From 4172ee10c71ffe1c0ef2751461dfd22a1af736f1 Mon Sep 17 00:00:00 2001
From: Michael Bolin <mbolin@openai.com>
Date: Fri, 27 Mar 2026 12:48:43 -0700
Subject: [PATCH] fix: stabilize SDK CI codex setup

---
 .github/workflows/sdk.yml         | 50 ++++++++++++++++++++++++++++---
 sdk/typescript/tests/testCodex.ts | 48 ++++++++++++++++++-----------
 2 files changed, 76 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/sdk.yml b/.github/workflows/sdk.yml
index c5026fe8c5..2bcb23a463 100644
--- a/.github/workflows/sdk.yml
+++ b/.github/workflows/sdk.yml
@@ -33,11 +33,44 @@ jobs:
           node-version: 22
           cache: pnpm
 
-      - uses: dtolnay/rust-toolchain@1.93.0
+      - name: Set up Bazel CI
+        id: setup_bazel
+        uses: ./.github/actions/setup-bazel-ci
+        with:
+          target: x86_64-unknown-linux-gnu
 
-      - name: build codex
-        run: cargo build --bin codex
-        working-directory: codex-rs
+      - name: Build codex with Bazel
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
+        shell: bash
+        run: |
+          ./.github/scripts/run-bazel-ci.sh \
+            -- \
+            build \
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA} \
+            --build_metadata=TAG_job=sdk \
+            -- \
+            //codex-rs/cli:codex
+
+      - name: Expose Bazel-built codex path
+        shell: bash
+        run: |
+          set -euo pipefail
+          codex_path="$(
+            bazel cquery \
+              --ui_event_filters=-info \
+              --noshow_progress \
+              --output=files \
+              //codex-rs/cli:codex \
+              | tail -n 1
+          )"
+          echo "CODEX_EXEC_PATH=$(realpath "${codex_path}")" >> "$GITHUB_ENV"
+
+      - name: Warm up Bazel-built codex
+        shell: bash
+        run: |
+          set -euo pipefail
+          "${CODEX_EXEC_PATH}" --version
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -50,3 +83,12 @@ jobs:
 
       - name: Test SDK packages
         run: pnpm -r --filter ./sdk/typescript run test
+
+      - name: Save bazel repository cache
+        if: always() && !cancelled() && steps.setup_bazel.outputs.cache-hit != 'true'
+        continue-on-error: true
+        uses: actions/cache/save@v5
+        with:
+          path: |
+            ~/.cache/bazel-repo-cache
+          key: bazel-cache-x86_64-unknown-linux-gnu-${{ hashFiles('MODULE.bazel', 'codex-rs/Cargo.lock', 'codex-rs/Cargo.toml') }}
diff --git a/sdk/typescript/tests/testCodex.ts b/sdk/typescript/tests/testCodex.ts
index d73b519b65..a95a685165 100644
--- a/sdk/typescript/tests/testCodex.ts
+++ b/sdk/typescript/tests/testCodex.ts
@@ -3,7 +3,9 @@ import path from "node:path";
 import { Codex } from "../src/codex";
 import type { CodexConfigObject } from "../src/codexOptions";
 
-export const codexExecPath = path.join(process.cwd(), "..", "..", "codex-rs", "target", "debug", "codex");
+export const codexExecPath =
+  process.env.CODEX_EXEC_PATH ??
+  path.join(process.cwd(), "..", "..", "codex-rs", "target", "debug", "codex");
 
 type CreateTestClientOptions = {
   apiKey?: string;
@@ -44,33 +46,43 @@ export function createTestClient(options: CreateTestClientOptions = {}): TestCli
       codexPathOverride: codexExecPath,
       baseUrl: options.baseUrl,
       apiKey: options.apiKey,
-      config: mergeTestProviderConfig(options.baseUrl, options.config),
+      config: mergeTestConfig(options.baseUrl, options.config),
       env,
     }),
   };
 }
 
-function mergeTestProviderConfig(
+function mergeTestConfig(
   baseUrl: string | undefined,
   config: CodexConfigObject | undefined,
 ): CodexConfigObject | undefined {
-  if (!baseUrl || hasExplicitProviderConfig(config)) {
-    return config;
-  }
+  const mergedConfig: CodexConfigObject | undefined =
+    !baseUrl || hasExplicitProviderConfig(config)
+      ? config
+      : {
+          ...config,
+          // Built-in providers are merged before user config, so tests need a
+          // custom provider entry to force SSE against the local mock server.
+          model_provider: "mock",
+          model_providers: {
+            mock: {
+              name: "Mock provider for test",
+              base_url: baseUrl,
+              wire_api: "responses",
+              supports_websockets: false,
+            },
+          },
+        };
+  const featureOverrides = mergedConfig?.features;
 
-  // Built-in providers are merged before user config, so tests need a custom
-  // provider entry to force SSE against the local mock server.
   return {
-    ...config,
-    model_provider: "mock",
-    model_providers: {
-      mock: {
-        name: "Mock provider for test",
-        base_url: baseUrl,
-        wire_api: "responses",
-        supports_websockets: false,
-      },
-    },
+    ...mergedConfig,
+    // Disable plugins in SDK integration tests so background curated-plugin
+    // sync does not race temp CODEX_HOME cleanup.
+    features:
+      featureOverrides && typeof featureOverrides === "object" && !Array.isArray(featureOverrides)
+        ? { ...featureOverrides, plugins: false }
+        : { plugins: false },
   };
 }