Charlie Marsh afb1b3c984 Verify the pinned zsh manifest in release builds (#39056) ...

## Why

Release jobs download the `codex-zsh` manifest before packaging or signing its
bundled binaries. Verify that download against a pinned digest so an unexpected
manifest cannot enter release artifacts.

## What changed

- Pin the SHA-256 digest for the `codex-zsh-v0.1.0` manifest.
- Add a portable verification script that uses `sha256sum` or macOS `shasum`.
- Run verification in both the package archive and macOS helper signing flows.

GitOrigin-RevId: a404bb897c8cc0bf3c0ff38e8a6e1cce059d7fab

2026-08-17 19:30:38 +00:00

..

macos-signing

Read Apple notarization issuer ID from Key Vault (#38646)

2026-08-14 20:49:15 +00:00

archive-release-symbols-and-strip-binaries.sh

[codex] Restore release symbol artifacts with line tables (#26202)

2026-06-08 17:16:36 +00:00

build-codex-package-archive.sh

Sign bundled macOS helper binaries (#35264)

2026-07-24 23:44:55 +00:00

build-zsh-release-artifact.sh

fix: keep zsh-fork release assets after removing shell-tool-mcp (#15644)

2026-03-24 12:56:26 -07:00

check_ci_results.py

[codex] group blocking and postmerge CI workflows (#30146)

2026-06-26 15:07:05 -07:00

compute-bazel-windows-path.ps1

ci: cross-compile Windows Bazel tests (#20585)

2026-05-01 15:55:28 -07:00

install-musl-build-tools.sh

Remove libubsan CI workaround (#24782)

2026-05-28 15:49:01 +00:00

publish_r2_release.py

Parallelize R2 asset publishing with DotSlash (#36871)

2026-08-04 10:05:24 +00:00

run_bazel_with_buildbuddy.py

ci: route build IO through Dev Drives (#31357)

2026-07-08 14:06:37 -07:00

run-argument-comment-lint-bazel.sh

Remove Windows Bazel lint toolchain overrides (#34827)

2026-07-22 21:07:34 +00:00

run-bazel-ci.sh

[codex] Fix Windows BuildBuddy Bazel wrapper execution (#25915)

2026-06-02 16:22:32 -07:00

run-bazel-query-ci.sh

[codex] Keep Bazel startup options stable across commands (#26256)

2026-06-04 20:23:37 -07:00

rusty_v8_bazel.py

Normalize rusty_v8 checksum manifest line endings (#36797)

2026-08-03 20:41:24 +00:00

rusty_v8_module_bazel.py

CI: Customize v8 building (#22086)

2026-05-18 21:33:05 -07:00

setup-dev-drive.ps1

ci: route build IO through Dev Drives (#31357)

2026-07-08 14:06:37 -07:00

test_macos_signing_entitlements.py

fix(release): add missing Intel V8 signing entitlement (#30953)

2026-07-07 16:47:21 +00:00

test_run_bazel_with_buildbuddy.py

ci: route build IO through Dev Drives (#31357)

2026-07-08 14:06:37 -07:00

test_rusty_v8_bazel.py

Normalize rusty_v8 checksum manifest line endings (#36797)

2026-08-03 20:41:24 +00:00

test_v8_canary_changes.py

ci: route build IO through Dev Drives (#31357)

2026-07-08 14:06:37 -07:00

v8_canary_changes.py

ci: route build IO through Dev Drives (#31357)

2026-07-08 14:06:37 -07:00

verify_bazel_clippy_lints.py

ci: sync Bazel clippy lints and fix uncovered violations (#16351)

2026-03-31 17:09:48 -07:00

verify_cargo_workspace_manifests.py

Enable V8 sandboxing for source-built builds (#21146)

2026-05-05 14:36:37 -07:00

verify_tui_core_boundary.py

TUI: enforce core boundary (#17399)

2026-04-10 20:25:31 -07:00

verify-zsh-manifest.sh

Verify the pinned zsh manifest in release builds (#39056)

2026-08-17 19:30:38 +00:00