79 Commits

• [release] Add a dmg target for MacOS (#8207)

  Add a dmg target that bundles the codex and codex responses api proxy
  binaries for MacOS. this target is signed and notarized.
  
  Verified by triggering a build here:
  https://github.com/openai/codex/actions/runs/20318136302/job/58367155205.
  Downloaded the artifact and verified that the dmg is signed and
  notarized, and the codex binary contained works as expected.

  Celia Chen · 2025-12-18 11:19:10 -08:00
  2e5d52cb14
• Upgrade GitHub Actions for Node 24 compatibility (#8102)

  ## Summary
  
  Upgrade GitHub Actions to their latest versions to ensure compatibility
  with Node 24, as Node 20 will reach end-of-life in April 2026.
  
  ## Changes
  
  | Action | Old Version(s) | New Version | Release | Files |
  |--------|---------------|-------------|---------|-------|
  | `actions/setup-node` |
  [`v5`](https://github.com/actions/setup-node/releases/tag/v5) |
  [`v6`](https://github.com/actions/setup-node/releases/tag/v6) |
  [Release](https://github.com/actions/setup-node/releases/tag/v6) |
  ci.yml, rust-release.yml, sdk.yml, shell-tool-mcp-ci.yml,
  shell-tool-mcp.yml |
  
  ## Context
  
  Per [GitHub's
  announcement](https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/),
  Node 20 is being deprecated and runners will begin using Node 24 by
  default starting March 4th, 2026.
  
  ### Why this matters
  
  - **Node 20 EOL**: April 2026
  - **Node 24 default**: March 4th, 2026
  - **Action**: Update to latest action versions that support Node 24
  
  ### Security Note
  
  Actions that were previously pinned to commit SHAs remain pinned to SHAs
  (updated to the latest release SHA) to maintain the security benefits of
  immutable references.
  
  ### Testing
  
  These changes only affect CI/CD workflow configurations and should not
  impact application functionality. The workflows should be tested by
  running them on a branch before merging.

  Salman Chishti · 2025-12-16 11:31:25 -08:00
  5ceeaa96b8
• chore: mac codesign refactor (#8085)

  ### Summary
  Similar to our linux and windows codesign, moving mac codesign logic
  into its own files.

  Shijie Rao · 2025-12-16 11:20:44 -08:00
  b27c702e83
• stage new windows sandbox binaries as artifacts (#8076)
  iceweasel-oai · 2025-12-15 09:15:32 -08:00
  c696456bf1
• chore(deps): bump actions/cache from 4 to 5 (#8039)

  Bumps [actions/cache](https://github.com/actions/cache) from 4 to 5.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/cache/releases">actions/cache's
  releases</a>.</em></p>
  <blockquote>
  <h2>v5.0.0</h2>
  <blockquote>
  <p>[!IMPORTANT]
  <strong><code>actions/cache@v5</code> runs on the Node.js 24 runtime and
  requires a minimum Actions Runner version of
  <code>2.327.1</code>.</strong></p>
  <p>If you are using self-hosted runners, ensure they are updated before
  upgrading.</p>
  </blockquote>
  <hr />
  <h2>What's Changed</h2>
  <ul>
  <li>Upgrade to use node24 by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/cache/pull/1630">actions/cache#1630</a></li>
  <li>Prepare v5.0.0 release by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/cache/pull/1684">actions/cache#1684</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/cache/compare/v4.3.0...v5.0.0">https://github.com/actions/cache/compare/v4.3.0...v5.0.0</a></p>
  <h2>v4.3.0</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Add note on runner versions by <a
  href="https://github.com/GhadimiR"><code>@​GhadimiR</code></a> in <a
  href="https://redirect.github.com/actions/cache/pull/1642">actions/cache#1642</a></li>
  <li>Prepare <code>v4.3.0</code> release by <a
  href="https://github.com/Link"><code>@​Link</code></a>- in <a
  href="https://redirect.github.com/actions/cache/pull/1655">actions/cache#1655</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/GhadimiR"><code>@​GhadimiR</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/cache/pull/1642">actions/cache#1642</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/cache/compare/v4...v4.3.0">https://github.com/actions/cache/compare/v4...v4.3.0</a></p>
  <h2>v4.2.4</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Update README.md by <a
  href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
  href="https://redirect.github.com/actions/cache/pull/1620">actions/cache#1620</a></li>
  <li>Upgrade <code>@actions/cache</code> to <code>4.0.5</code> and move
  <code>@protobuf-ts/plugin</code> to dev depdencies by <a
  href="https://github.com/Link"><code>@​Link</code></a>- in <a
  href="https://redirect.github.com/actions/cache/pull/1634">actions/cache#1634</a></li>
  <li>Prepare release <code>4.2.4</code> by <a
  href="https://github.com/Link"><code>@​Link</code></a>- in <a
  href="https://redirect.github.com/actions/cache/pull/1636">actions/cache#1636</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/actions/cache/pull/1620">actions/cache#1620</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/cache/compare/v4...v4.2.4">https://github.com/actions/cache/compare/v4...v4.2.4</a></p>
  <h2>v4.2.3</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Update to use <code>@​actions/cache</code> 4.0.3 package &amp;
  prepare for new release by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/cache/pull/1577">actions/cache#1577</a>
  (SAS tokens for cache entries are now masked in debug logs)</li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/cache/pull/1577">actions/cache#1577</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/cache/compare/v4.2.2...v4.2.3">https://github.com/actions/cache/compare/v4.2.2...v4.2.3</a></p>
  <!-- raw HTML omitted -->
  </blockquote>
  <p>... (truncated)</p>
  </details>
  <details>
  <summary>Changelog</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's
  changelog</a>.</em></p>
  <blockquote>
  <h1>Releases</h1>
  <h2>Changelog</h2>
  <h3>5.0.1</h3>
  <ul>
  <li>Update <code>@azure/storage-blob</code> to <code>^12.29.1</code> via
  <code>@actions/cache@5.0.1</code> <a
  href="https://redirect.github.com/actions/cache/pull/1685">#1685</a></li>
  </ul>
  <h3>5.0.0</h3>
  <blockquote>
  <p>[!IMPORTANT]
  <code>actions/cache@v5</code> runs on the Node.js 24 runtime and
  requires a minimum Actions Runner version of <code>2.327.1</code>.
  If you are using self-hosted runners, ensure they are updated before
  upgrading.</p>
  </blockquote>
  <h3>4.3.0</h3>
  <ul>
  <li>Bump <code>@actions/cache</code> to <a
  href="https://redirect.github.com/actions/toolkit/pull/2132">v4.1.0</a></li>
  </ul>
  <h3>4.2.4</h3>
  <ul>
  <li>Bump <code>@actions/cache</code> to v4.0.5</li>
  </ul>
  <h3>4.2.3</h3>
  <ul>
  <li>Bump <code>@actions/cache</code> to v4.0.3 (obfuscates SAS token in
  debug logs for cache entries)</li>
  </ul>
  <h3>4.2.2</h3>
  <ul>
  <li>Bump <code>@actions/cache</code> to v4.0.2</li>
  </ul>
  <h3>4.2.1</h3>
  <ul>
  <li>Bump <code>@actions/cache</code> to v4.0.1</li>
  </ul>
  <h3>4.2.0</h3>
  <p>TLDR; The cache backend service has been rewritten from the ground up
  for improved performance and reliability. <a
  href="https://github.com/actions/cache">actions/cache</a> now integrates
  with the new cache service (v2) APIs.</p>
  <p>The new service will gradually roll out as of <strong>February 1st,
  2025</strong>. The legacy service will also be sunset on the same date.
  Changes in these release are <strong>fully backward
  compatible</strong>.</p>
  <p><strong>We are deprecating some versions of this action</strong>. We
  recommend upgrading to version <code>v4</code> or <code>v3</code> as
  soon as possible before <strong>February 1st, 2025.</strong> (Upgrade
  instructions below).</p>
  <p>If you are using pinned SHAs, please use the SHAs of versions
  <code>v4.2.0</code> or <code>v3.4.0</code></p>
  <p>If you do not upgrade, all workflow runs using any of the deprecated
  <a href="https://github.com/actions/cache">actions/cache</a> will
  fail.</p>
  <p>Upgrading to the recommended versions will not break your
  workflows.</p>
  <h3>4.1.2</h3>
  <!-- raw HTML omitted -->
  </blockquote>
  <p>... (truncated)</p>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/actions/cache/commit/9255dc7a253b0ccc959486e2bca901246202afeb"><code>9255dc7</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/cache/issues/1686">#1686</a>
  from actions/cache-v5.0.1-release</li>
  <li><a
  href="https://github.com/actions/cache/commit/8ff5423e8b66eacab4e638ee52abbd2cb831366a"><code>8ff5423</code></a>
  chore: release v5.0.1</li>
  <li><a
  href="https://github.com/actions/cache/commit/9233019a152bc768059ac1768b8e4403b5da16c1"><code>9233019</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/cache/issues/1685">#1685</a>
  from salmanmkc/node24-storage-blob-fix</li>
  <li><a
  href="https://github.com/actions/cache/commit/b975f2bb844529e1063ad882c609b224bcd66eb6"><code>b975f2b</code></a>
  fix: add peer property to package-lock.json for dependencies</li>
  <li><a
  href="https://github.com/actions/cache/commit/d0a0e1813491d01d574c95f8d189f62622bbb2ae"><code>d0a0e18</code></a>
  fix: update license files for <code>@​actions/cache</code>,
  fast-xml-parser, and strnum</li>
  <li><a
  href="https://github.com/actions/cache/commit/74de208dcfcbe85c0e7154e7b17e4105fe2554ff"><code>74de208</code></a>
  fix: update <code>@​actions/cache</code> to ^5.0.1 for Node.js 24
  punycode fix</li>
  <li><a
  href="https://github.com/actions/cache/commit/ac7f1152ead02e89c14b5456d14ab17591e74cfb"><code>ac7f115</code></a>
  peer</li>
  <li><a
  href="https://github.com/actions/cache/commit/b0f846b50b6061d7a2ca6f1a2fea61d4a65d1a16"><code>b0f846b</code></a>
  fix: update <code>@​actions/cache</code> with storage-blob fix for
  Node.js 24 punycode depr...</li>
  <li><a
  href="https://github.com/actions/cache/commit/a7833574556fa59680c1b7cb190c1735db73ebf0"><code>a783357</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/cache/issues/1684">#1684</a>
  from actions/prepare-cache-v5-release</li>
  <li><a
  href="https://github.com/actions/cache/commit/3bb0d78750a39cefce0c2b5a0a9801052b4359ad"><code>3bb0d78</code></a>
  docs: highlight v5 runner requirement in releases</li>
  <li>Additional commits viewable in <a
  href="https://github.com/actions/cache/compare/v4...v5">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/cache&package-manager=github_actions&previous-version=4&new-version=5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-12-14 22:30:48 -08:00
  a21f0ac033
• chore(deps): bump actions/download-artifact from 4 to 7 (#8037)

