## Why
The BuildBuddy key is revoked. Temporarily keep Bazel-dependent checks from blocking CI and release only Cargo artifacts.
## What changed
- Remove Bazel from the `blocking-ci` required dependencies.
- Make the Bazel-backed argument comment lint and SDK jobs advisory, and stop requiring the lint job to succeed in the Rust CI results check.
- Restrict release build and packaging matrices to Cargo, including Windows and provisioned macOS packages, and exclude Bazel binaries and symbols from release artifact downloads.
GitOrigin-RevId: 2c0d23471bbd0ab2eb4d90d318b518d0b33db97f
## Why
Desktop consumers require successful Cargo and Bazel release artifacts, so Bazel release jobs must no longer be advisory.
## What changed
- Remove Bazel-specific `continue-on-error` settings from release build, signing, packaging, symbol, and macOS verification jobs.
- Add `codex-bazel`, `codex-command-runner-bazel`, and `codex-windows-sandbox-setup-bazel` DotSlash outputs for the corresponding Bazel release assets.
- Extend provisioned macOS signing and verification to both Cargo and Bazel packages on both architectures, keeping Bazel artifacts and reports distinct with a `-bazel` suffix.
- Add a `codex-provisioned-bazel` DotSlash output for provisioned macOS packages.
## Testing
Run the existing provisioned package smoke tests, including sandboxed code mode, for each build system using its matching CLI, app-server, and symbols archives.
GitOrigin-RevId: c951a3eb4557b539d53a12040237d5ef947f6bdf
## What changed
Update `astral-sh/setup-uv` to `v10.3.2` and pin `uv` to `0.13.5` across the affected build, test, and release workflows. Refresh the checksum used for DotSlash publishing.
Install `uv` in the Python SDK wheel test from a hash-pinned requirements file, requiring a binary distribution and hash verification.
GitOrigin-RevId: 05295f6468f4897ca08672ccf9dc4e9b7d717fa8
## What changed
- Attempt each `npm publish` up to three times, with 10- and 20-second delays and fresh OIDC credentials on each attempt. Continue skipping already-published versions.
- Enable verbose npm logging and retain debug logs as artifacts for seven days, including on failure.
- Use `macos-15-intel` to verify provisioned `x86_64-apple-darwin` packages, while keeping `aarch64-apple-darwin` verification on `macos-15-xlarge`.
GitOrigin-RevId: 1876c66993ecd8cdb44088ab17a3363d21135ec4
## What changed
- When `CODEX_PROVISIONED_MACOS_CANDIDATE` is `true`, require the provisioned macOS job to succeed and upload its verified packages as release assets. Allow releases to proceed when the job is disabled and skipped.
- Include provisioned archives in `codex-package_SHA256SUMS` and remove per-architecture `SHA256SUMS` files before upload.
- Publish a `codex-provisioned` DotSlash manifest for macOS ARM64 and x86_64 packages, pointing to `bin/codex`.
GitOrigin-RevId: 7e36df484a3b7da6b66180fa31418a6958d1fe77
## What changed
- Add a tag-release workflow gated by `CODEX_PROVISIONED_MACOS_CANDIDATE` for Apple Silicon and Intel macOS candidate artifacts.
- Package the CLI in `CodexCLI.app` with an embedded provisioning profile and a relocatable `bin/codex` launcher. Validate independently supplied profile, certificate, and team expectations before signing.
- Sign and notarize candidates, then verify signatures, entitlements, architecture, stapling, and Gatekeeper acceptance on macOS. Retain verified artifacts after package smoke tests pass.
- Filter code-mode smoke-test requests to `/v1/responses` so analytics requests are excluded from response parsing.
## Testing
Add tests for profile validation, launcher relocation and symlink handling, standard and provisioned signing flows, and rejection of signing, notarization, identity, and entitlement failures. The candidate workflow runs package smoke tests, including sandboxed code mode.
GitOrigin-RevId: f214f6a23dd10df62cd72a2c63c20cb0864fbc9c
Dmitriy Kovalenko