agent/codex
2
0
Fork 0
mirror of https://github.com/pchuan98/codex.git synced 2026-07-01 00:31:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add build_unsigned_archive release mode (#25435)

Browse Source 
## Why
We want a manual mode that produces the full packaged unsigned macOS
Codex archive, including bundled resources like `rg`, without mixing
those archives into the signing and publishing flow.

The existing `build_unsigned` mode is the handoff used by external
signing and `promote_signed`, so archive-only inspection and local
packaging should live in a separate mode and artifact namespace.

## What Changed
- added `build_unsigned_archive` as a new manual `release_mode`
- kept the existing `build` matrix running for that mode instead of
introducing a separate archive-only job
- wrote unsigned macOS package archives to
`codex-rs/unsigned-archive-dist/...` instead of the normal `dist/...`
tree
- uploaded those packaged macOS outputs as dedicated
`*-unsigned-archive` workflow artifacts
- kept `build_unsigned` and `promote_signed` on their existing raw
unsigned binary path

## Validation
- parsed `.github/workflows/rust-release.yml` with `ruby -e 'require
"yaml"; YAML.load_file(".github/workflows/rust-release.yml")'`
- ran `git diff --check -- .github/workflows/rust-release.yml`
- reviewed the workflow diff to confirm `build_unsigned_archive` now
reuses the existing `build` job while isolating the unsigned macOS
package archives under dedicated artifact names
- locally verified the package builder layout against unsigned macOS
binaries to confirm the packaged archive contains `bin/codex`,
`codex-path/rg`, and `codex-resources/zsh/bin/zsh`
This commit is contained in:
Shijie Rao
2026-05-31 14:56:06 -07:00
committed by GitHub
Unverified
parent e93dc98a48
commit 5f60b01352
1 changed files with 35 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/rust-release.yml
+35 -11
View File
@@ -10,7 +10,9 @@
# archive as a GitHub Release asset, then manually dispatch
# `release_mode=promote_signed` with `unsigned_run_id` and `signed_macos_asset`.
# The signed handoff archive should contain target or artifact directories such
# as `aarch64-apple-darwin/` with signed binaries.
# as `aarch64-apple-darwin/` with signed binaries. To inspect packaged unsigned
# macOS archives without publishing them, manually dispatch
# `release_mode=build_unsigned_archive`.
name: rust-release
on:
@@ -20,12 +22,13 @@ on:
workflow_dispatch:
inputs:
release_mode:
description: "build_unsigned creates unsigned macOS handoff artifacts; promote_signed finishes a release from signed macOS handoff artifacts."
description: "build_unsigned creates unsigned macOS handoff artifacts; build_unsigned_archive uploads packaged unsigned macOS archives as run artifacts only; promote_signed finishes a release from signed macOS handoff artifacts."
required: false
type: choice
default: build_unsigned
options:
- build_unsigned
- build_unsigned_archive
- promote_signed
sign_macos:
description: "Deprecated compatibility input; use release_mode instead."
@@ -71,7 +74,7 @@ jobs:
case "${RELEASE_MODE}" in
signed)
if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
echo "❌ Manual rust-release runs must use release_mode=build_unsigned or release_mode=promote_signed"
echo "❌ Manual rust-release runs must use release_mode=build_unsigned, build_unsigned_archive, or promote_signed"
exit 1
fi
;;
@@ -81,6 +84,12 @@ jobs:
exit 1
fi
;;
build_unsigned_archive)
if [[ "${GITHUB_EVENT_NAME}" != "workflow_dispatch" ]]; then
echo "❌ release_mode=build_unsigned_archive is only valid for manual runs"
exit 1
fi
;;
promote_signed)
if [[ "${GITHUB_EVENT_NAME}" != "workflow_dispatch" ]]; then
echo "❌ release_mode=promote_signed is only valid for manual runs"
@@ -110,7 +119,7 @@ jobs:
esac
if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${REQUESTED_SIGN_MACOS}" == "true" ]]; then
