Eric Burke 0c07c7ee47 Use Azure Key Vault for macOS notarization (#37154) ...

## Why

Keep the App Store Connect private key in Azure Key Vault instead of exporting it to release runners as a base64-encoded `.p8` secret.

## What changed

- Add a notarization client that creates notary-scoped Apple JWTs with a pinned Azure Key Vault key, submits and streams artifacts to Apple's notarization service, polls for completion, and saves developer diagnostics.
- Update the binary and DMG release wrappers to use the new client while continuing to staple accepted DMGs with `rcodesign`.
- Configure release jobs with the notarization vault key name and version instead of private-key material.

## Testing

- Add unit coverage for key validation, JWT signing, uploads, polling, diagnostic logs, and the binary and DMG wrapper contracts.

GitOrigin-RevId: 8f526c5691d774964fd33f847f8420cac0840b05

2026-08-05 20:31:46 +00:00

..

actions

Normalize rusty_v8 checksum manifest line endings (#36797)

2026-08-03 20:41:24 +00:00

codex

Fix minor typos in comments and documentation (#10287)

2026-01-30 22:11:02 -08:00

ISSUE_TEMPLATE

feat(cli): add codex doctor diagnostics (#22336)

2026-05-13 21:23:19 +00:00

scripts

Use Azure Key Vault for macOS notarization (#37154)

2026-08-05 20:31:46 +00:00

workflows

Use Azure Key Vault for macOS notarization (#37154)

2026-08-05 20:31:46 +00:00

blob-size-allowlist.txt

fix(guardian) Dont hard error on feature disable (#18795)

2026-04-20 19:54:39 -07:00

CODEOWNERS

Expand agent core ownership (#31675)

2026-07-08 18:04:44 -07:00

codex-cli-splash.png

Replaced user documentation with links to developers docs site (#8662)

2026-01-02 13:01:53 -07:00

dependabot.yaml

[codex] Apply a Dependabot cooldown of 7 days (#21599)

2026-05-07 16:07:46 -07:00

dotslash-argument-comment-lint-config.json

Publish runnable DotSlash package for argument-comment lint (#15198)

2026-03-19 18:59:02 +00:00

dotslash-config.json

dotslash: publish Codex entrypoints from package archives (#23638)

2026-05-20 12:18:10 -07:00

dotslash-zsh-config.json

release: publish standalone zsh artifacts (#30114)

2026-06-25 13:56:08 -07:00

pull_request_template.md

Clarify PR template invitation requirement (#19912)

2026-04-27 21:45:15 -07:00