix.build-system }} - continue-on-error: ${{ matrix.build-system == 'bazel' }} runs-on: macos-15-xlarge timeout-minutes: 30 permissions: