## What changed
Switch the SDK workflow to `prepare-bazel-ci` with the `sdk` cache scope to restore the Bazel repository cache using a dedicated namespace. Use the action's cache key and hit outputs when saving, and save only after a successful Bazel build when no exact cache hit was found.
GitOrigin-RevId: 15bad8ccf1a45685e0ab0191d1aa514b4ccb06bf
Sort top-level artifact files by descending size before dispatching them to
`xargs -P2`, so both compression workers stay busy.
GitOrigin-RevId: a459af0a0c50ead1aaf2a7c19563d8100cd63f0e
## Why
The Windows release workflow builds an extra package archive only to extract it again when staging the Python runtime wheel. Reuse the package directory to avoid this round trip.
## What changed
- Allow `stage-runtime` to accept a Codex package directory as well as a `.tar.gz` archive, with the same package layout validation.
- Reject overlapping source and staging directories, symlinks, and non-regular directory entries before staging.
- Stage Windows runtime wheels from the existing package directory and retain the check that voice resources are absent.
## Testing
Add coverage for matching directory and archive output, including file permissions, source preservation, invalid layouts, non-regular entries, overlapping directories, and CLI handling of both source formats.
GitOrigin-RevId: bf6d1e05888367d482d8d51a4a8061f92a9cae8b
## What changed
- When `CODEX_PROVISIONED_MACOS_CANDIDATE` is `true`, require the provisioned macOS job to succeed and upload its verified packages as release assets. Allow releases to proceed when the job is disabled and skipped.
- Include provisioned archives in `codex-package_SHA256SUMS` and remove per-architecture `SHA256SUMS` files before upload.
- Publish a `codex-provisioned` DotSlash manifest for macOS ARM64 and x86_64 packages, pointing to `bin/codex`.
GitOrigin-RevId: 7e36df484a3b7da6b66180fa31418a6958d1fe77
Download target artifacts, supplemental release assets, and staged npm
packages in a single `actions/download-artifact` step in
`.github/workflows/rust-release.yml` using a combined artifact pattern.
GitOrigin-RevId: 64c63cc7a2e263418b2a4064c1fd46e1c514cc29
## Why
Avoid rebuilding the upstream Docker image and downloading its apt dependencies for each release by using the Python and `gh` already available on Ubuntu runners.
## What changed
Add a shared composite action that checks out the pinned upstream publisher and uses pinned `uv` to install hash-verified Python dependencies from wheels in a virtual environment. Accept multiple configuration paths and publish each manifest for the requested tag.
Update the Rust and zsh release workflows to use the action, combining the Codex and argument-comment-lint manifests into one invocation.
GitOrigin-RevId: 2a7ffef9a076a1d426349bcea587b10599cb8175
## Why
Windows release packages need the voice helper and native audio libraries. Realtime TLS connections on fresh Windows installations also need platform certificate validation so Windows can retrieve missing trusted roots on demand.
## What changed
- Build and sign the voice helper and audio DLLs for Windows x64 and ARM64, bundle a pinned Microsoft CRT DLL, and verify signatures and runtime receipts before packaging.
- Add verified, pinned Cygwin and native build tools plus MSVC linker, compiler, and path handling fixes for the Windows Bazel builds.
- Include voice resources in primary release archives and WinGet packages. Preserve WinGet executable names, update manifest hashes, and recognize the package root through matching entrypoint metadata. Keep Python runtime wheels voice-free to preserve their existing Windows support floor.
- Use Windows platform TLS validation for realtime WebSockets when no custom CA bundle is configured, preserving custom CA behavior.
## Testing
Add coverage for build-input integrity and unsafe paths, signed Windows runtime assembly, WinGet file and hash preservation, package discovery, and TLS trust selection, untrusted certificate rejection, and hostname validation.
GitOrigin-RevId: 423da35872fa5549d69fd4ca97d922bb49599386
## Why
Linux voice needs system ALSA plugins and enough buffering to accommodate PipeWire graph cycles without losing capture samples. Voice startup failures also need actionable diagnostics without exposing native error details.
## What changed
- Build and bundle GNU voice helpers and runtimes with primary Linux musl release archives, and sign the archives. Keep Python wheels free of these libraries to preserve `manylinux_2_17` compatibility.
- Discover ALSA plugins in fixed system directories and increase Linux capture and playback buffering to support larger PipeWire graph cycles.
- Report voice failures by stage, preserve negotiation timeout classification, and discard native error sources. Suppress the misleading `requested` closure message after failure cleanup.
- Add explicit Windows MSVC, pkgconf, and CMake toolchain configuration and preserve host architecture in native build environments.
## Testing
Add coverage for Linux release assembly, ALSA plugin discovery, PipeWire capture and playback, classified startup failures, failure cleanup rendering, and Windows build environment handling.
GitOrigin-RevId: d805eace96a669ce3a4489f12e2db6f68f9f7f53
Add `codex-windows-sandbox-service` to the Windows release binaries and
helper builds for x86_64 and ARM64. Register both architectures in the
DotSlash configuration to resolve their compressed service executables.
GitOrigin-RevId: 363ad9229856391b283e57cfb10f28910fed96fb
## What changed
- Add a tag-release workflow gated by `CODEX_PROVISIONED_MACOS_CANDIDATE` for Apple Silicon and Intel macOS candidate artifacts.
- Package the CLI in `CodexCLI.app` with an embedded provisioning profile and a relocatable `bin/codex` launcher. Validate independently supplied profile, certificate, and team expectations before signing.
- Sign and notarize candidates, then verify signatures, entitlements, architecture, stapling, and Gatekeeper acceptance on macOS. Retain verified artifacts after package smoke tests pass.
- Filter code-mode smoke-test requests to `/v1/responses` so analytics requests are excluded from response parsing.
## Testing
Add tests for profile validation, launcher relocation and symlink handling, standard and provisioned signing flows, and rejection of signing, notarization, identity, and entitlement failures. The candidate workflow runs package smoke tests, including sandboxed code mode.
GitOrigin-RevId: f214f6a23dd10df62cd72a2c63c20cb0864fbc9c
Guard the `voice_args` array expansion to avoid unbound-variable errors
under `set -u` when packaging bundles without voice arguments. Preserve
quoted arguments for the `primary` bundle.
GitOrigin-RevId: 677a565d1678dc1e218cd9a98298aa6a26873643
## Why
GNU tar extraction and signing require writable copies of Bazel outputs.
## What changed
Recursively add owner write permission to the staged macOS voice runtime before creating the unsigned release archive.
GitOrigin-RevId: 1d415251b26303ac17cf886f35ae18277e9e6032
## What changed
Add a downstream workflow that builds the Python SDK and runtime from the stable CLI release commit, using the CLI version for both packages and the SDK's exact runtime dependency. Publish and verify the runtime on PyPI before publishing the SDK.
Require a successful CLI `release` job, an unchanged release tag, and complete runtime assets. Skip CLI prereleases and allow publication despite unrelated publisher failures. Support retries by CLI workflow run ID and accept existing PyPI uploads while verifying the complete release.
Document release setup, retry procedures, and independent SDK releases.
## Testing
Add resolver unit tests covering tag resolution, prerelease skipping, partial reruns, pagination, invalid runs, moved tags, missing assets, and equivalent automatic and manual release resolution.
GitOrigin-RevId: 4ec6b2e77c94c851507dbe7200ea420994fce36e
## What changed
- Build the voice host and native runtime with Bazel's `-c opt` configuration.
- Resolve runtime paths before validating their contents in the release workflow.
- Make `runtime.json` owner-writable before sealing the post-signing release receipt.
- Use `scripts` in `PYTHONPATH` so archive creation can import `codex_package.archive`.
