Add authenticated GCS caching for Bazel CI and releases (#61187)

## What changed

- Authenticate eligible protected `main` runs and Rust release tags with GitHub OIDC. Allow cache uploads only on `main` pushes; use read-only access for manual runs and release tags, and leave pull requests without GCS credentials.
- Rename the shared wrapper to `.github/scripts/run_bazel.py` and route Bazel callers through it. Disable the disk cache in GitHub Actions and default macOS GCS connections to 20 while respecting explicit limits.
- Gate additional Bazel release artifacts on `CODEX_BAZEL_RELEASES` and cache configuration, sharing the selected build systems across building, signing, and packaging. Keep Cargo as the default and prepare native Windows dependencies for Bazel releases.
- Add a `Bazel result` check for the full workflow and extend Bazel job timeouts.

## Testing

Add wrapper tests for cache access by event, argument preservation, and macOS connection limits. The wrapper test suite passes.

GitOrigin-RevId: d85edbd083acfaa8bafaa8fd5241daed3e9ef871

.github/workflows/README.md

@@ -20,7 +20,7 @@ The workflows in this directory are split so that pull requests get fast, review
 ## Post-Merge On `main`
 
 - `bazel.yml` also runs on pushes to `main`.
-  This re-verifies the merged Bazel path and helps keep the BuildBuddy caches warm.
+  This re-verifies the merged Bazel path and populates the public GCS cache.
 - `rust-ci-full.yml` is the full Cargo-native verification workflow.
   It keeps the heavier checks off the PR path while still validating them after merge:
   - the full Cargo `clippy` matrix
@@ -35,3 +35,21 @@ The workflows in this directory are split so that pull requests get fast, review
 - If a build/test/clippy check can be expressed in Bazel, prefer putting the PR-time version in `bazel.yml`.
 - Keep `rust-ci.yml` fast enough that it usually does not dominate PR latency.
 - Reserve `rust-ci-full.yml` for heavyweight Cargo-native coverage that Bazel does not replace yet.
+
+### Public Bazel action cache
+
+Set `CODEX_BAZEL_GCS_BUCKET` and `CODEX_BAZEL_GCS_WORKLOAD_IDENTITY_PROVIDER`
+as GitHub Actions secrets in `openai/codex`. They identify the bucket and its
+GitHub OIDC provider. The job exchanges its identity for temporary Google
+credentials. Protected main pushes populate the cache. Protected main
+dispatches and Rust release tags can read it. Pull requests build without
+GCS credentials.
+
+After a main push populates the cache and a separate runner reports a remote
+cache hit, set the repository variable `CODEX_BAZEL_RELEASES` to `true` to
+build the additional Bazel artifacts on Rust release tags. The release
+workflow selects one build-system matrix for the build, signing, and
+packaging jobs. Cargo artifacts remain the default.
+
+Once public Bazel CI passes, require the `Bazel result` check in the main
+branch ruleset. It reports the result of the full Bazel workflow.

.github/workflows/bazel.yml

@@ -13,12 +13,19 @@ concurrency:
   group: concurrency-group::${{ github.workflow }}::${{ github.event.pull_request.number > 0 && format('pr-{0}', github.event.pull_request.number) || github.ref_name }}${{ github.ref_name == 'main' && format('::{0}', github.run_id) || ''}}
   cancel-in-progress: ${{ github.ref_name != 'main' }}
 
+env:
+  CODEX_BAZEL_GCS_BUCKET: ${{ secrets.CODEX_BAZEL_GCS_BUCKET }}
+  CODEX_BAZEL_GCS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.CODEX_BAZEL_GCS_WORKLOAD_IDENTITY_PROVIDER }}
+
 jobs:
   test:
+    permissions:
+      contents: read
+      id-token: write
     # PRs use the sharded Windows cross-compiled test jobs below. Post-merge
     # pushes to main also run the native Windows test job for broader Windows
     # signal without putting PR latency back on the critical path.
-    timeout-minutes: 30
+    timeout-minutes: 120
     strategy:
       fail-fast: false
       matrix:
@@ -133,8 +140,11 @@ jobs:
         uses: ./.github/actions/check-clean-worktree
 
   test-windows-shard:
+    permissions:
+      contents: read
+      id-token: write
     # Build and test Windows shards on separate Windows runners.
-    timeout-minutes: 30
+    timeout-minutes: 90
     strategy:
       fail-fast: false
       matrix:
@@ -159,7 +169,7 @@ jobs:
       - name: Test Bazel command wrapper
         if: matrix.shard == 1
         shell: pwsh
-        run: python .github/scripts/test_run_bazel_with_buildbuddy.py
+        run: python .github/scripts/test_run_bazel.py
 
