openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-11 20:36:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
5d3fe48b08049165ef8143dca152869c1f18059c
codex/.github/workflows
History
Eric Burke 45eec73b11 Add opt-in provisioned macOS CLI release candidates (#44307) 
## What changed

- Add a tag-release workflow gated by `CODEX_PROVISIONED_MACOS_CANDIDATE` for Apple Silicon and Intel macOS candidate artifacts.
- Package the CLI in `CodexCLI.app` with an embedded provisioning profile and a relocatable `bin/codex` launcher. Validate independently supplied profile, certificate, and team expectations before signing.
- Sign and notarize candidates, then verify signatures, entitlements, architecture, stapling, and Gatekeeper acceptance on macOS. Retain verified artifacts after package smoke tests pass.
- Filter code-mode smoke-test requests to `/v1/responses` so analytics requests are excluded from response parsing.

## Testing

Add tests for profile validation, launcher relocation and symlink handling, standard and provisioned signing flows, and rejection of signing, notarization, identity, and entitlement failures. The candidate workflow runs package smoke tests, including sandboxed code mode.

GitOrigin-RevId: f214f6a23dd10df62cd72a2c63c20cb0864fbc9c
2026-09-09 21:28:49 +00:00
..
bazel.yml
Run required CI against pull request merge commits (#38051)
2026-08-11 18:31:31 +00:00
blob-size-policy.yml
Run required CI against pull request merge commits (#38051)
2026-08-11 18:31:31 +00:00
blocking-ci.yml
Run required CI against pull request merge commits (#38051)
2026-08-11 18:31:31 +00:00
cargo-deny.yml
Run required CI against pull request merge commits (#38051)
2026-08-11 18:31:31 +00:00
cla.yml
[codex] Pin GitHub Actions workflow references (#15828)
2026-03-27 23:00:05 +00:00
close-stale-contributor-prs.yml
[codex] Fully qualify hash-pins in GitHub Actions (#21436)
2026-05-07 14:31:20 -07:00
codespell.yml
Run required CI against pull request merge commits (#38051)
2026-08-11 18:31:31 +00:00
Dockerfile.bazel
Remove js_repl feature (#19410)
2026-04-24 17:49:29 -07:00
issue-deduplicator.yml
ci: use issue triage environment for issue workflows (#25134)
2026-05-29 12:06:55 -07:00
issue-labeler.yml
[codex] auto-label AWS Bedrock issues (#30607)
2026-06-29 11:10:38 -07:00
issue-translator.yml
Translate non-English issues (#27778)
2026-06-11 23:20:36 -07:00
postmerge-ci.yml
[codex] group blocking and postmerge CI workflows (#30146)
2026-06-26 15:07:05 -07:00
python-runtime-build.yml
Publish Python packages after stable CLI releases (#44067)
2026-09-09 05:39:52 +00:00
python-runtime-release.yml
Build Python SDK artifacts before publishing the runtime (#44061)
2026-09-09 05:14:27 +00:00
python-sdk-build.yml
Publish Python packages after stable CLI releases (#44067)
2026-09-09 05:39:52 +00:00
python-sdk-cli-release.yml
Publish Python packages after stable CLI releases (#44067)
2026-09-09 05:39:52 +00:00
python-sdk-release.yml
Build Python SDK artifacts before publishing the runtime (#44061)
2026-09-09 05:14:27 +00:00
r2-release.yml
Parallelize R2 asset publishing with DotSlash (#36871)
2026-08-04 10:05:24 +00:00
README.md
Run required CI against pull request merge commits (#38051)
2026-08-11 18:31:31 +00:00
repo-checks.yml
Add opt-in provisioned macOS CLI release candidates (#44307)
2026-09-09 21:28:49 +00:00
rust-ci-full-nextest-platform.yml
Add opt-in local audio devices to the voice helper (#43079)
2026-09-05 19:11:52 +00:00
rust-ci-full.yml
Add opt-in local audio devices to the voice helper (#43079)
2026-09-05 19:11:52 +00:00
rust-ci.yml
Clarify comments in CI setup and the Rust workflow (#43070)
2026-09-05 18:16:09 +00:00
rust-release-argument-comment-lint.yml
ci: template custom runner names by repo (#27024)
2026-06-08 11:47:23 -07:00
rust-release-prepare.yml
Exclude base instructions from the bundled model catalog (#43604)
2026-09-07 22:11:52 +00:00
rust-release-provisioned-macos.yml
Add opt-in provisioned macOS CLI release candidates (#44307)
2026-09-09 21:28:49 +00:00
rust-release-windows.yml
Enable sandboxed V8 for code mode (#36374)
2026-07-31 18:32:28 +00:00
rust-release-zsh.yml
release: publish standalone zsh artifacts (#30114)
2026-06-25 13:56:08 -07:00
rust-release.yml
Add opt-in provisioned macOS CLI release candidates (#44307)
2026-09-09 21:28:49 +00:00
rusty-v8-release.yml
Pin V8 release manifests and prevent published release replacement (#43444)
2026-09-07 11:55:57 +00:00
sdk.yml
Test Python SDK against the built CLI and installed runtime (#44053)
2026-09-09 04:40:22 +00:00
v8-canary.yml
Pin V8 release manifests and prevent published release replacement (#43444)
2026-09-07 11:55:57 +00:00
zstd
ci(windows): use DotSlash for zstd in rust-release-windows (#11542)
2026-02-11 20:57:11 -08:00

README.md

Workflow Strategy

The workflows in this directory are split so that pull requests get fast, review-friendly signal while main still gets the full cross-platform verification pass.

Pull Requests

  • Required checks run against GitHub's synthetic merge commit, not the pull request head alone. This includes changes already on main and catches conflicts before they reach the branch.
  • bazel.yml is the main pre-merge verification path for Rust code. It runs Bazel test and Bazel clippy on the supported Bazel targets, including the generated Rust test binaries needed to lint inline #[cfg(test)] code.
  • rust-ci.yml keeps the Cargo-native PR checks intentionally small:
    • cargo fmt --check
    • cargo shear
    • argument-comment-lint on Linux, macOS, and Windows
    • tools/argument-comment-lint package tests when the lint or its workflow wiring changes

Post-Merge On main

  • bazel.yml also runs on pushes to main. This re-verifies the merged Bazel path and helps keep the BuildBuddy caches warm.
  • rust-ci-full.yml is the full Cargo-native verification workflow. It keeps the heavier checks off the PR path while still validating them after merge:
    • the full Cargo clippy matrix
    • the full Cargo nextest matrix via per-platform archive-backed shards
    • Windows ARM64 nextest archives cross-compiled on Windows x64, then replayed on native Windows ARM64 shards
    • release-profile Cargo builds
    • cross-platform argument-comment-lint
    • Linux remote-env tests

Rule Of Thumb

  • If a build/test/clippy check can be expressed in Bazel, prefer putting the PR-time version in bazel.yml.
  • Keep rust-ci.yml fast enough that it usually does not dominate PR latency.
  • Reserve rust-ci-full.yml for heavyweight Cargo-native coverage that Bazel does not replace yet.
Reference in New Issue View Git Blame Copy Permalink