Use Azure artifact signing environment secrets

.github/workflows/rust-release-windows.yml

@@ -13,52 +13,7 @@ env:
   CARGO_NET_GIT_FETCH_WITH_CLI: "true"
 
 jobs:
-  validate-signing-secrets:
-    name: Validate Azure signing secrets
-    runs-on: ubuntu-latest
-    environment:
-      name: azure-artifact-signing
-    permissions:
-      contents: read
-    env:
-      AZURE_ARTIFACT_SIGNING_CLIENT_ID: ${{ secrets.AZURE_ARTIFACT_SIGNING_CLIENT_ID }}
-      AZURE_ARTIFACT_SIGNING_TENANT_ID: ${{ secrets.AZURE_ARTIFACT_SIGNING_TENANT_ID }}
-      AZURE_ARTIFACT_SIGNING_SUBSCRIPTION_ID: ${{ secrets.AZURE_ARTIFACT_SIGNING_SUBSCRIPTION_ID }}
-      AZURE_ARTIFACT_SIGNING_ENDPOINT: ${{ secrets.AZURE_ARTIFACT_SIGNING_ENDPOINT }}
-      AZURE_ARTIFACT_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_ARTIFACT_SIGNING_ACCOUNT_NAME }}
-      AZURE_ARTIFACT_SIGNING_CERTIFICATE_PROFILE_NAME: ${{ secrets.AZURE_ARTIFACT_SIGNING_CERTIFICATE_PROFILE_NAME }}
-    steps:
-      - name: Validate required Azure signing secrets are available
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          required=(
-            AZURE_ARTIFACT_SIGNING_CLIENT_ID
-            AZURE_ARTIFACT_SIGNING_TENANT_ID
-            AZURE_ARTIFACT_SIGNING_SUBSCRIPTION_ID
-            AZURE_ARTIFACT_SIGNING_ENDPOINT
-            AZURE_ARTIFACT_SIGNING_ACCOUNT_NAME
-            AZURE_ARTIFACT_SIGNING_CERTIFICATE_PROFILE_NAME
-          )
-
-          missing=()
-          for name in "${required[@]}"; do
-            if [[ -z "${!name}" ]]; then
-              missing+=("$name")
-            fi
-          done
-
-          if ((${#missing[@]})); then
-            printf 'Missing required secret: %s\n' "${missing[@]}" >&2
-            exit 1
-          fi
-
-          echo "All required Azure Trusted Signing secrets are available."
-
   build-windows-binaries:
-    # Temporarily disabled while this PR smoke-tests secret access.
-    if: ${{ false }}
     name: Build Windows binaries - ${{ matrix.runner }} - ${{ matrix.target }} - ${{ matrix.bundle }}
     runs-on: ${{ matrix.runs_on }}
     # Windows release builds can exceed an hour on fat-LTO mainline releases,
@@ -178,8 +133,6 @@ jobs:
             codex-rs/target/${{ matrix.target }}/release/staged-${{ matrix.bundle }}/*
 
   build-windows:
-    # Temporarily disabled while this PR smoke-tests secret access.
-    if: ${{ false }}
     needs:
       - build-windows-binaries
     name: Build - ${{ matrix.runner }} - ${{ matrix.target }}

.github/workflows/rust-release.yml

@@ -18,17 +18,8 @@
 name: rust-release
 on:
   push:
-    branches:
-      - dev/shijie/drop-windows-signing-deployment
     tags:
       - "rust-v*.*.*"
-  pull_request:
-    branches:
-      - main
-    paths:
-      - ".github/workflows/rust-release.yml"
-      - ".github/workflows/rust-release-windows.yml"
-      - ".github/actions/windows-code-sign/**"
   workflow_dispatch:
     inputs:
       release_mode:
@@ -58,7 +49,7 @@ on:
         type: string
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.number || 'release' }}
+  group: ${{ github.workflow }}
   cancel-in-progress: true
 
 jobs:
@@ -80,12 +71,6 @@ jobs:
           set -euo pipefail
           echo "::group::Tag validation"
 
-          if [[ "${GITHUB_EVENT_NAME}" == "pull_request" || "${GITHUB_REF_TYPE}" == "branch" ]]; then
-            echo "PR smoke run; skipping release tag validation."
-            echo "::endgroup::"
-            exit 0
-          fi
-
           case "${RELEASE_MODE}" in
             signed)
               if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
@@ -150,8 +135,7 @@ jobs:
           echo "::endgroup::"
 
   build:
-    # Temporarily disabled while this PR smoke-tests the Windows signing flow.
-    if: ${{ false && (github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed') }}
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed' }}
     needs: tag-check
     name: Build - ${{ matrix.runner }} - ${{ matrix.target }} - ${{ matrix.bundle }}
     runs-on: ${{ matrix.runs_on || matrix.runner }}
@@ -1104,8 +1088,7 @@ jobs:
           if-no-files-found: error
 