       - name: Test Windows Bazel target selector
         if: matrix.shard == 1
@@ -255,11 +265,14 @@ jobs:
           fi
 
   test-windows-native-main:
+    permissions:
+      contents: read
+      id-token: write
     # Native Windows Bazel tests are slower and frequently approach the
     # 30-minute PR budget. Run this only for post-merge commits to main and give
     # it a larger timeout. Also allow manual runs for native toolchain changes.
     if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'workflow_dispatch'
-    timeout-minutes: 40
+    timeout-minutes: 90
     runs-on:
       group: ${{ github.event.repository.name }}-runners
       labels: ${{ github.event.repository.name }}-windows-x64
@@ -341,7 +354,10 @@ jobs:
         uses: ./.github/actions/check-clean-worktree
 
   clippy:
-    timeout-minutes: 30
+    permissions:
+      contents: read
+      id-token: write
+    timeout-minutes: 90
     strategy:
       fail-fast: false
       matrix:
@@ -446,7 +462,10 @@ jobs:
         uses: ./.github/actions/check-clean-worktree
 
   verify-release-build:
-    timeout-minutes: 30
+    permissions:
+      contents: read
+      id-token: write
+    timeout-minutes: 90
     strategy:
       fail-fast: false
       matrix:

.github/workflows/blocking-ci.yml

@@ -11,10 +11,24 @@ jobs:
   # Keep reusable workflow calls alphabetized. The `required` job below is the
   # version-controlled list that the main-branch ruleset should require.
   bazel:
+    permissions:
+      contents: read
+      id-token: write
     name: Bazel
     uses: ./.github/workflows/bazel.yml
     secrets: inherit
 
+  bazel-result:
+    name: Bazel result
+    needs: bazel
+    if: ${{ always() }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Require the Bazel workflow to succeed
+        env:
+          BAZEL_RESULT: ${{ needs.bazel.result }}
+        run: test "$BAZEL_RESULT" = success
+
   blob-size-policy:
     name: Blob size policy
     uses: ./.github/workflows/blob-size-policy.yml
@@ -36,11 +50,17 @@ jobs:
     secrets: inherit
 
   rust-ci:
+    permissions:
+      contents: read
+      id-token: write
     name: rust-ci
     uses: ./.github/workflows/rust-ci.yml
     secrets: inherit
 
   sdk:
+    permissions:
+      contents: read
+      id-token: write
     name: sdk
     uses: ./.github/workflows/sdk.yml
     secrets: inherit
@@ -50,8 +70,6 @@ jobs:
     # Without `always()`, GitHub skips this job after a failed dependency and a
     # required check can appear successful instead of reporting the failure.
     if: ${{ always() }}
-    # Bazel is advisory while the BuildBuddy key is revoked. Restore its dependency
-    # once the suite can run without BuildBuddy.
     needs:
       - blob-size-policy
       - cargo-deny

.github/workflows/postmerge-ci.yml

@@ -10,11 +10,17 @@ jobs:
   # Keep reusable workflow calls alphabetized. Each child retains its own
   # workflow_dispatch trigger so maintainers can rerun flaky suites directly.
   rust-ci-full:
+    permissions:
+      contents: read
+      id-token: write
     name: rust-ci-full
     uses: ./.github/workflows/rust-ci-full.yml
     secrets: inherit
 
   v8-canary:
+    permissions:
+      contents: read
+      id-token: write
     name: v8-canary
     uses: ./.github/workflows/v8-canary.yml
     secrets: inherit

.github/workflows/rust-ci-full.yml

@@ -8,6 +8,10 @@ on:
       - "**full-ci**"
   workflow_dispatch:
 
+env:
+  CODEX_BAZEL_GCS_BUCKET: ${{ secrets.CODEX_BAZEL_GCS_BUCKET }}
+  CODEX_BAZEL_GCS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.CODEX_BAZEL_GCS_WORKLOAD_IDENTITY_PROVIDER }}
+
 jobs:
   # --- CI that doesn't need specific targets ---------------------------------
   general:
@@ -90,6 +94,9 @@ jobs:
           RUST_MIN_STACK: "8388608" # 8 MiB
 
   argument_comment_lint_prebuilt:
+    permissions:
+      contents: read
+      id-token: write
     name: Argument comment lint - ${{ matrix.name }}
     runs-on: ${{ matrix.runs_on || matrix.runner }}
     timeout-minutes: 120
@@ -127,6 +134,7 @@ jobs:
       deployment: false
     permissions:
       contents: read
+      id-token: write
     timeout-minutes: 120
     strategy:
       fail-fast: false

