mirror of
https://github.com/openai/codex.git
synced 2026-08-23 13:09:46 +00:00
77b766c6ee
## Why Prepare CI jobs for a later build-output relocation without changing where they write today. ## What - Export `CARGO_TARGET_DIR` from `setup-ci` at the existing `codex-rs/target` path. - Route nextest, release, artifact, and signing paths through `CARGO_TARGET_DIR`. - Require V8 staging callers to pass an explicit target directory while preserving the existing upstream path. ## Manual validation - Ran `just test-github-scripts`. - Parsed GitHub Actions YAML with `yq`. ## Stack - [#31332](https://github.com/openai/codex/pull/31332) — parameterize Cargo target paths - [#31356](https://github.com/openai/codex/pull/31356) — Windows 2025 runner bump - [#31357](https://github.com/openai/codex/pull/31357) — Dev Drive I/O routing
74 lines
2.5 KiB
YAML
74 lines
2.5 KiB
YAML
name: windows-code-sign
|
|
description: Sign Windows binaries with Azure Trusted Signing.
|
|
inputs:
|
|
target:
|
|
description: Target triple for the artifacts to sign.
|
|
required: true
|
|
binaries:
|
|
description: Space-delimited binary basenames to sign.
|
|
default: "codex codex-responses-api-proxy codex-windows-sandbox-setup codex-command-runner"
|
|
client-id:
|
|
description: Azure Trusted Signing client ID.
|
|
required: true
|
|
tenant-id:
|
|
description: Azure tenant ID for Trusted Signing.
|
|
required: true
|
|
subscription-id:
|
|
description: Azure subscription ID for Trusted Signing.
|
|
required: true
|
|
endpoint:
|
|
description: Azure Trusted Signing endpoint.
|
|
required: true
|
|
account-name:
|
|
description: Azure Trusted Signing account name.
|
|
required: true
|
|
certificate-profile-name:
|
|
description: Certificate profile name for signing.
|
|
required: true
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Azure login for Trusted Signing (OIDC)
|
|
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
|
|
with:
|
|
client-id: ${{ inputs.client-id }}
|
|
tenant-id: ${{ inputs.tenant-id }}
|
|
subscription-id: ${{ inputs.subscription-id }}
|
|
|
|
- name: Prepare file list
|
|
id: prepare
|
|
shell: bash
|
|
env:
|
|
TARGET: ${{ inputs.target }}
|
|
BINARIES: ${{ inputs.binaries }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
{
|
|
echo "files<<EOF"
|
|
for binary in ${BINARIES}; do
|
|
echo "${CARGO_TARGET_DIR}/${TARGET}/release/${binary}.exe"
|
|
done
|
|
echo "EOF"
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Sign Windows binaries with Azure Trusted Signing
|
|
uses: azure/trusted-signing-action@1d365fec12862c4aa68fcac418143d73f0cea293 # v0.5.11
|
|
with:
|
|
endpoint: ${{ inputs.endpoint }}
|
|
trusted-signing-account-name: ${{ inputs.account-name }}
|
|
certificate-profile-name: ${{ inputs.certificate-profile-name }}
|
|
exclude-environment-credential: true
|
|
exclude-workload-identity-credential: true
|
|
exclude-managed-identity-credential: true
|
|
exclude-shared-token-cache-credential: true
|
|
exclude-visual-studio-credential: true
|
|
exclude-visual-studio-code-credential: true
|
|
exclude-azure-cli-credential: false
|
|
exclude-azure-powershell-credential: true
|
|
exclude-azure-developer-cli-credential: true
|
|
exclude-interactive-browser-credential: true
|
|
cache-dependencies: false
|
|
files: ${{ steps.prepare.outputs.files }}
|