207 Commits

• download new windows binaries when staging npm package (#8203)
  iceweasel-oai · 2025-12-17 13:34:32 -08:00
  a9a7cf3488
• fix the models script (#8163)

  look at
  [failure](https://github.com/openai/codex/actions/runs/20294685253/job/58285812472)

  Ahmed Ibrahim · 2025-12-16 23:16:54 -08:00
  ebd1099b39
• Add user_agent header (#8149)

  add `user_agent` header and remove rust tool chain

  Ahmed Ibrahim · 2025-12-16 16:23:24 -08:00
  14d80c35a9
• include new windows binaries in npm package. (#8140)

  The Windows Elevated Sandbox uses two new binaries:
  
  codex-windows-sandbox-setup.exe
  codex-command-runner.exe
  
  This PR includes them when installing native deps and packaging for npm

  iceweasel-oai · 2025-12-16 16:14:33 -08:00
  3a0d9bca64
• Add a workflow for a hardcoded version of models (#8118)

  - Fetch the endpoint
  - Make a PR

  Ahmed Ibrahim · 2025-12-16 15:39:36 -08:00
  cafcd60ef0
• Upgrade GitHub Actions for Node 24 compatibility (#8102)

  ## Summary
  
  Upgrade GitHub Actions to their latest versions to ensure compatibility
  with Node 24, as Node 20 will reach end-of-life in April 2026.
  
  ## Changes
  
  | Action | Old Version(s) | New Version | Release | Files |
  |--------|---------------|-------------|---------|-------|
  | `actions/setup-node` |
  [`v5`](https://github.com/actions/setup-node/releases/tag/v5) |
  [`v6`](https://github.com/actions/setup-node/releases/tag/v6) |
  [Release](https://github.com/actions/setup-node/releases/tag/v6) |
  ci.yml, rust-release.yml, sdk.yml, shell-tool-mcp-ci.yml,
  shell-tool-mcp.yml |
  
  ## Context
  
  Per [GitHub's
  announcement](https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/),
  Node 20 is being deprecated and runners will begin using Node 24 by
  default starting March 4th, 2026.
  
  ### Why this matters
  
  - **Node 20 EOL**: April 2026
  - **Node 24 default**: March 4th, 2026
  - **Action**: Update to latest action versions that support Node 24
  
  ### Security Note
  
  Actions that were previously pinned to commit SHAs remain pinned to SHAs
  (updated to the latest release SHA) to maintain the security benefits of
  immutable references.
  
  ### Testing
  
  These changes only affect CI/CD workflow configurations and should not
  impact application functionality. The workflows should be tested by
  running them on a branch before merging.

  Salman Chishti · 2025-12-16 11:31:25 -08:00
  5ceeaa96b8
• chore: mac codesign refactor (#8085)

  ### Summary
  Similar to our linux and windows codesign, moving mac codesign logic
  into its own files.

  Shijie Rao · 2025-12-16 11:20:44 -08:00
  b27c702e83
• chore(ci): drop Homebrew origin/main workaround for macOS runners (#8084)

  ## Notes
  
  GitHub Actions macOS runners now ship a Homebrew version (5.0.5) that
  includes the fix that was needed in a change, so it's possible to remove
  the temporary CI step that forced using brew from origin/main (added in
  #7680).
  
  Proof of macOS GitHub Actions coming packaged with 5.0.5 - latest commit
  on `main`
  (https://github.com/openai/codex/actions/runs/20245177832/job/58123247999)
  - <img width="1286" height="136" alt="image"
  src="https://github.com/user-attachments/assets/8b25fd57-dad5-45c5-907c-4f4da6a36c3f"
  />
  
  `actions/runner-images` upgraded the macOS 14 image from pre-release to
  release today
  (https://github.com/actions/runner-images/releases/tag/macos-14-arm64%2F20251210.0045)
  
  - <img width="1076" height="793" alt="image"
  src="https://github.com/user-attachments/assets/357ea4bd-40b0-49c3-a6cd-e7d87ba6766d"
  />

