From 5f60b013524c6fbdc597417c15c1e1ee96244176 Mon Sep 17 00:00:00 2001 From: Shijie Rao Date: Sun, 31 May 2026 14:56:06 -0700 Subject: [PATCH] Add build_unsigned_archive release mode (#25435) ## Why We want a manual mode that produces the full packaged unsigned macOS Codex archive, including bundled resources like `rg`, without mixing those archives into the signing and publishing flow. The existing `build_unsigned` mode is the handoff used by external signing and `promote_signed`, so archive-only inspection and local packaging should live in a separate mode and artifact namespace. ## What Changed - added `build_unsigned_archive` as a new manual `release_mode` - kept the existing `build` matrix running for that mode instead of introducing a separate archive-only job - wrote unsigned macOS package archives to `codex-rs/unsigned-archive-dist/...` instead of the normal `dist/...` tree - uploaded those packaged macOS outputs as dedicated `*-unsigned-archive` workflow artifacts - kept `build_unsigned` and `promote_signed` on their existing raw unsigned binary path ## Validation - parsed `.github/workflows/rust-release.yml` with `ruby -e 'require "yaml"; YAML.load_file(".github/workflows/rust-release.yml")'` - ran `git diff --check -- .github/workflows/rust-release.yml` - reviewed the workflow diff to confirm `build_unsigned_archive` now reuses the existing `build` job while isolating the unsigned macOS package archives under dedicated artifact names - locally verified the package builder layout against unsigned macOS binaries to confirm the packaged archive contains `bin/codex`, `codex-path/rg`, and `codex-resources/zsh/bin/zsh` --- .github/workflows/rust-release.yml | 46 +++++++++++++++++++++++------- 1 file changed, 35 insertions(+), 11 deletions(-) diff --git a/.github/workflows/rust-release.yml b/.github/workflows/rust-release.yml index 07a2e87ef..1d53cb320 100644 --- a/.github/workflows/rust-release.yml +++ b/.github/workflows/rust-release.yml @@ -10,7 +10,9 @@ # archive as a GitHub Release asset, then manually dispatch # `release_mode=promote_signed` with `unsigned_run_id` and `signed_macos_asset`. # The signed handoff archive should contain target or artifact directories such -# as `aarch64-apple-darwin/` with signed binaries. +# as `aarch64-apple-darwin/` with signed binaries. To inspect packaged unsigned +# macOS archives without publishing them, manually dispatch +# `release_mode=build_unsigned_archive`. name: rust-release on: @@ -20,12 +22,13 @@ on: workflow_dispatch: inputs: release_mode: - description: "build_unsigned creates unsigned macOS handoff artifacts; promote_signed finishes a release from signed macOS handoff artifacts." + description: "build_unsigned creates unsigned macOS handoff artifacts; build_unsigned_archive uploads packaged unsigned macOS archives as run artifacts only; promote_signed finishes a release from signed macOS handoff artifacts." required: false type: choice default: build_unsigned options: - build_unsigned + - build_unsigned_archive - promote_signed sign_macos: description: "Deprecated compatibility input; use release_mode instead." @@ -71,7 +74,7 @@ jobs: case "${RELEASE_MODE}" in signed) if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then - echo "❌ Manual rust-release runs must use release_mode=build_unsigned or release_mode=promote_signed" + echo "❌ Manual rust-release runs must use release_mode=build_unsigned, build_unsigned_archive, or promote_signed" exit 1 fi ;; @@ -81,6 +84,12 @@ jobs: exit 1 fi ;; + build_unsigned_archive) + if [[ "${GITHUB_EVENT_NAME}" != "workflow_dispatch" ]]; then + echo "❌ release_mode=build_unsigned_archive is only valid for manual runs" + exit 1 + fi + ;; promote_signed) if [[ "${GITHUB_EVENT_NAME}" != "workflow_dispatch" ]]; then echo "❌ release_mode=promote_signed is only valid for manual runs" @@ -110,7 +119,7 @@ jobs: esac if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${REQUESTED_SIGN_MACOS}" == "true" ]]; then - echo "::warning title=Deprecated