diff --git a/.github/workflows/rust-release.yml b/.github/workflows/rust-release.yml index acc8b6bafe..8c56de10a6 100644 --- a/.github/workflows/rust-release.yml +++ b/.github/workflows/rust-release.yml @@ -10,6 +10,7 @@ on: push: tags: - "rust-v*.*.*" + pull_request: concurrency: group: ${{ github.workflow }} @@ -17,6 +18,7 @@ concurrency: jobs: tag-check: + if: ${{ github.event_name == 'push' }} runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 @@ -46,7 +48,6 @@ jobs: echo "::endgroup::" build: - needs: tag-check name: Build - ${{ matrix.runner }} - ${{ matrix.target }} runs-on: ${{ matrix.runner }} timeout-minutes: 60 @@ -65,18 +66,18 @@ jobs: target: aarch64-apple-darwin - runner: macos-15-xlarge target: x86_64-apple-darwin - - runner: ubuntu-24.04 - target: x86_64-unknown-linux-musl - - runner: ubuntu-24.04 - target: x86_64-unknown-linux-gnu - - runner: ubuntu-24.04-arm - target: aarch64-unknown-linux-musl - - runner: ubuntu-24.04-arm - target: aarch64-unknown-linux-gnu - - runner: windows-latest - target: x86_64-pc-windows-msvc - - runner: windows-11-arm - target: aarch64-pc-windows-msvc + # - runner: ubuntu-24.04 + # target: x86_64-unknown-linux-musl + # - runner: ubuntu-24.04 + # target: x86_64-unknown-linux-gnu + # - runner: ubuntu-24.04-arm + # target: aarch64-unknown-linux-musl + # - runner: ubuntu-24.04-arm + # target: aarch64-unknown-linux-gnu + # - runner: windows-latest + # target: x86_64-pc-windows-msvc + # - runner: windows-11-arm + # target: aarch64-pc-windows-msvc steps: - uses: actions/checkout@v6 @@ -109,408 +110,422 @@ jobs: cargo build --target ${{ matrix.target }} --release --bin codex --bin codex-responses-api-proxy fi - - if: ${{ contains(matrix.target, 'linux') }} - name: Cosign Linux artifacts - uses: ./.github/actions/linux-code-sign - with: - target: ${{ matrix.target }} - artifacts-dir: ${{ github.workspace }}/codex-rs/target/${{ matrix.target }}/release + # - if: ${{ github.event_name == 'push' && contains(matrix.target, 'linux') }} + # name: Cosign Linux artifacts + # uses: ./.github/actions/linux-code-sign + # with: + # target: ${{ matrix.target }} + # artifacts-dir: ${{ github.workspace }}/codex-rs/target/${{ matrix.target }}/release - - if: ${{ contains(matrix.target, 'windows') }} - name: Sign Windows binaries with Azure Trusted Signing - uses: ./.github/actions/windows-code-sign - with: - target: ${{ matrix.target }} - client-id: ${{ secrets.AZURE_TRUSTED_SIGNING_CLIENT_ID }} - tenant-id: ${{ secrets.AZURE_TRUSTED_SIGNING_TENANT_ID }} - subscription-id: ${{ secrets.AZURE_TRUSTED_SIGNING_SUBSCRIPTION_ID }} - endpoint: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }} - account-name: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }} - certificate-profile-name: ${{ secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_NAME }} + # - if: ${{ github.event_name == 'push' && contains(matrix.target, 'windows') }} + # name: Sign Windows binaries with Azure Trusted Signing + # uses: ./.github/actions/windows-code-sign + # with: + # target: ${{ matrix.target }} + # client-id: ${{ secrets.AZURE_TRUSTED_SIGNING_CLIENT_ID }} + # tenant-id: ${{ secrets.AZURE_TRUSTED_SIGNING_TENANT_ID }} + # subscription-id: ${{ secrets.AZURE_TRUSTED_SIGNING_SUBSCRIPTION_ID }} + # endpoint: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }} + # account-name: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }} + # certificate-profile-name: ${{ secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_NAME }} - if: ${{ runner.os == 'macOS' }} - name: MacOS code