22 Commits

• [codex] group blocking and postmerge CI workflows (#30146)

  ## Why
  
  It's hard to change the set of required jobs when they're managed in the
  GitHub UI, and when each workflow is responsible for choosing it's own
  scheduling it's easy to end up with skew between what we enforce on PRs
  vs. on main.
  
  ## What
  
  - add a `blocking-ci` caller workflow, triggered by pull requests and
  pushes to `main`, for Bazel, blob size, cargo-deny, Codespell,
  `repo-checks`, rust CI, and SDK CI
  - add an `always()` terminal job named `CI required` that fails unless
  every called workflow succeeds
  - add a `postmerge-ci` caller workflow for `rust-ci-full` and
  `v8-canary`, with a terminal `Postmerge CI results` job
  - centralize V8 relevance detection in `v8_canary_changes.py`; unrelated
  PR and postmerge runs execute metadata only and skip the expensive build
  matrices
  - leave `v8-canary` outside the blocking gate and leave the external
  `cla` check independent
  
  ## Rollout
  
  A repository admin must replace the existing required GitHub Actions
  contexts with `CI required` in the main-branch ruleset. Retain `cla` as
  a separate required check. Until that change is coordinated, this PR
  cannot satisfy the old standalone check names. In-flight PRs will need
  to be rebased after this lands.

  Adam Perry @ OpenAI · 2026-06-26 15:07:05 -07:00
  1168254bd9
• ci: fail jobs that dirty the worktree (#29720)

  ## Why
  
  CI jobs should not silently leave tracked changes or untracked files in
  the repository worktree.
  
  ## What
  
  - Add a shared final worktree-cleanliness action to 19 checkout-bearing
  PR and main CI jobs.
  - Ignore the intentional SDK scratch directory and nested V8 checkout.
  - Pin Bazelisk in shared CI setup so `.bazelversion` remains
  authoritative, avoiding `MODULE.bazel.lock` deltas on Windows runners.
  - Leave `rust-ci-full` and release-only workflows unchanged.
  - Update `AGENTS.md` to discourage review bots from asking for
  `MODULE.bazel.lock` changes.

  Adam Perry @ OpenAI · 2026-06-24 11:06:35 -07:00
  93c79046d6
• Use dependency groups for Python SDK tooling (#27538)

  ## Summary
  
  `just fmt` previously used `uv run --with ruff` to make Ruff available.
  Because `--with` creates an ephemeral overlay outside the project
  lockfile, uv periodically re-resolved Ruff (by default every 10 minutes)
  instead of using the version recorded in `uv.lock`.
  
  Move the Python SDK tooling dependencies from the published `dev` extra
  into `format`, `test`, and composed `dev` dependency groups. The
  formatter now selects only the locked `format` group, contributor and CI
  setup explicitly sync the `dev` group, and CI and release commands reuse
  that environment with `--frozen --no-sync`. The scripts formatter also
  uses its project's locked Ruff dependency instead of an ephemeral
  overlay.
  
  Validated the Python 3.12 SDK suite (119 passed, 38 skipped) and the
  repository formatter.

  Charlie Marsh · 2026-06-12 16:10:07 +00:00
  c375deaf66
• ci: template custom runner names by repo (#27024)

  ## Why
  
  These workflows currently hard-code the `codex` runner group and custom
  runner labels. That makes the same workflow definitions less portable
  across repository copies or renamed repos, even though the runner fleet
  follows the repository name scheme. Template the runner identities from
  the repository name so `openai/codex` still resolves to the existing
  `codex-*` runners while other repos can use their own `<repo>-*` runner
  names.
  
  ## What Changed
  
  - Replaced custom runner `group` values such as `codex-runners` with
  `${{ github.event.repository.name }}-runners`.
  - Replaced custom runner labels such as `codex-linux-x64` and
  `codex-windows-arm64` with `${{ github.event.repository.name }}-...`.
  - Covered direct `runs-on` objects, matrix `runs_on` entries, reusable
  workflow runner inputs, and release runner labels.
  
  ## Verification
  
  - Parsed all `.github/workflows/*.yml` files as YAML with Ruby.
  - Searched `.github/workflows` to confirm no hardcoded runner-field
  `codex-runners` or `codex-*` labels remain.

