openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-08-23 13:09:46 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
release/0.146
codex/.github/workflows
History
Channing Conger a453588416 Sign bundled macOS helper binaries (#35264) 
## Why

The macOS release workflow fetched `rg` and zsh while assembling package
archives, after the signing stage. This left the bundled helper executables
outside the workflow's signing and notarization checks.

## What changed

- Fetch, sign, notarize, and upload the pinned macOS `rg` and zsh binaries with
  the other release artifacts.
- Build package archives from those signed helpers via `--rg-bin` and the new
  `--zsh-bin` override.
- Verify the helpers' architecture, signatures, and absence of entitlements in
  the final package.

## Testing

- Cover the prebuilt zsh override and verify that package assembly preserves
  the supplied helper binaries.

GitOrigin-RevId: a3865c04fa2f0f4df32e627ee7202bc87bdc3241
2026-07-24 23:44:55 +00:00
..
bazel.yml
ci: share common workflow setup (#31318)
2026-07-06 17:27:44 -07:00
blob-size-policy.yml
[codex] group blocking and postmerge CI workflows (#30146)
2026-06-26 15:07:05 -07:00
blocking-ci.yml
[codex] group blocking and postmerge CI workflows (#30146)
2026-06-26 15:07:05 -07:00
cargo-deny.yml
ci: share common workflow setup (#31318)
2026-07-06 17:27:44 -07:00
cla.yml
[codex] Pin GitHub Actions workflow references (#15828)
2026-03-27 23:00:05 +00:00
close-stale-contributor-prs.yml
[codex] Fully qualify hash-pins in GitHub Actions (#21436)
2026-05-07 14:31:20 -07:00
codespell.yml
[codex] group blocking and postmerge CI workflows (#30146)
2026-06-26 15:07:05 -07:00
Dockerfile.bazel
Remove js_repl feature (#19410)
2026-04-24 17:49:29 -07:00
issue-deduplicator.yml
ci: use issue triage environment for issue workflows (#25134)
2026-05-29 12:06:55 -07:00
issue-labeler.yml
[codex] auto-label AWS Bedrock issues (#30607)
2026-06-29 11:10:38 -07:00
issue-translator.yml
Translate non-English issues (#27778)
2026-06-11 23:20:36 -07:00
postmerge-ci.yml
[codex] group blocking and postmerge CI workflows (#30146)
2026-06-26 15:07:05 -07:00
python-runtime-build.yml
Support alpha hotfix release versions (#34463)
2026-07-21 03:59:38 +00:00
python-runtime-release.yml
Support alpha hotfix release versions (#34463)
2026-07-21 03:59:38 +00:00
python-sdk-release.yml
Use dependency groups for Python SDK tooling (#27538)
2026-06-12 16:10:07 +00:00
r2-release.yml
Publish release metadata to R2 channels (#34508)
2026-07-21 09:55:09 +00:00
README.md
Fan out rust-ci-full nextest by platform (#23358)
2026-05-19 17:54:41 -07:00
repo-checks.yml
ci: share common workflow setup (#31318)
2026-07-06 17:27:44 -07:00
rust-ci-full-nextest-platform.yml
ci: route build IO through Dev Drives (#31357)
2026-07-08 14:06:37 -07:00
rust-ci-full.yml
ci: parameterize Cargo target paths (#31332)
2026-07-08 00:02:16 +00:00
rust-ci.yml
ci: share common workflow setup (#31318)
2026-07-06 17:27:44 -07:00
rust-release-argument-comment-lint.yml
ci: template custom runner names by repo (#27024)
2026-06-08 11:47:23 -07:00
rust-release-prepare.yml
make rust-release-prepare use env secret (#22702)
2026-05-14 21:45:53 +00:00
rust-release-windows.yml
ci: parameterize Cargo target paths (#31332)
2026-07-08 00:02:16 +00:00
rust-release-zsh.yml
release: publish standalone zsh artifacts (#30114)
2026-06-25 13:56:08 -07:00
rust-release.yml
Sign bundled macOS helper binaries (#35264)
2026-07-24 23:44:55 +00:00
rusty-v8-release.yml
ci: parameterize Cargo target paths (#31332)
2026-07-08 00:02:16 +00:00
sdk.yml
ci: route build IO through Dev Drives (#31357)
2026-07-08 14:06:37 -07:00
v8-canary.yml
ci: route build IO through Dev Drives (#31357)
2026-07-08 14:06:37 -07:00
zstd
ci(windows): use DotSlash for zstd in rust-release-windows (#11542)
2026-02-11 20:57:11 -08:00

README.md

Workflow Strategy

The workflows in this directory are split so that pull requests get fast, review-friendly signal while main still gets the full cross-platform verification pass.

Pull Requests

  • bazel.yml is the main pre-merge verification path for Rust code. It runs Bazel test and Bazel clippy on the supported Bazel targets, including the generated Rust test binaries needed to lint inline #[cfg(test)] code.
  • rust-ci.yml keeps the Cargo-native PR checks intentionally small:
    • cargo fmt --check
    • cargo shear
    • argument-comment-lint on Linux, macOS, and Windows
    • tools/argument-comment-lint package tests when the lint or its workflow wiring changes

Post-Merge On main

  • bazel.yml also runs on pushes to main. This re-verifies the merged Bazel path and helps keep the BuildBuddy caches warm.
  • rust-ci-full.yml is the full Cargo-native verification workflow. It keeps the heavier checks off the PR path while still validating them after merge:
    • the full Cargo clippy matrix
    • the full Cargo nextest matrix via per-platform archive-backed shards
    • Windows ARM64 nextest archives cross-compiled on Windows x64, then replayed on native Windows ARM64 shards
    • release-profile Cargo builds
    • cross-platform argument-comment-lint
    • Linux remote-env tests

Rule Of Thumb

  • If a build/test/clippy check can be expressed in Bazel, prefer putting the PR-time version in bazel.yml.
  • Keep rust-ci.yml fast enough that it usually does not dominate PR latency.
  • Reserve rust-ci-full.yml for heavyweight Cargo-native coverage that Bazel does not replace yet.
Reference in New Issue View Git Blame Copy Permalink