From df6896dc8ff80164cb6ff838a73f104f66103aaa Mon Sep 17 00:00:00 2001 From: shijie-openai Date: Wed, 3 Jun 2026 10:00:25 -0700 Subject: [PATCH] Use Azure artifact signing environment secrets --- .github/workflows/rust-release-windows.yml | 47 ------------ .github/workflows/rust-release.yml | 84 ++-------------------- 2 files changed, 6 insertions(+), 125 deletions(-) diff --git a/.github/workflows/rust-release-windows.yml b/.github/workflows/rust-release-windows.yml index 50c635faee..f5834d56c3 100644 --- a/.github/workflows/rust-release-windows.yml +++ b/.github/workflows/rust-release-windows.yml @@ -13,52 +13,7 @@ env: CARGO_NET_GIT_FETCH_WITH_CLI: "true" jobs: - validate-signing-secrets: - name: Validate Azure signing secrets - runs-on: ubuntu-latest - environment: - name: azure-artifact-signing - permissions: - contents: read - env: - AZURE_ARTIFACT_SIGNING_CLIENT_ID: ${{ secrets.AZURE_ARTIFACT_SIGNING_CLIENT_ID }} - AZURE_ARTIFACT_SIGNING_TENANT_ID: ${{ secrets.AZURE_ARTIFACT_SIGNING_TENANT_ID }} - AZURE_ARTIFACT_SIGNING_SUBSCRIPTION_ID: ${{ secrets.AZURE_ARTIFACT_SIGNING_SUBSCRIPTION_ID }} - AZURE_ARTIFACT_SIGNING_ENDPOINT: ${{ secrets.AZURE_ARTIFACT_SIGNING_ENDPOINT }} - AZURE_ARTIFACT_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_ARTIFACT_SIGNING_ACCOUNT_NAME }} - AZURE_ARTIFACT_SIGNING_CERTIFICATE_PROFILE_NAME: ${{ secrets.AZURE_ARTIFACT_SIGNING_CERTIFICATE_PROFILE_NAME }} - steps: - - name: Validate required Azure signing secrets are available - shell: bash - run: | - set -euo pipefail - - required=( - AZURE_ARTIFACT_SIGNING_CLIENT_ID - AZURE_ARTIFACT_SIGNING_TENANT_ID - AZURE_ARTIFACT_SIGNING_SUBSCRIPTION_ID - AZURE_ARTIFACT_SIGNING_ENDPOINT - AZURE_ARTIFACT_SIGNING_ACCOUNT_NAME - AZURE_ARTIFACT_SIGNING_CERTIFICATE_PROFILE_NAME - ) - - missing=() - for name in "${required[@]}"; do - if [[ -z "${!name}" ]]; then - missing+=("$name") - fi - done - - if ((${#missing[@]})); then - printf 'Missing required secret: %s\n' "${missing[@]}" >&2 - exit 1 - fi - - echo "All required Azure Trusted Signing secrets are available." - build-windows-binaries: - # Temporarily disabled while this PR smoke-tests secret access. - if: ${{ false }} name: Build Windows binaries - ${{ matrix.runner }} - ${{ matrix.target }} - ${{ matrix.bundle }} runs-on: ${{ matrix.runs_on }} # Windows release builds can exceed an hour on fat-LTO mainline releases, @@ -178,8 +133,6 @@ jobs: codex-rs/target/${{ matrix.target }}/release/staged-${{ matrix.bundle }}/* build-windows: - # Temporarily disabled while this PR smoke-tests secret access. - if: ${{ false }} needs: - build-windows-binaries name: Build - ${{ matrix.runner }} - ${{ matrix.target }} diff --git a/.github/workflows/rust-release.yml b/.github/workflows/rust-release.yml index 2d11ec889d..6f86fd24b3 100644 --- a/.github/workflows/rust-release.yml +++ b/.github/workflows/rust-release.yml @@ -18,17 +18,8 @@ name: rust-release on: push: - branches: - - dev/shijie/drop-windows-signing-deployment tags: - "rust-v*.*.*" - pull_request: - branches: - - main - paths: - - ".github/workflows/rust-release.yml" - - ".github/workflows/rust-release-windows.yml" - - ".github/actions/windows-code-sign/**" workflow_dispatch: inputs: release_mode: @@ -58,7 +49,7 @@ on: type: string concurrency: - group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.number || 'release' }} + group: ${{ github.workflow }} cancel-in-progress: true jobs: @@ -80,12 +71,6 @@ jobs: set -euo pipefail echo "::group::Tag validation" - if [[ "${GITHUB_EVENT_NAME}" == "pull_request" || "${GITHUB_REF_TYPE}" == "branch" ]]; then - echo "PR smoke run; skipping release tag validation." - echo "::endgroup::" - exit 0 - fi - case "${RELEASE_MODE}" in signed) if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then @@ -150,8 +135,7 @@ jobs: echo "::endgroup::" build: - # Temporarily disabled while this PR smoke-tests the Windows signing flow. - if: ${{ false && (github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed') }} + if: ${{ github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed' }} needs: tag-check name: Build - ${{ matrix.runner }} - ${{ matrix.target }} - ${{ matrix.bundle }} runs-on: ${{ matrix.runs_on || matrix.runner }} @@ -1104,8 +1088,7 @@ jobs: if-no-files-found: error