  Michael Bolin · 2026-06-08 11:47:23 -07:00
  2375cb6449
• ci: use bazel environment for BuildBuddy secret (#26895)

  ## Why
  
  `BUILDBUDDY_API_KEY` now lives in the `bazel` GitHub Actions environment
  as an environment secret. Jobs that need BuildBuddy credentials must opt
  into that environment so `${{ secrets.BUILDBUDDY_API_KEY }}` resolves
  from the protected environment secret instead of relying on an unscoped
  repository/organization secret.
  
  This follows the same environment-secret migration pattern as #26466.
  
  ## What Changed
  
  - Attach each workflow job that reads `BUILDBUDDY_API_KEY` to the
  `bazel` environment.
  - Set `deployment: false` on those job-level environment blocks.
  
  `deployment: false` lets the job enter the `bazel` environment to access
  its environment secrets without creating GitHub deployment records for
  these CI jobs. That keeps the environment as a secret/access-control
  boundary without making ordinary Bazel CI runs look like deploys.
  
  ## Validation
  
  - Parsed the modified workflow YAML files with Ruby's YAML parser.
  - Checked the modified workflow files for trailing whitespace.

  Michael Bolin · 2026-06-07 09:24:54 -07:00
  2ee3358c00
• [codex] Pin Python SDK to glibc-compatible runtime (#25907)

  ## Summary
  - pin the Python SDK runtime package to `openai-codex-cli-bin==0.136.0`
  so Ubuntu/glibc installs resolve a compatible wheel
  - refresh generated SDK artifacts and lock data for the runtime update
  - keep newly generated client-message-id wire models internal to the
  generated protocol layer
  
  ## Dependency
  - merge #25906 first so the Python SDK release publishes both manylinux
  and musllinux runtime wheels before publishing the package with this pin
  
  ## Validation
  - ran `just fmt`
  - regenerated the Python public API helpers
  - validated the edited workflow YAML
  - CI passed 29/29 checks

  Ahmed Ibrahim · 2026-06-02 12:27:01 -07:00
  bc49677ec8
• [8/8] Add Python SDK Ruff formatting (#22021)

  ## Why
  
  The Python SDK needs the same tight formatter/lint loop as the rest of
  the repo: a safe Ruff autofix pass, Ruff formatting, editor save
  behavior, and CI checks that catch drift. Without that loop, SDK changes
  can land with formatting or import ordering that differs from what
  reviewers and CI expect.
  
  ## What
  
  - Add Ruff configuration to `sdk/python/pyproject.toml`, excluding
  generated protocol code and notebooks from the normal lint/format pass.
  - Update `just fmt` so it still formats Rust and also runs Python SDK
  Ruff autofix and formatting.
  - Add Python SDK CI steps for `ruff check` and `ruff format --check`
  before pytest.
  - Recommend the Ruff VS Code extension and enable Python
  format/fix/organize-on-save so Cmd+S uses the same tooling.
  - Apply the resulting Ruff formatting to SDK Python files, examples, and
  the checked-in generated `v2_all.py` output emitted by the pinned
  generator.
  - Add a guard test for the `just fmt` recipe so it keeps working from
  both Rust and Python SDK working directories.
  
  ## Stack
  
  1. #21891 `[1/8]` Pin Python SDK runtime dependency
  2. #21893 `[2/8]` Generate Python SDK types from pinned runtime
  3. #21895 `[3/8]` Run Python SDK tests in CI
  4. #21896 `[4/8]` Define Python SDK public API surface
  5. #21905 `[5/8]` Rename Python SDK package to `openai-codex`
  6. #21910 `[6/8]` Add high-level Python SDK approval mode
  7. #22014 `[7/8]` Add Python SDK app-server integration harness
  8. This PR `[8/8]` Add Python SDK Ruff formatting
  
  ## Verification
  
  - Added `test_root_fmt_recipe_formats_rust_and_python_sdk` for the
  shared format recipe.
  - Ran `just fmt` after the recipe update.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-05-12 01:10:29 +03:00
  aa9e8f0262
• [3/8] Run Python SDK tests in CI (#21895)

  ## Why
  
  The Python SDK stack now depends on packaging metadata, pinned runtime
  wheels, generated artifacts, async behavior, and stream interleaving.
  Those checks need to run in CI so future changes cannot bypass the SDK
  test suite.
  
