openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-01 14:39:21 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
41ece455b7fa7166f4fc38522952afdaa2604e18
codex/.github/workflows
History
Eric Burke 0c07c7ee47 Use Azure Key Vault for macOS notarization (#37154) 
## Why

Keep the App Store Connect private key in Azure Key Vault instead of exporting it to release runners as a base64-encoded `.p8` secret.

## What changed

- Add a notarization client that creates notary-scoped Apple JWTs with a pinned Azure Key Vault key, submits and streams artifacts to Apple's notarization service, polls for completion, and saves developer diagnostics.
- Update the binary and DMG release wrappers to use the new client while continuing to staple accepted DMGs with `rcodesign`.
- Configure release jobs with the notarization vault key name and version instead of private-key material.

## Testing

- Add unit coverage for key validation, JWT signing, uploads, polling, diagnostic logs, and the binary and DMG wrapper contracts.

GitOrigin-RevId: 8f526c5691d774964fd33f847f8420cac0840b05
2026-08-05 20:31:46 +00:00
..
bazel.yml
Run native Windows Bazel tests with MSVC (#36372)
2026-07-31 18:22:06 +00:00
blob-size-policy.yml
Add Fence auditing to the blob size workflow (#36979)
2026-08-04 22:03:13 +00:00
blocking-ci.yml
[codex] group blocking and postmerge CI workflows (#30146)
2026-06-26 15:07:05 -07:00
cargo-deny.yml
ci: share common workflow setup (#31318)
2026-07-06 17:27:44 -07:00
cla.yml
[codex] Pin GitHub Actions workflow references (#15828)
2026-03-27 23:00:05 +00:00
close-stale-contributor-prs.yml
[codex] Fully qualify hash-pins in GitHub Actions (#21436)
2026-05-07 14:31:20 -07:00
codespell.yml
[codex] group blocking and postmerge CI workflows (#30146)
2026-06-26 15:07:05 -07:00
Dockerfile.bazel
Remove js_repl feature (#19410)
2026-04-24 17:49:29 -07:00
issue-deduplicator.yml
ci: use issue triage environment for issue workflows (#25134)
2026-05-29 12:06:55 -07:00
issue-labeler.yml
[codex] auto-label AWS Bedrock issues (#30607)
2026-06-29 11:10:38 -07:00
issue-translator.yml
Translate non-English issues (#27778)
2026-06-11 23:20:36 -07:00
postmerge-ci.yml
[codex] group blocking and postmerge CI workflows (#30146)
2026-06-26 15:07:05 -07:00
python-runtime-build.yml
Support alpha hotfix release versions (#34463)
2026-07-21 03:59:38 +00:00
python-runtime-release.yml
Support alpha hotfix release versions (#34463)
2026-07-21 03:59:38 +00:00
python-sdk-release.yml
Use dependency groups for Python SDK tooling (#27538)
2026-06-12 16:10:07 +00:00
r2-release.yml
Parallelize R2 asset publishing with DotSlash (#36871)
2026-08-04 10:05:24 +00:00
README.md
Fan out rust-ci-full nextest by platform (#23358)
2026-05-19 17:54:41 -07:00
repo-checks.yml
Use Azure Key Vault for macOS notarization (#37154)
2026-08-05 20:31:46 +00:00
rust-ci-full-nextest-platform.yml
ci: route build IO through Dev Drives (#31357)
2026-07-08 14:06:37 -07:00
rust-ci-full.yml
Enable sandboxed V8 for code mode (#36374)
2026-07-31 18:32:28 +00:00
rust-ci.yml
ci: share common workflow setup (#31318)
2026-07-06 17:27:44 -07:00
rust-release-argument-comment-lint.yml
ci: template custom runner names by repo (#27024)
2026-06-08 11:47:23 -07:00
rust-release-prepare.yml
make rust-release-prepare use env secret (#22702)
2026-05-14 21:45:53 +00:00
rust-release-windows.yml
Enable sandboxed V8 for code mode (#36374)
2026-07-31 18:32:28 +00:00
rust-release-zsh.yml
release: publish standalone zsh artifacts (#30114)
2026-06-25 13:56:08 -07:00
rust-release.yml
Use Azure Key Vault for macOS notarization (#37154)
2026-08-05 20:31:46 +00:00
rusty-v8-release.yml
ci: parameterize Cargo target paths (#31332)
2026-07-08 00:02:16 +00:00
sdk.yml
ci: route build IO through Dev Drives (#31357)
2026-07-08 14:06:37 -07:00
v8-canary.yml
ci: route build IO through Dev Drives (#31357)
2026-07-08 14:06:37 -07:00
zstd
ci(windows): use DotSlash for zstd in rust-release-windows (#11542)
2026-02-11 20:57:11 -08:00

README.md

Workflow Strategy

The workflows in this directory are split so that pull requests get fast, review-friendly signal while main still gets the full cross-platform verification pass.

Pull Requests

  • bazel.yml is the main pre-merge verification path for Rust code. It runs Bazel test and Bazel clippy on the supported Bazel targets, including the generated Rust test binaries needed to lint inline #[cfg(test)] code.
  • rust-ci.yml keeps the Cargo-native PR checks intentionally small:
    • cargo fmt --check
    • cargo shear
    • argument-comment-lint on Linux, macOS, and Windows
    • tools/argument-comment-lint package tests when the lint or its workflow wiring changes

Post-Merge On main

  • bazel.yml also runs on pushes to main. This re-verifies the merged Bazel path and helps keep the BuildBuddy caches warm.
  • rust-ci-full.yml is the full Cargo-native verification workflow. It keeps the heavier checks off the PR path while still validating them after merge:
    • the full Cargo clippy matrix
    • the full Cargo nextest matrix via per-platform archive-backed shards
    • Windows ARM64 nextest archives cross-compiled on Windows x64, then replayed on native Windows ARM64 shards
    • release-profile Cargo builds
    • cross-platform argument-comment-lint
    • Linux remote-env tests

Rule Of Thumb

  • If a build/test/clippy check can be expressed in Bazel, prefer putting the PR-time version in bazel.yml.
  • Keep rust-ci.yml fast enough that it usually does not dominate PR latency.
  • Reserve rust-ci-full.yml for heavyweight Cargo-native coverage that Bazel does not replace yet.
Reference in New Issue View Git Blame Copy Permalink