signing (binaries) - uses: ./.github/actions/macos-code-sign - with: - target: ${{ matrix.target }} - sign-binaries: "true" - sign-dmg: "false" - apple-certificate: ${{ secrets.APPLE_CERTIFICATE_P12 }} - apple-certificate-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} - apple-notarization-key-p8: ${{ secrets.APPLE_NOTARIZATION_KEY_P8 }} - apple-notarization-key-id: ${{ secrets.APPLE_NOTARIZATION_KEY_ID }} - apple-notarization-issuer-id: ${{ secrets.APPLE_NOTARIZATION_ISSUER_ID }} - - - if: ${{ runner.os == 'macOS' }} - name: Build macOS dmg + name: Check Apple Notary connectivity shell: bash run: | - set -euo pipefail + set -e + nslookup appstoreconnect.apple.com + curl -Iv --connect-timeout 10 https://appstoreconnect.apple.com/ - target="${{ matrix.target }}" - release_dir="target/${target}/release" - dmg_root="${RUNNER_TEMP}/codex-dmg-root" - volname="Codex (${target})" - dmg_path="${release_dir}/codex-${target}.dmg" + # - if: ${{ github.event_name == 'push' && runner.os == 'macOS' }} + # name: MacOS code signing (binaries) + # uses: ./.github/actions/macos-code-sign + # with: + # target: ${{ matrix.target }} + # sign-binaries: "true" + # sign-dmg: "false" + # apple-certificate: ${{ secrets.APPLE_CERTIFICATE_P12 }} + # apple-certificate-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} + # apple-notarization-key-p8: ${{ secrets.APPLE_NOTARIZATION_KEY_P8 }} + # apple-notarization-key-id: ${{ secrets.APPLE_NOTARIZATION_KEY_ID }} + # apple-notarization-issuer-id: ${{ secrets.APPLE_NOTARIZATION_ISSUER_ID }} - # The previous "MacOS code signing (binaries)" step signs + notarizes the - # built artifacts in `${release_dir}`. This step packages *those same* - # signed binaries into a dmg. - codex_binary_path="${release_dir}/codex" - proxy_binary_path="${release_dir}/codex-responses-api-proxy" + # - if: ${{ github.event_name == 'push' && runner.os == 'macOS' }} + # name: Build macOS dmg + # shell: bash + # run: | + # set -euo pipefail - rm -rf "$dmg_root" - mkdir -p "$dmg_root" + # target="${{ matrix.target }}" + # release_dir="target/${target}/release" + # dmg_root="${RUNNER_TEMP}/codex-dmg-root" + # volname="Codex (${target})" + # dmg_path="${release_dir}/codex-${target}.dmg" - if [[ ! -f "$codex_binary_path" ]]; then - echo "Binary $codex_binary_path not found" - exit 1 - fi - if [[ ! -f "$proxy_binary_path" ]]; then - echo "Binary $proxy_binary_path not found" - exit 1 - fi + # # The previous "MacOS code signing (binaries)" step signs + notarizes the + # # built artifacts in `${release_dir}`. This step packages *those same* + # # signed binaries into a dmg. + # codex_binary_path="${release_dir}/codex" + # proxy_binary_path="${release_dir}/codex-responses-api-proxy" - ditto "$codex_binary_path" "${dmg_root}/codex" - ditto "$proxy_binary_path" "${dmg_root}/codex-responses-api-proxy" + # rm -rf "$dmg_root" + # mkdir -p "$dmg_root" - rm -f "$dmg_path" - hdiutil create \ - -volname "$volname" \ - -srcfolder "$dmg_root" \ - -format UDZO \ - -ov \ - "$dmg_path" + # if [[ ! -f "$codex_binary_path" ]]; then + # echo "Binary $codex_binary_path not found" + # exit 1 + # fi + # if [[ ! -f "$proxy_binary_path" ]]; then + # echo "Binary $proxy_binary_path not found" + # exit 1 + # fi - if [[ ! -f "$dmg_path" ]]; then - echo "dmg $dmg_path not found after build" - exit 1 - fi + # ditto "$codex_binary_path" "${dmg_root}/codex" + # ditto "$proxy_binary_path" "${dmg_root}/codex-responses-api-proxy" - - if: ${{ runner.os == 'macOS' }} - name: MacOS code signing (dmg) - uses: ./.github/actions/macos-code-sign - with: - target: ${{ matrix.target }} - sign-binaries: "false" - sign-dmg: "true" - apple-certificate: ${{ secrets.APPLE_CERTIFICATE_P12 }} - apple-certificate-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} - apple-notarization-key-p8: ${{ secrets.APPLE_NOTARIZATION_KEY_P8 }} - apple-notarization-key-id: ${{ secrets.APPLE_NOTARIZATION_KEY_ID }} - apple-notarization-issuer-id: ${{ secrets.APPLE_NOTARIZATION_ISSUER_ID }} + # rm -f "$dmg_path" + # hdiutil create \ + # -volname "$volname" \ + # -srcfolder "$dmg_root" \ + # -format UDZO \ + # -ov \ + # "$dmg_path" - - name: Stage artifacts - shell: bash - run: | - dest="dist/${{ matrix.target }}" - mkdir -p "$dest" + # if [[ ! -f "$dmg_path" ]]; then + # echo "dmg $dmg_path not found after build" + # exit 1 + # fi - if [[ "${{ matrix.runner }}" == windows* ]]; then - cp target/${{ matrix.target }}/release/codex.exe "$dest/codex-${{ matrix.target }}.exe" - cp target/${{ matrix.target }}/release/codex-responses-api-proxy.exe "$dest/codex-responses-api-proxy-${{ matrix.target }}.exe" - cp target/${{ matrix.target }}/release/codex-windows-sandbox-setup.exe "$dest/codex-windows-sandbox-setup-${{ matrix.target }}.exe" - cp target/${{ matrix.target }}/release/codex-command-runner.exe "$dest/codex-command-runner-${{ matrix.target }}.exe" - else - cp target/${{ matrix.target }}/release/codex "$dest/codex-${{ matrix.target }}" - cp target/${{ matrix.target }}/release/codex-responses-api-proxy "$dest/codex-responses-api-proxy-${{ matrix.target }}" - fi + # - if: ${{ github.event_name == 'push' && runner.os == 'macOS' }} + # name: MacOS code signing (dmg) + # uses: ./.github/actions/macos-code-sign + # with: + # target: ${{ matrix.target }} + # sign-binaries: "false" + # sign-dmg: "true" + # apple-certificate: ${{ secrets.APPLE_CERTIFICATE_P12 }} + # apple-certificate-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} + # apple-notarization-key-p8: ${{ secrets.APPLE_NOTARIZATION_KEY_P8 }} + # apple-notarization-key-id: ${{ secrets.APPLE_NOTARIZATION_KEY_ID }} + # apple-notarization-issuer-id: ${{ secrets.APPLE_NOTARIZATION_ISSUER_ID }} - if [[ "${{ matrix.target }}" == *linux* ]]; then - cp target/${{ matrix.target }}/release/codex.sigstore "$dest/codex-${{ matrix.target }}.sigstore" - cp target/${{ matrix.target }}/release/codex-responses-api-proxy.sigstore "$dest/codex-responses-api-proxy-${{ matrix.target }}.sigstore" - fi + # - if: ${{ github.event_name == 'push' }} + # name: Stage artifacts + # shell: bash + # run: | + # dest="dist/${{ matrix.target }}" + # mkdir -p "$dest" - if [[ "${{ matrix.target }}" == *apple-darwin ]]; then - cp target/${{ matrix.target }}/release/codex-${{ matrix.target }}.dmg "$dest/codex-${{ matrix.target }}.dmg" - fi + # if [[ "${{ matrix.runner }}" == windows* ]]; then + # cp target/${{ matrix.target }}/release/codex.exe "$dest/codex-${{ matrix.target }}.exe" + # cp target/${{ matrix.target }}/release/codex-responses-api-proxy.exe "$dest/codex-responses-api-proxy-${{ matrix.target }}.exe" + # cp target/${{ matrix.target }}/release/codex-windows-sandbox-setup.exe "$dest/codex-windows-sandbox-setup-${{ matrix.target }}.exe" + # cp target/${{ matrix.target }}/release/codex-command-runner.exe "$dest/codex-command-runner-${{ matrix.target }}.exe" + # else + # cp target/${{ matrix.target }}/release/codex "$dest/codex-${{ matrix.target }}" + # cp target/${{ matrix.target }}/release/codex-responses-api-proxy "$dest/codex-responses-api-proxy-${{ matrix.target }}" + # fi - - if: ${{ matrix.runner == 'windows-11-arm' }} - name: Install zstd - shell: powershell - run: choco install -y zstandard + # if [[ "${{ matrix.target }}" == *linux* ]]; then + # cp target/${{ matrix.target }}/release/codex.sigstore "$dest/codex-${{ matrix.target }}.sigstore" + # cp target/${{ matrix.target }}/release/codex-responses-api-proxy.sigstore "$dest/codex-responses-api-proxy-${{ matrix.target }}.sigstore" + # fi - - name: Compress artifacts - shell: bash - run: | - # Path that contains the uncompressed binaries for the current - # ${{ matrix.target }} - dest="dist/${{ matrix.target }}" + # if [[ "${{ matrix.target }}" == *apple-darwin ]]; then + # cp target/${{ matrix.target }}/release/codex-${{ matrix.target }}.dmg "$dest/codex-${{ matrix.target }}.dmg" + # fi - # We want to ship the raw Windows executables in the GitHub Release - # in addition to the compressed archives. Keep the originals for - # Windows targets; remove them elsewhere to limit the number of - # artifacts that end up in the GitHub Release. - keep_originals=false - if [[ "${{ matrix.runner }}" == windows* ]]; then - keep_originals=true - fi + # - if: ${{ github.event_name == 'push' && matrix.runner == 'windows-11-arm' }} + # name: Install zstd + # shell: powershell + # run: choco install -y zstandard - # For compatibility with environments that lack the `zstd` tool we - # additionally create a `.tar.gz` for all platforms and `.zip` for - # Windows alongside every single binary that we publish. The end result is: - # codex-.zst (existing) - # codex-.tar.gz (new) - # codex-.zip (only for Windows) + # - if: ${{ github.event_name == 'push' }} + # name: Compress artifacts + # shell: bash + # run: | + # # Path that contains the uncompressed binaries for the current + # # ${{ matrix.target }} + # dest="dist/${{ matrix.target }}" - # 1. Produce a .tar.gz for every file in the directory *before* we - # run `zstd --rm`, because that flag deletes the original files. - for f in "$dest"/*; do - base="$(basename "$f")" - # Skip files that are already archives (shouldn't happen, but be - # safe). - if [[ "$base" == *.tar.gz || "$base" == *.zip || "$base" == *.dmg ]]; then - continue - fi + # # We want to ship the raw Windows executables in the GitHub Release + # # in addition to the compressed archives. Keep the originals for + # # Windows targets; remove them elsewhere to limit the number of + # # artifacts that end up in the GitHub Release. + # keep_originals=false + # if [[ "${{ matrix.runner }}" == windows* ]]; then + # keep_originals=true + # fi - # Don't try to compress signature bundles. - if [[ "$base" == *.sigstore ]]; then - continue - fi + # # For compatibility with environments that lack the `zstd` tool we + # # additionally create a `.tar.gz` for all platforms and `.zip` for + # # Windows alongside every single binary that we publish. The end result is: + # # codex-.zst (existing) + # # codex-.tar.gz (new) + # # codex-.zip (only for Windows) - # Create per-binary tar.gz - tar -C "$dest" -czf "$dest/${base}.tar.gz" "$base" + # # 1. Produce a .tar.gz for every file in the directory *before* we + # # run `zstd --rm`, because that flag deletes the original files. + # for f in "$dest"/*; do + # base="$(basename "$f")" + # # Skip files that are already archives (shouldn't happen, but be + # # safe). + # if [[ "$base" == *.tar.gz || "$base" == *.zip || "$base" == *.dmg ]]; then + # continue + # fi - # Create zip archive for Windows binaries - # Must run from inside the dest dir so 7z won't - # embed the directory path inside the zip. - if [[ "${{ matrix.runner }}" == windows* ]]; then - (cd "$dest" && 7z a "${base}.zip" "$base") - fi + # # Don't try to compress signature bundles. + # if [[ "$base" == *.sigstore ]]; then + # continue + # fi - # Also create .zst (existing behaviour) *and* remove the original - # uncompressed binary to keep the directory small. - zstd_args=(-T0 -19) - if [[ "${keep_originals}" == false ]]; then - zstd_args+=(--rm) - fi - zstd "${zstd_args[@]}" "$dest/$base" - done + # # Create per-binary tar.gz + # tar -C "$dest" -czf "$dest/${base}.tar.gz" "$base" - - uses: actions/upload-artifact@v6 - with: - name: ${{ matrix.target }} - # Upload the per-binary .zst files as well as the new .tar.gz - # equivalents we generated in the previous step. - path: | - codex-rs/dist/${{ matrix.target }}/* + # # Create zip archive for Windows binaries + # # Must run from inside the dest dir so 7z won't + # # embed the directory path inside the zip. + # if [[ "${{ matrix.runner }}" == windows* ]]; then + # (cd "$dest" && 7z a "${base}.zip" "$base") + # fi - shell-tool-mcp: - name: shell-tool-mcp - needs: tag-check - uses: ./.github/workflows/shell-tool-mcp.yml - with: - release-tag: ${{ github.ref_name }} - publish: true - secrets: inherit + # # Also create .zst (existing behaviour) *and* remove the original + # # uncompressed binary to keep the directory small. + # zstd_args=(-T0 -19) + # if [[ "${keep_originals}" == false ]]; then + # zstd_args+=(--rm) + # fi + # zstd "${zstd_args[@]}" "$dest/$base" + # done - release: - needs: - - build - - shell-tool-mcp - name: release - runs-on: ubuntu-latest - permissions: - contents: write - actions: read - outputs: - version: ${{ steps.release_name.outputs.name }} - tag: ${{ github.ref_name }} - should_publish_npm: ${{ steps.npm_publish_settings.outputs.should_publish }} - npm_tag: ${{ steps.npm_publish_settings.outputs.npm_tag }} + # - if: ${{ github.event_name == 'push' }} + # uses: actions/upload-artifact@v6 + # with: + # name: ${{ matrix.target }} + # # Upload the per-binary .zst files as well as the new .tar.gz + # # equivalents we generated in the previous step. + # path: | + # codex-rs/dist/${{ matrix.target }}/* - steps: - - name: Checkout repository - uses: actions/checkout@v6 + # shell-tool-mcp: + # name: shell-tool-mcp + # if: ${{ github.event_name == 'push' }} + # needs: tag-check + # uses: ./.github/workflows/shell-tool-mcp.yml + # with: + # release-tag: ${{ github.ref_name }} + # publish: true + # secrets: inherit - - name: Generate release notes from tag commit message - id: release_notes - shell: bash - run: | - set -euo pipefail + # release: + # needs: + # - build + # - shell-tool-mcp + # name: release + # if: ${{ github.event_name == 'push' }} + # runs-on: ubuntu-latest + # permissions: + # contents: write + # actions: read + # outputs: + # version: ${{ steps.release_name.outputs.name }} + # tag: ${{ github.ref_name }} + # should_publish_npm: ${{ steps.npm_publish_settings.outputs.should_publish }} + # npm_tag: ${{ steps.npm_publish_settings.outputs.npm_tag }} - # On tag pushes, GITHUB_SHA may be a tag object for annotated tags; - # peel it to the underlying commit. - commit="$(git rev-parse "${GITHUB_SHA}^{commit}")" - notes_path="${RUNNER_TEMP}/release-notes.md" + # steps: + # - name: Checkout repository + # uses: actions/checkout@v6 - # Use the commit message for the commit the tag points at (not the - # annotated tag message). - git log -1 --format=%B "${commit}" > "${notes_path}" - # Ensure trailing newline so GitHub's markdown renderer doesn't - # occasionally run the last line into