Stop bundling patched zsh in Codex packages (#52213)

## What changed Remove the patched `zsh` resource from package assembly and macOS signing, along with the `--zsh-bin` and `--zsh-manifest` packaging options. Delete the standalone `codex-zsh` release workflow, build scripts, and DotSlash manifests. Update package documentation and layout and signing tests to match the remaining resources. GitOrigin-RevId: 429a8db55048fed7facec89957910206523b6013
2026-10-19 17:28:46 +00:00 · 2026-10-08 18:17:04 +00:00
parent ade12342e2
commit a645742bb5
18 changed files with 12 additions and 577 deletions
@@ -1,182 +0,0 @@
-name: rust-release-zsh
-
-on:
-  push:
-    tags:
-      - "codex-zsh-v*.*.*"
-
-env:
-  ZSH_COMMIT: 77045ef899e53b9598bebc5a41db93a548a40ca6
-  ZSH_PATCH: codex-rs/shell-escalation/patches/zsh-exec-wrapper.patch
-
-concurrency:
-  group: ${{ github.workflow }}::${{ github.ref_name }}
-  cancel-in-progress: false
-
-jobs:
-  metadata:
-    runs-on: ubuntu-latest
-    outputs:
-      release_tag: ${{ steps.release_tag.outputs.release_tag }}
-
-    steps:
-      - name: Validate release tag
-        id: release_tag
-        env:
-          RELEASE_TAG: ${{ github.ref_name }}
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          if [[ ! "${RELEASE_TAG}" =~ ^codex-zsh-v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "Tag ${RELEASE_TAG} does not match codex-zsh-vX.Y.Z." >&2
-            exit 1
-          fi
-
-          echo "release_tag=${RELEASE_TAG}" >> "${GITHUB_OUTPUT}"
-
-      - name: Ensure release does not exist
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ steps.release_tag.outputs.release_tag }}
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          if gh release view "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" > /dev/null 2>&1; then
-            echo "Release ${RELEASE_TAG} already exists; publish changed artifacts under a new tag." >&2
-            exit 1
-          fi
-
-  linux:
-    name: Build zsh (Linux) - ${{ matrix.variant }} - ${{ matrix.target }}
-    needs: metadata
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 30
-    container:
-      image: ${{ matrix.image }}
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: ubuntu-24.04
-            target: x86_64-unknown-linux-musl
-            variant: ubuntu-24.04
-            image: ubuntu:24.04
-            archive_name: codex-zsh-x86_64-unknown-linux-musl.tar.gz
-          - runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-musl
-            variant: ubuntu-24.04
-            image: arm64v8/ubuntu:24.04
-            archive_name: codex-zsh-aarch64-unknown-linux-musl.tar.gz
-
-    steps:
-      - name: Install build prerequisites
-        shell: bash
-        run: |
-          set -euo pipefail
-          apt-get update
-          DEBIAN_FRONTEND=noninteractive apt-get install -y \
-            autoconf \
-            bison \
-            build-essential \
-            ca-certificates \
-            gettext \
-            git \
-            libncursesw5-dev
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Build, smoke-test, and stage zsh artifact
-        shell: bash
-        run: |
-          "${GITHUB_WORKSPACE}/.github/scripts/build-zsh-release-artifact.sh" \
-            "dist/zsh/${{ matrix.target }}/${{ matrix.archive_name }}"
-
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: codex-zsh-${{ matrix.target }}
-          path: dist/zsh/${{ matrix.target }}/*
-
-  darwin:
-    name: Build zsh (macOS) - ${{ matrix.variant }} - ${{ matrix.target }}
-    needs: metadata
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 30
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: macos-15-large
-            target: x86_64-apple-darwin
-            variant: macos-15
-            archive_name: codex-zsh-x86_64-apple-darwin.tar.gz
-          - runner: macos-15-xlarge
-            target: aarch64-apple-darwin
-            variant: macos-15
-            archive_name: codex-zsh-aarch64-apple-darwin.tar.gz
-
-    steps:
-      - name: Install build prerequisites
-        shell: bash
-        run: |
-          set -euo pipefail
-          if ! command -v autoconf >/dev/null 2>&1; then
-            brew install autoconf
-          fi
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Build, smoke-test, and stage zsh artifact
-        shell: bash
-        run: |
-          "${GITHUB_WORKSPACE}/.github/scripts/build-zsh-release-artifact.sh" \
-            "dist/zsh/${{ matrix.target }}/${{ matrix.archive_name }}"
-
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: codex-zsh-${{ matrix.target }}
-          path: dist/zsh/${{ matrix.target }}/*
-
-  publish-release:
-    needs:
-      - metadata
-      - linux
-      - darwin
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      actions: read
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          path: dist
-
-      - name: Create GitHub Release
-        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
-        with:
-          tag_name: ${{ needs.metadata.outputs.release_tag }}
-          name: ${{ needs.metadata.outputs.release_tag }}
-          files: dist/**
-          # Keep zsh artifact releases out of Codex's normal "latest release" channel.
-          prerelease: true
-
-      - name: Publish DotSlash manifest
-        uses: ./.github/actions/publish-dotslash
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag: ${{ needs.metadata.outputs.release_tag }}
-          configs: .github/dotslash-zsh-config.json
@@ -16,8 +16,6 @@ on:

 env:
  CODEX_REPO_ROOT: ${{ github.workspace }}
-  CODEX_ZSH_RELEASE_TAG: codex-zsh-v0.1.0
-  CODEX_ZSH_MANIFEST_SHA256: c534eab89dcea7e3d8a5e5b3f49c025c7c64cd4e4d9814ee24871de58a9359a1