  Victor Vannara · 2025-12-15 15:29:43 -08:00
  fbeb7d47a9
• stage new windows sandbox binaries as artifacts (#8076)
  iceweasel-oai · 2025-12-15 09:15:32 -08:00
  c696456bf1
• chore(deps): bump actions/cache from 4 to 5 (#8039)

  Bumps [actions/cache](https://github.com/actions/cache) from 4 to 5.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/cache/releases">actions/cache's
  releases</a>.</em></p>
  <blockquote>
  <h2>v5.0.0</h2>
  <blockquote>
  <p>[!IMPORTANT]
  <strong><code>actions/cache@v5</code> runs on the Node.js 24 runtime and
  requires a minimum Actions Runner version of
  <code>2.327.1</code>.</strong></p>
  <p>If you are using self-hosted runners, ensure they are updated before
  upgrading.</p>
  </blockquote>
  <hr />
  <h2>What's Changed</h2>
  <ul>
  <li>Upgrade to use node24 by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/cache/pull/1630">actions/cache#1630</a></li>
  <li>Prepare v5.0.0 release by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/cache/pull/1684">actions/cache#1684</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/cache/compare/v4.3.0...v5.0.0">https://github.com/actions/cache/compare/v4.3.0...v5.0.0</a></p>
  <h2>v4.3.0</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Add note on runner versions by <a
  href="https://github.com/GhadimiR"><code>@​GhadimiR</code></a> in <a
  href="https://redirect.github.com/actions/cache/pull/1642">actions/cache#1642</a></li>
  <li>Prepare <code>v4.3.0</code> release by <a
  href="https://github.com/Link"><code>@​Link</code></a>- in <a
  href="https://redirect.github.com/actions/cache/pull/1655">actions/cache#1655</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/GhadimiR"><code>@​GhadimiR</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/cache/pull/1642">actions/cache#1642</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/cache/compare/v4...v4.3.0">https://github.com/actions/cache/compare/v4...v4.3.0</a></p>
  <h2>v4.2.4</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Update README.md by <a
  href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
  href="https://redirect.github.com/actions/cache/pull/1620">actions/cache#1620</a></li>
  <li>Upgrade <code>@actions/cache</code> to <code>4.0.5</code> and move
  <code>@protobuf-ts/plugin</code> to dev depdencies by <a
  href="https://github.com/Link"><code>@​Link</code></a>- in <a
  href="https://redirect.github.com/actions/cache/pull/1634">actions/cache#1634</a></li>
  <li>Prepare release <code>4.2.4</code> by <a
  href="https://github.com/Link"><code>@​Link</code></a>- in <a
  href="https://redirect.github.com/actions/cache/pull/1636">actions/cache#1636</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/actions/cache/pull/1620">actions/cache#1620</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/cache/compare/v4...v4.2.4">https://github.com/actions/cache/compare/v4...v4.2.4</a></p>
  <h2>v4.2.3</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Update to use <code>@​actions/cache</code> 4.0.3 package &amp;
  prepare for new release by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/cache/pull/1577">actions/cache#1577</a>
  (SAS tokens for cache entries are now masked in debug logs)</li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/cache/pull/1577">actions/cache#1577</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/cache/compare/v4.2.2...v4.2.3">https://github.com/actions/cache/compare/v4.2.2...v4.2.3</a></p>
  <!-- raw HTML omitted -->
  </blockquote>
  <p>... (truncated)</p>
  </details>
  <details>
  <summary>Changelog</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's
  changelog</a>.</em></p>
  <blockquote>
  <h1>Releases</h1>
  <h2>Changelog</h2>
  <h3>5.0.1</h3>
  <ul>
  <li>Update <code>@azure/storage-blob</code> to <code>^12.29.1</code> via
  <code>@actions/cache@5.0.1</code> <a
  href="https://redirect.github.com/actions/cache/pull/1685">#1685</a></li>
  </ul>
  <h3>5.0.0</h3>
  <blockquote>
  <p>[!IMPORTANT]
  <code>actions/cache@v5</code> runs on the Node.js 24 runtime and
  requires a minimum Actions Runner version of <code>2.327.1</code>.
  If you are using self-hosted runners, ensure they are updated before
