From 8d7cc24a87f4aa66aa434eb4f25f4f4bafc0e0a9 Mon Sep 17 00:00:00 2001
From: Charlie Marsh <charliemarsh@openai.com>
Date: Sun, 6 Sep 2026 20:46:06 +0000
Subject: [PATCH] Make Bazel binary stamping opt-in (#43282)

## Why

Binaries that do not consume build identity should not have their cached compilations invalidated by Git revisions or build timestamps.

## What changed

Add `stamped_binaries` to `codex_rust_crate`, defaulting to an empty list. Only listed binaries enable stamping and receive `STABLE_GIT_COMMIT`. Opt in `codex`, `codex-tui`, and `codex-voice-host`.

GitOrigin-RevId: 9bcac29f98f20129c988f696ce5b98057be7a158
---
 codex-rs/cli/BUILD.bazel        |  1 +
 codex-rs/tui/BUILD.bazel        |  1 +
 codex-rs/voice-host/BUILD.bazel |  1 +
 defs.bzl                        | 11 +++++++----
 4 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/codex-rs/cli/BUILD.bazel b/codex-rs/cli/BUILD.bazel
index ce49f4b2e5..87494cb33f 100644
--- a/codex-rs/cli/BUILD.bazel
+++ b/codex-rs/cli/BUILD.bazel
@@ -9,6 +9,7 @@ codex_rust_crate(
         "//codex-rs/bwrap:bwrap",
     ],
     rustc_flags_extra = MACOS_WEBRTC_RUSTC_LINK_FLAGS,
+    stamped_binaries = ["codex"],
     test_data_extra = glob(["src/**/snapshots/**"]),
 )
 
diff --git a/codex-rs/tui/BUILD.bazel b/codex-rs/tui/BUILD.bazel
index 15ef18ee82..c98e954025 100644
--- a/codex-rs/tui/BUILD.bazel
+++ b/codex-rs/tui/BUILD.bazel
@@ -12,6 +12,7 @@ codex_rust_crate(
     ],
     integration_compile_data_extra = ["src/test_backend.rs"],
     rustc_flags_extra = MACOS_WEBRTC_RUSTC_LINK_FLAGS,
+    stamped_binaries = ["codex-tui"],
     test_data_extra = glob([
         "src/**/*.rs",
         "src/**/snapshots/**",
diff --git a/codex-rs/voice-host/BUILD.bazel b/codex-rs/voice-host/BUILD.bazel
index 3cdb23f758..a893868022 100644
--- a/codex-rs/voice-host/BUILD.bazel
+++ b/codex-rs/voice-host/BUILD.bazel
@@ -4,5 +4,6 @@ codex_rust_crate(
     name = "voice-host",
     crate_name = "codex_voice_host",
     crate_srcs = [],
+    stamped_binaries = ["codex-voice-host"],
     unit_test_args = ["--test-threads=1"],
 )
diff --git a/defs.bzl b/defs.bzl
index 7a18fd096e..4a82be374e 100644
--- a/defs.bzl
+++ b/defs.bzl
@@ -195,6 +195,7 @@ def codex_rust_crate(
         lib_data_extra = [],
         rustc_flags_extra = [],
         binary_rustc_flags_extra = {},
+        stamped_binaries = [],
         rustc_env = {},
         rustc_env_files = [],
         deps_extra = [],
@@ -239,6 +240,9 @@ def codex_rust_crate(
         lib_data_extra: Extra runtime data for the library target.
         binary_rustc_flags_extra: Mapping from binary names to extra rustc
             flags for those binary targets.
+        stamped_binaries: Binary names that read STABLE_GIT_COMMIT at compile
+            time. Other binaries omit workspace status inputs so Git revisions
+            and build timestamps do not invalidate their cached compilations.
         rustc_env: Extra rustc_env entries to merge with defaults.
         rustc_env_files: Generated compiler environment files for the library target.
         deps_extra: Extra normal deps beyond @crates resolution.
@@ -403,11 +407,10 @@ def codex_rust_crate(
             # generated rust_binary instead of leaking it to sibling binaries.
             compile_data = binary_compile_data_extra.get(binary, []),
             rustc_flags = rustc_flags_extra + binary_rustc_flags_extra.get(binary, []) + WINDOWS_RUSTC_LINK_FLAGS,
-            # rules_rust substitutes workspace status values only for stamped
-            # actions, so pass the existing key through to final binaries.
-            rustc_env = {"STABLE_GIT_COMMIT": "{STABLE_GIT_COMMIT}"},
+            # Only consumers of build identity need workspace status inputs.
+            rustc_env = {"STABLE_GIT_COMMIT": "{STABLE_GIT_COMMIT}"} if binary in stamped_binaries else {},
             srcs = native.glob(["src/**/*.rs"]),
-            stamp = 1,
+            stamp = 1 if binary in stamped_binaries else 0,
             visibility = ["//visibility:public"],
         )