mirror of https://github.com/openai/codex.git synced 2026-09-14 11:57:03 +00:00

Files

Benjamin Carlsson ce7fbb373b Bundle native voice runtimes in Windows releases (#44922 )

## Why

Windows release packages need the voice helper and native audio libraries. Realtime TLS connections on fresh Windows installations also need platform certificate validation so Windows can retrieve missing trusted roots on demand.

## What changed

- Build and sign the voice helper and audio DLLs for Windows x64 and ARM64, bundle a pinned Microsoft CRT DLL, and verify signatures and runtime receipts before packaging.
- Add verified, pinned Cygwin and native build tools plus MSVC linker, compiler, and path handling fixes for the Windows Bazel builds.
- Include voice resources in primary release archives and WinGet packages. Preserve WinGet executable names, update manifest hashes, and recognize the package root through matching entrypoint metadata. Keep Python runtime wheels voice-free to preserve their existing Windows support floor.
- Use Windows platform TLS validation for realtime WebSockets when no custom CA bundle is configured, preserving custom CA behavior.

## Testing

Add coverage for build-input integrity and unsafe paths, signed Windows runtime assembly, WinGet file and hash preservation, package discovery, and TLS trust selection, untrusted certificate rejection, and hostname validation.

GitOrigin-RevId: 423da35872fa5549d69fd4ca97d922bb49599386

2026-09-11 21:59:24 +00:00

bazel.yml

Run required CI against pull request merge commits (#38051 )

2026-08-11 18:31:31 +00:00

blob-size-policy.yml

Run required CI against pull request merge commits (#38051 )

2026-08-11 18:31:31 +00:00

blocking-ci.yml

Run required CI against pull request merge commits (#38051 )

2026-08-11 18:31:31 +00:00

cargo-deny.yml

Run required CI against pull request merge commits (#38051 )

2026-08-11 18:31:31 +00:00

cla.yml

[codex] Pin GitHub Actions workflow references (#15828 )

2026-03-27 23:00:05 +00:00

close-stale-contributor-prs.yml

[codex] Fully qualify hash-pins in GitHub Actions (#21436 )

2026-05-07 14:31:20 -07:00

codespell.yml

Run required CI against pull request merge commits (#38051 )

2026-08-11 18:31:31 +00:00

Dockerfile.bazel

Remove js_repl feature (#19410 )

2026-04-24 17:49:29 -07:00

issue-deduplicator.yml

ci: use issue triage environment for issue workflows (#25134 )

2026-05-29 12:06:55 -07:00

issue-labeler.yml

[codex] auto-label AWS Bedrock issues (#30607 )

2026-06-29 11:10:38 -07:00

issue-translator.yml

Translate non-English issues (#27778 )

2026-06-11 23:20:36 -07:00

postmerge-ci.yml

[codex] group blocking and postmerge CI workflows (#30146 )

2026-06-26 15:07:05 -07:00

python-runtime-build.yml

Publish Python packages after stable CLI releases (#44067 )

2026-09-09 05:39:52 +00:00

python-runtime-release.yml

Build Python SDK artifacts before publishing the runtime (#44061 )

2026-09-09 05:14:27 +00:00

python-sdk-build.yml

Publish Python packages after stable CLI releases (#44067 )

2026-09-09 05:39:52 +00:00

python-sdk-cli-release.yml

Publish Python packages after stable CLI releases (#44067 )

2026-09-09 05:39:52 +00:00

python-sdk-release.yml

Build Python SDK artifacts before publishing the runtime (#44061 )

2026-09-09 05:14:27 +00:00

r2-release.yml

Parallelize R2 asset publishing with DotSlash (#36871 )

2026-08-04 10:05:24 +00:00

README.md

Run required CI against pull request merge commits (#38051 )

2026-08-11 18:31:31 +00:00

repo-checks.yml

Add opt-in provisioned macOS CLI release candidates (#44307 )

2026-09-09 21:28:49 +00:00

rust-ci-full-nextest-platform.yml

Add opt-in local audio devices to the voice helper (#43079 )

2026-09-05 19:11:52 +00:00

rust-ci-full.yml

Add opt-in local audio devices to the voice helper (#43079 )

2026-09-05 19:11:52 +00:00

rust-ci.yml

Clarify comments in CI setup and the Rust workflow (#43070 )

2026-09-05 18:16:09 +00:00

rust-release-argument-comment-lint.yml

ci: template custom runner names by repo (#27024 )

2026-06-08 11:47:23 -07:00

rust-release-prepare.yml

Exclude base instructions from the bundled model catalog (#43604 )

2026-09-07 22:11:52 +00:00

rust-release-provisioned-macos.yml

Add opt-in provisioned macOS CLI release candidates (#44307 )

2026-09-09 21:28:49 +00:00

rust-release-windows.yml

Bundle native voice runtimes in Windows releases (#44922 )

2026-09-11 21:59:24 +00:00

rust-release-zsh.yml

release: publish standalone zsh artifacts (#30114 )

2026-06-25 13:56:08 -07:00

rust-release.yml

Bundle Linux voice runtimes and improve audio reliability (#44714 )

2026-09-11 03:16:01 +00:00

rusty-v8-release.yml

Pin V8 release manifests and prevent published release replacement (#43444 )

2026-09-07 11:55:57 +00:00

sdk.yml

Test Python SDK against the built CLI and installed runtime (#44053 )

2026-09-09 04:40:22 +00:00

v8-canary.yml

Pin V8 release manifests and prevent published release replacement (#43444 )

2026-09-07 11:55:57 +00:00

zstd

ci(windows): use DotSlash for zstd in rust-release-windows (#11542 )

2026-02-11 20:57:11 -08:00

README.md

Workflow Strategy

The workflows in this directory are split so that pull requests get fast, review-friendly signal while main still gets the full cross-platform verification pass.

Pull Requests

Required checks run against GitHub's synthetic merge commit, not the pull request head alone. This includes changes already on main and catches conflicts before they reach the branch.
bazel.yml is the main pre-merge verification path for Rust code. It runs Bazel test and Bazel clippy on the supported Bazel targets, including the generated Rust test binaries needed to lint inline #[cfg(test)] code.
rust-ci.yml keeps the Cargo-native PR checks intentionally small:
- cargo fmt --check
- cargo shear
- argument-comment-lint on Linux, macOS, and Windows
- tools/argument-comment-lint package tests when the lint or its workflow wiring changes

Post-Merge On `main`

bazel.yml also runs on pushes to main. This re-verifies the merged Bazel path and helps keep the BuildBuddy caches warm.
rust-ci-full.yml is the full Cargo-native verification workflow. It keeps the heavier checks off the PR path while still validating them after merge:
- the full Cargo clippy matrix
- the full Cargo nextest matrix via per-platform archive-backed shards
- Windows ARM64 nextest archives cross-compiled on Windows x64, then replayed on native Windows ARM64 shards
- release-profile Cargo builds
- cross-platform argument-comment-lint
- Linux remote-env tests

Rule Of Thumb

If a build/test/clippy check can be expressed in Bazel, prefer putting the PR-time version in bazel.yml.
Keep rust-ci.yml fast enough that it usually does not dominate PR latency.
Reserve rust-ci-full.yml for heavyweight Cargo-native coverage that Bazel does not replace yet.

README.md

Workflow Strategy

Pull Requests

Post-Merge On main

Rule Of Thumb

Post-Merge On `main`