sign_macos input ignored::Use release_mode=build_unsigned or release_mode=promote_signed instead." + echo "::warning title=Deprecated sign_macos input ignored::Use release_mode=build_unsigned, build_unsigned_archive, or promote_signed instead." fi # 1. Must be a tag and match the regex @@ -149,6 +158,7 @@ jobs: # 2026-03-04: temporarily change releases to use thin LTO because # Ubuntu ARM is timing out at 60 minutes. CARGO_PROFILE_RELEASE_LTO: ${{ contains(github.ref_name, '-alpha') && 'thin' || 'thin' }} + RELEASE_MODE: ${{ github.event_name == 'workflow_dispatch' && inputs.release_mode || 'signed' }} SIGN_MACOS: ${{ github.event_name != 'workflow_dispatch' }} strategy: @@ -324,7 +334,7 @@ jobs: path: codex-rs/target/**/cargo-timings/cargo-timing.html if-no-files-found: warn - - if: ${{ runner.os == 'macOS' && env.SIGN_MACOS != 'true' }} + - if: ${{ runner.os == 'macOS' && env.RELEASE_MODE == 'build_unsigned' }} name: Stage unsigned macOS artifacts shell: bash run: | @@ -349,7 +359,7 @@ jobs: zstd -T0 -19 --rm "${unsigned_path}" done - - if: ${{ runner.os == 'macOS' && env.SIGN_MACOS != 'true' }} + - if: ${{ runner.os == 'macOS' && env.RELEASE_MODE == 'build_unsigned' }} name: Upload unsigned macOS artifacts uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: @@ -463,18 +473,31 @@ jobs: fi - name: Build Codex package archive - if: ${{ runner.os != 'macOS' || env.SIGN_MACOS == 'true' }} + if: ${{ runner.os != 'macOS' || env.SIGN_MACOS == 'true' || env.RELEASE_MODE == 'build_unsigned_archive' }} shell: bash env: TARGET: ${{ matrix.target }} BUNDLE: ${{ matrix.bundle }} run: | set -euo pipefail + archive_dir="dist/${TARGET}" + if [[ "${RUNNER_OS}" == "macOS" && "${RELEASE_MODE}" == "build_unsigned_archive" ]]; then + archive_dir="unsigned-archive-dist/${TARGET}" + fi bash "${GITHUB_WORKSPACE}/.github/scripts/build-codex-package-archive.sh" \ --target "$TARGET" \ --bundle "$BUNDLE" \ --entrypoint-dir "target/${TARGET}/release" \ - --archive-dir "dist/${TARGET}" + --archive-dir "$archive_dir" + + - name: Upload unsigned macOS package archives + if: ${{ runner.os == 'macOS' && env.RELEASE_MODE == 'build_unsigned_archive' }} + uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + with: + name: ${{ matrix.artifact_name }}-unsigned-archive + path: | + codex-rs/unsigned-archive-dist/${{ matrix.target }}/* + if-no-files-found: error - name: Build Python runtime wheel if: ${{ matrix.bundle == 'primary' && (runner.os != 'macOS' || env.SIGN_MACOS == 'true') }} @@ -813,7 +836,7 @@ jobs: codex-rs/dist/${{ matrix.target }}/* build-windows: - if: ${{ github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed' }} + if: ${{ github.event_name != 'workflow_dispatch' || (inputs.release_mode != 'promote_signed' && inputs.release_mode != 'build_unsigned_archive') }} needs: tag-check uses: ./.github/workflows/rust-release-windows.yml with: @@ -821,7 +844,7 @@ jobs: secrets: inherit argument-comment-lint-release-assets: - if: ${{ github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed' }} + if: ${{ github.event_name != 'workflow_dispatch' || (inputs.release_mode != 'promote_signed' && inputs.release_mode != 'build_unsigned_archive') }} name: argument-comment-lint release assets needs: tag-check uses: ./.github/workflows/rust-release-argument-comment-lint.yml @@ -829,7 +852,7 @@ jobs: publish: true zsh-release-assets: - if: ${{ github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed' }} + if: ${{ github.event_name != 'workflow_dispatch' || (inputs.release_mode != 'promote_signed' && inputs.release_mode != 'build_unsigned_archive') }} name: zsh release assets needs: tag-check uses: ./.github/workflows/rust-release-zsh.yml @@ -858,6 +881,7 @@ jobs: ) || ( (github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed') && + (github.event_name != 'workflow_dispatch' || inputs.release_mode != 'build_unsigned_archive') && needs.build.result == 'success' && needs.stage-signed-macos.result == 'skipped' && needs.build-windows.result == 'success' &&