  Bumps
  [actions/download-artifact](https://github.com/actions/download-artifact)
  from 4 to 7.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/download-artifact/releases">actions/download-artifact's
  releases</a>.</em></p>
  <blockquote>
  <h2>v7.0.0</h2>
  <h2>v7 - What's new</h2>
  <blockquote>
  <p>[!IMPORTANT]
  actions/download-artifact@v7 now runs on Node.js 24 (<code>runs.using:
  node24</code>) and requires a minimum Actions Runner version of 2.327.1.
  If you are using self-hosted runners, ensure they are updated before
  upgrading.</p>
  </blockquote>
  <h3>Node.js 24</h3>
  <p>This release updates the runtime to Node.js 24. v6 had preliminary
  support for Node 24, however this action was by default still running on
  Node.js 20. Now this action by default will run on Node.js 24.</p>
  <h2>What's Changed</h2>
  <ul>
  <li>Update GHES guidance to include reference to Node 20 version by <a
  href="https://github.com/patrikpolyak"><code>@​patrikpolyak</code></a>
  in <a
  href="https://redirect.github.com/actions/download-artifact/pull/440">actions/download-artifact#440</a></li>
  <li>Download Artifact Node24 support by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/download-artifact/pull/415">actions/download-artifact#415</a></li>
  <li>fix: update <code>@​actions/artifact</code> to fix Node.js 24
  punycode deprecation by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/download-artifact/pull/451">actions/download-artifact#451</a></li>
  <li>prepare release v7.0.0 for Node.js 24 support by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/download-artifact/pull/452">actions/download-artifact#452</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a
  href="https://github.com/patrikpolyak"><code>@​patrikpolyak</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/download-artifact/pull/440">actions/download-artifact#440</a></li>
  <li><a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/download-artifact/pull/415">actions/download-artifact#415</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/download-artifact/compare/v6.0.0...v7.0.0">https://github.com/actions/download-artifact/compare/v6.0.0...v7.0.0</a></p>
  <h2>v6.0.0</h2>
  <h2>What's Changed</h2>
  <p><strong>BREAKING CHANGE:</strong> this update supports Node
  <code>v24.x</code>. This is not a breaking change per-se but we're
  treating it as such.</p>
  <ul>
  <li>Update README for download-artifact v5 changes by <a
  href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
  href="https://redirect.github.com/actions/download-artifact/pull/417">actions/download-artifact#417</a></li>
  <li>Update README with artifact extraction details by <a
  href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
  href="https://redirect.github.com/actions/download-artifact/pull/424">actions/download-artifact#424</a></li>
  <li>Readme: spell out the first use of GHES by <a
  href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
  <a
  href="https://redirect.github.com/actions/download-artifact/pull/431">actions/download-artifact#431</a></li>
  <li>Bump <code>@actions/artifact</code> to <code>v4.0.0</code></li>
  <li>Prepare <code>v6.0.0</code> by <a
  href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
  <a
  href="https://redirect.github.com/actions/download-artifact/pull/438">actions/download-artifact#438</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a
  href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/download-artifact/pull/431">actions/download-artifact#431</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/download-artifact/compare/v5...v6.0.0">https://github.com/actions/download-artifact/compare/v5...v6.0.0</a></p>
  <h2>v5.0.0</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Update README.md by <a
  href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
  href="https://redirect.github.com/actions/download-artifact/pull/407">actions/download-artifact#407</a></li>
  <li>BREAKING fix: inconsistent path behavior for single artifact
  downloads by ID by <a
  href="https://github.com/GrantBirki"><code>@​GrantBirki</code></a> in <a
  href="https://redirect.github.com/actions/download-artifact/pull/416">actions/download-artifact#416</a></li>
  </ul>
  <h2>v5.0.0</h2>
  <h3>🚨 Breaking Change</h3>
  <p>This release fixes an inconsistency in path behavior for single
  artifact downloads by ID. <strong>If you're downloading single artifacts
  by ID, the output path may change.</strong></p>
  <h4>What Changed</h4>
  <!-- raw HTML omitted -->
  </blockquote>
  <p>... (truncated)</p>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/actions/download-artifact/commit/37930b1c2abaa49bbe596cd826c3c89aef350131"><code>37930b1</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/download-artifact/issues/452">#452</a>
  from actions/download-artifact-v7-release</li>
  <li><a
  href="https://github.com/actions/download-artifact/commit/72582b9e0acd370909e83fa4a1fd0fca3ad452d8"><code>72582b9</code></a>
  doc: update readme</li>
  <li><a
  href="https://github.com/actions/download-artifact/commit/0d2ec9d4cbcefe257d822f108de2a1f15f8da9f6"><code>0d2ec9d</code></a>
  chore: release v7.0.0 for Node.js 24 support</li>
  <li><a
  href="https://github.com/actions/download-artifact/commit/fd7ae8fda6dc16277a9ffbc91cdb0eedf156e912"><code>fd7ae8f</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/download-artifact/issues/451">#451</a>
  from actions/fix-storage-blob</li>
  <li><a
  href="https://github.com/actions/download-artifact/commit/d484700543354b15886d6a52910cf61b7f1d2b27"><code>d484700</code></a>
  chore: restore minimatch.dep.yml license file</li>
  <li><a
  href="https://github.com/actions/download-artifact/commit/03a808050efe42bb6ad85281890afd4e4546672c"><code>03a8080</code></a>
  chore: remove obsolete dependency license files</li>
  <li><a
  href="https://github.com/actions/download-artifact/commit/56fe6d904b0968950f8b68ea17774c54973ed5e2"><code>56fe6d9</code></a>
  chore: update <code>@​actions/artifact</code> license file to 5.0.1</li>
  <li><a
  href="https://github.com/actions/download-artifact/commit/8e3ebc4ab4d2e095e5eb44ba1a4a53b6b03976ad"><code>8e3ebc4</code></a>
  chore: update package-lock.json with <code>@​actions/artifact</code><a
  href="https://github.com/5"><code>@​5</code></a>.0.1</li>
  <li><a
  href="https://github.com/actions/download-artifact/commit/1e3c4b4d4906c98ab57453c24efefdf16c078044"><code>1e3c4b4</code></a>
  fix: update <code>@​actions/artifact</code> to ^5.0.0 for Node.js 24
  punycode fix</li>
  <li><a
  href="https://github.com/actions/download-artifact/commit/458627d354794c71bc386c8d5839d20b5885fe2a"><code>458627d</code></a>
  chore: use local <code>@​actions/artifact</code> package for Node.js 24
  testing</li>
  <li>Additional commits viewable in <a
  href="https://github.com/actions/download-artifact/compare/v4...v7">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/download-artifact&package-manager=github_actions&previous-version=4&new-version=7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-12-14 22:30:23 -08:00
  b349ec4e94
• chore(deps): bump actions/upload-artifact from 5 to 6 (#8038)

  Bumps
  [actions/upload-artifact](https://github.com/actions/upload-artifact)
  from 5 to 6.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's
  releases</a>.</em></p>
  <blockquote>
  <h2>v6.0.0</h2>
  <h2>v6 - What's new</h2>
  <blockquote>
  <p>[!IMPORTANT]
  actions/upload-artifact@v6 now runs on Node.js 24 (<code>runs.using:
  node24</code>) and requires a minimum Actions Runner version of 2.327.1.
  If you are using self-hosted runners, ensure they are updated before
  upgrading.</p>
  </blockquote>
  <h3>Node.js 24</h3>
  <p>This release updates the runtime to Node.js 24. v5 had preliminary
  support for Node.js 24, however this action was by default still running
  on Node.js 20. Now this action by default will run on Node.js 24.</p>
  <h2>What's Changed</h2>
  <ul>
  <li>Upload Artifact Node 24 support by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/719">actions/upload-artifact#719</a></li>
  <li>fix: update <code>@​actions/artifact</code> for Node.js 24 punycode
  deprecation by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/744">actions/upload-artifact#744</a></li>
  <li>prepare release v6.0.0 for Node.js 24 support by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/745">actions/upload-artifact#745</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0">https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0</a></p>
  </blockquote>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/b7c566a772e6b6bfb58ed0dc250532a479d7789f"><code>b7c566a</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/upload-artifact/issues/745">#745</a>
  from actions/upload-artifact-v6-release</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/e516bc8500aaf3d07d591fcd4ae6ab5f9c391d5b"><code>e516bc8</code></a>
  docs: correct description of Node.js 24 support in README</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/ddc45ed9bca9b38dbd643978d88e3981cdc91415"><code>ddc45ed</code></a>
  docs: update README to correct action name for Node.js 24 support</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/615b319bd27bb32c3d64dca6b6ed6974d5fbe653"><code>615b319</code></a>
  chore: release v6.0.0 for Node.js 24 support</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/017748b48f8610ca8e6af1222f4a618e84a9c703"><code>017748b</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/upload-artifact/issues/744">#744</a>
  from actions/fix-storage-blob</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/38d4c7997f5510fcc41fc4aae2a6b97becdbe7fc"><code>38d4c79</code></a>
  chore: rebuild dist</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/7d27270e0cfd253e666c44abac0711308d2d042f"><code>7d27270</code></a>
  chore: add missing license cache files for <code>@​actions/core</code>,
  <code>@​actions/io</code>, and mi...</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/5f643d3c9475505ccaf26d686ffbfb71a8387261"><code>5f643d3</code></a>
  chore: update license files for <code>@​actions/artifact</code><a
  href="https://github.com/5"><code>@​5</code></a>.0.1 dependencies</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/1df1684032c88614064493e1a0478fcb3583e1d0"><code>1df1684</code></a>
  chore: update package-lock.json with <code>@​actions/artifact</code><a
  href="https://github.com/5"><code>@​5</code></a>.0.1</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/b5b1a918401ee270935b6b1d857ae66c85f3be6f"><code>b5b1a91</code></a>
  fix: update <code>@​actions/artifact</code> to ^5.0.0 for Node.js 24
  punycode fix</li>
  <li>Additional commits viewable in <a
  href="https://github.com/actions/upload-artifact/compare/v5...v6">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/upload-artifact&package-manager=github_actions&previous-version=5&new-version=6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-12-14 22:13:57 -08:00
  dd68245a9d
• fix cargo build switch (#7948)
  iceweasel-oai · 2025-12-12 14:31:09 -08:00
  3d07cd6c0c
• Sign two additional exes for Windows (#7942)

  The elevated sandbox ships two exes
  * one for elevated setup of the sandbox
  * one to actually run commands under the sandbox user.
  
  This PR adds them to the windows signing step

  iceweasel-oai · 2025-12-12 13:33:42 -08:00
  4d2deb1098
• Revert "Revert "feat: windows codesign with Azure trusted signing"" (#7806)

  Reverts openai/codex#7804

  Shijie Rao · 2025-12-09 20:42:00 -08:00
  ab9ddcd50b
• Revert "feat: windows codesign with Azure trusted signing" (#7804)

  Reverts openai/codex#7757

  Shijie Rao · 2025-12-09 20:19:37 -08:00
  f11520f5f1
• Revert "Revert "feat: windows codesign with Azure trusted signing"" (#7757)

  Reverts openai/codex#7753
  
  Updated the tag ref matching at
  https://github.com/openai/openai/pull/594858 so that release with tag
  change can be picked up correctly.

  Shijie Rao · 2025-12-09 19:31:46 -08:00
  42e0817398
• Revert "feat: windows codesign with Azure trusted signing" (#7753)

  Reverts openai/codex#7675

  Shijie Rao · 2025-12-08 16:09:28 -08:00
  0f2b589d5e
• feat: windows codesign with Azure trusted signing (#7675)

  ### Summary
  Set up codesign for windows dist with [Azure trusted
  signing](https://azure.microsoft.com/en-us/products/trusted-signing) and
  [its github action
  integration](https://github.com/Azure/trusted-signing-action).

  Shijie Rao · 2025-12-08 15:12:01 -08:00
  badda736c6
• feat: linux codesign with sigstore (#7674)

  ### Summary
  Linux codesigning with sigstore and test run output at
  https://github.com/openai/codex/actions/runs/19994328162?pr=7662.
  