.github/workflows/rust-ci.yml

@@ -3,6 +3,10 @@ on:
   workflow_call:
   workflow_dispatch:
 
+env:
+  CODEX_BAZEL_GCS_BUCKET: ${{ secrets.CODEX_BAZEL_GCS_BUCKET }}
+  CODEX_BAZEL_GCS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.CODEX_BAZEL_GCS_WORKLOAD_IDENTITY_PROVIDER }}
+
 jobs:
   # --- Detect changed paths so the fast PR workflow only runs relevant jobs ---
   changed:
@@ -162,9 +166,11 @@ jobs:
         uses: ./.github/actions/check-clean-worktree
 
   argument_comment_lint_prebuilt:
+    permissions:
+      contents: read
+      id-token: write
     name: Argument comment lint - ${{ matrix.name }}
-    # This job runs through Bazel and is advisory while the BuildBuddy key is
-    # revoked. Restore blocking behavior once it can run without BuildBuddy.
+    # Keep this Bazel job advisory until the public build and cache rollout is verified.
     continue-on-error: true
     runs-on: ${{ matrix.runs_on || matrix.runner }}
     timeout-minutes: ${{ matrix.timeout_minutes }}

.github/workflows/rust-release-provisioned-macos.yml

@@ -1,4 +1,4 @@
-# Verified Cargo side packages, published by rust-release.yml when enabled.
+# Verified side packages, published by rust-release.yml when enabled.
 # The legacy CLI, npm, installer and DMG packages are unchanged.
 # Required secrets in the codesigning environment:
 # - CODEX_CLI_PROVISIONING_PROFILE_BASE64: profile approved for public distribution.
@@ -11,6 +11,11 @@ name: Provisioned macOS CLI candidate
 
 on:
   workflow_call:
+    inputs:
+      build-systems:
+        description: Release build systems selected during tag validation, as a JSON array.
+        type: string
+        default: '["cargo"]'
 
 permissions:
   contents: read
@@ -32,7 +37,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        build-system: [cargo] # Bazel releases are disabled while the BuildBuddy key is revoked.
+        build-system: ${{ fromJSON(inputs.build-systems) }}
         target: [aarch64-apple-darwin, x86_64-apple-darwin]
     env:
       TARGET: ${{ matrix.target }}
@@ -131,7 +136,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        build-system: [cargo] # Bazel releases are disabled while the BuildBuddy key is revoked.
+        build-system: ${{ fromJSON(inputs.build-systems) }}
         target: [aarch64-apple-darwin, x86_64-apple-darwin]
         include:
           - target: aarch64-apple-darwin

.github/workflows/rust-release-windows.yml

@@ -2,14 +2,20 @@ name: rust-release-windows
 
 on:
   workflow_call:
+    inputs:
+      build-systems:
+        description: Release build systems selected during tag validation, as a JSON array.
+        type: string
+        default: '["cargo"]'
 
 env:
+  CODEX_BAZEL_GCS_BUCKET: ${{ secrets.CODEX_BAZEL_GCS_BUCKET }}
+  CODEX_BAZEL_GCS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.CODEX_BAZEL_GCS_WORKLOAD_IDENTITY_PROVIDER }}
   WINDOWS_BINARIES: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy codex-windows-sandbox-setup codex-windows-sandbox-service codex-command-runner codex-app-server"
 
 jobs:
   build-windows-binaries:
     name: Build Windows binaries - ${{ matrix.runner }} - ${{ matrix.target }} - ${{ matrix.bundle }} - ${{ matrix.build-system }}
-    # Release Cargo artifacts only while Bazel releases are disabled.
     runs-on: ${{ matrix.runs_on }}
     environment:
       name: bazel
@@ -19,6 +25,7 @@ jobs:
     timeout-minutes: 120
     permissions:
       contents: read
+      id-token: write
     defaults:
       run:
         working-directory: codex-rs
@@ -29,7 +36,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        build-system: [cargo] # Bazel releases are disabled while the BuildBuddy key is revoked.
+        build-system: ${{ fromJSON(inputs.build-systems) }}
         target:
           - x86_64-pc-windows-msvc
           - aarch64-pc-windows-msvc
@@ -117,10 +124,17 @@ jobs:
           target: ${{ matrix.target }}
 