GitOrigin-RevId: 02f960573a4151f52cde486e17e1d45b73435306
## Why
The SDK release workflow published the runtime before building the SDK, so an SDK build failure could leave the runtime published on its own.
## What changed
- Extract a reusable SDK build workflow that packages checked-in generated code and runs alongside runtime preparation. Require both builds before publishing the runtime, and verify runtime availability before publishing the SDK.
- Add `stage-sdk --codex-version` to set an explicit runtime dependency independently of the SDK version, retaining the checked-in pin by default and rejecting missing or duplicate pins.
- Accept Codex release tags in the runtime version resolver and use its normalized Python version for standalone runtime PyPI verification.
## Testing
Add coverage for wheel and source distribution metadata, preservation of checked-in code, independent beta SDK versions, runtime tag normalization, and invalid versions or dependency pins.
GitOrigin-RevId: feb572fadcf5d148814b26b480b4bae5ef6a39c5
## Why
The SDK publish job needs to wait for runtime wheels to become available on PyPI, and release reruns need to tolerate SDK files that have already been uploaded.
## What changed
- Require runtime publication and verification before publishing the SDK, and enable `skip-existing` for SDK uploads.
- Share a PyPI verifier between runtime and SDK releases. Require the exact expected artifact set, including the SDK wheel and source distribution.
- Canonicalize versions with `packaging.version.Version` and retry registry errors, malformed responses, and incomplete artifact sets with a bounded retry loop.
## Testing
Add unit tests for transient failures and malformed responses, waiting for complete SDK artifacts, canonical version lookup, and retry exhaustion when runtime wheels are missing. Run them in repository checks.
GitOrigin-RevId: 9cb2ddced4ce6d509ebfd130511ab3f39239dd62
## Why
Python SDK CI needs to exercise the checkout's CLI while retaining coverage of the wheel installation and its default runtime.
## What changed
- Run the Python SDK test suite against the same Bazel-built CLI as the TypeScript SDK tests. Build and stage `codex-code-mode-host` alongside the CLI so it can be discovered.
- Make the Python test harness prefer `CODEX_EXEC_PATH`, then a local debug build, then the installed runtime. Exclude optional turn-cost probes from recorded model requests.
- Add a separate installation job that builds the Python SDK wheel and installs it in a fresh environment.
## Testing
The installation smoke test verifies that imports resolve to the installed SDK and that its default runtime completes a mocked turn with the expected user input and final response.
GitOrigin-RevId: 8e3126742a014e2cf042afe799bc657e1ea2a282
## Why
Release tags bump `Cargo.toml` versions without updating the workspace lockfile, leaving stale versions for Bazel's Cargo dependency graph.
## What changed
Run `cargo update --workspace` in `codex-rs` before the macOS voice release job builds the voice host and native runtime with Bazel.
GitOrigin-RevId: ed923530ff5bc9982968cac4f1def4dde379f422
## What changed
- Build, sign, and notarize `codex-voice-host` and its native runtime for Apple Silicon and Intel macOS release packages, granting the helper audio-input access.
- Include voice resources in primary package archives and DMGs, with a root-level `codex` symlink to `bin/codex` so the runtime can be located.
- Seal runtime receipts with post-signing hashes, require matching release versions and source builds, and bundle dependency notices, licenses, and source metadata.
- Keep voice resources out of Python wheels to preserve their older macOS compatibility; the native voice build targets macOS 14.
## Testing
Add packaging tests for alpha, beta, and stable versions, signed-byte preservation, license hashes, receipt validation, tamper detection, and exclusion of unlisted files. Extend release verification to check voice architectures, signatures, build identity, package hashes, and DMG contents.
GitOrigin-RevId: 9f9415a8b2532d655a9a8740bcdf64066ddb7472
## What changed
Remove `base_instructions` from `codex-rs/models-manager/models.json` and filter out the field in the `rust-release-prepare` workflow so automated catalog updates keep it excluded.