   stage-signed-macos:
-    # Temporarily disabled while this PR smoke-tests the Windows signing flow.
-    if: ${{ false && github.event_name == 'workflow_dispatch' && inputs.release_mode == 'promote_signed' }}
+    if: ${{ github.event_name == 'workflow_dispatch' && inputs.release_mode == 'promote_signed' }}
     needs: tag-check
     name: Stage signed macOS handoff - ${{ matrix.target }} - ${{ matrix.bundle }}
     runs-on: macos-15-xlarge
@@ -1348,12 +1331,11 @@ jobs:
     needs: tag-check
     uses: ./.github/workflows/rust-release-windows.yml
     with:
-      release-lto: ${{ (github.event_name == 'pull_request' || github.ref_type == 'branch') && 'thin' || (contains(github.ref_name, '-alpha') && 'thin' || 'fat') }}
+      release-lto: ${{ contains(github.ref_name, '-alpha') && 'thin' || 'fat' }}
     secrets: inherit
 
   argument-comment-lint-release-assets:
-    # Temporarily disabled while this PR smoke-tests the Windows signing flow.
-    if: ${{ false && (github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed') }}
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed' }}
     name: argument-comment-lint release assets
     needs: tag-check
     uses: ./.github/workflows/rust-release-argument-comment-lint.yml
@@ -1361,8 +1343,7 @@ jobs:
       publish: true
 
   zsh-release-assets:
-    # Temporarily disabled while this PR smoke-tests the Windows signing flow.
-    if: ${{ false && (github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed') }}
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed' }}
     name: zsh release assets
     needs: tag-check
     uses: ./.github/workflows/rust-release-zsh.yml
@@ -1379,7 +1360,6 @@ jobs:
     if: >-
       ${{
         always() &&
-        false &&
         needs.tag-check.result == 'success' &&
         (
           (
@@ -1770,7 +1750,6 @@ jobs:
     # success() check to the whole dependency chain before evaluating release outputs.
     if: >-
       ${{
-        false &&
         !cancelled() &&
         needs.release.result == 'success' &&
         needs.release.outputs.should_publish_npm == 'true'
@@ -1926,54 +1905,6 @@ jobs:
             exit "${publish_status}"
           done
 
-  # Publish the platform-specific Python runtime wheels using PyPI trusted publishing.
-  # PyPI project configuration must trust this workflow and job. Keep this
-  # non-blocking while the Python runtime publishing path is new; failures still
-  # need release follow-up, but should not invalidate the Rust release itself.
-  publish-python-runtime:
-    # Publish to PyPI for stable releases and alpha pre-releases with numeric suffixes.
-    if: >-
-      ${{
-        false &&
-        !cancelled() &&
-        needs.release.result == 'success' &&
-        needs.release.outputs.should_publish_python_runtime == 'true'
-      }}
-    name: publish-python-runtime
-    needs: release
-    runs-on: ubuntu-latest
-    continue-on-error: true
-    environment: pypi
-    permissions:
-      id-token: write # Required for PyPI trusted publishing.
-      contents: read
-
-    steps:
-      - name: Download Python runtime wheels from release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          RELEASE_TAG: ${{ needs.release.outputs.tag }}
-          RELEASE_VERSION: ${{ needs.release.outputs.version }}
-        run: |
-          set -euo pipefail
-          python_version="$RELEASE_VERSION"
-          python_version="${python_version/-alpha./a}"
-          python_version="${python_version/-beta./b}"
-          python_version="${python_version/-rc./rc}"
-
-          mkdir -p dist/python-runtime
-          gh release download "$RELEASE_TAG" \
-            --repo "${GITHUB_REPOSITORY}" \
-            --pattern "openai_codex_cli_bin-${python_version}-*.whl" \
-            --dir dist/python-runtime
-          ls -lh dist/python-runtime
-
-      - name: Publish Python runtime wheels to PyPI
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
-        with:
-          packages-dir: dist/python-runtime
-          skip-existing: true
-
   deploy-dev-website:
     name: Trigger developers.openai.com deploy
     needs: release
@@ -1981,7 +1912,6 @@ jobs:
     # The deploy updates developers.openai.com with the new config schema json file.
     if: >-
       ${{
-        false &&
         !cancelled() &&
         needs.release.result == 'success' &&
         needs.release.outputs.sign_macos == 'true' &&
@@ -2012,7 +1942,6 @@ jobs:
     # '-' in the semver string (e.g., 1.2.3-alpha.1).
     if: >-
       ${{
-        false &&
         !cancelled() &&
         needs.release.result == 'success' &&
         needs.release.outputs.sign_macos == 'true' &&
@@ -2039,7 +1968,6 @@ jobs:
     name: Update latest-alpha-cli branch
     if: >-
       ${{
-        false &&
         !cancelled() &&
         needs.release.result == 'success' &&
         needs.release.outputs.sign_macos == 'true'