subsequent content. - echo >> "${notes_path}" + # - name: Generate release notes from tag commit message + # id: release_notes + # shell: bash + # run: | + # set -euo pipefail - echo "path=${notes_path}" >> "${GITHUB_OUTPUT}" + # # On tag pushes, GITHUB_SHA may be a tag object for annotated tags; + # # peel it to the underlying commit. + # commit="$(git rev-parse "${GITHUB_SHA}^{commit}")" + # notes_path="${RUNNER_TEMP}/release-notes.md" - - uses: actions/download-artifact@v7 - with: - path: dist + # # Use the commit message for the commit the tag points at (not the + # # annotated tag message). + # git log -1 --format=%B "${commit}" > "${notes_path}" + # # Ensure trailing newline so GitHub's markdown renderer doesn't + # # occasionally run the last line into subsequent content. + # echo >> "${notes_path}" - - name: List - run: ls -R dist/ + # echo "path=${notes_path}" >> "${GITHUB_OUTPUT}" - # This is a temporary fix: we should modify shell-tool-mcp.yml so these - # files do not end up in dist/ in the first place. - - name: Delete entries from dist/ that should not go in the release - run: | - rm -rf dist/shell-tool-mcp* + # - uses: actions/download-artifact@v7 + # with: + # path: dist - ls -R dist/ + # - name: List + # run: ls -R dist/ - - name: Define release name - id: release_name - run: | - # Extract the version from the tag name, which is in the format - # "rust-v0.1.0". - version="${GITHUB_REF_NAME#rust-v}" - echo "name=${version}" >> $GITHUB_OUTPUT + # # This is a temporary fix: we should modify shell-tool-mcp.yml so these + # # files do not end up in dist/ in the first place. + # - name: Delete entries from dist/ that should not go in the release + # run: | + # rm -rf dist/shell-tool-mcp* - - name: Determine npm publish settings - id: npm_publish_settings - env: - VERSION: ${{ steps.release_name.outputs.name }} - run: | - set -euo pipefail - version="${VERSION}" + # ls -R dist/ - if [[ "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then - echo "should_publish=true" >> "$GITHUB_OUTPUT" - echo "npm_tag=" >> "$GITHUB_OUTPUT" - elif [[ "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+-alpha\.[0-9]+$ ]]; then - echo "should_publish=true" >> "$GITHUB_OUTPUT" - echo "npm_tag=alpha" >> "$GITHUB_OUTPUT" - else - echo "should_publish=false" >> "$GITHUB_OUTPUT" - echo "npm_tag=" >> "$GITHUB_OUTPUT" - fi + # - name: Define release name + # id: release_name + # run: | + # # Extract the version from the tag name, which is in the format + # # "rust-v0.1.0". + # version="${GITHUB_REF_NAME#rust-v}" + # echo "name=${version}" >> $GITHUB_OUTPUT - - name: Setup pnpm - uses: pnpm/action-setup@v4 - with: - run_install: false + # - name: Determine npm publish settings + # id: npm_publish_settings + # env: + # VERSION: ${{ steps.release_name.outputs.name }} + # run: | + # set -euo pipefail + # version="${VERSION}" - - name: Setup Node.js for npm packaging - uses: actions/setup-node@v6 - with: - node-version: 22 + # if [[ "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + # echo "should_publish=true" >> "$GITHUB_OUTPUT" + # echo "npm_tag=" >> "$GITHUB_OUTPUT" + # elif [[ "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+-alpha\.