mirror of
https://github.com/openai/codex.git
synced 2026-10-19 17:28:46 +00:00
Eric Burke
45eec73b11
## What changed - Add a tag-release workflow gated by `CODEX_PROVISIONED_MACOS_CANDIDATE` for Apple Silicon and Intel macOS candidate artifacts. - Package the CLI in `CodexCLI.app` with an embedded provisioning profile and a relocatable `bin/codex` launcher. Validate independently supplied profile, certificate, and team expectations before signing. - Sign and notarize candidates, then verify signatures, entitlements, architecture, stapling, and Gatekeeper acceptance on macOS. Retain verified artifacts after package smoke tests pass. - Filter code-mode smoke-test requests to `/v1/responses` so analytics requests are excluded from response parsing. ## Testing Add tests for profile validation, launcher relocation and symlink handling, standard and provisioned signing flows, and rejection of signing, notarization, identity, and entitlement failures. The candidate workflow runs package smoke tests, including sandboxed code mode. GitOrigin-RevId: f214f6a23dd10df62cd72a2c63c20cb0864fbc9c
76 lines
2.5 KiB
YAML
76 lines
2.5 KiB
YAML
name: repo-checks
|
|
|
|
on:
|
|
workflow_call:
|
|
|
|
jobs:
|
|
build-test:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
env:
|
|
NODE_OPTIONS: --max-old-space-size=4096
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: ./.github/actions/setup-ci
|
|
|
|
- name: Verify codex-rs Cargo manifests inherit workspace settings
|
|
run: python3 .github/scripts/verify_cargo_workspace_manifests.py
|
|
|
|
- name: Verify codex-tui does not import codex-core directly
|
|
run: python3 .github/scripts/verify_tui_core_boundary.py
|
|
|
|
- name: Verify Bazel clippy flags match Cargo workspace lints
|
|
run: python3 .github/scripts/verify_bazel_clippy_lints.py
|
|
|
|
- name: Install uv
|
|
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
|
|
with:
|
|
version: "0.11.3"
|
|
|
|
- name: Test downstream Python release resolution
|
|
run: python3 -m unittest discover -s .github/scripts -p 'test_resolve_python_cli_release.py'
|
|
|
|
- name: Test PyPI release verification
|
|
run: uv run --no-project --with packaging==26.2 python -m unittest discover -s .github/scripts -p 'test_verify_pypi_release.py'
|
|
|
|
- name: Test Codex package builder
|
|
run: python3 -m unittest discover -s scripts/codex_package -p 'test_*.py'
|
|
|
|
- name: Test standalone installer
|
|
run: python3 -m unittest discover -s scripts/install -p 'test_*.py'
|
|
|
|
- name: Test macOS signing and notarization
|
|
run: python3 -m unittest discover -s .github/scripts/macos-signing -p 'test_*.py'
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@a8198c4bff370c8506180b035930dea56dbd5288 # v5
|
|
with:
|
|
run_install: false
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
|
|
with:
|
|
node-version: 22
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Ensure root README.md contains only ASCII and certain Unicode code points
|
|
run: ./scripts/asciicheck.py README.md
|
|
- name: Check root README ToC
|
|
run: python3 scripts/readme_toc.py README.md
|
|
|
|
- name: Check formatting (run `just fmt` to fix)
|
|
run: just fmt-check
|
|
|
|
- name: Prettier (run `pnpm run format:fix` to fix)
|
|
run: pnpm run format
|
|
|
|
- name: Check for a clean worktree
|
|
if: always() && !cancelled()
|
|
uses: ./.github/actions/check-clean-worktree
|