Add Bazel support to the Codex package build action (#51855)

## What changed

Add a `build-system` input to `build-codex-packages`, defaulting to `cargo`, and extract binary builds into dedicated Cargo and Bazel actions. The Bazel path stages binaries and symbols for the shared CLI and app-server packaging and smoke-test steps, with support for `release` and `debug` build modes.

Resolve the package source root before invoking nested actions, and use Bash to export the Bazel repository cache path.

GitOrigin-RevId: ebd5e7c84451733419838da5956dc090cd09b19a

.github/actions/build-bazel-package-binaries/action.yml

@@ -0,0 +1,35 @@
+name: Build Bazel package binaries
+description: Set up Bazel and stage unstripped runtime package binaries and symbols.
+inputs:
+  target:
+    description: Rust release target triple.
+    required: true
+  build-mode:
+    description: Release optimizations, or debug for faster package smoke builds.
+    default: release
+
+runs:
+  using: composite
+  steps:
+    - name: Set up Bazel
+      uses: ./.github/actions/prepare-bazel-ci
+      with:
+        target: ${{ inputs.target }}
+        cache-scope: bazel-release
+
+    - name: Install Cargo for workspace metadata
+      uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
+
+    - name: Configure MSVC environment
+      if: ${{ runner.os == 'Windows' }}
+      uses: ./.github/actions/setup-msvc-env
+      with:
+        target: ${{ inputs.target }}
+
+    - name: Build Bazel release binaries and symbols
+      uses: ./.github/actions/build-bazel-release
+      with:
+        target: ${{ inputs.target }}
+        bundle: combined
+        release-dir: ${{ env.CARGO_TARGET_DIR }}/${{ inputs.target }}/release
+        build-mode: ${{ inputs.build-mode }}

.github/actions/build-cargo-package-binaries/action.yml

@@ -0,0 +1,135 @@
+name: Build Cargo package binaries
+description: Set up Cargo and build unstripped runtime package binaries and symbols.
+inputs:
+  target:
+    description: Rust release target triple.
+    required: true
+  binaries:
+    description: Space-separated binary target names.
+    required: true
+  build-mode:
+    description: Release optimizations, or debug for faster package smoke builds.
+    default: release
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/setup-ci
+
+    - name: Configure Cargo release profile
+      shell: bash
+      env:
+        BUILD_MODE: ${{ inputs.build-mode }}
+        # macOS symbol extraction needs packed dSYM bundles before binaries are stripped.
+        CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO: ${{ contains(inputs.target, 'apple-darwin') && 'packed' || 'off' }}
+      run: |
+        set -euo pipefail
+        echo "CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO=$CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO" >> "$GITHUB_ENV"
+        case "$BUILD_MODE" in
+          release) ;;
+          debug)
+            # Use the release profile so assertions, symbols and packaging match production.
+            # Only trade compiler optimizations for faster builds.
+            {
+              echo "CARGO_PROFILE_RELEASE_OPT_LEVEL=0"
+              echo "CARGO_PROFILE_RELEASE_LTO=off"
+              echo "CARGO_PROFILE_RELEASE_CODEGEN_UNITS=256"
+            } >> "$GITHUB_ENV"
+            ;;
+          *) echo "Unsupported build mode: $BUILD_MODE" >&2; exit 1 ;;
+        esac
+
+    - uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
+      with:
+        targets: ${{ inputs.target }}
+
+    - name: Use hermetic Cargo home (musl)
+      if: ${{ runner.os == 'Linux' }}
+      shell: bash
+      working-directory: codex-rs
+      run: |
+        set -euo pipefail
+        cargo_home="${GITHUB_WORKSPACE}/.cargo-home"
+        mkdir -p "${cargo_home}/bin"
+        echo "CARGO_HOME=${cargo_home}" >> "$GITHUB_ENV"
+        echo "${cargo_home}/bin" >> "$GITHUB_PATH"
+        : > "${cargo_home}/config.toml"
+
+    - name: Install Zig
+      if: ${{ runner.os == 'Linux' }}
+      uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
+      with:
+        version: 0.14.0
+        use-cache: false
+
+    - name: Install musl build tools
+      if: ${{ runner.os == 'Linux' }}
+      shell: bash
+      working-directory: codex-rs
+      env:
+        TARGET: ${{ inputs.target }}
+      run: bash "${GITHUB_WORKSPACE}/.github/scripts/install-musl-build-tools.sh"
+
+    - name: Disable aws-lc jitter entropy (musl)
+      if: ${{ runner.os == 'Linux' }}
+      shell: bash
+      working-directory: codex-rs
+      env:
+        TARGET: ${{ inputs.target }}
+      run: |
+        set -euo pipefail
+        # aws-lc's jitter entropy path does not work reliably on musl builders,
+        # so disable it globally and per target.
+        echo "AWS_LC_SYS_NO_JITTER_ENTROPY=1" >> "$GITHUB_ENV"
+        target_no_jitter="AWS_LC_SYS_NO_JITTER_ENTROPY_${TARGET}"
+        target_no_jitter="${target_no_jitter//-/_}"
+        echo "${target_no_jitter}=1" >> "$GITHUB_ENV"
+
+    - name: Configure rusty_v8 artifact overrides and verify checksums
+      uses: ./.github/actions/setup-rusty-v8
+      with:
+        target: ${{ inputs.target }}
+
+    - name: Configure MSVC environment
+      if: ${{ runner.os == 'Windows' }}
+      uses: ./.github/actions/setup-msvc-env
+      with:
+        target: ${{ inputs.target }}
+
+    - name: Build bwrap and export digest
+      if: ${{ runner.os == 'Linux' }}
+      shell: bash
+      working-directory: codex-rs
+      env:
+        TARGET: ${{ inputs.target }}
+      run: |
+        set -euo pipefail
+        cargo build --target "${TARGET}" --release --timings --bin bwrap
+
+        bwrap_path="${CARGO_TARGET_DIR}/${TARGET}/release/bwrap"
+        # Codex embeds this digest at build time and verifies the packaged
+        # bwrap at runtime, so hash its final stripped bytes first.
+        strip --strip-debug --strip-unneeded "$bwrap_path"
+        digest="$(sha256sum "$bwrap_path" | awk '{print $1}')"
+        echo "CODEX_BWRAP_SHA256=${digest}" >> "$GITHUB_ENV"
+
+    - name: Build Codex package binaries
+      shell: bash
+      working-directory: codex-rs
+      env:
+        TARGET: ${{ inputs.target }}
+        BINARIES: ${{ inputs.binaries }}
+      run: |
+        set -euo pipefail
+        build_args=()
+        for binary in $BINARIES; do
+          build_args+=(--bin "$binary")
+        done
+        # SQLite intrinsics can emit instructions unsupported by older x64
+        # CPUs, causing Windows release binaries to crash during startup.
+        if [[ "${TARGET}" == "x86_64-pc-windows-msvc" ]]; then
+          export LIBSQLITE3_FLAGS=SQLITE_DISABLE_INTRINSIC
+        fi
+        STABLE_GIT_COMMIT="$(git rev-parse HEAD)"
+        export STABLE_GIT_COMMIT
+        cargo build --target "${TARGET}" --release --timings "${build_args[@]}"