GitOrigin-RevId: 711d43c21a90aadc98e5622b8c24847bc4642c83
## Why
Executor compatibility checks need a build identity that distinguishes commits
and compiler targets independently of the package release version.
## What changed
- Add optional `providerId` to exec-server environment metadata, cached at startup
and returned by initialization and `environment/info`.
- Derive the ID as SHA-256 of `git:<lowercase commit>:<target>`. It identifies a
standard build configuration, not exact executable bytes, and is omitted when
the commit stamp or target is unavailable or invalid.
- Embed the compiler target in `BuildInfo`, preserve compatibility with historical
metadata without a target, and stamp Cargo release builds with `STABLE_GIT_COMMIT`.
- Group Bazel build-script argument files under one `--arg-file` flag to reduce
Windows command-line length while preserving file order.
## Testing
Add deterministic build-ID vectors across targets, commit normalization and invalid
input coverage, and historical metadata compatibility tests. Extend exec-server
coverage for metadata caching and ensure runtime environment overrides cannot
replace the executor's build identity.
GitOrigin-RevId: 125a18c23de7ad006571940ba305836376c983f4
## Why
Artifact checksums alone do not authenticate the downloaded checksum manifest. V8 downloads need a trusted digest recorded in the repository, and published releases should not have their assets overwritten.
## What changed
- Pin the V8 `150.4.0` release manifest digests and verify manifests before downloading archives or bindings in packaging and `setup-rusty-v8`, preserving CRLF support.
- Refuse to replace published V8 releases, remove unfinished drafts on retry, and use `gh release create` to upload assets before publication.
- Install Windows `sccache` through a pinned `taiki-e/install-action` in the release and canary workflows.
- Document independent manifest verification and digest recording for version updates.
## Testing
Add five packaging tests covering successful downloads, CRLF manifests, tampered manifests, missing pins, and missing pin files. Rejection tests verify that artifacts are not downloaded.
GitOrigin-RevId: 5c771cdcff376388e124faa4826bf81135d84b50
## What changed
- Stage npm tarballs in a job with `contents: read` permissions and upload them as the `npm-packages` artifact.
- Require staging to succeed before the `release` job runs, and download the staged tarballs there. Remove its dependency installation, packaging steps, and `actions: read` permission.
- Reuse native artifacts from `--artifacts-dir` when every target directory is nonempty, skipping workflow lookup and download. Retain workflow-based downloads as a fallback.
GitOrigin-RevId: 89c6a5039afbac12968fb6f35a39c8db723c4c62
## What changed
- Add `openDevices` and `setAudioControls` to the helper protocol. Open the default microphone and speaker after runtime initialization and transport negotiation, initially muted and suppressed.
- Use CPAL on macOS, GNU Linux, and MSVC Windows, with native audio dependencies confined to `codex-voice-host`. Add ALSA development dependencies to Linux CI.
- Pack callback samples into preallocated, bounded queues and service devices every 5 ms. Reject incompatible callback configurations, invalidate queued audio on control transitions, and reject capture backlog after unmute using device timestamps.
- Handle recoverable stream underruns and overruns without terminating the helper; terminate on device failure, active audio queue overflow, or stale queued audio.
Device opening only establishes local device readiness. Capture and rendered audio references are drained locally; encoding, decoding, and peer audio are not connected by this change.
## Testing
Add unit tests for mute boundaries, stale playback invalidation, sample bounds, partial-block packing and timestamps, callback size and timing limits, startup silence, queue overflow, and recoverable stream errors.
GitOrigin-RevId: 108aea3d411ef6c12908fe5fb67aaf9cddf4475f
## What changed
Install the `build-essential` package on apt-based runners in both full Rust CI workflows, including the platform-specific nextest workflow.
GitOrigin-RevId: 52e611235f032ed4a630301f40f8aafd9ca11a08
## What changed
Set `persist-credentials: false` for the V8 canary repository checkout and
for the `rusty_v8` checkouts in both the canary and release workflows.