  ## What
  
  - Add a dedicated `python-sdk` job to `.github/workflows/sdk.yml`.
  - Run the job in `python:3.12-alpine` so dependency resolution exercises
  the pinned musl runtime wheel.
  - Keep the Python SDK test job parallel to the existing SDK job instead
  of serializing the full workflow.
  
  ## Stack
  
  1. #21891 `[1/8]` Pin Python SDK runtime dependency
  2. #21893 `[2/8]` Generate Python SDK types from pinned runtime
  3. This PR `[3/8]` Run Python SDK tests in CI
  4. #21896 `[4/8]` Define Python SDK public API surface
  5. #21905 `[5/8]` Rename Python SDK package to `openai-codex`
  6. #21910 `[6/8]` Add high-level Python SDK approval mode
  7. #22014 `[7/8]` Add Python SDK app-server integration harness
  8. #22021 `[8/8]` Add Python SDK Ruff formatting
  
  ## Verification
  
  - The added workflow job installs the SDK with `uv sync --extra dev
  --frozen` and runs the Python SDK pytest suite.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-05-12 00:53:36 +03:00
  3e2936dd0e
• ci: check out PR head commits in workflows (#21835)

  ## Why
  
  PR CI should test the exact commit that was pushed to the PR branch. By
  default, GitHub's `pull_request` event checks out a synthetic merge
  commit from `refs/pull/<number>/merge`, so the tested tree can include
  an implicit merge with the current base branch instead of matching the
  pushed head SHA.
  
  Using the PR head SHA makes each check result correspond to a concrete
  commit the author submitted. This also behaves better for stacked PR
  workflows, including Sapling stacks and other Git stack tooling: a
  middle PR's head commit already contains the lower stack changes in its
  tree, without pulling in commits above it or GitHub's temporary merge
  ref.
  
  ## What Changed
  
  - Set every `actions/checkout` in `pull_request` workflows under
  `.github/workflows` to use `github.event.pull_request.head.sha` on PR
  events and `github.sha` otherwise.
  - Updated `blob-size-policy` to compare
  `github.event.pull_request.base.sha` and
  `github.event.pull_request.head.sha`, since it no longer checks out
  GitHub's merge commit where `HEAD^1`/`HEAD^2` represented the PR range.
  
  ## Verification
  
  - Parsed the edited workflow YAML files with Ruby.
  - Checked that every checkout block in the `pull_request` workflows has
  the PR-head `ref`.

  Michael Bolin · 2026-05-08 15:14:33 -07:00
  24111790f0
• [codex] Address some more GHA hygiene issues (#21622)

  This does two things:
  
  - We use `persist-credentials: false` everywhere now. This is
  unfortunately not the default in GitHub Actions, but it prevents
  `actions/checkout` from dropping `secrets.GITHUB_TOKEN` onto disk.
  - We interpose (some) template expansions through environment variables.
  I've limited this to contexts that have non-fixed values; contexts that
  are fixed (like `*.result`) are not dangerous to expand directly inline
  (but maybe we should clean those up in the future for consistency
  anyways).
  
  This is a medium-risk change in terms of CI breakage: I did a scan for
  usage of `git push` and other commands that implicitly use the persisted
  credential, but couldn't find any. Even still, some implicit usages of
  the persisted credentials may be lurking. Please ping ww@ if any issues
  arise.

  William Woodruff · 2026-05-08 10:19:27 -07:00
  8bea5d231a
• [codex] Fully qualify hash-pins in GitHub Actions (#21436)

  This builds on top of https://github.com/openai/codex/pull/15828 by
  ensuring that hash-pinned actions with version comments are fully
  qualified, rather than referencing floating/mutable comments like "v7".
  This makes actions management tools behave more consistently.
  
  This shouldn't break anything, since it's comment only. But if it does,
  ping ww@ 🙂

  William Woodruff · 2026-05-07 14:31:20 -07:00
  8abcc5357d
• ci: run SDK tests with a Bazel-built codex (#16046)

  ## Why
  
  Before this change, the SDK CI job built `codex` with Cargo before
  running the TypeScript package tests. That step has been getting more
  expensive as the Rust workspace grows, while the repo already has a
  Bazel-backed build path for the CLI.
  