       - name: Configure MSVC environment
+        if: matrix.build-system == 'cargo'
         uses: ./.github/actions/setup-msvc-env
         with:
           target: ${{ matrix.target }}
 
+      - name: Prepare native Windows release dependencies
+        if: matrix.build-system == 'bazel'
+        uses: ./.github/actions/setup-bazel-windows
+        with:
+          target: ${{ matrix.target }}
+
       - name: Build Bazel release binaries and symbols
         if: ${{ matrix.build-system == 'bazel' }}
         uses: ./.github/actions/build-bazel-release
@@ -182,6 +196,7 @@ jobs:
     timeout-minutes: 120
     permissions:
       contents: read
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -250,7 +265,6 @@ jobs:
         env:
           ARCH: ${{ matrix.arch }}
           VOICE_ARCH: ${{ matrix.arch }}
-          # Use local Bazel while BuildBuddy credentials are unavailable.
         run: |
           (cd codex-rs && cargo update --workspace)
           python .github/scripts/watch_voice_bazel.py "$(cygpath -w "$BASH")" ./.github/scripts/run-bazel-ci.sh \
@@ -318,7 +332,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        build-system: [cargo] # Bazel releases are disabled while the BuildBuddy key is revoked.
+        build-system: ${{ fromJSON(inputs.build-systems) }}
         target:
           - aarch64-pc-windows-msvc
           - x86_64-pc-windows-msvc
@@ -382,7 +396,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        build-system: [cargo] # Bazel releases are disabled while the BuildBuddy key is revoked.
+        build-system: ${{ fromJSON(inputs.build-systems) }}
         target:
           - x86_64-pc-windows-msvc
           - aarch64-pc-windows-msvc

.github/workflows/rust-release.yml

@@ -15,6 +15,8 @@ on:
       - "rust-v*.*.*"
 
 env:
+  CODEX_BAZEL_GCS_BUCKET: ${{ secrets.CODEX_BAZEL_GCS_BUCKET }}
+  CODEX_BAZEL_GCS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.CODEX_BAZEL_GCS_WORKLOAD_IDENTITY_PROVIDER }}
   CODEX_REPO_ROOT: ${{ github.workspace }}
 
 # The launcher uses this per-tag group as the migration boundary. Keep shared
@@ -25,6 +27,12 @@ concurrency:
 
 jobs:
   tag-check:
+    outputs:
+      build-systems: >-
+        ${{ github.repository == 'openai/codex' && github.ref_protected &&
+            vars.CODEX_BAZEL_RELEASES == 'true' &&
+            secrets.CODEX_BAZEL_GCS_BUCKET != '' && secrets.CODEX_BAZEL_GCS_WORKLOAD_IDENTITY_PROVIDER != '' &&
+            '["cargo","bazel"]' || '["cargo"]' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -59,7 +67,6 @@ jobs:
   build:
     needs: tag-check
     name: Build - ${{ matrix.runner }} - ${{ matrix.target }} - ${{ matrix.bundle }} - ${{ matrix.build-system }}
-    # Release Cargo artifacts only while Bazel releases are disabled.
     runs-on: ${{ matrix.runner }}
     environment:
       name: bazel
@@ -83,7 +90,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        build-system: [cargo] # Bazel releases are disabled while the BuildBuddy key is revoked.
+        build-system: ${{ fromJSON(needs.tag-check.outputs.build-systems) }}
         target:
           - aarch64-apple-darwin
           - x86_64-apple-darwin
@@ -325,7 +332,6 @@ jobs:
         shell: bash
         env:
           APP_TARGET: ${{ matrix.target }}
-          # Use local Bazel while BuildBuddy credentials are unavailable.
         run: |
           set -euo pipefail
           cd "$GITHUB_WORKSPACE"
@@ -335,7 +341,7 @@ jobs:
             x86_64-unknown-linux-gnu) prefix=linux_x86_64 ;;
             *) exit 1 ;;
           esac
-          python3 .github/scripts/run_bazel_with_buildbuddy.py build --config=release \
+          python3 .github/scripts/run_bazel.py build --config=release \
             //codex-rs/voice-host:codex-voice-host //third_party/voice:native_runtime
           source="bazel-bin/third_party/voice/native_runtime_${prefix}"
           output="${RUNNER_TEMP}/signed-voice/${APP_TARGET}"
@@ -577,6 +583,7 @@ jobs:
     timeout-minutes: 120
     permissions:
       contents: read
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -604,13 +611,12 @@ jobs:
         env:
           TARGET: ${{ matrix.target }}
           PREFIX: ${{ matrix.prefix }}
-          # Use local Bazel while BuildBuddy credentials are unavailable.
         run: |
           set -euo pipefail
           # Release tags bump Cargo.toml without rewriting the workspace lockfile.
           # Refresh workspace versions before Bazel reads the Cargo dependency graph.
           (cd codex-rs && cargo update --workspace)
-          python3 .github/scripts/run_bazel_with_buildbuddy.py build --config=release \
+          python3 .github/scripts/run_bazel.py build --config=release \
             --macos_minimum_os=14.0 //codex-rs/voice-host:codex-voice-host //third_party/voice:native_runtime
           runtime="bazel-bin/third_party/voice/native_runtime_${PREFIX}"
           PYTHONPATH=third_party/voice python3 - "$runtime" "$TARGET" <<'PY'
@@ -632,7 +638,7 @@ jobs:
           if-no-files-found: error
 
