mirror of
https://github.com/openai/codex.git
synced 2026-11-13 21:30:47 +00:00
## What changed Wire signer-service settings from repository variables into the PKCS11 setup action for macOS binary, DMG, and provisioned bundle releases. Keep the feature disabled by default; Azure continues to supply tools, certificates, and notarization. Require signing mode, a pinned certificate, GitHub OIDC, and valid endpoint, purpose, and key ID inputs when enabled. Reject pre-supplied OIDC tokens and providers missing signer-service support markers, then export the signer-service backend configuration. GitOrigin-RevId: d6c9f2f65512892b286e4bbeb271633e23a96a24