  The SDK tests also need a normal executable path they can spawn
  repeatedly. Moving the job to Bazel exposed an extra CI detail: a plain
  `bazel-bin/...` lookup is not reliable under the Linux config because
  top-level outputs may stay remote and the wrapper emits status lines
  around `cquery` output.
  
  ## What Changed
  
  - taught `sdk/typescript/tests/testCodex.ts` to honor `CODEX_EXEC_PATH`
  before falling back to the local Cargo-style `target/debug/codex` path
  - added `--remote-download-toplevel` to
  `.github/scripts/run-bazel-ci.sh` so workflows can force Bazel to
  materialize top-level outputs on disk after a build
  - switched `.github/workflows/sdk.yml` from `cargo build --bin codex` to
  the shared Bazel CI setup and `//codex-rs/cli:codex` build target
  - changed the SDK workflow to resolve the built CLI with wrapper-backed
  `cquery --output=files`, stage the binary into
  `${GITHUB_WORKSPACE}/.tmp/sdk-ci/codex`, and point the SDK tests at that
  path via `CODEX_EXEC_PATH`
  - kept the warm-up step before Jest and the Bazel repository-cache save
  step
  
  ## Verification
  
  - `bash -n .github/scripts/run-bazel-ci.sh`
  - `./.github/scripts/run-bazel-ci.sh -- cquery --output=files --
  //codex-rs/cli:codex | grep -E '^(/|bazel-out/)' | tail -n 1`
  - `./.github/scripts/run-bazel-ci.sh --remote-download-toplevel -- build
  --build_metadata=TAG_job=sdk -- //codex-rs/cli:codex`
  - `CODEX_EXEC_PATH="$PWD/.tmp/sdk-ci/codex" pnpm --dir sdk/typescript
  test --runInBand`
  - `pnpm --dir sdk/typescript lint`

  Michael Bolin · 2026-03-27 17:17:22 -07:00
  2ffb32db98
• [codex] Pin GitHub Actions workflow references (#15828)

  Pin floating external GitHub Actions workflow refs to immutable SHAs.
  
  Why are we doing this? Please see the rationale doc:
  https://docs.google.com/document/d/1qOURCNx2zszQ0uWx7Fj5ERu4jpiYjxLVWBWgKa2wTsA/edit?tab=t.0
  
  Did this break you? Please roll back and let hintz@ know

  Drew Hintz · 2026-03-27 23:00:05 +00:00
  f4f6eca871
• chore(deps): bump pnpm/action-setup from 4 to 5 (#15484)

  Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 4
  to 5.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/pnpm/action-setup/releases">pnpm/action-setup's
  releases</a>.</em></p>
  <blockquote>
  <h2>v5.0.0</h2>
  <p>Updated the action to use Node.js 24.</p>
  <h2>v4.4.0</h2>
  <p>Updated the action to use Node.js 24.</p>
  <h2>v4.3.0</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>docs: fix the run_install example in the Readme by <a
  href="https://github.com/dreyks"><code>@​dreyks</code></a> in <a
  href="https://redirect.github.com/pnpm/action-setup/pull/175">pnpm/action-setup#175</a></li>
  <li>chore: remove unused <code>@types/node-fetch</code> dependency by <a
  href="https://github.com/silverwind"><code>@​silverwind</code></a> in <a
  href="https://redirect.github.com/pnpm/action-setup/pull/186">pnpm/action-setup#186</a></li>
  <li>Clarify that package_json_file is relative to GITHUB_WORKSPACE by <a
  href="https://github.com/chris-martin"><code>@​chris-martin</code></a>
  in <a
  href="https://redirect.github.com/pnpm/action-setup/pull/184">pnpm/action-setup#184</a></li>
  <li>feat: store caching by <a
  href="https://github.com/jrmajor"><code>@​jrmajor</code></a> in <a
  href="https://redirect.github.com/pnpm/action-setup/pull/188">pnpm/action-setup#188</a></li>
  <li>refactor: remove star imports by <a
  href="https://github.com/KSXGitHub"><code>@​KSXGitHub</code></a> in <a
  href="https://redirect.github.com/pnpm/action-setup/pull/196">pnpm/action-setup#196</a></li>
  <li>fix(ci): exclude macos by <a
  href="https://github.com/KSXGitHub"><code>@​KSXGitHub</code></a> in <a
  href="https://redirect.github.com/pnpm/action-setup/pull/197">pnpm/action-setup#197</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/dreyks"><code>@​dreyks</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/pnpm/action-setup/pull/175">pnpm/action-setup#175</a></li>
  <li><a
  href="https://github.com/silverwind"><code>@​silverwind</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/pnpm/action-setup/pull/186">pnpm/action-setup#186</a></li>
  <li><a
  href="https://github.com/chris-martin"><code>@​chris-martin</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/pnpm/action-setup/pull/184">pnpm/action-setup#184</a></li>
  <li><a href="https://github.com/jrmajor"><code>@​jrmajor</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/pnpm/action-setup/pull/188">pnpm/action-setup#188</a></li>
  <li><a
  href="https://github.com/Boosted-Bonobo"><code>@​Boosted-Bonobo</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/pnpm/action-setup/pull/199">pnpm/action-setup#199</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/pnpm/action-setup/compare/v4.2.0...v4.3.0">https://github.com/pnpm/action-setup/compare/v4.2.0...v4.3.0</a></p>
  <h2>v4.2.0</h2>
  <p>When there's a <code>.npmrc</code> file at the root of the
  repository, pnpm will be fetched from the registry that is specified in
  that <code>.npmrc</code> file <a
  href="https://redirect.github.com/pnpm/action-setup/pull/179">#179</a></p>
  <h2>v4.1.0</h2>
  <p>Add support for <code>package.yaml</code> <a
  href="https://redirect.github.com/pnpm/action-setup/pull/156">#156</a>.</p>
  </blockquote>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li>See full diff in <a
  href="https://github.com/pnpm/action-setup/compare/v4...v5">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pnpm/action-setup&package-manager=github_actions&previous-version=4&new-version=5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2026-03-24 09:40:31 -06:00
  d7343486da
• Increase sdk workflow timeout to 15 minutes (#14252)

