openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-14 21:40:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add authenticated GCS caching for Bazel CI and releases (#61187)

Browse Source 
## What changed

- Authenticate eligible protected `main` runs and Rust release tags with GitHub OIDC. Allow cache uploads only on `main` pushes; use read-only access for manual runs and release tags, and leave pull requests without GCS credentials.
- Rename the shared wrapper to `.github/scripts/run_bazel.py` and route Bazel callers through it. Disable the disk cache in GitHub Actions and default macOS GCS connections to 20 while respecting explicit limits.
- Gate additional Bazel release artifacts on `CODEX_BAZEL_RELEASES` and cache configuration, sharing the selected build systems across building, signing, and packaging. Keep Cargo as the default and prepare native Windows dependencies for Bazel releases.
- Add a `Bazel result` check for the full workflow and extend Bazel job timeouts.

## Testing

Add wrapper tests for cache access by event, argument preservation, and macOS connection limits. The wrapper test suite passes.

GitOrigin-RevId: d85edbd083acfaa8bafaa8fd5241daed3e9ef871
This commit is contained in:
Dmitriy Kovalenko
2026-11-12 21:41:05 +00:00
committed by copyberry
parent d0221bc947
commit 4490060db6
25 changed files with 464 additions and 184 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/scripts/compute-bazel-windows-path.ps1
+1 -1
View File
@@ -1,5 +1,5 @@
<#
BuildBuddy cache keys include the action and test environment, so Bazel should
Bazel action cache keys include the action and test environment, so Bazel should
not inherit the full hosted-runner PATH on Windows. That PATH includes volatile
tool entries, such as Maven, that can change independently of this repo and
cause avoidable cache misses.