   sign-macos-binaries:
-    needs: [build, build-macos-voice]
+    needs: [tag-check, build, build-macos-voice]
     if: ${{ always() && needs.build.result == 'success' && needs.build-macos-voice.result == 'success' }}
     name: Sign macOS binaries - ${{ matrix.target }} - ${{ matrix.bundle }} - ${{ matrix.build-system }}
     runs-on: ubuntu-latest
@@ -650,7 +656,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        build-system: [cargo] # Bazel releases are disabled while the BuildBuddy key is revoked.
+        build-system: ${{ fromJSON(needs.tag-check.outputs.build-systems) }}
         target:
           - aarch64-apple-darwin
           - x86_64-apple-darwin
@@ -878,7 +884,7 @@ jobs:
           if-no-files-found: warn
 
   package-macos:
-    needs: sign-macos-binaries
+    needs: [tag-check, sign-macos-binaries]
     name: Package macOS artifacts - ${{ matrix.target }} - ${{ matrix.bundle }} - ${{ matrix.build-system }}
     runs-on: macos-15-xlarge
     timeout-minutes: 45
@@ -894,7 +900,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        build-system: [cargo] # Bazel releases are disabled while the BuildBuddy key is revoked.
+        build-system: ${{ fromJSON(needs.tag-check.outputs.build-systems) }}
         target:
           - aarch64-apple-darwin
           - x86_64-apple-darwin
@@ -1165,7 +1171,7 @@ jobs:
           if-no-files-found: error
 
   sign-macos-dmg:
-    needs: package-macos
+    needs: [tag-check, package-macos]
     name: Sign macOS DMG - ${{ matrix.target }} - ${{ matrix.build-system }}
     runs-on: ubuntu-latest
     timeout-minutes: 45
@@ -1182,7 +1188,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        build-system: [cargo] # Bazel releases are disabled while the BuildBuddy key is revoked.
+        build-system: ${{ fromJSON(needs.tag-check.outputs.build-systems) }}
         target:
           - aarch64-apple-darwin
           - x86_64-apple-darwin
@@ -1268,6 +1274,7 @@ jobs:
 
   finalize-macos:
     needs:
+      - tag-check
       - package-macos
       - sign-macos-dmg
     name: Verify macOS artifacts - ${{ matrix.target }} - ${{ matrix.bundle }} - ${{ matrix.build-system }}
@@ -1285,7 +1292,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        build-system: [cargo] # Bazel releases are disabled while the BuildBuddy key is revoked.
+        build-system: ${{ fromJSON(needs.tag-check.outputs.build-systems) }}
         target:
           - aarch64-apple-darwin
           - x86_64-apple-darwin
@@ -1533,17 +1540,24 @@ jobs:
   # Keep provisioned packages separate from the legacy CLI/npm/installer layout.
   # Desktop consumes the versioned codex-provisioned manifest from this release.
   provisioned-macos-candidate:
-    needs: finalize-macos
+    needs: [tag-check, finalize-macos]
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/rust-v') && vars.CODEX_PROVISIONED_MACOS_CANDIDATE == 'true'
     permissions:
       contents: read
       id-token: write
     uses: ./.github/workflows/rust-release-provisioned-macos.yml
+    with:
+      build-systems: ${{ needs.tag-check.outputs.build-systems }}
     secrets: inherit
 
