mirror of
https://github.com/openai/codex.git
synced 2026-10-21 17:48:44 +00:00
ee
57560e9d53
## Why GitHub Actions workflows can use short-lived OpenAI credentials instead of storing a long-lived OpenAI API key in GitHub secrets. ## What changed - Add `--github-oidc` with required audience, identity provider, service account, and GitHub token-request URL settings. Read the GitHub request credential from stdin and connect it to the existing federated authentication flow. - Require the default OpenAI Responses endpoint in OIDC mode before reading credentials, and complete the initial token exchange before publishing server info. - Close the npm launcher's copy of stdin after the native child starts. - Document OIDC setup, credential handling, renewal behavior, and caller responsibilities. Keep API-key authentication as the default. ## Testing Add tests for required OIDC flags, upstream restrictions before credential reads, rejection of unsafe or empty settings without exposing sensitive input, and failure when a configured custom CA cannot be loaded in the CLI blocking context. GitOrigin-RevId: 7de6fd4c3491e7ccd6a2c2ccdee0bc2eedd0e642
105 lines
2.4 KiB
JavaScript
Executable File
105 lines
2.4 KiB
JavaScript
Executable File
#!/usr/bin/env node
|
|
// Entry point for the Codex responses API proxy binary.
|
|
|
|
import { spawn } from "node:child_process";
|
|
import { closeSync } from "node:fs";
|
|
import path from "path";
|
|
import { fileURLToPath } from "url";
|
|
|
|
const __filename = fileURLToPath(import.meta.url);
|
|
const __dirname = path.dirname(__filename);
|
|
|
|
function determineTargetTriple(platform, arch) {
|
|
switch (platform) {
|
|
case "linux":
|
|
case "android":
|
|
if (arch === "x64") {
|
|
return "x86_64-unknown-linux-musl";
|
|
}
|
|
if (arch === "arm64") {
|
|
return "aarch64-unknown-linux-musl";
|
|
}
|
|
break;
|
|
case "darwin":
|
|
if (arch === "x64") {
|
|
return "x86_64-apple-darwin";
|
|
}
|
|
if (arch === "arm64") {
|
|
return "aarch64-apple-darwin";
|
|
}
|
|
break;
|
|
case "win32":
|
|
if (arch === "x64") {
|
|
return "x86_64-pc-windows-msvc";
|
|
}
|
|
if (arch === "arm64") {
|
|
return "aarch64-pc-windows-msvc";
|
|
}
|
|
break;
|
|
default:
|
|
break;
|
|
}
|
|
return null;
|
|
}
|
|
|
|
const targetTriple = determineTargetTriple(process.platform, process.arch);
|
|
if (!targetTriple) {
|
|
throw new Error(
|
|
`Unsupported platform: ${process.platform} (${process.arch})`,
|
|
);
|
|
}
|
|
|
|
const vendorRoot = path.join(__dirname, "..", "vendor");
|
|
const archRoot = path.join(vendorRoot, targetTriple);
|
|
const binaryBaseName = "codex-responses-api-proxy";
|
|
const binaryPath = path.join(
|
|
archRoot,
|
|
binaryBaseName,
|
|
process.platform === "win32" ? `${binaryBaseName}.exe` : binaryBaseName,
|
|
);
|
|
|
|
const child = spawn(binaryPath, process.argv.slice(2), {
|
|
stdio: "inherit",
|
|
});
|
|
|
|
child.once("spawn", () => {
|
|
// The child has inherited stdin. Close our copy so credential input
|
|
// cannot be reread through the long-lived Node launcher.
|
|
closeSync(0);
|
|
});
|
|
|
|
child.on("error", (err) => {
|
|
console.error(err);
|
|
process.exit(1);
|
|
});
|
|
|
|
const forwardSignal = (signal) => {
|
|
if (!child.killed) {
|
|
try {
|
|
child.kill(signal);
|
|
} catch {
|
|
/* ignore */
|
|
}
|
|
}
|
|
};
|
|
|
|
["SIGINT", "SIGTERM", "SIGHUP"].forEach((sig) => {
|
|
process.on(sig, () => forwardSignal(sig));
|
|
});
|
|
|
|
const childResult = await new Promise((resolve) => {
|
|
child.on("exit", (code, signal) => {
|
|
if (signal) {
|
|
resolve({ type: "signal", signal });
|
|
} else {
|
|
resolve({ type: "code", exitCode: code ?? 1 });
|
|
}
|
|
});
|
|
});
|
|
|
|
if (childResult.type === "signal") {
|
|
process.kill(process.pid, childResult.signal);
|
|
} else {
|
|
process.exit(childResult.exitCode);
|
|
}
|