  upgrading.</p>
  </blockquote>
  <h3>4.3.0</h3>
  <ul>
  <li>Bump <code>@actions/cache</code> to <a
  href="https://redirect.github.com/actions/toolkit/pull/2132">v4.1.0</a></li>
  </ul>
  <h3>4.2.4</h3>
  <ul>
  <li>Bump <code>@actions/cache</code> to v4.0.5</li>
  </ul>
  <h3>4.2.3</h3>
  <ul>
  <li>Bump <code>@actions/cache</code> to v4.0.3 (obfuscates SAS token in
  debug logs for cache entries)</li>
  </ul>
  <h3>4.2.2</h3>
  <ul>
  <li>Bump <code>@actions/cache</code> to v4.0.2</li>
  </ul>
  <h3>4.2.1</h3>
  <ul>
  <li>Bump <code>@actions/cache</code> to v4.0.1</li>
  </ul>
  <h3>4.2.0</h3>
  <p>TLDR; The cache backend service has been rewritten from the ground up
  for improved performance and reliability. <a
  href="https://github.com/actions/cache">actions/cache</a> now integrates
  with the new cache service (v2) APIs.</p>
  <p>The new service will gradually roll out as of <strong>February 1st,
  2025</strong>. The legacy service will also be sunset on the same date.
  Changes in these release are <strong>fully backward
  compatible</strong>.</p>
  <p><strong>We are deprecating some versions of this action</strong>. We
  recommend upgrading to version <code>v4</code> or <code>v3</code> as
  soon as possible before <strong>February 1st, 2025.</strong> (Upgrade
  instructions below).</p>
  <p>If you are using pinned SHAs, please use the SHAs of versions
  <code>v4.2.0</code> or <code>v3.4.0</code></p>
  <p>If you do not upgrade, all workflow runs using any of the deprecated
  <a href="https://github.com/actions/cache">actions/cache</a> will
  fail.</p>
  <p>Upgrading to the recommended versions will not break your
  workflows.</p>
  <h3>4.1.2</h3>
  <!-- raw HTML omitted -->
  </blockquote>
  <p>... (truncated)</p>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/actions/cache/commit/9255dc7a253b0ccc959486e2bca901246202afeb"><code>9255dc7</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/cache/issues/1686">#1686</a>
  from actions/cache-v5.0.1-release</li>
  <li><a
  href="https://github.com/actions/cache/commit/8ff5423e8b66eacab4e638ee52abbd2cb831366a"><code>8ff5423</code></a>
  chore: release v5.0.1</li>
  <li><a
  href="https://github.com/actions/cache/commit/9233019a152bc768059ac1768b8e4403b5da16c1"><code>9233019</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/cache/issues/1685">#1685</a>
  from salmanmkc/node24-storage-blob-fix</li>
  <li><a
  href="https://github.com/actions/cache/commit/b975f2bb844529e1063ad882c609b224bcd66eb6"><code>b975f2b</code></a>
  fix: add peer property to package-lock.json for dependencies</li>
  <li><a
  href="https://github.com/actions/cache/commit/d0a0e1813491d01d574c95f8d189f62622bbb2ae"><code>d0a0e18</code></a>
  fix: update license files for <code>@​actions/cache</code>,
  fast-xml-parser, and strnum</li>
  <li><a
  href="https://github.com/actions/cache/commit/74de208dcfcbe85c0e7154e7b17e4105fe2554ff"><code>74de208</code></a>
  fix: update <code>@​actions/cache</code> to ^5.0.1 for Node.js 24
  punycode fix</li>
  <li><a
  href="https://github.com/actions/cache/commit/ac7f1152ead02e89c14b5456d14ab17591e74cfb"><code>ac7f115</code></a>
  peer</li>
  <li><a
  href="https://github.com/actions/cache/commit/b0f846b50b6061d7a2ca6f1a2fea61d4a65d1a16"><code>b0f846b</code></a>
  fix: update <code>@​actions/cache</code> with storage-blob fix for
  Node.js 24 punycode depr...</li>
  <li><a
  href="https://github.com/actions/cache/commit/a7833574556fa59680c1b7cb190c1735db73ebf0"><code>a783357</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/cache/issues/1684">#1684</a>
  from actions/prepare-cache-v5-release</li>
  <li><a
  href="https://github.com/actions/cache/commit/3bb0d78750a39cefce0c2b5a0a9801052b4359ad"><code>3bb0d78</code></a>
  docs: highlight v5 runner requirement in releases</li>
  <li>Additional commits viewable in <a
  href="https://github.com/actions/cache/compare/v4...v5">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/cache&package-manager=github_actions&previous-version=4&new-version=5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-12-14 22:30:48 -08:00
  a21f0ac033
• chore(deps): bump actions/download-artifact from 4 to 7 (#8037)