echo "::warning title=Deprecated sign_macos input ignored::Use release_mode=build_unsigned or release_mode=promote_signed instead."
echo "::warning title=Deprecated sign_macos input ignored::Use release_mode=build_unsigned, build_unsigned_archive, or promote_signed instead."
fi
# 1. Must be a tag and match the regex
@@ -149,6 +158,7 @@ jobs:
# 2026-03-04: temporarily change releases to use thin LTO because
# Ubuntu ARM is timing out at 60 minutes.
CARGO_PROFILE_RELEASE_LTO: ${{ contains(github.ref_name, '-alpha') && 'thin' || 'thin' }}
RELEASE_MODE: ${{ github.event_name == 'workflow_dispatch' && inputs.release_mode || 'signed' }}
SIGN_MACOS: ${{ github.event_name != 'workflow_dispatch' }}
strategy:
@@ -324,7 +334,7 @@ jobs:
path: codex-rs/target/**/cargo-timings/cargo-timing.html
if-no-files-found: warn
- if: ${{ runner.os == 'macOS' && env.SIGN_MACOS != 'true' }}
- if: ${{ runner.os == 'macOS' && env.RELEASE_MODE == 'build_unsigned' }}
name: Stage unsigned macOS artifacts
shell: bash
run: |
@@ -349,7 +359,7 @@ jobs:
zstd -T0 -19 --rm "${unsigned_path}"
done
- if: ${{ runner.os == 'macOS' && env.SIGN_MACOS != 'true' }}
- if: ${{ runner.os == 'macOS' && env.RELEASE_MODE == 'build_unsigned' }}
name: Upload unsigned macOS artifacts
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
with:
@@ -463,18 +473,31 @@ jobs:
fi
- name: Build Codex package archive
if: ${{ runner.os != 'macOS' || env.SIGN_MACOS == 'true' }}
if: ${{ runner.os != 'macOS' || env.SIGN_MACOS == 'true' || env.RELEASE_MODE == 'build_unsigned_archive' }}
shell: bash
env:
TARGET: ${{ matrix.target }}
BUNDLE: ${{ matrix.bundle }}
run: |
set -euo pipefail
archive_dir="dist/${TARGET}"
if [[ "${RUNNER_OS}" == "macOS" && "${RELEASE_MODE}" == "build_unsigned_archive" ]]; then
archive_dir="unsigned-archive-dist/${TARGET}"
fi
bash "${GITHUB_WORKSPACE}/.github/scripts/build-codex-package-archive.sh" \
--target "$TARGET" \
--bundle "$BUNDLE" \
--entrypoint-dir "target/${TARGET}/release" \
--archive-dir "dist/${TARGET}"
--archive-dir "$archive_dir"
- name: Upload unsigned macOS package archives
if: ${{ runner.os == 'macOS' && env.RELEASE_MODE == 'build_unsigned_archive' }}
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
with:
name: ${{ matrix.artifact_name }}-unsigned-archive
path: |
codex-rs/unsigned-archive-dist/${{ matrix.target }}/*
if-no-files-found: error
- name: Build Python runtime wheel
if: ${{ matrix.bundle == 'primary' && (runner.os != 'macOS' || env.SIGN_MACOS == 'true') }}
@@ -813,7 +836,7 @@ jobs:
codex-rs/dist/${{ matrix.target }}/*
build-windows:
if: ${{ github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed' }}
if: ${{ github.event_name != 'workflow_dispatch' || (inputs.release_mode != 'promote_signed' && inputs.release_mode != 'build_unsigned_archive') }}
needs: tag-check
uses: ./.github/workflows/rust-release-windows.yml
with:
@@ -821,7 +844,7 @@ jobs:
secrets: inherit
argument-comment-lint-release-assets:
if: ${{ github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed' }}
if: ${{ github.event_name != 'workflow_dispatch' || (inputs.release_mode != 'promote_signed' && inputs.release_mode != 'build_unsigned_archive') }}
name: argument-comment-lint release assets
needs: tag-check
uses: ./.github/workflows/rust-release-argument-comment-lint.yml
@@ -829,7 +852,7 @@ jobs:
publish: true
zsh-release-assets:
if: ${{ github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed' }}
if: ${{ github.event_name != 'workflow_dispatch' || (inputs.release_mode != 'promote_signed' && inputs.release_mode != 'build_unsigned_archive') }}
name: zsh release assets
needs: tag-check
uses: ./.github/workflows/rust-release-zsh.yml
@@ -858,6 +881,7 @@ jobs:
) ||
(
(github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed') &&
(github.event_name != 'workflow_dispatch' || inputs.release_mode != 'build_unsigned_archive') &&
needs.build.result == 'success' &&
needs.stage-signed-macos.result == 'skipped' &&
needs.build-windows.result == 'success' &&