  Sigstore is one of the few ways for codesigning for linux platform.
  Linux is open sourced and therefore binary/dist validation comes with
  the build itself instead of a central authority like Windows or Mac.
  Alternative here is to use GPG which again a public key included with
  the bundle for validation. Advantage with Sigstore is that we do not
  have to create a private key for signing but rather with[ keyless
  signing](https://docs.sigstore.dev/cosign/signing/overview/).
  
  This should be sufficient for us at this point and if we want to we can
  support GPG in the future.

  Shijie Rao · 2025-12-08 11:13:50 -08:00
  28e7218c0b
• chore(deps): bump actions/checkout from 5 to 6 (#7230)

  Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to
  6.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/checkout/releases">actions/checkout's
  releases</a>.</em></p>
  <blockquote>
  <h2>v6.0.0</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Update README to include Node.js 24 support details and requirements
  by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
  in <a
  href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
  <li>Persist creds to a separate file by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
  <li>v6-beta by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2298">actions/checkout#2298</a></li>
  <li>update readme/changelog for v6 by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2311">actions/checkout#2311</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/checkout/compare/v5.0.0...v6.0.0">https://github.com/actions/checkout/compare/v5.0.0...v6.0.0</a></p>
  <h2>v6-beta</h2>
  <h2>What's Changed</h2>
  <p>Updated persist-credentials to store the credentials under
  <code>$RUNNER_TEMP</code> instead of directly in the local git
  config.</p>
  <p>This requires a minimum Actions Runner version of <a
  href="https://github.com/actions/runner/releases/tag/v2.329.0">v2.329.0</a>
  to access the persisted credentials for <a
  href="https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action">Docker
  container action</a> scenarios.</p>
  <h2>v5.0.1</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Port v6 cleanup to v5 by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/checkout/compare/v5...v5.0.1">https://github.com/actions/checkout/compare/v5...v5.0.1</a></p>
  </blockquote>
  </details>
  <details>
  <summary>Changelog</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
  changelog</a>.</em></p>
  <blockquote>
  <h1>Changelog</h1>
  <h2>V6.0.0</h2>
  <ul>
  <li>Persist creds to a separate file by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
  <li>Update README to include Node.js 24 support details and requirements
  by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
  in <a
  href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
  </ul>
  <h2>V5.0.1</h2>
  <ul>
  <li>Port v6 cleanup to v5 by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
  </ul>
  <h2>V5.0.0</h2>
  <ul>
  <li>Update actions checkout to use node 24 by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
  </ul>
  <h2>V4.3.1</h2>
  <ul>
  <li>Port v6 cleanup to v4 by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
  </ul>
  <h2>V4.3.0</h2>
  <ul>
  <li>docs: update README.md by <a
  href="https://github.com/motss"><code>@​motss</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
  <li>Add internal repos for checking out multiple repositories by <a
  href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
  <li>Documentation update - add recommended permissions to Readme by <a
  href="https://github.com/benwells"><code>@​benwells</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
  <li>Adjust positioning of user email note and permissions heading by <a
  href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
  <li>Update README.md by <a
  href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
  <li>Update CODEOWNERS for actions by <a
  href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
  in <a
  href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
  <li>Update package dependencies by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
  </ul>
  <h2>v4.2.2</h2>
  <ul>
  <li><code>url-helper.ts</code> now leverages well-known environment
  variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
  in <a
  href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
  <li>Expand unit test coverage for <code>isGhes</code> by <a
  href="https://github.com/jww3"><code>@​jww3</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
  </ul>
  <h2>v4.2.1</h2>
  <ul>
  <li>Check out other refs/* by commit if provided, fall back to ref by <a
  href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
  </ul>
  <h2>v4.2.0</h2>
  <ul>
  <li>Add Ref and Commit outputs by <a
  href="https://github.com/lucacome"><code>@​lucacome</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1180">actions/checkout#1180</a></li>
  <li>Dependency updates by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a>- <a
  href="https://redirect.github.com/actions/checkout/pull/1777">actions/checkout#1777</a>,
  <a
  href="https://redirect.github.com/actions/checkout/pull/1872">actions/checkout#1872</a></li>
  </ul>
  <h2>v4.1.7</h2>
  <ul>
  <li>Bump the minor-npm-dependencies group across 1 directory with 4
  updates by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li>
  <li>Bump actions/checkout from 3 to 4 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li>
  <li>Check out other refs/* by commit by <a
  href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li>
  <li>Pin actions/checkout's own workflows to a known, good, stable
  version. by <a href="https://github.com/jww3"><code>@​jww3</code></a> in
  <a
  href="https://redirect.github.com/actions/checkout/pull/1776">actions/checkout#1776</a></li>
  </ul>
  <h2>v4.1.6</h2>
  <ul>
  <li>Check platform to set archive extension appropriately by <a
  href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
  <a
  href="https://redirect.github.com/actions/checkout/pull/1732">actions/checkout#1732</a></li>
  </ul>
  <h2>v4.1.5</h2>
  <ul>
  <li>Update NPM dependencies by <a
  href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
  <a
  href="https://redirect.github.com/actions/checkout/pull/1703">actions/checkout#1703</a></li>
  <li>Bump github/codeql-action from 2 to 3 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1694">actions/checkout#1694</a></li>
  <li>Bump actions/setup-node from 1 to 4 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1696">actions/checkout#1696</a></li>
  <li>Bump actions/upload-artifact from 2 to 4 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1695">actions/checkout#1695</a></li>
  </ul>
  <!-- raw HTML omitted -->
  </blockquote>
  <p>... (truncated)</p>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3"><code>1af3b93</code></a>
  update readme/changelog for v6 (<a
  href="https://redirect.github.com/actions/checkout/issues/2311">#2311</a>)</li>
  <li><a
  href="https://github.com/actions/checkout/commit/71cf2267d89c5cb81562390fa70a37fa40b1305e"><code>71cf226</code></a>
  v6-beta (<a
  href="https://redirect.github.com/actions/checkout/issues/2298">#2298</a>)</li>
  <li><a
  href="https://github.com/actions/checkout/commit/069c6959146423d11cd0184e6accf28f9d45f06e"><code>069c695</code></a>
  Persist creds to a separate file (<a
  href="https://redirect.github.com/actions/checkout/issues/2286">#2286</a>)</li>
  <li><a
  href="https://github.com/actions/checkout/commit/ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493"><code>ff7abcd</code></a>
  Update README to include Node.js 24 support details and requirements (<a
  href="https://redirect.github.com/actions/checkout/issues/2248">#2248</a>)</li>
  <li>See full diff in <a
  href="https://github.com/actions/checkout/compare/v5...v6">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=5&new-version=6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-11-24 11:45:57 -08:00
  6dd3606773
• fix: start publishing @openai/codex-shell-tool-mcp to npm (#7123)

  Start publishing as part of the normal release process.

  Michael Bolin · 2025-11-21 15:03:50 -08:00
  af63e6eccc
• fix: clear out duplicate entries for bash in the GitHub release (#7103)

  https://github.com/openai/codex/pull/7005 introduced a new part of the
  release process that added multiple files named `bash` in the `dist/`
  folder used as the basis of the GitHub Release. I believe that all file
  names in a GitHub Release have to be unique, which is why the recent
  release build failed:
  
  https://github.com/openai/codex/actions/runs/19577669780/job/56070183504
  
  Based on the output of the **List** step, I believe these are the
  appropriate artifacts to delete as a quick fix.

  Michael Bolin · 2025-11-21 09:59:30 -08:00
  40d14c0756
• feat: codex-shell-tool-mcp (#7005)

  This adds a GitHub workflow for building a new npm module we are
  experimenting with that contains an MCP server for running Bash
  commands. The new workflow, `shell-tool-mcp`, is a dependency of the
  general `release` workflow so that we continue to use one version number
  for all artifacts across the project in one GitHub release.
  