  Bumps
  [actions/download-artifact](https://github.com/actions/download-artifact)
  from 4 to 7.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/download-artifact/releases">actions/download-artifact's
  releases</a>.</em></p>
  <blockquote>
  <h2>v7.0.0</h2>
  <h2>v7 - What's new</h2>
  <blockquote>
  <p>[!IMPORTANT]
  actions/download-artifact@v7 now runs on Node.js 24 (<code>runs.using:
  node24</code>) and requires a minimum Actions Runner version of 2.327.1.
  If you are using self-hosted runners, ensure they are updated before
  upgrading.</p>
  </blockquote>
  <h3>Node.js 24</h3>
  <p>This release updates the runtime to Node.js 24. v6 had preliminary
  support for Node 24, however this action was by default still running on
  Node.js 20. Now this action by default will run on Node.js 24.</p>
  <h2>What's Changed</h2>
  <ul>
  <li>Update GHES guidance to include reference to Node 20 version by <a
  href="https://github.com/patrikpolyak"><code>@​patrikpolyak</code></a>
  in <a
  href="https://redirect.github.com/actions/download-artifact/pull/440">actions/download-artifact#440</a></li>
  <li>Download Artifact Node24 support by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/download-artifact/pull/415">actions/download-artifact#415</a></li>
  <li>fix: update <code>@​actions/artifact</code> to fix Node.js 24
  punycode deprecation by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/download-artifact/pull/451">actions/download-artifact#451</a></li>
  <li>prepare release v7.0.0 for Node.js 24 support by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/download-artifact/pull/452">actions/download-artifact#452</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a
  href="https://github.com/patrikpolyak"><code>@​patrikpolyak</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/download-artifact/pull/440">actions/download-artifact#440</a></li>
  <li><a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/download-artifact/pull/415">actions/download-artifact#415</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/download-artifact/compare/v6.0.0...v7.0.0">https://github.com/actions/download-artifact/compare/v6.0.0...v7.0.0</a></p>
  <h2>v6.0.0</h2>
  <h2>What's Changed</h2>
  <p><strong>BREAKING CHANGE:</strong> this update supports Node
  <code>v24.x</code>. This is not a breaking change per-se but we're
  treating it as such.</p>
  <ul>
  <li>Update README for download-artifact v5 changes by <a
  href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
  href="https://redirect.github.com/actions/download-artifact/pull/417">actions/download-artifact#417</a></li>
  <li>Update README with artifact extraction details by <a
  href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
  href="https://redirect.github.com/actions/download-artifact/pull/424">actions/download-artifact#424</a></li>
  <li>Readme: spell out the first use of GHES by <a
  href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
  <a
  href="https://redirect.github.com/actions/download-artifact/pull/431">actions/download-artifact#431</a></li>
  <li>Bump <code>@actions/artifact</code> to <code>v4.0.0</code></li>
  <li>Prepare <code>v6.0.0</code> by <a
  href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
  <a
  href="https://redirect.github.com/actions/download-artifact/pull/438">actions/download-artifact#438</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a
  href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/download-artifact/pull/431">actions/download-artifact#431</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/download-artifact/compare/v5...v6.0.0">https://github.com/actions/download-artifact/compare/v5...v6.0.0</a></p>
