mirror of
https://github.com/openai/codex.git
synced 2026-11-13 21:30:47 +00:00
Dmitriy Kovalenko
4490060db6
## What changed - Authenticate eligible protected `main` runs and Rust release tags with GitHub OIDC. Allow cache uploads only on `main` pushes; use read-only access for manual runs and release tags, and leave pull requests without GCS credentials. - Rename the shared wrapper to `.github/scripts/run_bazel.py` and route Bazel callers through it. Disable the disk cache in GitHub Actions and default macOS GCS connections to 20 while respecting explicit limits. - Gate additional Bazel release artifacts on `CODEX_BAZEL_RELEASES` and cache configuration, sharing the selected build systems across building, signing, and packaging. Keep Cargo as the default and prepare native Windows dependencies for Bazel releases. - Add a `Bazel result` check for the full workflow and extend Bazel job timeouts. ## Testing Add wrapper tests for cache access by event, argument preservation, and macOS connection limits. The wrapper test suite passes. GitOrigin-RevId: d85edbd083acfaa8bafaa8fd5241daed3e9ef871
43 lines
1.1 KiB
Bash
Executable File
43 lines
1.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
# Run target-discovery queries with the same startup settings as the main
|
|
# build/test invocation so they can reuse the same Bazel server. Queries only
|
|
# enumerate labels, so they intentionally do not select a CI build/test config
|
|
# or remote execution.
|
|
|
|
if [[ $# -lt 2 || "${@: -2:1}" != "--" ]]; then
|
|
echo "Usage: $0 [<bazel query args>...] -- <query expression>" >&2
|
|
exit 1
|
|
fi
|
|
|
|
query_args=("${@:1:$#-2}")
|
|
query_expression="${@: -1}"
|
|
|
|
run_bazel() {
|
|
if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
|
|
MSYS2_ARG_CONV_EXCL='*' "$(dirname "${BASH_SOURCE[0]}")/run_bazel.py" "$@"
|
|
return
|
|
fi
|
|
|
|
"$(dirname "${BASH_SOURCE[0]}")/run_bazel.py" "$@"
|
|
}
|
|
|
|
bazel_query_args=(query)
|
|
|
|
if [[ -n "${BAZEL_REPO_CONTENTS_CACHE:-}" ]]; then
|
|
bazel_query_args+=("--repo_contents_cache=${BAZEL_REPO_CONTENTS_CACHE}")
|
|
fi
|
|
|
|
if [[ -n "${BAZEL_REPOSITORY_CACHE:-}" ]]; then
|
|
bazel_query_args+=("--repository_cache=${BAZEL_REPOSITORY_CACHE}")
|
|
fi
|
|
|
|
if (( ${#query_args[@]} > 0 )); then
|
|
bazel_query_args+=("${query_args[@]}")
|
|
fi
|
|
bazel_query_args+=("$query_expression")
|
|
|
|
run_bazel "${bazel_query_args[@]}"
|