  `.github/workflows/shell-tool-mcp.yml` is the primary workflow
  introduced by this PR, which does the following:
  
  - builds the `codex-exec-mcp-server` and `codex-execve-wrapper`
  executables for both arm64 and x64 versions of Mac and Linux (preferring
  the MUSL version for Linux)
  - builds Bash (dynamically linked) for a [comically] large number of
  platforms (both x64 and arm64 for most) with a small patch specified by
  `shell-tool-mcp/patches/bash-exec-wrapper.patch`:
    - `debian-11`
    - `debian-12`
    - `ubuntu-20.04`
    - `ubuntu-22.04`
    - `ubuntu-24.04`
    - `centos-9`
    - `macos-13` (x64 only)
    - `macos-14` (arm64 only)
    - `macos-15` (arm64 only)
  - builds the TypeScript for the [new] Node module declared in the
  `shell-tool-mcp/` folder, which creates `bin/mcp-server.js`
  - adds all of the native binaries to `shell-tool-mcp/vendor/` folder;
  `bin/mcp-server.js` does a runtime check to determine which ones to
  execute
  - uses `npm pack` to create the `.tgz` for the module
  - if `publish: true` is set, invokes the `npm publish` call with the
  `.tgz`
  
  The justification for building Bash for so many different operating
  systems is because, since it is dynamically linked, we want to increase
  our confidence that the version we build is compatible with the glibc
  whatever OS we end up running on. (Note this is less of a concern with
  `codex-exec-mcp-server` and `codex-execve-wrapper` on Linux, as they are
  statically linked.)
  
  This PR also introduces the code for the npm module in `shell-tool-mcp/`
  (the proposed module name is `@openai/codex-shell-tool-mcp`). Initially,
  I intended the module to be a single file of vanilla JavaScript (like
  [`codex-cli/bin/codex.js`](https://github.com/openai/codex/blob/ab5972d447da78d3e4dd8461cf7d43a22e5d2acb/codex-cli/bin/codex.js)),
  but some of the logic seemed a bit tricky, so I decided to port it to
  TypeScript and add unit tests.
  
  `shell-tool-mcp/src/index.ts` defines the `main()` function for the
  module, which performs runtime checks to determine the clang triple to
  find the path to the Rust executables within the `vendor/` folder
  (`resolveTargetTriple()`). It uses a combination of `readOsRelease()`
  and `resolveBashPath()` to determine the correct Bash executable to run
  in the environment. Ultimately, it spawns a command like the following:
  
  ```
  codex-exec-mcp-server \
      --execve codex-execve-wrapper \
      --bash custom-bash "$@"
  ```
  
  Note `.github/workflows/shell-tool-mcp-ci.yml` defines a fairly standard
  CI job for the module (`format`/`build`/`test`).
  
  To test this PR, I pushed this branch to my personal fork of Codex and
  ran the CI job there:
  
  https://github.com/bolinfest/codex/actions/runs/19564311320
  
  Admittedly, the graph looks a bit wild now:
  
  <img width="5115" height="2969" alt="Screenshot 2025-11-20 at 11 44
  58 PM"
  src="https://github.com/user-attachments/assets/cc5ef306-efc1-4ed7-a137-5347e394f393"
  />
  
  But when it finished, I was able to download `codex-shell-tool-mcp-npm`
  from the **Artifacts** for the workflow in an empty temp directory,
  unzip the `.zip` and then the `.tgz` inside it, followed by `xattr -rc
  .` to remove the quarantine bits. Then I ran:
  
  ```shell
  npx @modelcontextprotocol/inspector node /private/tmp/foobar4/package/bin/mcp-server.js
  ```
  
  which launched the MCP Inspector and I was able to use it as expected!
  This bodes well that this should work once the package is published to
  npm:
  
  ```shell
  npx @modelcontextprotocol/inspector npx @openai/codex-shell-tool-mcp
  ```
  
  Also, to verify the package contains what I expect:
  
  ```shell
  /tmp/foobar4/package$ tree
  .
  ├── bin
  │   └── mcp-server.js
  ├── package.json
  ├── README.md
  └── vendor
      ├── aarch64-apple-darwin
      │   ├── bash
      │   │   ├── macos-14
      │   │   │   └── bash
      │   │   └── macos-15
      │   │       └── bash
      │   ├── codex-exec-mcp-server
      │   └── codex-execve-wrapper
      ├── aarch64-unknown-linux-musl
      │   ├── bash
      │   │   ├── centos-9
      │   │   │   └── bash
      │   │   ├── debian-11
      │   │   │   └── bash
      │   │   ├── debian-12
      │   │   │   └── bash
      │   │   ├── ubuntu-20.04
      │   │   │   └── bash
      │   │   ├── ubuntu-22.04
      │   │   │   └── bash
      │   │   └── ubuntu-24.04
      │   │       └── bash
      │   ├── codex-exec-mcp-server
      │   └── codex-execve-wrapper
      ├── x86_64-apple-darwin
      │   ├── bash
      │   │   └── macos-13
      │   │       └── bash
      │   ├── codex-exec-mcp-server
      │   └── codex-execve-wrapper
      └── x86_64-unknown-linux-musl
          ├── bash
          │   ├── centos-9
          │   │   └── bash
          │   ├── debian-11
          │   │   └── bash
          │   ├── debian-12
          │   │   └── bash
          │   ├── ubuntu-20.04
          │   │   └── bash
          │   ├── ubuntu-22.04
          │   │   └── bash
          │   └── ubuntu-24.04
          │       └── bash
          ├── codex-exec-mcp-server
          └── codex-execve-wrapper
  
  26 directories, 26 files
  ```

  Michael Bolin · 2025-11-21 08:16:36 -08:00
  d363a0968e
• Revert "templates and build step for validating/submitting winget package" (#6696)

  Reverts openai/codex#6485

  Ahmed Ibrahim · 2025-11-15 03:47:58 +00:00
  b560c5cef1
• templates and build step for validating/submitting winget package (#6485)
  iceweasel-oai · 2025-11-14 11:06:44 -08:00
  37fba28ac3
• upload Windows .exe file artifacts for CLI releases (#6478)

  This PR is to unlock future WinGet installation. WinGet struggles to
  create command aliases when installing from nested ZIPs on some clients,
  so adding raw Windows x64/Arm64 executables lets the manifest use
  InstallerType: portable with direct EXEs, which reliably registers the
  codex alias. This makes “winget install → codex” work out of the box
  without PATH changes.
  
  ---------
  
  Co-authored-by: Michael Bolin <mbolin@openai.com>

  iceweasel-oai · 2025-11-10 23:31:06 +00:00
  9aff64e017
• Revert "fix: pin musl 1.2.5 for DNS fixes" (#6222)

  Reverts openai/codex#6189

  Dylan Hurd · 2025-11-04 11:56:40 -08:00
  3a22018edd
• fix: pin musl 1.2.5 for DNS fixes (#6189)

  ## Summary
  musl 1.2.5 includes [several fixes to DNS over
  TCP](https://www.openwall.com/lists/musl/2024/03/01/2), which appears to
  be the root cause of #6116.
  
  This approach is a bit janky, but according to codex:
  > On the Ubuntu 24.04 runners we use, apt-cache policy musl-tools shows
  only the distro build (1.2.4-2ubuntu2)"
  
  We should build with this version and confirm.
  