  <h2>v5.0.0</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Update README.md by <a
  href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
  href="https://redirect.github.com/actions/download-artifact/pull/407">actions/download-artifact#407</a></li>
  <li>BREAKING fix: inconsistent path behavior for single artifact
  downloads by ID by <a
  href="https://github.com/GrantBirki"><code>@​GrantBirki</code></a> in <a
  href="https://redirect.github.com/actions/download-artifact/pull/416">actions/download-artifact#416</a></li>
  </ul>
  <h2>v5.0.0</h2>
  <h3>🚨 Breaking Change</h3>
  <p>This release fixes an inconsistency in path behavior for single
  artifact downloads by ID. <strong>If you're downloading single artifacts
  by ID, the output path may change.</strong></p>
  <h4>What Changed</h4>
  <!-- raw HTML omitted -->
  </blockquote>
  <p>... (truncated)</p>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/actions/download-artifact/commit/37930b1c2abaa49bbe596cd826c3c89aef350131"><code>37930b1</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/download-artifact/issues/452">#452</a>
  from actions/download-artifact-v7-release</li>
  <li><a
  href="https://github.com/actions/download-artifact/commit/72582b9e0acd370909e83fa4a1fd0fca3ad452d8"><code>72582b9</code></a>
  doc: update readme</li>
  <li><a
  href="https://github.com/actions/download-artifact/commit/0d2ec9d4cbcefe257d822f108de2a1f15f8da9f6"><code>0d2ec9d</code></a>
  chore: release v7.0.0 for Node.js 24 support</li>
  <li><a
  href="https://github.com/actions/download-artifact/commit/fd7ae8fda6dc16277a9ffbc91cdb0eedf156e912"><code>fd7ae8f</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/download-artifact/issues/451">#451</a>
  from actions/fix-storage-blob</li>
  <li><a
  href="https://github.com/actions/download-artifact/commit/d484700543354b15886d6a52910cf61b7f1d2b27"><code>d484700</code></a>
  chore: restore minimatch.dep.yml license file</li>
  <li><a
  href="https://github.com/actions/download-artifact/commit/03a808050efe42bb6ad85281890afd4e4546672c"><code>03a8080</code></a>
  chore: remove obsolete dependency license files</li>
  <li><a
  href="https://github.com/actions/download-artifact/commit/56fe6d904b0968950f8b68ea17774c54973ed5e2"><code>56fe6d9</code></a>
  chore: update <code>@​actions/artifact</code> license file to 5.0.1</li>
  <li><a
  href="https://github.com/actions/download-artifact/commit/8e3ebc4ab4d2e095e5eb44ba1a4a53b6b03976ad"><code>8e3ebc4</code></a>
  chore: update package-lock.json with <code>@​actions/artifact</code><a
  href="https://github.com/5"><code>@​5</code></a>.0.1</li>
  <li><a
  href="https://github.com/actions/download-artifact/commit/1e3c4b4d4906c98ab57453c24efefdf16c078044"><code>1e3c4b4</code></a>
  fix: update <code>@​actions/artifact</code> to ^5.0.0 for Node.js 24
  punycode fix</li>
  <li><a
  href="https://github.com/actions/download-artifact/commit/458627d354794c71bc386c8d5839d20b5885fe2a"><code>458627d</code></a>
  chore: use local <code>@​actions/artifact</code> package for Node.js 24
  testing</li>
  <li>Additional commits viewable in <a
  href="https://github.com/actions/download-artifact/compare/v4...v7">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/download-artifact&package-manager=github_actions&previous-version=4&new-version=7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-12-14 22:30:23 -08:00
  b349ec4e94
• chore(deps): bump actions/upload-artifact from 5 to 6 (#8038)