  - raise the sdk workflow job timeout from 10 to 15 minutes to reduce
  false cancellations near the current limit
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-03-11 12:33:08 -07:00
  b1dddcb76e
• fix(ci) lock rust toolchain at 1.93.0 to unblock (#11703)

  ## Summary
  CI is broken on main because our CI toolchain is trying to run 1.93.1
  while our rust toolchain is locked at 1.93.0. I'm sure it's likely safe
  to upgrade, but let's keep things stable for now.
  
  ## Testing
  - [x] CI should hopefully pass

  Dylan Hurd · 2026-02-13 08:44:23 +00:00
  fca5629e34
• build(linux-sandbox): always compile vendored bubblewrap on Linux; remove CODEX_BWRAP_ENABLE_FFI (#11498)

  ## Summary
  This PR removes the temporary `CODEX_BWRAP_ENABLE_FFI` flag and makes
  Linux builds always compile vendored bubblewrap support for
  `codex-linux-sandbox`.
  
  ## Changes
  - Removed `CODEX_BWRAP_ENABLE_FFI` gating from
  `codex-rs/linux-sandbox/build.rs`.
  - Linux builds now fail fast if vendored bubblewrap compilation fails
  (instead of warning and continuing).
  - Updated fallback/help text in
  `codex-rs/linux-sandbox/src/vendored_bwrap.rs` to remove references to
  `CODEX_BWRAP_ENABLE_FFI`.
  - Removed `CODEX_BWRAP_ENABLE_FFI` env wiring from:
    - `.github/workflows/rust-ci.yml`
    - `.github/workflows/bazel.yml`
    - `.github/workflows/rust-release.yml`
  
  ---------
  
  Co-authored-by: David Zbarsky <zbarsky@openai.com>

  viyatb-oai · 2026-02-11 21:30:41 -08:00
  923f931121
• Upgrade to rust 1.93 (#10080)

  I needed to upgrade bazel one to get gnullvm artifacts and then noticed
  monorepo had drifted forward. They should move in lockstep. Also 1.93
  already shipped so we can try that instead.

  zbarsky-openai · 2026-01-28 17:46:18 +00:00
  ad5f9e7370
• chore: upgrade to Rust 1.92.0 (#8860)

  **Summary**
  - Upgrade Rust toolchain used by CI to 1.92.0.
  - Address new clippy `derivable_impls` warnings by deriving `Default`
  for enums across protocol, core, backend openapi models, and
  windows-sandbox setup.
  - Tidy up related test/config behavior (originator header handling, env
  override cleanup) and remove a now-unused assignment in TUI/TUI2 render
  layout.
  