  ## Testing
  - [ ] TODO: test and see if this fixes Azure issues

  Dylan Hurd · 2025-11-04 09:17:16 -08:00
  cb6584de46
• chore(deps): bump actions/upload-artifact from 4 to 5 (#6137)

  Bumps
  [actions/upload-artifact](https://github.com/actions/upload-artifact)
  from 4 to 5.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's
  releases</a>.</em></p>
  <blockquote>
  <h2>v5.0.0</h2>
  <h2>What's Changed</h2>
  <p><strong>BREAKING CHANGE:</strong> this update supports Node
  <code>v24.x</code>. This is not a breaking change per-se but we're
  treating it as such.</p>
  <ul>
  <li>Update README.md by <a
  href="https://github.com/GhadimiR"><code>@​GhadimiR</code></a> in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/681">actions/upload-artifact#681</a></li>
  <li>Update README.md by <a
  href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/712">actions/upload-artifact#712</a></li>
  <li>Readme: spell out the first use of GHES by <a
  href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
  <a
  href="https://redirect.github.com/actions/upload-artifact/pull/727">actions/upload-artifact#727</a></li>
  <li>Update GHES guidance to include reference to Node 20 version by <a
  href="https://github.com/patrikpolyak"><code>@​patrikpolyak</code></a>
  in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/725">actions/upload-artifact#725</a></li>
  <li>Bump <code>@actions/artifact</code> to <code>v4.0.0</code></li>
  <li>Prepare <code>v5.0.0</code> by <a
  href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
  <a
  href="https://redirect.github.com/actions/upload-artifact/pull/734">actions/upload-artifact#734</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/GhadimiR"><code>@​GhadimiR</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/681">actions/upload-artifact#681</a></li>
  <li><a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/712">actions/upload-artifact#712</a></li>
  <li><a
  href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/727">actions/upload-artifact#727</a></li>
  <li><a
  href="https://github.com/patrikpolyak"><code>@​patrikpolyak</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/725">actions/upload-artifact#725</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/upload-artifact/compare/v4...v5.0.0">https://github.com/actions/upload-artifact/compare/v4...v5.0.0</a></p>
  <h2>v4.6.2</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Update to use artifact 2.3.2 package &amp; prepare for new
  upload-artifact release by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/685">actions/upload-artifact#685</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/685">actions/upload-artifact#685</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/upload-artifact/compare/v4...v4.6.2">https://github.com/actions/upload-artifact/compare/v4...v4.6.2</a></p>
  <h2>v4.6.1</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Update to use artifact 2.2.2 package by <a
  href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/673">actions/upload-artifact#673</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/upload-artifact/compare/v4...v4.6.1">https://github.com/actions/upload-artifact/compare/v4...v4.6.1</a></p>
  <h2>v4.6.0</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Expose env vars to control concurrency and timeout by <a
  href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/662">actions/upload-artifact#662</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/upload-artifact/compare/v4...v4.6.0">https://github.com/actions/upload-artifact/compare/v4...v4.6.0</a></p>
  <h2>v4.5.0</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>fix: deprecated <code>Node.js</code> version in action by <a
  href="https://github.com/hamirmahal"><code>@​hamirmahal</code></a> in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/578">actions/upload-artifact#578</a></li>
  <li>Add new <code>artifact-digest</code> output by <a
  href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/656">actions/upload-artifact#656</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a
  href="https://github.com/hamirmahal"><code>@​hamirmahal</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/578">actions/upload-artifact#578</a></li>
  </ul>
  <!-- raw HTML omitted -->
  </blockquote>
  <p>... (truncated)</p>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/330a01c490aca151604b8cf639adc76d48f6c5d4"><code>330a01c</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/upload-artifact/issues/734">#734</a>
  from actions/danwkennedy/prepare-5.0.0</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/03f282445299bbefc96171af272a984663b63a26"><code>03f2824</code></a>
  Update <code>github.dep.yml</code></li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/905a1ecb5915b264cbc519e4eb415b5d82916018"><code>905a1ec</code></a>
  Prepare <code>v5.0.0</code></li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/2d9f9cdfa99fedaddba68e9b5b5c281eca26cc63"><code>2d9f9cd</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/upload-artifact/issues/725">#725</a>
  from patrikpolyak/patch-1</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/9687587dec67f2a8bc69104e183d311c42af6d6f"><code>9687587</code></a>
  Merge branch 'main' into patch-1</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/2848b2cda0e5190984587ec6bb1f36730ca78d50"><code>2848b2c</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/upload-artifact/issues/727">#727</a>
  from danwkennedy/patch-1</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/9b511775fd9ce8c5710b38eea671f856de0e70a7"><code>9b51177</code></a>
  Spell out the first use of GHES</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/cd231ca1eda77976a84805c4194a1954f56b0727"><code>cd231ca</code></a>
  Update GHES guidance to include reference to Node 20 version</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/de65e23aa2b7e23d713bb51fbfcb6d502f8667d8"><code>de65e23</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/upload-artifact/issues/712">#712</a>
  from actions/nebuk89-patch-1</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/8747d8cd7632611ad6060b528f3e0f654c98869c"><code>8747d8c</code></a>
  Update README.md</li>
  <li>Additional commits viewable in <a
  href="https://github.com/actions/upload-artifact/compare/v4...v5">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/upload-artifact&package-manager=github_actions&previous-version=4&new-version=5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-11-02 20:38:45 -08:00
  f5945d7c03
• revert #5812 release file (#5887)

  revert #5812 release file

  Ahmed Ibrahim · 2025-10-28 20:06:16 +00:00
  e3f913f567
• chore: speed-up pipeline (#5812)

  Speed-up pipeline by:
  * Decoupling tests and clippy
  * Use pre-built binary in tests
  * `sccache` for caching of the builds

  jif-oai · 2025-10-28 14:08:52 +00:00
  7ff142d93f
• chore(ci): Speed up macOS builds by using larger runner (#5234)

  Saves about 2min per build
  
  https://github.com/openai/codex/actions/runs/18544852356/job/52860637804
  vs
  https://github.com/openai/codex/actions/runs/18545106208/job/52861427485

  Javi · 2025-10-20 23:47:38 +00:00
  df15a2f6ef
• Revert "feat(CI): Allow running rust-release manually and in dry-run mode (#5232)" (#5266)

  This reverts commit 5fa7844ad7.

  Javi · 2025-10-16 21:58:44 +00:00
  fc1723f131
• feat(CI): Allow running rust-release manually and in dry-run mode (#5232)

  Example:
  https://github.com/openai/codex/actions/runs/18544852356/job/52860637804

  Javi · 2025-10-15 23:50:18 +00:00
  5fa7844ad7
• feat(releases): Add macOS notarization step to release workflow (#5233)

  Also: fixed the contents of the `APPLE_CERTIFICATE_P12` and
  `APPLE_CERTIFICATE_PASSWORD` secrets, so the code-signing step will use
  the right certificate now.

  Javi · 2025-10-15 23:31:52 +00:00
  84c9b574f9
• Shijie/codesign binary (#4899)

  ### Summary
  * Added code signing for MacOS. 
  
  ### Before - UNSIGNED codex-aarch64
  <img width="716" height="334" alt="Screenshot 2025-10-08 at 11 53 28 AM"
  src="https://github.com/user-attachments/assets/276000f1-8be2-4b89-9aff-858fac28b4d4"
  />
  
  ### After - SIGNED codex-aarch64
  <img width="706" height="410" alt="Screenshot 2025-10-08 at 11 52 20 AM"
  src="https://github.com/user-attachments/assets/927528f8-2686-4d15-b3cb-c47a8f11ef29"
  />

  Shijie Rao · 2025-10-09 09:42:24 -07:00
  7b4a4c2219
• fix: pnpm/action-setup@v4 should run before actions/setup-node@v5 (#4555)

  `rust-release.yml` just failed:
  
  https://github.com/openai/codex/actions/runs/18167317356/job/51714366768
  
  The error is:
  
  > Error: Unable to locate executable file: pnpm. Please verify either
  the file path exists or the file can be found within a directory
  specified by the PATH environment variable. Also check the file mode to
  verify the file is executable.
  