[0-9]+$ ]]; then + # echo "should_publish=true" >> "$GITHUB_OUTPUT" + # echo "npm_tag=alpha" >> "$GITHUB_OUTPUT" + # else + # echo "should_publish=false" >> "$GITHUB_OUTPUT" + # echo "npm_tag=" >> "$GITHUB_OUTPUT" + # fi - - name: Install dependencies - run: pnpm install --frozen-lockfile + # - name: Setup pnpm + # uses: pnpm/action-setup@v4 + # with: + # run_install: false - # stage_npm_packages.py requires DotSlash when staging releases. - - uses: facebook/install-dotslash@v2 - - name: Stage npm packages - env: - GH_TOKEN: ${{ github.token }} - run: | - ./scripts/stage_npm_packages.py \ - --release-version "${{ steps.release_name.outputs.name }}" \ - --package codex \ - --package codex-responses-api-proxy \ - --package codex-sdk + # - name: Setup Node.js for npm packaging + # uses: actions/setup-node@v6 + # with: + # node-version: 22 - - name: Create GitHub Release - uses: softprops/action-gh-release@v2 - with: - name: ${{ steps.release_name.outputs.name }} - tag_name: ${{ github.ref_name }} - body_path: ${{ steps.release_notes.outputs.path }} - files: dist/** - # Mark as prerelease only when the version has a suffix after x.y.z - # (e.g. -alpha, -beta). Otherwise publish a normal release. - prerelease: ${{ contains(steps.release_name.outputs.name, '-') }} + # - name: Install dependencies + # run: pnpm install --frozen-lockfile - - uses: facebook/dotslash-publish-release@v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - tag: ${{ github.ref_name }} - config: .github/dotslash-config.json + # # stage_npm_packages.py requires DotSlash when staging releases. + # - uses: facebook/install-dotslash@v2 + # - name: Stage npm packages + # env: + # GH_TOKEN: ${{ github.token }} + # run: | + # ./scripts/stage_npm_packages.py \ + # --release-version "${{ steps.release_name.outputs.name }}" \ + # --package codex \ + # --package codex-responses-api-proxy \ + # --package codex-sdk - # Publish to npm using OIDC authentication. - # July 31, 2025: https://github.blog/changelog/2025-07-31-npm-trusted-publishing-with-oidc-is-generally-available/ - # npm docs: https://docs.npmjs.com/trusted-publishers - publish-npm: - # Publish to npm for stable releases and alpha pre-releases with numeric suffixes. - if: ${{ needs.release.outputs.should_publish_npm == 'true' }} - name: publish-npm - needs: release - runs-on: ubuntu-latest - permissions: - id-token: write # Required for OIDC - contents: read + # - name: Create GitHub Release + # uses: softprops/action-gh-release@v2 + # with: + # name: ${{ steps.release_name.outputs.name }} + # tag_name: ${{ github.ref_name }} + # body_path: ${{ steps.release_notes.outputs.path }} + # files: dist/** + # # Mark as prerelease only when the version has a suffix after x.y.z + # # (e.g. -alpha, -beta). Otherwise publish a normal release. + # prerelease: ${{ contains(steps.release_name.outputs.name, '-') }} - steps: - - name: Setup Node.js - uses: actions/setup-node@v6 - with: - node-version: 22 - registry-url: "https://registry.npmjs.org" - scope: "@openai" + # - uses: facebook/dotslash-publish-release@v2 + # env: + # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # with: + # tag: ${{ github.ref_name }} + # config: .github/dotslash-config.json - # Trusted publishing requires npm CLI version 11.5.1 or later. - - name: Update npm - run: npm install -g npm@latest + # # Publish to npm using OIDC authentication. + # # July 31, 2025: https://github.blog/changelog/2025-07-31-npm-trusted-publishing-with-oidc-is-generally-available/ + # # npm docs: https://docs.npmjs.com/trusted-publishers + # publish-npm: + # # Publish to npm for stable releases and alpha pre-releases with numeric suffixes. + # if: ${{ github.event_name == 'push' && needs.release.outputs.should_publish_npm == 'true' }} + # name: publish-npm + # needs: release + # runs-on: ubuntu-latest + # permissions: + # id-token: write # Required for OIDC + # contents: read - - name: Download