  Bumps
  [actions/upload-artifact](https://github.com/actions/upload-artifact)
  from 5 to 6.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's
  releases</a>.</em></p>
  <blockquote>
  <h2>v6.0.0</h2>
  <h2>v6 - What's new</h2>
  <blockquote>
  <p>[!IMPORTANT]
  actions/upload-artifact@v6 now runs on Node.js 24 (<code>runs.using:
  node24</code>) and requires a minimum Actions Runner version of 2.327.1.
  If you are using self-hosted runners, ensure they are updated before
  upgrading.</p>
  </blockquote>
  <h3>Node.js 24</h3>
  <p>This release updates the runtime to Node.js 24. v5 had preliminary
  support for Node.js 24, however this action was by default still running
  on Node.js 20. Now this action by default will run on Node.js 24.</p>
  <h2>What's Changed</h2>
  <ul>
  <li>Upload Artifact Node 24 support by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/719">actions/upload-artifact#719</a></li>
  <li>fix: update <code>@​actions/artifact</code> for Node.js 24 punycode
  deprecation by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/744">actions/upload-artifact#744</a></li>
  <li>prepare release v6.0.0 for Node.js 24 support by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/745">actions/upload-artifact#745</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0">https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0</a></p>
  </blockquote>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/b7c566a772e6b6bfb58ed0dc250532a479d7789f"><code>b7c566a</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/upload-artifact/issues/745">#745</a>
  from actions/upload-artifact-v6-release</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/e516bc8500aaf3d07d591fcd4ae6ab5f9c391d5b"><code>e516bc8</code></a>
  docs: correct description of Node.js 24 support in README</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/ddc45ed9bca9b38dbd643978d88e3981cdc91415"><code>ddc45ed</code></a>
  docs: update README to correct action name for Node.js 24 support</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/615b319bd27bb32c3d64dca6b6ed6974d5fbe653"><code>615b319</code></a>
  chore: release v6.0.0 for Node.js 24 support</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/017748b48f8610ca8e6af1222f4a618e84a9c703"><code>017748b</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/upload-artifact/issues/744">#744</a>
  from actions/fix-storage-blob</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/38d4c7997f5510fcc41fc4aae2a6b97becdbe7fc"><code>38d4c79</code></a>
  chore: rebuild dist</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/7d27270e0cfd253e666c44abac0711308d2d042f"><code>7d27270</code></a>
  chore: add missing license cache files for <code>@​actions/core</code>,
  <code>@​actions/io</code>, and mi...</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/5f643d3c9475505ccaf26d686ffbfb71a8387261"><code>5f643d3</code></a>
  chore: update license files for <code>@​actions/artifact</code><a
  href="https://github.com/5"><code>@​5</code></a>.0.1 dependencies</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/1df1684032c88614064493e1a0478fcb3583e1d0"><code>1df1684</code></a>
  chore: update package-lock.json with <code>@​actions/artifact</code><a
  href="https://github.com/5"><code>@​5</code></a>.0.1</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/b5b1a918401ee270935b6b1d857ae66c85f3be6f"><code>b5b1a91</code></a>
  fix: update <code>@​actions/artifact</code> to ^5.0.0 for Node.js 24
  punycode fix</li>
  <li>Additional commits viewable in <a
  href="https://github.com/actions/upload-artifact/compare/v5...v6">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/upload-artifact&package-manager=github_actions&previous-version=5&new-version=6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-12-14 22:13:57 -08:00
  dd68245a9d
• fix cargo build switch (#7948)
  iceweasel-oai · 2025-12-12 14:31:09 -08:00
  3d07cd6c0c
• Sign two additional exes for Windows (#7942)