GitOrigin-RevId: b4ccca7c7edf4e038b7b84c83f83d1416f655f65
## Why
Embedding reusable-workflow inputs directly in shell scripts can cause their
contents to be interpreted as shell syntax.
## What changed
- Export the Rust nextest target, profile, and test-thread inputs as environment
variables before using them in Bash commands and paths.
- Pass the MSVC target and host architecture to PowerShell through environment
variables.
GitOrigin-RevId: f96bbeeb7b556022e4bdea9db384a88f925050bf
## What changed
- Enable unprivileged user namespaces for every Linux job that uses the shared
`setup-ci` action.
- Disable AppArmor's unprivileged user namespace restriction when that sysctl is
available.
- Remove the duplicate setup from the two nextest workflow jobs.
GitOrigin-RevId: a5aebe0795ada435e687826134411c8b1c28bd98
## What changed
- Add `just assemble-codex-package` as the documented entry point for the package builder.
- Export `CODEX_REPO_ROOT` from `just` and release CI, and require the package builder to use it for repository-relative inputs.
- Resolve the ripgrep and zsh manifests relative to their Python modules.
GitOrigin-RevId: 039d12107a49171f064b0119adc6b99cf97c6c1e
## What changed
Remove the `repo-checks` steps that staged a Codex npm package from a fixed
release workflow and uploaded the resulting tarball as an artifact.
GitOrigin-RevId: bb3756188eeea2ed236710273234e70f17dc9e9d
## What changed
- Pin `openai-codex` to the `0.147.0` CLI runtime and regenerate its protocol models and lockfile.
- Allow stable Python SDK release tags and require their versions to match the pinned runtime.
- Expose the regenerated API additions, including thread sections, environment connection notifications, audio inputs, and the `section_id` thread-list filter.
## Testing
- Update release staging, generated-contract, notification, and public-signature coverage for the new runtime.
GitOrigin-RevId: 8b99ef6781e01c34d9d697c8c44247fb4e4fe3ab
## What changed
Update `pypa/gh-action-pypi-publish` from v1.13.0 to v1.14.2 for the Python runtime and SDK publishing jobs.
GitOrigin-RevId: 239d2787aec47fd53111e05c29efdd680c0c7c67
## Why
Release jobs download the `codex-zsh` manifest before packaging or signing its
bundled binaries. Verify that download against a pinned digest so an unexpected
manifest cannot enter release artifacts.
## What changed
- Pin the SHA-256 digest for the `codex-zsh-v0.1.0` manifest.
- Add a portable verification script that uses `sha256sum` or macOS `shasum`.
- Run verification in both the package archive and macOS helper signing flows.
GitOrigin-RevId: a404bb897c8cc0bf3c0ff38e8a6e1cce059d7fab
## What changed
- Load the Apple issuer ID from the notarization key's `apple-issuer-id`
tag alongside its key ID and pinned version.
- Require the tag to contain a valid UUID before creating the notarization JWT.
- Remove the separate `APPLE_NOTARIZATION_ISSUER_ID` environment variable and
release workflow secret wiring.
## Testing
- Cover valid, missing, empty, and malformed issuer ID tags in the macOS
notarization tests.
GitOrigin-RevId: c42da96a36293cf39312d8238f958f6898247f19
## Why
Checking only the pull request head can miss conflicts with changes already on
`main`.
## What changed
Remove explicit pull request head refs from required workflow checkouts so
GitHub Actions checks out the synthetic merge commit by default. Keep the
blocking gate on the same combined revision as the child workflows it
evaluates, and document the merge-commit policy in the workflow README.
GitOrigin-RevId: dc357caa5dc43f46b9b9a0edea6ee560b4fe8efb
## Why
Keep the App Store Connect private key in Azure Key Vault instead of exporting it to release runners as a base64-encoded `.p8` secret.
## What changed
- Add a notarization client that creates notary-scoped Apple JWTs with a pinned Azure Key Vault key, submits and streams artifacts to Apple's notarization service, polls for completion, and saves developer diagnostics.