npm tarballs from release - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - set -euo pipefail - version="${{ needs.release.outputs.version }}" - tag="${{ needs.release.outputs.tag }}" - mkdir -p dist/npm - gh release download "$tag" \ - --repo "${GITHUB_REPOSITORY}" \ - --pattern "codex-npm-${version}.tgz" \ - --dir dist/npm - gh release download "$tag" \ - --repo "${GITHUB_REPOSITORY}" \ - --pattern "codex-responses-api-proxy-npm-${version}.tgz" \ - --dir dist/npm - gh release download "$tag" \ - --repo "${GITHUB_REPOSITORY}" \ - --pattern "codex-sdk-npm-${version}.tgz" \ - --dir dist/npm + # steps: + # - name: Setup Node.js + # uses: actions/setup-node@v6 + # with: + # node-version: 22 + # registry-url: "https://registry.npmjs.org" + # scope: "@openai" - # No NODE_AUTH_TOKEN needed because we use OIDC. - - name: Publish to npm - env: - VERSION: ${{ needs.release.outputs.version }} - NPM_TAG: ${{ needs.release.outputs.npm_tag }} - run: | - set -euo pipefail - tag_args=() - if [[ -n "${NPM_TAG}" ]]; then - tag_args+=(--tag "${NPM_TAG}") - fi + # # Trusted publishing requires npm CLI version 11.5.1 or later. + # - name: Update npm + # run: npm install -g npm@latest - tarballs=( - "codex-npm-${VERSION}.tgz" - "codex-responses-api-proxy-npm-${VERSION}.tgz" - "codex-sdk-npm-${VERSION}.tgz" - ) + # - name: Download npm tarballs from release + # env: + # GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # run: | + # set -euo pipefail + # version="${{ needs.release.outputs.version }}" + # tag="${{ needs.release.outputs.tag }}" + # mkdir -p dist/npm + # gh release download "$tag" \ + # --repo "${GITHUB_REPOSITORY}" \ + # --pattern "codex-npm-${version}.tgz" \ + # --dir dist/npm + # gh release download "$tag" \ + # --repo "${GITHUB_REPOSITORY}" \ + # --pattern "codex-responses-api-proxy-npm-${version}.tgz" \ + # --dir dist/npm + # gh release download "$tag" \ + # --repo "${GITHUB_REPOSITORY}" \ + # --pattern "codex-sdk-npm-${version}.tgz" \ + # --dir dist/npm - for tarball in "${tarballs[@]}"; do - npm publish "${GITHUB_WORKSPACE}/dist/npm/${tarball}" "${tag_args[@]}" - done + # # No NODE_AUTH_TOKEN needed because we use OIDC. + # - name: Publish to npm + # env: + # VERSION: ${{ needs.release.outputs.version }} + # NPM_TAG: ${{ needs.release.outputs.npm_tag }} + # run: | + # set -euo pipefail + # tag_args=() + # if [[ -n "${NPM_TAG}" ]]; then + # tag_args+=(--tag "${NPM_TAG}") + # fi - update-branch: - name: Update latest-alpha-cli branch - permissions: - contents: write - needs: release - runs-on: ubuntu-latest + # tarballs=( + # "codex-npm-${VERSION}.tgz" + # "codex-responses-api-proxy-npm-${VERSION}.tgz" + # "codex-sdk-npm-${VERSION}.tgz" + # ) - steps: - - name: Update latest-alpha-cli branch - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - set -euo pipefail - gh api \ - repos/${GITHUB_REPOSITORY}/git/refs/heads/latest-alpha-cli \ - -X PATCH \ - -f sha="${GITHUB_SHA}" \ - -F force=true + # for tarball in "${tarballs[@]}"; do + # npm publish "${GITHUB_WORKSPACE}/dist/npm/${tarball}" "${tag_args[@]}" + # done + + # update-branch: + # name: Update latest-alpha-cli branch + # if: ${{ github.event_name == 'push' }} + # permissions: + # contents: write + # needs: release + # runs-on: ubuntu-latest + + # steps: + # - name: Update latest-alpha-cli branch + # env: + # GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # run: | + # set -euo pipefail + # gh api \ + # repos/${GITHUB_REPOSITORY}/git/refs/heads/latest-alpha-cli \ + # -X PATCH \ + # -f sha="${GITHUB_SHA}" \ + # -F force=true