tarunoai 568c592f9c Add sign-only mode and tighten macOS signing verification (#60671) ...

## What changed

- Add a `sign-only` operation to sign macOS CLI packages without notarization.
- Validate the configured signing certificate before signing both standard and provisioned packages.
- Require the configured team ID for every executable during verification and extend leaf certificate fingerprint checks to standard packages.

## Testing

Add coverage for signing a standard package without notarization and rejecting unexpected signing certificates in both standard and provisioned packages.

GitOrigin-RevId: 0794c7666abfe981b59b47311e3a9108223b8f57

2026-11-10 22:00:40 +00:00

..

fixtures

Remove Bazel outputs from DotSlash release configs (#58757)

2026-11-01 20:41:58 +00:00

macos-signing

Add sign-only mode and tighten macOS signing verification (#60671)

2026-11-10 22:00:40 +00:00

archive-release-symbols-and-strip-binaries.sh

[codex] Restore release symbol artifacts with line tables (#26202)

2026-06-08 17:16:36 +00:00

build-codex-package-archive.sh

Ship the standalone executor in release packages (#57837)

2026-10-28 21:09:05 +00:00

check_ci_results.py

[codex] group blocking and postmerge CI workflows (#30146)

2026-06-26 15:07:05 -07:00

compute-bazel-windows-path.ps1

Consolidate Bazel CI setup into prepare-bazel-ci (#56222)

2026-10-22 17:09:38 +00:00

contract_releases.py

Extend GitHub release read retries and add jitter (#57796)

2026-10-28 17:50:33 +00:00

install-musl-build-tools.sh

Pack relative relocations in x86-64 musl release builds (#59805)

2026-11-06 03:09:21 +00:00

install-musl-openssl.sh

Use OpenSSL 3.6.4 for musl builds (#45149)

2026-09-13 01:19:53 +00:00

npm_alpha_tag.py

Prevent stable release pointers from moving backward (#51186)

2026-10-05 22:19:18 +00:00

publish_r2_release.py

Skip stable installer alias publishing for prereleases (#51425)

2026-10-06 17:25:28 +00:00

publish-github-release.sh

Delete incomplete prereleases by release ID (#59903)

2026-11-06 12:52:36 +00:00

releases.py

Prevent stable release pointers from moving backward (#51186)

2026-10-05 22:19:18 +00:00

resolve_exec_server_releases.py

Resolve stable releases dynamically for exec-server compatibility tests (#54623)

2026-10-16 14:49:23 +00:00

resolve_python_cli_release.py

Publish Python packages after stable CLI releases (#44067)

2026-09-09 05:39:52 +00:00

run_bazel_with_buildbuddy.py

Run Bazel CI locally without BuildBuddy credentials (#59055)

2026-11-03 04:08:59 +00:00

run-argument-comment-lint-bazel.sh

Run Bazel CI locally without BuildBuddy credentials (#59055)

2026-11-03 04:08:59 +00:00

run-bazel-ci.sh

Run Bazel CI locally without BuildBuddy credentials (#59055)

2026-11-03 04:08:59 +00:00

run-bazel-query-ci.sh

[codex] Keep Bazel startup options stable across commands (#26256)

2026-06-04 20:23:37 -07:00

rusty_v8_bazel.py

Enforce V8 artifact profiles at Bazel target boundaries (#57165)

2026-10-26 17:56:15 +00:00

rusty_v8_module_bazel.py

CI: Customize v8 building (#22086)

2026-05-18 21:33:05 -07:00

select_windows_bazel_targets.py

Balance Windows Bazel test shards using duration estimates (#49103)

2026-09-28 23:52:19 +00:00

setup-dev-drive.ps1

ci: route build IO through Dev Drives (#31357)

2026-07-08 14:06:37 -07:00

setup-voice-windows.ps1

Bundle native voice runtimes in Windows releases (#44922)

2026-09-11 21:59:24 +00:00

test_contract_releases.py

Resolve stable releases dynamically for exec-server compatibility tests (#54623)

2026-10-16 14:49:23 +00:00

test_macos_signing_entitlements.py

fix(release): add missing Intel V8 signing entitlement (#30953)

2026-07-07 16:47:21 +00:00

test_releases.py

Delete incomplete prereleases by release ID (#59903)

2026-11-06 12:52:36 +00:00

test_resolve_python_cli_release.py

Publish Python packages after stable CLI releases (#44067)

2026-09-09 05:39:52 +00:00

test_run_bazel_with_buildbuddy.py

Run Bazel CI locally without BuildBuddy credentials (#59055)

2026-11-03 04:08:59 +00:00

test_rusty_v8_bazel.py

Run Bazel CI locally without BuildBuddy credentials (#59055)

2026-11-03 04:08:59 +00:00

test_select_windows_bazel_targets.py

Balance Windows Bazel test shards using duration estimates (#49103)

2026-09-28 23:52:19 +00:00

test_v8_canary_changes.py

Upgrade V8 to 152.2.0 and backport Array.sort safety guards (#54519)

2026-10-16 06:06:54 +00:00

test_verify_pypi_release.py

Gate Python SDK publishing on runtime availability and verify PyPI files (#44055)

2026-09-09 04:47:38 +00:00

test_voice_cygwin_inputs.py

Bundle native voice runtimes in Windows releases (#44922)

2026-09-11 21:59:24 +00:00

v8_canary_changes.py

Generate Rust bindings that match Bazel-built V8 archives (#57644)

2026-10-28 04:48:23 +00:00

verify_bazel_clippy_lints.py

ci: sync Bazel clippy lints and fix uncovered violations (#16351)

2026-03-31 17:09:48 -07:00

verify_cargo_workspace_manifests.py

Format all Rust sources and clean up repository checks (#57314)

2026-10-27 00:23:39 +00:00

verify_pypi_release.py

Gate Python SDK publishing on runtime availability and verify PyPI files (#44055)

2026-09-09 04:47:38 +00:00

verify_tui_core_boundary.py

Format Python scripts across the repository (#42109)

2026-09-01 17:47:29 +00:00

voice_windows_tools.py

Stabilize Windows voice build cache keys across tool reinstalls (#50046)

2026-10-01 17:27:30 +00:00

voice-cygwin-inputs.py

Bundle native voice runtimes in Windows releases (#44922)

2026-09-11 21:59:24 +00:00

voice-cygwin-snapshot.json

Bundle native voice runtimes in Windows releases (#44922)

2026-09-11 21:59:24 +00:00

watch_voice_bazel.py

Bundle native voice runtimes in Windows releases (#44922)

2026-09-11 21:59:24 +00:00

windows_bazel_test_durations.tsv

Extract shared message-board code into codex-message-board (#55970)

2026-10-21 19:34:51 +00:00