.github/actions/build-codex-packages/action.yml

@@ -10,44 +10,42 @@ inputs:
   build-mode:
     description: Use release optimizations (release) or disable them for faster smoke coverage (debug).
     required: true
+  build-system:
+    description: Build package binaries with Cargo or Bazel.
+    default: cargo
 
 # Resolve package sources relative to the action so it works in both repository layouts.
 runs:
   using: composite
   steps:
     - name: Select release binaries
+      id: package_setup
       shell: bash
       working-directory: codex-rs
       env:
         BASE_BINARIES: "codex codex-app-server codex-code-mode-host"
         WINDOWS_ONLY_BINARIES: "codex-command-runner codex-windows-sandbox-setup"
         BUILD_MODE: ${{ inputs.build-mode }}
-        # macOS symbol extraction needs packed dSYM bundles before binaries are stripped.
-        CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO: ${{ contains(inputs.target, 'apple-darwin') && 'packed' || 'off' }}
+        BUILD_SYSTEM: ${{ inputs.build-system }}
+        PACKAGE_ACTION_PATH: ${{ github.action_path }}
       run: |
         set -euo pipefail
+        package_source_root="$(cd "${PACKAGE_ACTION_PATH}/../../.." && pwd)"
+        echo "source_root=$package_source_root" >> "$GITHUB_OUTPUT"
         needed_binaries="$BASE_BINARIES"
         if [[ "$RUNNER_OS" == "Windows" ]]; then
           needed_binaries+=" $WINDOWS_ONLY_BINARIES"
         fi
         echo "NEEDED_BINARIES=$needed_binaries" >> "$GITHUB_ENV"
-        echo "CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO=$CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO" >> "$GITHUB_ENV"
+        case "$BUILD_SYSTEM" in
+          cargo|bazel) ;;
+          *) echo "Unsupported build system: $BUILD_SYSTEM" >&2; exit 1 ;;
+        esac
         case "$BUILD_MODE" in
-          release) ;;
-          debug)
-            # Use the release profile so assertions, symbols and packaging match production.
-            # Only trade compiler optimizations for faster builds.
-            {
-              echo "CARGO_PROFILE_RELEASE_OPT_LEVEL=0"
-              echo "CARGO_PROFILE_RELEASE_LTO=off"
-              echo "CARGO_PROFILE_RELEASE_CODEGEN_UNITS=256"
-            } >> "$GITHUB_ENV"
-            ;;
+          release|debug) ;;
           *) echo "Unsupported build mode: $BUILD_MODE" >&2; exit 1 ;;
         esac
 