- Update the binary and DMG release wrappers to use the new client while continuing to staple accepted DMGs with `rcodesign`.
- Configure release jobs with the notarization vault key name and version instead of private-key material.
## Testing
- Add unit coverage for key validation, JWT signing, uploads, polling, diagnostic logs, and the binary and DMG wrapper contracts.
GitOrigin-RevId: 8f526c5691d774964fd33f847f8420cac0840b05
## What changed
Run the hash-pinned `openai/fence` action in `audit` mode before checkout in
the blob size policy job.
GitOrigin-RevId: 9312897dae76d93298008b2ce8a8767680fe34b8
## Why
R2 publication waited for DotSlash to finish before uploading any release
assets, extending the release pipeline's critical path.
## What changed
- Start an `assets` stage after the GitHub release is created, in parallel with
DotSlash publication. Upload available assets concurrently without publishing
release metadata or channel aliases.
- Run a `finalize` stage after both jobs complete. Verify assets already present
in R2, upload any assets DotSlash added, and then publish metadata, stable
installer aliases, and release channels.
- Validate downloaded assets before upload and retain no-overwrite semantics
across both stages.
GitOrigin-RevId: 1c3e8ca715be4064c2532a5c651f1bbe03ed96a4
## Why
Code mode must link against a V8 build with sandbox support, but Windows MSVC
still used upstream non-sandboxed prebuilts and package builds selected the
older release artifact profile.
## What changed
- Enable the `v8_enable_sandbox` feature directly for the code mode runtime.
- Select the `ptrcomp_sandbox_release` archive and bindings in Cargo packaging
and CI, including Windows MSVC release builds.
- Point Bazel's Windows MSVC targets at the sandbox-enabled Codex artifacts and
enable the matching crate feature.
## Testing
Add a runtime test that calls `v8__V8__IsSandboxEnabled()` and verifies that
the linked V8 library has sandbox support enabled.
GitOrigin-RevId: c1b49b44a6ccfea5b5006d69ec7866848d1cddd7
## What changed
- Target `x86_64-pc-windows-msvc` in the post-merge native Windows Bazel job.
- Select the `//:windows_x86_64_msvc` target platform and the MSVC host platform.
- Update the job and execution-log artifact names to identify the MSVC target.
GitOrigin-RevId: ca7d65c8bc074dccb5e7ebbac3be80b97545a846
## Why
Linux release packages already include `codex`, `codex-code-mode-host`, and
`codex-resources/bwrap` in the `codex-package-<target>` archive.
## What changed
Remove the release workflow step that also created the redundant
`codex-<target>-bundle.tar.zst` archive for primary Linux builds.
GitOrigin-RevId: b4fd80e96b4fed991e9365e41fe7aad42a3fa28d
## What changed
Make the `update-branch` job wait for successful R2 publication before moving
`latest-alpha-cli`. For releases that publish npm packages, also require the npm
job to succeed; releases that intentionally skip npm publication can still
advance the branch.
GitOrigin-RevId: 38381b82c95c5c9650b2d72258ea7b835bdfa555
## Why
The Rust release workflow accepts alpha versions with a second numeric suffix,
such as `1.2.3-alpha.4.1`, but the R2 publisher rejects them as invalid.
## What changed
- Allow up to two numeric suffix components for alpha versions in
`publish_r2_release.py`.
- Document that its version pattern must remain aligned with release tag
validation in `rust-release.yml`.
GitOrigin-RevId: 8df68ce4f4d3e652367f7394a642827f21979d70
## Why
The macOS release workflow fetched `rg` and zsh while assembling package
archives, after the signing stage. This left the bundled helper executables
outside the workflow's signing and notarization checks.
## What changed
- Fetch, sign, notarize, and upload the pinned macOS `rg` and zsh binaries with
the other release artifacts.