  **Testing**
  - `just fmt`
  - `just fix -p codex-tui`
  - `just fix -p codex-tui2`
  - `just fix -p codex-windows-sandbox`
  - `cargo test -p codex-tui`
  - `cargo test -p codex-tui2`
  - `cargo test -p codex-windows-sandbox`
  - `cargo test -p codex-core --test all`
  - `cargo test -p codex-app-server --test all`
  - `cargo test -p codex-mcp-server --test all`
  - `cargo test --all-features`

  viyatb-oai · 2026-01-16 11:12:52 -08:00
  f89a40a849
• Upgrade GitHub Actions for Node 24 compatibility (#8102)

  ## Summary
  
  Upgrade GitHub Actions to their latest versions to ensure compatibility
  with Node 24, as Node 20 will reach end-of-life in April 2026.
  
  ## Changes
  
  | Action | Old Version(s) | New Version | Release | Files |
  |--------|---------------|-------------|---------|-------|
  | `actions/setup-node` |
  [`v5`](https://github.com/actions/setup-node/releases/tag/v5) |
  [`v6`](https://github.com/actions/setup-node/releases/tag/v6) |
  [Release](https://github.com/actions/setup-node/releases/tag/v6) |
  ci.yml, rust-release.yml, sdk.yml, shell-tool-mcp-ci.yml,
  shell-tool-mcp.yml |
  
  ## Context
  
  Per [GitHub's
  announcement](https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/),
  Node 20 is being deprecated and runners will begin using Node 24 by
  default starting March 4th, 2026.
  
  ### Why this matters
  
  - **Node 20 EOL**: April 2026
  - **Node 24 default**: March 4th, 2026
  - **Action**: Update to latest action versions that support Node 24
  
  ### Security Note
  
  Actions that were previously pinned to commit SHAs remain pinned to SHAs
  (updated to the latest release SHA) to maintain the security benefits of
  immutable references.
  
  ### Testing
  
  These changes only affect CI/CD workflow configurations and should not
  impact application functionality. The workflows should be tested by
  running them on a branch before merging.

  Salman Chishti · 2025-12-16 11:31:25 -08:00
  5ceeaa96b8
• chore(deps): bump actions/checkout from 5 to 6 (#7230)

  Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to
  6.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/checkout/releases">actions/checkout's
  releases</a>.</em></p>
  <blockquote>
  <h2>v6.0.0</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Update README to include Node.js 24 support details and requirements
  by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
  in <a
  href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
  <li>Persist creds to a separate file by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
  <li>v6-beta by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2298">actions/checkout#2298</a></li>
  <li>update readme/changelog for v6 by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2311">actions/checkout#2311</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/checkout/compare/v5.0.0...v6.0.0">https://github.com/actions/checkout/compare/v5.0.0...v6.0.0</a></p>
  <h2>v6-beta</h2>
  <h2>What's Changed</h2>
  <p>Updated persist-credentials to store the credentials under
  <code>$RUNNER_TEMP</code> instead of directly in the local git
  config.</p>
  <p>This requires a minimum Actions Runner version of <a
  href="https://github.com/actions/runner/releases/tag/v2.329.0">v2.329.0</a>
  to access the persisted credentials for <a
  href="https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action">Docker
  container action</a> scenarios.</p>
  <h2>v5.0.1</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Port v6 cleanup to v5 by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/checkout/compare/v5...v5.0.1">https://github.com/actions/checkout/compare/v5...v5.0.1</a></p>
  </blockquote>
  </details>
  <details>
  <summary>Changelog</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
  changelog</a>.</em></p>
  <blockquote>
  <h1>Changelog</h1>
  <h2>V6.0.0</h2>
  <ul>
  <li>Persist creds to a separate file by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
  <li>Update README to include Node.js 24 support details and requirements
  by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
  in <a
  href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
  </ul>
  <h2>V5.0.1</h2>
  <ul>
  <li>Port v6 cleanup to v5 by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
  </ul>
  <h2>V5.0.0</h2>
  <ul>
  <li>Update actions checkout to use node 24 by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
  </ul>
  <h2>V4.3.1</h2>
  <ul>
  <li>Port v6 cleanup to v4 by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
  </ul>
  <h2>V4.3.0</h2>
  <ul>
  <li>docs: update README.md by <a
  href="https://github.com/motss"><code>@​motss</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
  <li>Add internal repos for checking out multiple repositories by <a
  href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
  <li>Documentation update - add recommended permissions to Readme by <a
  href="https://github.com/benwells"><code>@​benwells</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
  <li>Adjust positioning of user email note and permissions heading by <a
  href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
  <li>Update README.md by <a
  href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
  <li>Update CODEOWNERS for actions by <a
  href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
  in <a
  href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
  <li>Update package dependencies by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
  </ul>
  <h2>v4.2.2</h2>
  <ul>
  <li><code>url-helper.ts</code> now leverages well-known environment
  variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
  in <a
  href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
  <li>Expand unit test coverage for <code>isGhes</code> by <a
  href="https://github.com/jww3"><code>@​jww3</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
  </ul>
  <h2>v4.2.1</h2>
  <ul>
  <li>Check out other refs/* by commit if provided, fall back to ref by <a
  href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
  </ul>
  <h2>v4.2.0</h2>
  <ul>
  <li>Add Ref and Commit outputs by <a
  href="https://github.com/lucacome"><code>@​lucacome</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1180">actions/checkout#1180</a></li>
  <li>Dependency updates by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a>- <a
  href="https://redirect.github.com/actions/checkout/pull/1777">actions/checkout#1777</a>,
  <a
  href="https://redirect.github.com/actions/checkout/pull/1872">actions/checkout#1872</a></li>
  </ul>
  <h2>v4.1.7</h2>
  <ul>
  <li>Bump the minor-npm-dependencies group across 1 directory with 4
  updates by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li>
  <li>Bump actions/checkout from 3 to 4 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li>
  <li>Check out other refs/* by commit by <a
  href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li>
  <li>Pin actions/checkout's own workflows to a known, good, stable
  version. by <a href="https://github.com/jww3"><code>@​jww3</code></a> in
  <a
  href="https://redirect.github.com/actions/checkout/pull/1776">actions/checkout#1776</a></li>
  </ul>
  <h2>v4.1.6</h2>
  <ul>
  <li>Check platform to set archive extension appropriately by <a
  href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
  <a
  href="https://redirect.github.com/actions/checkout/pull/1732">actions/checkout#1732</a></li>
  </ul>
  <h2>v4.1.5</h2>
  <ul>
  <li>Update NPM dependencies by <a
  href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
  <a
  href="https://redirect.github.com/actions/checkout/pull/1703">actions/checkout#1703</a></li>
  <li>Bump github/codeql-action from 2 to 3 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1694">actions/checkout#1694</a></li>
  <li>Bump actions/setup-node from 1 to 4 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1696">actions/checkout#1696</a></li>
  <li>Bump actions/upload-artifact from 2 to 4 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1695">actions/checkout#1695</a></li>
  </ul>
  <!-- raw HTML omitted -->
  </blockquote>
  <p>... (truncated)</p>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3"><code>1af3b93</code></a>
  update readme/changelog for v6 (<a
  href="https://redirect.github.com/actions/checkout/issues/2311">#2311</a>)</li>
  <li><a
  href="https://github.com/actions/checkout/commit/71cf2267d89c5cb81562390fa70a37fa40b1305e"><code>71cf226</code></a>
  v6-beta (<a
  href="https://redirect.github.com/actions/checkout/issues/2298">#2298</a>)</li>
  <li><a
  href="https://github.com/actions/checkout/commit/069c6959146423d11cd0184e6accf28f9d45f06e"><code>069c695</code></a>
  Persist creds to a separate file (<a
  href="https://redirect.github.com/actions/checkout/issues/2286">#2286</a>)</li>
  <li><a
  href="https://github.com/actions/checkout/commit/ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493"><code>ff7abcd</code></a>
  Update README to include Node.js 24 support details and requirements (<a
  href="https://redirect.github.com/actions/checkout/issues/2248">#2248</a>)</li>
  <li>See full diff in <a
  href="https://github.com/actions/checkout/compare/v5...v6">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=5&new-version=6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-11-24 11:45:57 -08:00
  6dd3606773
• SDK CI (#4483)

  Build debug codex in SDK configuration

  pakrym-oai · 2025-09-29 21:15:02 -07:00
  27c6c5d7a7