 # The launcher uses this per-tag group as the migration boundary. Keep shared
 # publication jobs on the original queued group below when changing this.
@@ -415,17 +413,6 @@ jobs:
            cp target/${{ matrix.target }}/release/codex-${{ matrix.target }}.dmg "$dest/codex-${{ matrix.target }}.dmg"
          fi

-      - name: Download packaged zsh manifest
-        if: ${{ runner.os != 'macOS' }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          curl -fsSL \
-            "https://github.com/${GITHUB_REPOSITORY}/releases/download/${CODEX_ZSH_RELEASE_TAG}/codex-zsh" \
-            -o "${RUNNER_TEMP}/codex-zsh"
-          bash "${GITHUB_WORKSPACE}/.github/scripts/verify-zsh-manifest.sh" \
-            "${RUNNER_TEMP}/codex-zsh" "$CODEX_ZSH_MANIFEST_SHA256"
-
      - name: Build Codex package archive
        if: ${{ runner.os != 'macOS' }}
        shell: bash
@@ -444,7 +431,6 @@ jobs:
            --bundle "$BUNDLE" \
            --entrypoint-dir "target/${TARGET}/release" \
            --archive-dir "dist/${TARGET}" \
-            --zsh-manifest "${RUNNER_TEMP}/codex-zsh" \
            "${voice_args[@]}"

      - name: Cosign Linux voice package archives
@@ -493,8 +479,7 @@ jobs:
            --target "${{ matrix.target }}" \
            --bundle primary \
            --entrypoint-dir "target/${{ matrix.target }}/release" \
-            --archive-dir "$wheel_archives" \
-            --zsh-manifest "${RUNNER_TEMP}/codex-zsh"
+            --archive-dir "$wheel_archives"
          wheel_archive="${wheel_archives}/codex-package-${{ matrix.target }}.tar.gz"
          python3 - "$wheel_archive" <<'PY'
          import sys
@@ -774,33 +759,22 @@ jobs:
          set -euo pipefail

          signed_root="${GITHUB_WORKSPACE}/signed-resources/${TARGET}"
-          zsh_manifest="${RUNNER_TEMP}/codex-zsh-${TARGET}"
          mkdir -p "$signed_root"
-          curl -fsSL \
-            "https://github.com/${GITHUB_REPOSITORY}/releases/download/${CODEX_ZSH_RELEASE_TAG}/codex-zsh" \
-            -o "$zsh_manifest"
-          bash "${GITHUB_WORKSPACE}/.github/scripts/verify-zsh-manifest.sh" \
-            "$zsh_manifest" "$CODEX_ZSH_MANIFEST_SHA256"

-          PYTHONPATH="${GITHUB_WORKSPACE}/scripts" python3 - "$TARGET" "$signed_root" "$zsh_manifest" <<'PY'
+          PYTHONPATH="${GITHUB_WORKSPACE}/scripts" python3 - "$TARGET" "$signed_root" <<'PY'
          import shutil
          import sys
          from pathlib import Path

          from codex_package.ripgrep import fetch_rg
          from codex_package.targets import TARGET_SPECS
-          from codex_package.zsh import resolve_zsh_bin

          spec = TARGET_SPECS[sys.argv[1]]
          signed_root = Path(sys.argv[2])
-          zsh_bin = resolve_zsh_bin(spec, Path(sys.argv[3]))
-          if zsh_bin is None:
-              raise RuntimeError(f"Pinned zsh release is missing {spec.target}")
          shutil.copy2(fetch_rg(spec), signed_root / "rg")
-          shutil.copy2(zsh_bin, signed_root / "zsh")
          PY

-          for resource in rg zsh; do
+          for resource in rg; do
            binary="${signed_root}/${resource}"
            report_dir="${GITHUB_WORKSPACE}/macos-binary-signing-verification/${TARGET}/${resource}"
            mkdir -p "$report_dir"
@@ -1001,7 +975,7 @@ jobs:
            codesign --verify --strict --verbose=2 "$binary_path"
          done

-          for resource in rg zsh; do
+          for resource in rg; do
            resource_path="signed-resources/${{ matrix.target }}/${resource}"
            chmod 0755 "$resource_path"
            codesign --verify --strict --verbose=2 "$resource_path"
@@ -1041,7 +1015,6 @@ jobs:
            --entrypoint-dir "target/${TARGET}/release" \
            --archive-dir "dist/${TARGET}" \
            --rg-bin "signed-resources/${TARGET}/rg" \
-            --zsh-bin "signed-resources/${TARGET}/zsh" \
            ${voice_args[@]+"${voice_args[@]}"}

      - name: Build unsigned macOS DMG
@@ -1129,8 +1102,7 @@ jobs:
            --bundle primary \
            --entrypoint-dir "target/${{ matrix.target }}/release" \
            --archive-dir "$wheel_archives" \
-            --rg-bin "signed-resources/${{ matrix.target }}/rg" \
-            --zsh-bin "signed-resources/${{ matrix.target }}/zsh"
+            --rg-bin "signed-resources/${{ matrix.target }}/rg"
          wheel_archive="${wheel_archives}/codex-package-${{ matrix.target }}.tar.gz"
          python3 - "$wheel_archive" <<'PY'
          import sys
@@ -1436,8 +1408,7 @@ jobs:
          verify_signed_binary "${package_dir}/bin/codex-code-mode-host" "codex-code-mode-host"

          for resource in \
-            "${package_dir}/codex-path/rg" \
-            "${package_dir}/codex-resources/zsh/bin/zsh"
+            "${package_dir}/codex-path/rg"
          do
            chmod 0755 "$resource"
            lipo "$resource" -verify_arch "$expected_arch"