Add Bazel repositories for pinned Codex releases (#40718)

## What changed

- Add a Bazel module extension that downloads checksum-pinned Linux x86-64 Codex release packages, with the Codex release host and GitHub Releases as sources.
- Generate `codex` and `package` filegroups from each package's `codex-package.json` manifest so consumers can address the entrypoint or the complete package contents.
- Register repositories for Codex `0.145.0` and `0.149.1` in `MODULE.bazel`.

GitOrigin-RevId: a73225bae76cf01a588c7e1b570f3fdd9f6e12ab

MODULE.bazel

@@ -427,6 +427,24 @@ crate.annotation(
 
 http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
+codex_release_archive = use_extension(
+    "//bazel/extensions:codex_release_archive.bzl",
+    "codex_release_archive",
+)
+codex_release_archive.release(
+    sha256 = "1e8531ae5f6dea3c6e11e53e74cc5ac81bf1ba597f9b296fb112d6ea30fdaf5d",
+    version = "0.149.1",
+)
+codex_release_archive.release(
+    sha256 = "71a28d362c96ac9829bf8203a2c71be451aeb726adb843167fdaf0eae8fe7dd9",
+    version = "0.145.0",
+)
+use_repo(
+    codex_release_archive,
+    "codex_release_0.145.0_linux_x86_64",
+    "codex_release_0.149.1_linux_x86_64",
+)
+
 http_file = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
 
 new_local_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:local.bzl", "new_local_repository")

bazel/extensions/BUILD.bazel

@@ -0,0 +1,3 @@
+package(default_visibility = ["//visibility:public"])
+
+exports_files(["codex_release_archive.bzl"])

bazel/extensions/codex_release_archive.bzl

@@ -0,0 +1,76 @@
+"""Bazel module extension for pinned Codex release archives."""
+
+_CODEX_RELEASE_BUILD_FILE = """\
+package(default_visibility = ["//visibility:public"])
+
+filegroup(
+    name = "codex",
+    srcs = [{entrypoint}],
+)
+
+filegroup(
+    name = "package",
+    srcs = glob([
+        "codex-package.json",
+        {binaries},
+        {resources},
+        {path},
+    ]),
+)
+"""
+
+def _codex_release_repository_impl(repository_ctx):
+    asset = "codex-package-x86_64-unknown-linux-musl.tar.gz"
+    version = repository_ctx.attr.version
+    repository_ctx.download_and_extract(
+        url = [
+            "https://releases.openai.com/codex/releases/{}/{}".format(version, asset),
+            "https://github.com/openai/codex/releases/download/rust-v{}/{}".format(version, asset),
+        ],
+        sha256 = repository_ctx.attr.sha256,
+    )
+    manifest = json.decode(repository_ctx.read("codex-package.json"))
+    entrypoint = manifest["entrypoint"]
+    binaries = entrypoint.rpartition("/")[0] + "/**"
+    repository_ctx.file(
+        "BUILD.bazel",
+        _CODEX_RELEASE_BUILD_FILE.format(
+            binaries = json.encode(binaries),
+            entrypoint = json.encode(entrypoint),
+            path = json.encode(manifest["pathDir"] + "/**"),
+            resources = json.encode(manifest["resourcesDir"] + "/**"),
+        ),
+        executable = False,
+    )
+    return repository_ctx.repo_metadata(reproducible = True)
+
+_codex_release_repository = repository_rule(
+    implementation = _codex_release_repository_impl,
+    attrs = {
+        "sha256": attr.string(mandatory = True),
+        "version": attr.string(mandatory = True),
+    },
+)
+
+_RELEASE = tag_class(
+    attrs = {
+        "sha256": attr.string(mandatory = True),
+        "version": attr.string(mandatory = True),
+    },
+)
+
+def _codex_release_archive_impl(module_ctx):
+    for module in module_ctx.modules:
+        for release in module.tags.release:
+            _codex_release_repository(
+                name = "codex_release_{}_linux_x86_64".format(release.version),
+                sha256 = release.sha256,
+                version = release.version,
+            )
+
+    return module_ctx.extension_metadata(reproducible = True)
+
+codex_release_archive = module_extension(
+    implementation = _codex_release_archive_impl,
+    tag_classes = {"release": _RELEASE},
+)