mirror of
https://github.com/openai/codex.git
synced 2026-11-13 21:30:47 +00:00
Dmitriy Kovalenko
4490060db6
## What changed - Authenticate eligible protected `main` runs and Rust release tags with GitHub OIDC. Allow cache uploads only on `main` pushes; use read-only access for manual runs and release tags, and leave pull requests without GCS credentials. - Rename the shared wrapper to `.github/scripts/run_bazel.py` and route Bazel callers through it. Disable the disk cache in GitHub Actions and default macOS GCS connections to 20 while respecting explicit limits. - Gate additional Bazel release artifacts on `CODEX_BAZEL_RELEASES` and cache configuration, sharing the selected build systems across building, signing, and packaging. Keep Cargo as the default and prepare native Windows dependencies for Bazel releases. - Add a `Bazel result` check for the full workflow and extend Bazel job timeouts. ## Testing Add wrapper tests for cache access by event, argument preservation, and macOS connection limits. The wrapper test suite passes. GitOrigin-RevId: d85edbd083acfaa8bafaa8fd5241daed3e9ef871
10 lines
383 B
Bash
Executable File
10 lines
383 B
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
if ! "${repo_root}/.github/scripts/run_bazel.py" mod deps --lockfile_mode=error; then
|
|
echo "Unable to verify MODULE.bazel.lock; see the Bazel error above."
|
|
echo "If Bazel reports an out-of-date lockfile, run 'just bazel-lock-update' and commit the updated lockfile."
|
|
exit 1
|
|
fi
|