-    - uses: ./.github/actions/setup-ci
-
     - name: Set up Python 3.12
       uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
@@ -67,99 +65,20 @@ runs:
         sudo apt-get update -y
         sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends binutils make pkg-config libcap-dev
 
-    - uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
-      with:
-        targets: ${{ inputs.target }}
-
-    - name: Use hermetic Cargo home (musl)
-      if: ${{ runner.os == 'Linux' }}
-      shell: bash
-      working-directory: codex-rs
-      run: |
-        set -euo pipefail
-        cargo_home="${GITHUB_WORKSPACE}/.cargo-home"
-        mkdir -p "${cargo_home}/bin"
-        echo "CARGO_HOME=${cargo_home}" >> "$GITHUB_ENV"
-        echo "${cargo_home}/bin" >> "$GITHUB_PATH"
-        : > "${cargo_home}/config.toml"
-
-    - name: Install Zig
-      if: ${{ runner.os == 'Linux' }}
-      uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
-      with:
-        version: 0.14.0
-        use-cache: false
-
-    - name: Install musl build tools
-      if: ${{ runner.os == 'Linux' }}
-      shell: bash
-      working-directory: codex-rs
-      env:
-        TARGET: ${{ inputs.target }}
-      run: bash "${GITHUB_WORKSPACE}/.github/scripts/install-musl-build-tools.sh"
-
-    - name: Disable aws-lc jitter entropy (musl)
-      if: ${{ runner.os == 'Linux' }}
-      shell: bash
-      working-directory: codex-rs
-      env:
-        TARGET: ${{ inputs.target }}
-      run: |
-        set -euo pipefail
-        # Match public releases: aws-lc's jitter entropy path does not work
-        # reliably on musl builders, so disable it globally and per target.
-        echo "AWS_LC_SYS_NO_JITTER_ENTROPY=1" >> "$GITHUB_ENV"
-        target_no_jitter="AWS_LC_SYS_NO_JITTER_ENTROPY_${TARGET}"
-        target_no_jitter="${target_no_jitter//-/_}"
-        echo "${target_no_jitter}=1" >> "$GITHUB_ENV"
-
-    - name: Configure rusty_v8 artifact overrides and verify checksums
-      uses: ./.github/actions/setup-rusty-v8
+    - name: Build Cargo package binaries
+      if: inputs.build-system == 'cargo'
+      uses: ./.github/actions/build-cargo-package-binaries
       with:
         target: ${{ inputs.target }}
+        binaries: ${{ env.NEEDED_BINARIES }}
+        build-mode: ${{ inputs.build-mode }}
 
-    - name: Configure MSVC environment
-      if: ${{ runner.os == 'Windows' }}
-      uses: ./.github/actions/setup-msvc-env
+    - name: Build Bazel package binaries
+      if: inputs.build-system == 'bazel'
+      uses: ./.github/actions/build-bazel-package-binaries
       with:
         target: ${{ inputs.target }}
-
-    - name: Build bwrap and export digest
-      if: ${{ runner.os == 'Linux' }}
-      shell: bash
-      working-directory: codex-rs
-      env:
-        TARGET: ${{ inputs.target }}
-      run: |
-        set -euo pipefail
-        cargo build --target "${TARGET}" --release --timings --bin bwrap
-
-        bwrap_path="${CARGO_TARGET_DIR}/${TARGET}/release/bwrap"
-        # Codex embeds this digest at build time and verifies the packaged
-        # bwrap at runtime, so hash its final stripped bytes first.
-        strip --strip-debug --strip-unneeded "$bwrap_path"
-        digest="$(sha256sum "$bwrap_path" | awk '{print $1}')"
-        echo "CODEX_BWRAP_SHA256=${digest}" >> "$GITHUB_ENV"
-
-    - name: Build Codex package binaries
-      shell: bash
-      working-directory: codex-rs
-      env:
-        TARGET: ${{ inputs.target }}
-      run: |
-        set -euo pipefail
-        build_args=()
-        for binary in $NEEDED_BINARIES; do
-          build_args+=(--bin "$binary")
-        done
-        # SQLite intrinsics can emit instructions unsupported by older x64
-        # CPUs, causing Windows release binaries to crash during startup.
-        if [[ "${TARGET}" == "x86_64-pc-windows-msvc" ]]; then
-          export LIBSQLITE3_FLAGS=SQLITE_DISABLE_INTRINSIC
-        fi
-        STABLE_GIT_COMMIT="$(git rev-parse HEAD)"
-        export STABLE_GIT_COMMIT
-        cargo build --target "${TARGET}" --release --timings "${build_args[@]}"
+        build-mode: ${{ inputs.build-mode }}
 