  We need to install `pnpm` first like we do in `ci.yml`:
  
  
  https://github.com/openai/codex/blob/f815157dd9d02377f827c0b6cd1cd1d0386461f8/.github/workflows/ci.yml#L17-L25

  Michael Bolin · 2025-10-01 09:04:14 -07:00
  325fad1d92
• chore: introduce publishing logic for @openai/codex-sdk (#4543)

  There was a bit of copypasta I put up with when were publishing two
  packages to npm, but now that it's three, I created some more scripts to
  consolidate things.
  
  With this change, I ran:
  
  ```shell
  ./scripts/stage_npm_packages.py --release-version 0.43.0-alpha.8 --package codex --package codex-responses-api-proxy --package codex-sdk
  ```
  
  Indeed when it finished, I ended up with:
  
  ```shell
  $ tree dist
  dist
  └── npm
      ├── codex-npm-0.43.0-alpha.8.tgz
      ├── codex-responses-api-proxy-npm-0.43.0-alpha.8.tgz
      └── codex-sdk-npm-0.43.0-alpha.8.tgz
  $ tar tzvf dist/npm/codex-sdk-npm-0.43.0-alpha.8.tgz
  -rwxr-xr-x  0 0      0    25476720 Oct 26  1985 package/vendor/aarch64-apple-darwin/codex/codex
  -rwxr-xr-x  0 0      0    29871400 Oct 26  1985 package/vendor/aarch64-unknown-linux-musl/codex/codex
  -rwxr-xr-x  0 0      0    28368096 Oct 26  1985 package/vendor/x86_64-apple-darwin/codex/codex
  -rwxr-xr-x  0 0      0    36029472 Oct 26  1985 package/vendor/x86_64-unknown-linux-musl/codex/codex
  -rw-r--r--  0 0      0       10926 Oct 26  1985 package/LICENSE
  -rw-r--r--  0 0      0    30187520 Oct 26  1985 package/vendor/aarch64-pc-windows-msvc/codex/codex.exe
  -rw-r--r--  0 0      0    35277824 Oct 26  1985 package/vendor/x86_64-pc-windows-msvc/codex/codex.exe
  -rw-r--r--  0 0      0        4842 Oct 26  1985 package/dist/index.js
  -rw-r--r--  0 0      0        1347 Oct 26  1985 package/package.json
  -rw-r--r--  0 0      0        9867 Oct 26  1985 package/dist/index.js.map
  -rw-r--r--  0 0      0          12 Oct 26  1985 package/README.md
  -rw-r--r--  0 0      0        4287 Oct 26  1985 package/dist/index.d.ts
  ```

  Michael Bolin · 2025-10-01 08:29:59 -07:00
  f815157dd9
• feat: introduce npm module for codex-responses-api-proxy (#4417)

  This PR expands `.github/workflows/rust-release.yml` so that it also
  builds and publishes the `npm` module for
  `@openai/codex-responses-api-proxy` in addition to `@openai/codex`. Note
  both `npm` modules are similar, in that they each contain a single `.js`
  file that is a thin launcher around the appropriate native executable.
  (Since we have a minimal dependency on Node.js, I also lowered the
  minimum version from 20 to 16 and verified that works on my machine.)
  
  As part of this change, we tighten up some of the docs around
  `codex-responses-api-proxy` and ensure the details regarding protecting
  the `OPENAI_API_KEY` in memory match the implementation.
  
  To test the `npm` build process, I ran:
  
  ```
  ./codex-cli/scripts/build_npm_package.py --package codex-responses-api-proxy --version 0.43.0-alpha.3
  ```
  
  which stages the `npm` module for `@openai/codex-responses-api-proxy` in
  a temp directory, using the binary artifacts from
  https://github.com/openai/codex/releases/tag/rust-v0.43.0-alpha.3.

  Michael Bolin · 2025-09-28 19:34:06 -07:00
  618a42adf5
• feat: build codex-responses-api-proxy for all platforms as part of the GitHub Release (#4406)

  This should make the `codex-responses-api-proxy` binaries available for
  all platforms in a GitHub Release as well as a corresponding DotSlash
  file.
  
  Making `codex-responses-api-proxy` available as an `npm` module will be
  done in a follow-up PR.
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/4404).
  * __->__ #4406
  * #4404
  * #4403

  Michael Bolin · 2025-09-28 15:25:15 -07:00
  ff6dbff0b6
• chore: upgrade to Rust 1.90 (#4124)

  Inspired by Dependabot's attempt to do this:
  https://github.com/openai/codex/pull/4029
  
  The new version of Clippy found some unused structs that are removed in
  this PR.
  
  Though nothing stood out to me in the Release Notes in terms of things
  we should start to take advantage of:
  https://blog.rust-lang.org/2025/09/18/Rust-1.90.0/.

  Michael Bolin · 2025-09-24 08:32:00 -07:00
  639a6fd2f3
• fix: npm publish --tag alpha when building an alpha release (#4112)

  This updates our release process so that when we build an alpha of the
  Codex CLI (as determined by pushing a tag of the format
  `rust-v<cli-version>-alpha.<alpha-version>`), we will now publish the
  corresponding npm module publicly, but under the `alpha` tag. As you can
  see, this PR adds `--tag alpha` to the `npm publish` command, as
  appropriate.

  Michael Bolin · 2025-09-23 23:03:43 -07:00
  9336f2b84b
• fix: vendor ripgrep in the npm module (#3660)

  We try to ensure ripgrep (`rg`) is provided with Codex.
  
  - For `brew`, we declare it as a dependency of our formula:
  
  https://github.com/Homebrew/homebrew-core/blob/08d82d8b006a19efbe234477bc8b18d35b5fef50/Formula/c/codex.rb#L24
  - For `npm`, we declare `@vscode/ripgrep` as a dependency, which
  installs the platform-specific binary as part of a `postinstall` script:
  
  https://github.com/openai/codex/blob/fdb8dadcae9f8eec91bc3eb5a17b3f9b19e28505/codex-cli/package.json#L22
  - Users who download the CLI directly from GitHub Releases are on their
  own.
  
  In practice, I have seen `@vscode/ripgrep` fail on occasion. Here is a
  trace from a GitHub workflow:
  
  ```
  npm error code 1
  npm error path /Users/runner/hostedtoolcache/node/20.19.5/arm64/lib/node_modules/@openai/codex/node_modules/@vscode/ripgrep
  npm error command failed
  npm error command sh -c node ./lib/postinstall.js
  npm error Finding release for v13.0.0-13
  npm error GET https://api.github.com/repos/microsoft/ripgrep-prebuilt/releases/tags/v13.0.0-13
  npm error Deleting invalid download cache
  npm error Download attempt 1 failed, retrying in 2 seconds...
  npm error Finding release for v13.0.0-13
  npm error GET https://api.github.com/repos/microsoft/ripgrep-prebuilt/releases/tags/v13.0.0-13
  npm error Deleting invalid download cache
  npm error Download attempt 2 failed, retrying in 4 seconds...
  npm error Finding release for v13.0.0-13
  npm error GET https://api.github.com/repos/microsoft/ripgrep-prebuilt/releases/tags/v13.0.0-13
  npm error Deleting invalid download cache
  npm error Download attempt 3 failed, retrying in 8 seconds...
  npm error Finding release for v13.0.0-13
  npm error GET https://api.github.com/repos/microsoft/ripgrep-prebuilt/releases/tags/v13.0.0-13
  npm error Deleting invalid download cache
  npm error Download attempt 4 failed, retrying in 16 seconds...
  npm error Finding release for v13.0.0-13
  npm error GET https://api.github.com/repos/microsoft/ripgrep-prebuilt/releases/tags/v13.0.0-13
  npm error Deleting invalid download cache
  npm error Error: Request failed: 403
  ```
  
  To eliminate this error, this PR changes things so that we vendor the
  `rg` binary into https://www.npmjs.com/package/@openai/codex so it is
  guaranteed to be included when a user runs `npm i -g @openai/codex`.
  