   build-windows:
+    permissions:
+      contents: read
+      id-token: write
     needs: tag-check
     uses: ./.github/workflows/rust-release-windows.yml
+    with:
+      build-systems: ${{ needs.tag-check.outputs.build-systems }}
     secrets: inherit
 
   argument-comment-lint-release-assets:
@@ -1675,7 +1689,7 @@ jobs:
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: dist
-          pattern: "{{aarch64,x86_64}-{apple-darwin{,-app-server},unknown-linux-musl{,-app-server},pc-windows-msvc},*-symbols,argument-comment-lint-*,python-runtime-wheel-*,npm-packages}"
+          pattern: "{{aarch64,x86_64}-{apple-darwin{,-app-server},unknown-linux-musl{,-app-server},pc-windows-msvc}{,-bazel},*-symbols{,-bazel},argument-comment-lint-*,python-runtime-wheel-*,npm-packages}"
 
       - name: Download verified provisioned macOS packages
         if: vars.CODEX_PROVISIONED_MACOS_CANDIDATE == 'true'

.github/workflows/rusty-v8-release.yml

@@ -191,7 +191,7 @@ jobs:
             --build_metadata=COMMIT_SHA=$(git rev-parse HEAD)
           )
 
-          ./.github/scripts/run_bazel_with_buildbuddy.py \
+          ./.github/scripts/run_bazel.py \
             --noexperimental_remote_repo_contents_cache \
             "${bazel_args[@]}" \
             "--config=${{ matrix.bazel_config }}"

.github/workflows/sdk.yml

@@ -3,6 +3,10 @@ name: sdk
 on:
   workflow_call:
 
+env:
+  CODEX_BAZEL_GCS_BUCKET: ${{ secrets.CODEX_BAZEL_GCS_BUCKET }}
+  CODEX_BAZEL_GCS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.CODEX_BAZEL_GCS_WORKLOAD_IDENTITY_PROVIDER }}
+
 jobs:
   python-sdk-installation:
     runs-on:
@@ -36,13 +40,15 @@ jobs:
             '
 
   sdks:
-    # This job builds its CLI with Bazel. Keep it advisory while the BuildBuddy
-    # key is revoked; restore blocking behavior once it can run without BuildBuddy.
+    permissions:
+      contents: read
+      id-token: write
+    # Keep the Bazel CLI build advisory until the public build and cache rollout is verified.
     continue-on-error: true
     runs-on:
       group: ${{ github.event.repository.name }}-runners
       labels: ${{ github.event.repository.name }}-linux-x64
-    timeout-minutes: 20
+    timeout-minutes: 90
     environment:
       name: bazel
       deployment: false
@@ -83,7 +89,7 @@ jobs:
         run: |
           set -euo pipefail
           # Use the shared CI wrapper so fork PRs fall back cleanly when
-          # BuildBuddy credentials are unavailable. This workflow needs the
+          # This workflow needs the
           # built binaries on disk afterwards, so ask the wrapper to override
           # CI's default remote_download_minimal behavior.
           ./.github/scripts/run-bazel-ci.sh \

.github/workflows/v8-canary.yml

@@ -13,6 +13,10 @@ concurrency:
   group: ${{ github.workflow }}::${{ github.event.pull_request.number > 0 && format('pr-{0}', github.event.pull_request.number) || github.ref_name }}
   cancel-in-progress: ${{ github.ref_name != 'main' }}
 
+env:
+  CODEX_BAZEL_GCS_BUCKET: ${{ secrets.CODEX_BAZEL_GCS_BUCKET }}
+  CODEX_BAZEL_GCS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.CODEX_BAZEL_GCS_WORKLOAD_IDENTITY_PROVIDER }}
+
 jobs:
   metadata:
     runs-on: ubuntu-latest
@@ -77,6 +81,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
     permissions:
       contents: read
+      id-token: write
       actions: read
     environment:
       name: bazel
@@ -202,7 +207,7 @@ jobs:
             --build_metadata=COMMIT_SHA=$(git rev-parse HEAD)
           )
 
-          ./.github/scripts/run_bazel_with_buildbuddy.py \
+          ./.github/scripts/run_bazel.py \
             --noexperimental_remote_repo_contents_cache \
             "${bazel_args[@]}" \
             "--config=${{ matrix.bazel_config }}"