     - name: Normalize Windows PDB filenames
       if: ${{ runner.os == 'Windows' }}
@@ -199,10 +118,10 @@ runs:
       working-directory: codex-rs
       env:
         TARGET: ${{ inputs.target }}
-        PACKAGE_ACTION_PATH: ${{ github.action_path }}
+        PACKAGE_SOURCE_ROOT: ${{ steps.package_setup.outputs.source_root }}
       run: |
         set -euo pipefail
-        bash "${PACKAGE_ACTION_PATH}/../../../.github/scripts/archive-release-symbols-and-strip-binaries.sh" \
+        bash "${PACKAGE_SOURCE_ROOT}/.github/scripts/archive-release-symbols-and-strip-binaries.sh" \
           --target "${TARGET}" \
           --artifact-name "${TARGET}" \
           --release-dir "${CARGO_TARGET_DIR}/${TARGET}/release" \
@@ -215,7 +134,7 @@ runs:
       env:
         TARGET: ${{ inputs.target }}
         CODEX_PACKAGE_VERSION: ${{ inputs.package-version }}
-        PACKAGE_ACTION_PATH: ${{ github.action_path }}
+        PACKAGE_SOURCE_ROOT: ${{ steps.package_setup.outputs.source_root }}
       run: |
         set -euo pipefail
         target="${TARGET}"
@@ -245,7 +164,7 @@ runs:
           package_args+=(--zsh-manifest "${RUNNER_TEMP}/codex-zsh")
         fi
 
-        python3 "${PACKAGE_ACTION_PATH}/../../../scripts/build_codex_package.py" \
+        python3 "${PACKAGE_SOURCE_ROOT}/scripts/build_codex_package.py" \
           "${package_args[@]}" \
           --variant codex \
           --entrypoint-bin "${release_dir}/codex${exe_suffix}" \
@@ -253,7 +172,7 @@ runs:
           --archive-output "${archive_dir}/codex-package-${target}.tar.gz" \
           --archive-output "${archive_dir}/codex-package-${target}.tar.zst"
 
-        python3 "${PACKAGE_ACTION_PATH}/../../../scripts/build_codex_package.py" \
+        python3 "${PACKAGE_SOURCE_ROOT}/scripts/build_codex_package.py" \
           "${package_args[@]}" \
           --variant codex-app-server \
           --entrypoint-bin "${release_dir}/codex-app-server${exe_suffix}" \
@@ -267,10 +186,10 @@ runs:
       env:
         TARGET: ${{ inputs.target }}
         PYTHONPATH: ${{ github.workspace }}/sdk/python/src${{ runner.os == 'Windows' && ';' || ':' }}${{ github.workspace }}/sdk/python/tests
-        PACKAGE_ACTION_PATH: ${{ github.action_path }}
+        PACKAGE_SOURCE_ROOT: ${{ steps.package_setup.outputs.source_root }}
       run: |
         set -euo pipefail
-        cd "${PACKAGE_ACTION_PATH}/../../../scripts/codex_package/smoke_tests"
+        cd "${PACKAGE_SOURCE_ROOT}/scripts/codex_package/smoke_tests"
         target="${TARGET}"
         archive_dir="${GITHUB_WORKSPACE}/dist/${target}"
         mkdir -p "${GITHUB_WORKSPACE}/codex-rs/target"

.github/actions/setup-bazel-ci/action.yml

@@ -27,9 +27,9 @@ runs:
 
     - name: Configure Bazel repository cache
       id: configure_bazel_repository_cache
-      shell: pwsh
+      shell: bash
       run: |
-        "repository-cache-path=$env:BAZEL_REPOSITORY_CACHE" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
+        echo "repository-cache-path=$BAZEL_REPOSITORY_CACHE" >> "$GITHUB_OUTPUT"
 
     - name: Expose MSVC SDK environment (Windows)
       if: runner.os == 'Windows'