From f0c903a72b4bf71ad1fbcd482cb3e22601e3098c Mon Sep 17 00:00:00 2001
From: Adam Perry <anp@openai.com>
Date: Fri, 5 Jun 2026 18:08:56 +0000
Subject: [PATCH] bazel: refresh hermetic macOS SDK

---
 .github/workflows/macos-cross-build.yml | 56 +++++++++++++++++++++++++
 MODULE.bazel                            |  6 +--
 2 files changed, 59 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/macos-cross-build.yml

diff --git a/.github/workflows/macos-cross-build.yml b/.github/workflows/macos-cross-build.yml
new file mode 100644
index 0000000000..a8b526b579
--- /dev/null
+++ b/.github/workflows/macos-cross-build.yml
@@ -0,0 +1,56 @@
+name: macOS cross-build
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/macos-cross-build.yml"
+      - "MODULE.bazel"
+      - "MODULE.bazel.lock"
+      - "patches/llvm_*.patch"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/macos-cross-build.yml"
+      - "MODULE.bazel"
+      - "MODULE.bazel.lock"
+      - "patches/llvm_*.patch"
+  schedule:
+    - cron: "17 9 * * 1"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}::${{ github.event.pull_request.number > 0 && format('pr-{0}', github.event.pull_request.number) || github.ref_name }}
+  cancel-in-progress: ${{ github.ref_name != 'main' }}
+
+jobs:
+  build:
+    name: Cross-build macOS binaries
+    runs-on: macos-15-xlarge
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+
+      - name: Set up Bazel
+        uses: ./.github/actions/setup-bazel-ci
+        with:
+          target: macos-cross
+
+      - name: Cross-build file search
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          repository_cache="${RUNNER_TEMP}/macos-cross-repository-cache"
+          mkdir -p "${repository_cache}"
+
+          for platform in macos_amd64 macos_arm64; do
+            bazel build \
+              "--repository_cache=${repository_cache}" \
+              "--platforms=@llvm//platforms:${platform}" \
+              //codex-rs/file-search:codex-file-search
+          done
diff --git a/MODULE.bazel b/MODULE.bazel
index f123c30f33..167dab6bb2 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -29,11 +29,11 @@ register_toolchains("@llvm//toolchain:all")
 
 osx = use_extension("@llvm//extensions:osx.bzl", "osx")
 osx.from_archive(
-    sha256 = "1bde70c0b1c2ab89ff454acbebf6741390d7b7eb149ca2a3ca24cc9203a408b7",
-    strip_prefix = "Payload/Library/Developer/CommandLineTools/SDKs/MacOSX26.4.sdk",
+    sha256 = "5f044578cd78a3a9b9c965a42d56bad609ee5d252e1d4e6aa7c42fc3f35fee7b",
+    strip_prefix = "Payload/Library/Developer/CommandLineTools/SDKs/MacOSX26.5.sdk",
     type = "pkg",
     urls = [
-        "https://swcdn.apple.com/content/downloads/32/53/047-96692-A_OAHIHT53YB/ybtshxmrcju8m2qvw3w5elr4rajtg1x3y3/CLTools_macOSNMOS_SDK.pkg",
+        "https://swcdn.apple.com/content/downloads/09/08/047-91568-A_Y1CFZWQCD4/4xekpyz43i26dbp4enxfro8eb1q7wiujh5/CLTools_macOSNMOS_SDK.pkg",
     ],
 )
 osx.frameworks(names = [