  The downside of this approach is the increase in package size: we
  include the `rg` executable for six architectures (in addition to the
  six copies of `codex` we already include). In a follow-up, I plan to add
  support for "slices" of our npm module, so that soon users will be able
  to do:
  
  ```
  npm install -g @openai/codex@aarch64-apple-darwin
  ```
  
  Admittedly, this is a sizable change and I tried to clean some things up
  in the process:
  
  - `install_native_deps.sh` has been replaced by `install_native_deps.py`
  - `stage_release.sh` and `stage_rust_release.py` has been replaced by
  `build_npm_package.py`
  
  We now vendor in a DotSlash file for ripgrep (as a modest attempt to
  facilitate local testing) and then build up the extension by:
  
  - creating a temp directory and copying `package.json` over to it with
  the target value for `"version"`
  - finding the GitHub workflow that corresponds to the
  `--release-version` and copying the various `codex` artifacts to
  respective `vendor/TARGET_TRIPLE/codex` folder
  - downloading the `rg` artifacts specified in the DotSlash file and
  copying them over to the respective `vendor/TARGET_TRIPLE/path` folder
  - if `--pack-output` is specified, runs `npm pack` on the temp directory
  
  To test, I downloaded the artifact produced by this CI job:
  
  
  https://github.com/openai/codex/actions/runs/17961595388/job/51085840022?pr=3660
  
  and verified that `node ./bin/codex.js 'which -a rg'` worked as
  intended.

  Michael Bolin · 2025-09-23 23:00:33 -07:00
  af37785bca
• fix: specify --repo when calling gh (#3806)

  Often, `gh` infers `--repo` when it is run from a Git clone, but our
  `publish-npm` step is designed to avoid the overhead of cloning the
  repo, so add the `--repo` option explicitly to fix things.

  Michael Bolin · 2025-09-17 11:05:22 -07:00
  e5fdb5b0fd
• fix: make publish-npm its own job with specific permissions (#3767)

  The build for `v0.37.0-alpha.3` failed on the `Create GitHub Release`
  step:
  
  https://github.com/openai/codex/actions/runs/17786866086/job/50556513221
  
  with:
  
  ```
  ⚠️ GitHub release failed with status: 403
  {"message":"Resource not accessible by integration","documentation_url":"https://docs.github.com/rest/releases/releases#create-a-release","status":"403"}
  Skip retry — your GitHub token/PAT does not have the required permission to create a release
  ```
  
  I believe I should have not introduced a top-level `permissions` for the
  workflow in https://github.com/openai/codex/pull/3431 because that
  affected the `permissions` for each job in the workflow.
  
  This PR introduces `publish-npm` as its own job, which allows us to:
  
  - consolidate all the Node.js-related steps required for publishing
  - limit the reach of the `id-token: write` permission
  - skip it altogether if is an alpha build
  
  With this PR, each of `release`, `publish-npm`, and `update-branch` has
  an explicit `permissions` block.

  Michael Bolin · 2025-09-16 22:55:53 -07:00
  5332f6e215
• fix: ensure pnpm is installed before running npm install (#3763)

  Note we do the same thing in `ci.yml`:
  
  
  https://github.com/openai/codex/blob/791d7b125f4166ef576531075688aac339350011/.github/workflows/ci.yml#L17-L25

  Michael Bolin · 2025-09-16 21:36:13 -07:00
  5d87f5d24a
• fix: make GitHub Action publish to npm using trusted publishing (#3431)
  Michael Bolin · 2025-09-16 20:33:59 -07:00
  791d7b125f
• chore: restore prerelease logic in rust-release.yml (#3659)

  Revert #3645.

  Michael Bolin · 2025-09-15 17:52:49 +00:00
  2df7f7efe5
• chore: set prerelease:true for now (#3645)
  Michael Bolin · 2025-09-15 07:17:46 -07:00
  6aafe37752
• fix: use -F instead of -f for force=true in gh call (#3486)

  Apparently `-F` is the correct thing to use. From the code sample on 
  
  
  https://docs.github.com/en/rest/git/refs?apiVersion=2022-11-28#update-a-reference
  
  ```shell
  gh api \
    --method PATCH \
    -H "Accept: application/vnd.github+json" \
    -H "X-GitHub-Api-Version: 2022-11-28" \
    /repos/OWNER/REPO/git/refs/REF \
     -f 'sha=aa218f56b14c9653891f9e74264a383fa43fefbd' -F "force=true"
  ```
  
  Also, I ran the following locally and verified it worked:
  
  ```shell
  export GITHUB_REPOSITORY=openai/codex
  export GITHUB_SHA=305252b2fb2d57bb40a9e4bad269db9a761f7099
  gh api \
    repos/${GITHUB_REPOSITORY}/git/refs/heads/latest-alpha-cli \
    -X PATCH \
    -f sha="${GITHUB_SHA}" \
    -F force=true
  ```
  
  `$GITHUB_REPOSITORY` and `$GITHUB_SHA` should already be available as
  environment variables for the `run` step without having to be redeclared
  in the `env` section.

  Michael Bolin · 2025-09-11 11:32:47 -07:00
  167154178b
• chore: rust-release.yml should update the latest-alpha-cli branch (#3458)

  This updates `rust-release.yml` so that the last step of creating a
  release entails updating the `latest-alpha-cli` branch to point to the
  tag used to create the latest release. This will facilitate building
  automation to identify the most recent alpha release of Codex CLI
  (though note this branch could also point to an official release, as it
  is implemented today).
  
  This introduces a new job, `update-branch`, which depends on the
  `release` job. I made it separate from the `release` job because
  `update-branch` needs the `contents: write` permission, so this limits
  the amount of work we do with that permission.
  
  Note I also created a branch protection rule for `latest-alpha-cli`
  that:
  
  - specifies repository admins as the only members of the bypass list
  - only those with bypass permissions can create, update, or delete this
  branch
  - this branch requires a linear history
  - note that force pushes _are_ allowed
  
  This is the first step in fixing
  https://github.com/openai/codex/issues/3098.

  Michael Bolin · 2025-09-11 08:06:28 -07:00
  86e0f31a7e
• fix: install zstd on the windows-11-arm image used to cut a release (#3066)

  https://github.com/openai/codex/pull/3062 added `windows-11-arm` to the
  list of images used for building, but the job to build an alpha just
  failed:
  
  https://github.com/openai/codex/actions/runs/17415565601
  
  with this error:
  
  ```
  Creating archive: codex-aarch64-pc-windows-msvc.exe.zip
  
  Add new data to archive: 1 file, 20484096 bytes (20 MiB)
  
  
  Files read from disk: 1
  Archive size: 7869619 bytes (7686 KiB)
  Everything is Ok
  C:\a\_temp\0e71926f-4d8a-42ae-a337-a9627acc9c57.sh: line 34: zstd: command not found
  ```
  
  so allegedly this should fix it? I'm surprised this was not necessary
  for the `windows-latest` image, though.

  Michael Bolin · 2025-09-02 14:23:51 -07:00
  13e5b567f5
• fix: leverage windows-11-arm for Windows ARM builds (#3062)

  This is in support of https://github.com/openai/codex/issues/2979.
  
  Once we have a release out, we can update the npm module and the VS Code
  extension to take advantage of this.

  Michael Bolin · 2025-09-02 12:56:09 -07:00
  4b426f7e1e
• fix: try to populate the Windows cache for release builds when PRs are put up for review (#2884)

  Windows release builds take close to 12 minutes whereas Mac/Linux are
  closer to 5. Let's see if this speeds things up?

  Michael Bolin · 2025-08-28 23:48:29 -07:00
  7eee69d821