tarunoai ac54a05173 Add a Signer Service backend for macOS notarization (#60695) ...

## What changed

Allow `APPLE_NOTARIZATION_BACKEND=signer-service` to sign Apple notarization JWTs through `grpcurl`, using GitHub OIDC authentication. Validate the returned signing key and algorithm, and redact transport and signing failure details.

Keep Azure Key Vault as the default backend and skip its configuration requirements when Signer Service is selected.

## Testing

Add coverage for JWT refresh with fresh OIDC tokens and for the binary wrapper running without Azure configuration. All six notarization tests pass.

GitOrigin-RevId: e38ea90e94639d87c11ab075c999d85b61b37c17

2026-11-11 00:58:44 +00:00

..

fixtures

Remove Bazel outputs from DotSlash release configs (#58757)

2026-11-01 20:41:58 +00:00

macos-signing

Add a Signer Service backend for macOS notarization (#60695)

2026-11-11 00:58:44 +00:00

archive-release-symbols-and-strip-binaries.sh

[codex] Restore release symbol artifacts with line tables (#26202)

2026-06-08 17:16:36 +00:00

build-codex-package-archive.sh

Ship the standalone executor in release packages (#57837)

2026-10-28 21:09:05 +00:00

check_ci_results.py

[codex] group blocking and postmerge CI workflows (#30146)

2026-06-26 15:07:05 -07:00

compute-bazel-windows-path.ps1

Consolidate Bazel CI setup into prepare-bazel-ci (#56222)

2026-10-22 17:09:38 +00:00

contract_releases.py

Extend GitHub release read retries and add jitter (#57796)

2026-10-28 17:50:33 +00:00

install-musl-build-tools.sh

Pack relative relocations in x86-64 musl release builds (#59805)

2026-11-06 03:09:21 +00:00

install-musl-openssl.sh

Use OpenSSL 3.6.4 for musl builds (#45149)

2026-09-13 01:19:53 +00:00

npm_alpha_tag.py

Prevent stable release pointers from moving backward (#51186)

2026-10-05 22:19:18 +00:00

publish_r2_release.py

Skip stable installer alias publishing for prereleases (#51425)

2026-10-06 17:25:28 +00:00

publish-github-release.sh

Delete incomplete prereleases by release ID (#59903)

2026-11-06 12:52:36 +00:00

releases.py

Prevent stable release pointers from moving backward (#51186)

2026-10-05 22:19:18 +00:00

resolve_exec_server_releases.py

Resolve stable releases dynamically for exec-server compatibility tests (#54623)

2026-10-16 14:49:23 +00:00

resolve_python_cli_release.py

Publish Python packages after stable CLI releases (#44067)

2026-09-09 05:39:52 +00:00

run_bazel_with_buildbuddy.py

Run Bazel CI locally without BuildBuddy credentials (#59055)

2026-11-03 04:08:59 +00:00

run-argument-comment-lint-bazel.sh

Run Bazel CI locally without BuildBuddy credentials (#59055)

2026-11-03 04:08:59 +00:00

run-bazel-ci.sh

Run Bazel CI locally without BuildBuddy credentials (#59055)

2026-11-03 04:08:59 +00:00

run-bazel-query-ci.sh

[codex] Keep Bazel startup options stable across commands (#26256)

2026-06-04 20:23:37 -07:00

rusty_v8_bazel.py

Enforce V8 artifact profiles at Bazel target boundaries (#57165)

2026-10-26 17:56:15 +00:00

rusty_v8_module_bazel.py

CI: Customize v8 building (#22086)

2026-05-18 21:33:05 -07:00

select_windows_bazel_targets.py

Balance Windows Bazel test shards using duration estimates (#49103)

2026-09-28 23:52:19 +00:00

setup-dev-drive.ps1

ci: route build IO through Dev Drives (#31357)

2026-07-08 14:06:37 -07:00

setup-voice-windows.ps1

Bundle native voice runtimes in Windows releases (#44922)

2026-09-11 21:59:24 +00:00

test_contract_releases.py

Resolve stable releases dynamically for exec-server compatibility tests (#54623)

2026-10-16 14:49:23 +00:00

test_macos_signing_entitlements.py

fix(release): add missing Intel V8 signing entitlement (#30953)

2026-07-07 16:47:21 +00:00

test_releases.py

Delete incomplete prereleases by release ID (#59903)

2026-11-06 12:52:36 +00:00

test_resolve_python_cli_release.py

Publish Python packages after stable CLI releases (#44067)

2026-09-09 05:39:52 +00:00

test_run_bazel_with_buildbuddy.py

Run Bazel CI locally without BuildBuddy credentials (#59055)

2026-11-03 04:08:59 +00:00

test_rusty_v8_bazel.py

Run Bazel CI locally without BuildBuddy credentials (#59055)

2026-11-03 04:08:59 +00:00

test_select_windows_bazel_targets.py

Balance Windows Bazel test shards using duration estimates (#49103)

2026-09-28 23:52:19 +00:00

test_v8_canary_changes.py

Upgrade V8 to 152.2.0 and backport Array.sort safety guards (#54519)

2026-10-16 06:06:54 +00:00

test_verify_pypi_release.py

Gate Python SDK publishing on runtime availability and verify PyPI files (#44055)

2026-09-09 04:47:38 +00:00

test_voice_cygwin_inputs.py

Bundle native voice runtimes in Windows releases (#44922)

2026-09-11 21:59:24 +00:00

v8_canary_changes.py

Generate Rust bindings that match Bazel-built V8 archives (#57644)

2026-10-28 04:48:23 +00:00

verify_bazel_clippy_lints.py

ci: sync Bazel clippy lints and fix uncovered violations (#16351)

2026-03-31 17:09:48 -07:00

verify_cargo_workspace_manifests.py

Format all Rust sources and clean up repository checks (#57314)

2026-10-27 00:23:39 +00:00

verify_pypi_release.py

Gate Python SDK publishing on runtime availability and verify PyPI files (#44055)

2026-09-09 04:47:38 +00:00

verify_tui_core_boundary.py

Format Python scripts across the repository (#42109)

2026-09-01 17:47:29 +00:00

voice_windows_tools.py

Stabilize Windows voice build cache keys across tool reinstalls (#50046)

2026-10-01 17:27:30 +00:00

voice-cygwin-inputs.py

Bundle native voice runtimes in Windows releases (#44922)

2026-09-11 21:59:24 +00:00

voice-cygwin-snapshot.json

Bundle native voice runtimes in Windows releases (#44922)

2026-09-11 21:59:24 +00:00

watch_voice_bazel.py

Bundle native voice runtimes in Windows releases (#44922)

2026-09-11 21:59:24 +00:00

windows_bazel_test_durations.tsv

Extract shared message-board code into codex-message-board (#55970)

2026-10-21 19:34:51 +00:00