- Build package archives from those signed helpers via `--rg-bin` and the new
`--zsh-bin` override.
- Verify the helpers' architecture, signatures, and absence of entitlements in
the final package.
## Testing
- Cover the prebuilt zsh override and verify that package assembly preserves
the supplied helper binaries.
GitOrigin-RevId: a3865c04fa2f0f4df32e627ee7202bc87bdc3241
## What changed
- Publish the verified `release.json` metadata to `codex/channels/latest` for
stable releases and `codex/channels/prerelease` for prereleases.
- Pass the release classification through the reusable R2 workflow so GitHub
Releases and R2 channels use the same stable-versus-prerelease decision.
- Allow channel objects to be replaced while keeping versioned release objects
immutable, and verify each channel upload before completing the publication.
GitOrigin-RevId: bd5c728c5565befe42b041ee1a032b111daca1c2
## What changed
- Add a reusable workflow that runs after the GitHub Release and DotSlash publishing jobs and mirrors each release asset to a versioned R2 prefix.
- Validate GitHub asset sizes and SHA-256 digests before upload, publish objects without overwriting existing files, and verify their remote size, digest metadata, and CRC64 checksum.
- Generate `release.json` with installer-facing asset URLs and digests, then publish and verify it alongside the release assets.
- Allow an in-progress Rust release workflow to finish instead of cancelling it when another run starts.
GitOrigin-RevId: e6717cd27914994accced6e2c5df696f0e9a558e
## Why
Windows Cargo and Bazel jobs spend significant time in filesystem-heavy
build and cache directories. Route those directories through one CI
build root so Windows can use its Dev Drive and Unix can use a stable
cache root.
## What
- Have `setup-ci` define `CI_BUILD_ROOT`, `CARGO_TARGET_DIR`, Bazel
cache/output paths, and temp paths.
- Require Windows to find or provision a verified Dev Drive instead of
falling back to `C:`.
- Pass the shared Bazel output base to `setup-bazel` so its explicit
`output_base` does not defeat Dev Drive routing.
- Point nextest, release, and V8 source-build paths at the shared
environment contract.
## Benchmark results
One-off cold-cache WPR/ETW traces show the explicit Bazel output-base
routing removes the dominant `C:` traffic:
| sample | `C:\_bazel` | summed `C:` traffic | traced test step |
|---|---:|---:|---:|
| shard 1 before | 62.2 GiB | 85.2 GiB | 16m22s |
| shard 1 updated | 0 | 16.5 GiB | 12m05s |
| shard 3 before | 67.2 GiB | 84.6 GiB | 16m48s |
| shard 3 updated | 0 | 13.5 GiB | 11m08s |
For a cold x64 V8 source build, the retained build-tail sample showed
`D:\cargo-target` at ~1.29 GiB while measured `C:` roots totaled ~0.45
GiB (`C:\Users` ~0.33 GiB, `C:\Program Files` ~0.06 GiB, `C:\Windows`
~0.03 GiB). The full cold build took 2h20m36s.
The Bazel timing improvement is directional because both refreshed
shards failed tests. The V8 trace is a bounded build-tail sample, not
the full build. All final samples had zero lost ETW events; VHDX traffic
was excluded from the optimization ranking.
Runs: [baseline
Bazel](https://github.com/openai/codex/actions/runs/28911908527),
[updated
Bazel](https://github.com/openai/codex/actions/runs/28917133701), [V8
build tail](https://github.com/openai/codex/actions/runs/28933626678).
## Manual validation
- Ran `just fmt`.
- Ran `just test-github-scripts` (35 tests).
- Parsed GitHub Actions YAML with `yq`.
- Ran `git diff --check`.
## Stack
- [#31332](https://github.com/openai/codex/pull/31332) — parameterize
Cargo target paths
- [#31356](https://github.com/openai/codex/pull/31356) — Windows 2025
runner bump
- [#31357](https://github.com/openai/codex/pull/31357) — Dev Drive I/O
routing
