## What changed
- Authenticate eligible protected `main` runs and Rust release tags with GitHub OIDC. Allow cache uploads only on `main` pushes; use read-only access for manual runs and release tags, and leave pull requests without GCS credentials.
- Rename the shared wrapper to `.github/scripts/run_bazel.py` and route Bazel callers through it. Disable the disk cache in GitHub Actions and default macOS GCS connections to 20 while respecting explicit limits.
- Gate additional Bazel release artifacts on `CODEX_BAZEL_RELEASES` and cache configuration, sharing the selected build systems across building, signing, and packaging. Keep Cargo as the default and prepare native Windows dependencies for Bazel releases.
- Add a `Bazel result` check for the full workflow and extend Bazel job timeouts.
## Testing
Add wrapper tests for cache access by event, argument preservation, and macOS connection limits. The wrapper test suite passes.
GitOrigin-RevId: d85edbd083acfaa8bafaa8fd5241daed3e9ef871
## Why
The BuildBuddy key is revoked. Temporarily keep Bazel-dependent checks from blocking CI and release only Cargo artifacts.
## What changed
- Remove Bazel from the `blocking-ci` required dependencies.
- Make the Bazel-backed argument comment lint and SDK jobs advisory, and stop requiring the lint job to succeed in the Rust CI results check.
- Restrict release build and packaging matrices to Cargo, including Windows and provisioned macOS packages, and exclude Bazel binaries and symbols from release artifact downloads.
GitOrigin-RevId: 2c0d23471bbd0ab2eb4d90d318b518d0b33db97f
## Why
Desktop consumers require successful Cargo and Bazel release artifacts, so Bazel release jobs must no longer be advisory.
## What changed
- Remove Bazel-specific `continue-on-error` settings from release build, signing, packaging, symbol, and macOS verification jobs.
- Add `codex-bazel`, `codex-command-runner-bazel`, and `codex-windows-sandbox-setup-bazel` DotSlash outputs for the corresponding Bazel release assets.
- Extend provisioned macOS signing and verification to both Cargo and Bazel packages on both architectures, keeping Bazel artifacts and reports distinct with a `-bazel` suffix.
- Add a `codex-provisioned-bazel` DotSlash output for provisioned macOS packages.
## Testing
Run the existing provisioned package smoke tests, including sandboxed code mode, for each build system using its matching CLI, app-server, and symbols archives.
GitOrigin-RevId: c951a3eb4557b539d53a12040237d5ef947f6bdf
## What changed
Update `astral-sh/setup-uv` to `v10.3.2` and pin `uv` to `0.13.5` across the affected build, test, and release workflows. Refresh the checksum used for DotSlash publishing.
Install `uv` in the Python SDK wheel test from a hash-pinned requirements file, requiring a binary distribution and hash verification.
GitOrigin-RevId: 05295f6468f4897ca08672ccf9dc4e9b7d717fa8
## What changed
- Attempt each `npm publish` up to three times, with 10- and 20-second delays and fresh OIDC credentials on each attempt. Continue skipping already-published versions.
- Enable verbose npm logging and retain debug logs as artifacts for seven days, including on failure.
- Use `macos-15-intel` to verify provisioned `x86_64-apple-darwin` packages, while keeping `aarch64-apple-darwin` verification on `macos-15-xlarge`.
GitOrigin-RevId: 1876c66993ecd8cdb44088ab17a3363d21135ec4
## What changed
- When `CODEX_PROVISIONED_MACOS_CANDIDATE` is `true`, require the provisioned macOS job to succeed and upload its verified packages as release assets. Allow releases to proceed when the job is disabled and skipped.
- Include provisioned archives in `codex-package_SHA256SUMS` and remove per-architecture `SHA256SUMS` files before upload.
- Publish a `codex-provisioned` DotSlash manifest for macOS ARM64 and x86_64 packages, pointing to `bin/codex`.
GitOrigin-RevId: 7e36df484a3b7da6b66180fa31418a6958d1fe77
## What changed
- Add a tag-release workflow gated by `CODEX_PROVISIONED_MACOS_CANDIDATE` for Apple Silicon and Intel macOS candidate artifacts.
- Package the CLI in `CodexCLI.app` with an embedded provisioning profile and a relocatable `bin/codex` launcher. Validate independently supplied profile, certificate, and team expectations before signing.
- Sign and notarize candidates, then verify signatures, entitlements, architecture, stapling, and Gatekeeper acceptance on macOS. Retain verified artifacts after package smoke tests pass.
- Filter code-mode smoke-test requests to `/v1/responses` so analytics requests are excluded from response parsing.
## Testing
Add tests for profile validation, launcher relocation and symlink handling, standard and provisioned signing flows, and rejection of signing, notarization, identity, and entitlement failures. The candidate workflow runs package smoke tests, including sandboxed code mode.
GitOrigin-RevId: f214f6a23dd10df62cd72a2c63c20cb0864fbc9c
Dmitriy Kovalenko