mirror of https://github.com/openai/codex.git synced 2026-08-23 13:09:46 +00:00

Files

Sean Huang 2e32d95894 Enable sandboxed V8 for code mode (#36374 )

## Why

Code mode must link against a V8 build with sandbox support, but Windows MSVC
still used upstream non-sandboxed prebuilts and package builds selected the
older release artifact profile.

## What changed

- Enable the `v8_enable_sandbox` feature directly for the code mode runtime.
- Select the `ptrcomp_sandbox_release` archive and bindings in Cargo packaging
  and CI, including Windows MSVC release builds.
- Point Bazel's Windows MSVC targets at the sandbox-enabled Codex artifacts and
  enable the matching crate feature.

## Testing

Add a runtime test that calls `v8__V8__IsSandboxEnabled()` and verifies that
the linked V8 library has sandbox support enabled.

GitOrigin-RevId: c1b49b44a6ccfea5b5006d69ec7866848d1cddd7

2026-07-31 18:32:28 +00:00

bazel.yml

Run native Windows Bazel tests with MSVC (#36372 )

2026-07-31 18:22:06 +00:00

blob-size-policy.yml

[codex] group blocking and postmerge CI workflows (#30146 )

2026-06-26 15:07:05 -07:00

blocking-ci.yml

[codex] group blocking and postmerge CI workflows (#30146 )

2026-06-26 15:07:05 -07:00

cargo-deny.yml

ci: share common workflow setup (#31318 )

2026-07-06 17:27:44 -07:00

cla.yml

[codex] Pin GitHub Actions workflow references (#15828 )

2026-03-27 23:00:05 +00:00

close-stale-contributor-prs.yml

[codex] Fully qualify hash-pins in GitHub Actions (#21436 )

2026-05-07 14:31:20 -07:00

codespell.yml

[codex] group blocking and postmerge CI workflows (#30146 )

2026-06-26 15:07:05 -07:00

Dockerfile.bazel

Remove js_repl feature (#19410 )

2026-04-24 17:49:29 -07:00

issue-deduplicator.yml

ci: use issue triage environment for issue workflows (#25134 )

2026-05-29 12:06:55 -07:00

issue-labeler.yml

[codex] auto-label AWS Bedrock issues (#30607 )

2026-06-29 11:10:38 -07:00

issue-translator.yml

Translate non-English issues (#27778 )

2026-06-11 23:20:36 -07:00

postmerge-ci.yml

[codex] group blocking and postmerge CI workflows (#30146 )

2026-06-26 15:07:05 -07:00

python-runtime-build.yml

Support alpha hotfix release versions (#34463 )

2026-07-21 03:59:38 +00:00

python-runtime-release.yml

Support alpha hotfix release versions (#34463 )

2026-07-21 03:59:38 +00:00

python-sdk-release.yml

Use dependency groups for Python SDK tooling (#27538 )

2026-06-12 16:10:07 +00:00

r2-release.yml

Publish release metadata to R2 channels (#34508 )

2026-07-21 09:55:09 +00:00

README.md

Fan out rust-ci-full nextest by platform (#23358 )

2026-05-19 17:54:41 -07:00

repo-checks.yml

ci: share common workflow setup (#31318 )

2026-07-06 17:27:44 -07:00

rust-ci-full-nextest-platform.yml

ci: route build IO through Dev Drives (#31357 )

2026-07-08 14:06:37 -07:00

rust-ci-full.yml

Enable sandboxed V8 for code mode (#36374 )

2026-07-31 18:32:28 +00:00

rust-ci.yml

ci: share common workflow setup (#31318 )

2026-07-06 17:27:44 -07:00

rust-release-argument-comment-lint.yml

ci: template custom runner names by repo (#27024 )

2026-06-08 11:47:23 -07:00

rust-release-prepare.yml

make rust-release-prepare use env secret (#22702 )

2026-05-14 21:45:53 +00:00

rust-release-windows.yml

Enable sandboxed V8 for code mode (#36374 )

2026-07-31 18:32:28 +00:00

rust-release-zsh.yml

release: publish standalone zsh artifacts (#30114 )

2026-06-25 13:56:08 -07:00

rust-release.yml

Stop publishing legacy Linux bundle archives (#36342 )

2026-07-31 14:55:14 +00:00

rusty-v8-release.yml

ci: parameterize Cargo target paths (#31332 )

2026-07-08 00:02:16 +00:00

sdk.yml

ci: route build IO through Dev Drives (#31357 )

2026-07-08 14:06:37 -07:00

v8-canary.yml

ci: route build IO through Dev Drives (#31357 )

2026-07-08 14:06:37 -07:00

zstd

ci(windows): use DotSlash for zstd in rust-release-windows (#11542 )

2026-02-11 20:57:11 -08:00

README.md

Workflow Strategy

The workflows in this directory are split so that pull requests get fast, review-friendly signal while main still gets the full cross-platform verification pass.

Pull Requests

bazel.yml is the main pre-merge verification path for Rust code. It runs Bazel test and Bazel clippy on the supported Bazel targets, including the generated Rust test binaries needed to lint inline #[cfg(test)] code.
rust-ci.yml keeps the Cargo-native PR checks intentionally small:
- cargo fmt --check
- cargo shear
- argument-comment-lint on Linux, macOS, and Windows
- tools/argument-comment-lint package tests when the lint or its workflow wiring changes

Post-Merge On `main`

bazel.yml also runs on pushes to main. This re-verifies the merged Bazel path and helps keep the BuildBuddy caches warm.
rust-ci-full.yml is the full Cargo-native verification workflow. It keeps the heavier checks off the PR path while still validating them after merge:
- the full Cargo clippy matrix
- the full Cargo nextest matrix via per-platform archive-backed shards
- Windows ARM64 nextest archives cross-compiled on Windows x64, then replayed on native Windows ARM64 shards
- release-profile Cargo builds
- cross-platform argument-comment-lint
- Linux remote-env tests

Rule Of Thumb

If a build/test/clippy check can be expressed in Bazel, prefer putting the PR-time version in bazel.yml.
Keep rust-ci.yml fast enough that it usually does not dominate PR latency.
Reserve rust-ci-full.yml for heavyweight Cargo-native coverage that Bazel does not replace yet.

README.md

Workflow Strategy

Pull Requests

Post-Merge On main

Rule Of Thumb

Post-Merge On `main`