stage-signed-macos: - # Temporarily disabled while this PR smoke-tests the Windows signing flow. - if: ${{ false && github.event_name == 'workflow_dispatch' && inputs.release_mode == 'promote_signed' }} + if: ${{ github.event_name == 'workflow_dispatch' && inputs.release_mode == 'promote_signed' }} needs: tag-check name: Stage signed macOS handoff - ${{ matrix.target }} - ${{ matrix.bundle }} runs-on: macos-15-xlarge @@ -1348,12 +1331,11 @@ jobs: needs: tag-check uses: ./.github/workflows/rust-release-windows.yml with: - release-lto: ${{ (github.event_name == 'pull_request' || github.ref_type == 'branch') && 'thin' || (contains(github.ref_name, '-alpha') && 'thin' || 'fat') }} + release-lto: ${{ contains(github.ref_name, '-alpha') && 'thin' || 'fat' }} secrets: inherit argument-comment-lint-release-assets: - # Temporarily disabled while this PR smoke-tests the Windows signing flow. - if: ${{ false && (github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed') }} + if: ${{ github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed' }} name: argument-comment-lint release assets needs: tag-check uses: ./.github/workflows/rust-release-argument-comment-lint.yml @@ -1361,8 +1343,7 @@ jobs: publish: true zsh-release-assets: - # Temporarily disabled while this PR smoke-tests the Windows signing flow. - if: ${{ false && (github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed') }} + if: ${{ github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed' }} name: zsh release assets needs: tag-check uses: ./.github/workflows/rust-release-zsh.yml @@ -1379,7 +1360,6 @@ jobs: if: >- ${{ always() && - false && needs.tag-check.result == 'success' && ( ( @@ -1770,7 +1750,6 @@ jobs: # success() check to the whole dependency chain before evaluating release outputs. if: >- ${{ - false && !cancelled() && needs.release.result == 'success' && needs.release.outputs.should_publish_npm == 'true' @@ -1926,54 +1905,6 @@ jobs: exit "${publish_status}" done - # Publish the platform-specific Python runtime wheels using PyPI trusted publishing. - # PyPI project configuration must trust this workflow and job. Keep this - # non-blocking while the Python runtime publishing path is new; failures still - # need release follow-up, but should not invalidate the Rust release itself. - publish-python-runtime: - # Publish to PyPI for stable releases and alpha pre-releases with numeric suffixes. - if: >- - ${{ - false && - !cancelled() && - needs.release.result == 'success' && - needs.release.outputs.should_publish_python_runtime == 'true' - }} - name: publish-python-runtime - needs: release - runs-on: ubuntu-latest - continue-on-error: true - environment: pypi - permissions: - id-token: write # Required for PyPI trusted publishing. - contents: read - - steps: - - name: Download Python runtime wheels from release - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - RELEASE_TAG: ${{ needs.release.outputs.tag }} - RELEASE_VERSION: ${{ needs.release.outputs.version }} - run: | - set -euo pipefail - python_version="$RELEASE_VERSION" - python_version="${python_version/-alpha./a}" - python_version="${python_version/-beta./b}" - python_version="${python_version/-rc./rc}" - - mkdir -p dist/python-runtime - gh release download "$RELEASE_TAG" \ - --repo "${GITHUB_REPOSITORY}" \ - --pattern "openai_codex_cli_bin-${python_version}-*.whl" \ - --dir dist/python-runtime - ls -lh dist/python-runtime - - - name: Publish Python runtime wheels to PyPI - uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0 - with: - packages-dir: dist/python-runtime - skip-existing: true - deploy-dev-website: name: Trigger developers.openai.com deploy needs: release @@ -1981,7 +1912,6 @@ jobs: # The deploy updates developers.openai.com with the new config schema json file. if: >- ${{ - false && !cancelled() && needs.release.result == 'success' && needs.release.outputs.sign_macos == 'true' && @@ -2012,7 +1942,6 @@ jobs: # '-' in the semver string (e.g., 1.2.3-alpha.1). if: >- ${{ - false && !cancelled() && needs.release.result == 'success' && needs.release.outputs.sign_macos == 'true' && @@ -2039,7 +1968,6 @@ jobs: name: Update latest-alpha-cli branch if: >- ${{ - false && !cancelled() && needs.release.result == 'success' && needs.release.outputs.sign_macos == 'true'