  The elevated sandbox ships two exes
  * one for elevated setup of the sandbox
  * one to actually run commands under the sandbox user.
  
  This PR adds them to the windows signing step

  iceweasel-oai · 2025-12-12 13:33:42 -08:00
  4d2deb1098
• fix: ensure accept_elicitation_for_prompt_rule() test passes locally (#7832)

  When I originally introduced `accept_elicitation_for_prompt_rule()` in
  https://github.com/openai/codex/pull/7617, it worked for me locally
  because I had run `codex-rs/exec-server/tests/suite/bash` once myself,
  which had the side-effect of installing the corresponding DotSlash
  artifact.
  
  In CI, I added explicit logic to do this as part of
  `.github/workflows/rust-ci.yml`, which meant the test also passed in CI,
  but this logic should have been done as part of the test so that it
  would work locally for devs who had not installed the DotSlash artifact
  for `codex-rs/exec-server/tests/suite/bash` before. This PR updates the
  test to do this (and deletes the setup logic from `rust-ci.yml`),
  creating a new `DOTSLASH_CACHE` in a temp directory so that this is
  handled independently for each test.
  
  While here, also added a check to ensure that the `codex` binary has
  been built prior to running the test, as we have to ensure it is
  symlinked as `codex-linux-sandbox` on Linux in order for the integration
  test to work on that platform.

  Michael Bolin · 2025-12-10 15:17:13 -08:00
  87f5b69b24
• chore: disable trusted signing pkg cache hit (#7807)
  Shijie Rao · 2025-12-09 22:14:14 -08:00
  d1c5db5796
• Revert "Revert "feat: windows codesign with Azure trusted signing"" (#7806)

  Reverts openai/codex#7804

  Shijie Rao · 2025-12-09 20:42:00 -08:00
  ab9ddcd50b
• Revert "feat: windows codesign with Azure trusted signing" (#7804)

  Reverts openai/codex#7757

  Shijie Rao · 2025-12-09 20:19:37 -08:00
  f11520f5f1
• Revert "Revert "feat: windows codesign with Azure trusted signing"" (#7757)

  Reverts openai/codex#7753
  
  Updated the tag ref matching at
  https://github.com/openai/openai/pull/594858 so that release with tag
  change can be picked up correctly.

  Shijie Rao · 2025-12-09 19:31:46 -08:00
  42e0817398
• Revert "feat: windows codesign with Azure trusted signing" (#7753)

  Reverts openai/codex#7675

  Shijie Rao · 2025-12-08 16:09:28 -08:00
  0f2b589d5e
• feat: windows codesign with Azure trusted signing (#7675)

  ### Summary
  Set up codesign for windows dist with [Azure trusted
  signing](https://azure.microsoft.com/en-us/products/trusted-signing) and
  [its github action
  integration](https://github.com/Azure/trusted-signing-action).

  Shijie Rao · 2025-12-08 15:12:01 -08:00
  badda736c6
• feat: linux codesign with sigstore (#7674)

  ### Summary
  Linux codesigning with sigstore and test run output at
  https://github.com/openai/codex/actions/runs/19994328162?pr=7662.
  
  Sigstore is one of the few ways for codesigning for linux platform.
  Linux is open sourced and therefore binary/dist validation comes with
  the build itself instead of a central authority like Windows or Mac.
  Alternative here is to use GPG which again a public key included with
  the bundle for validation. Advantage with Sigstore is that we do not
  have to create a private key for signing but rather with[ keyless
  signing](https://docs.sigstore.dev/cosign/signing/overview/).
  
  This should be sufficient for us at this point and if we want to we can
  support GPG in the future.

  Shijie Rao · 2025-12-08 11:13:50 -08:00
  28e7218c0b
• fix: add integration tests for codex-exec-mcp-server with execpolicy (#7617)

  This PR introduces integration tests that run
  [codex-shell-tool-mcp](https://www.npmjs.com/package/@openai/codex-shell-tool-mcp)
  as a user would. Note that this requires running our fork of Bash, so we
  introduce a [DotSlash](https://dotslash-cli.com/) file for `bash` so
  that we can run the integration tests on multiple platforms without
  having to check the binaries into the repository. (As noted in the
  DotSlash file, it is slightly more heavyweight than necessary, which may
  be worth addressing as disk space in CI is limited:
  https://github.com/openai/codex/pull/7678.)
  
  To start, this PR adds two tests:
  
  - `list_tools()` makes the `list_tools` request to the MCP server and
  verifies we get the expected response
  - `accept_elicitation_for_prompt_rule()` defines a `prefix_rule()` with
  `decision="prompt"` and verifies the elicitation flow works as expected
  
  Though the `accept_elicitation_for_prompt_rule()` test **only works on
  Linux**, as this PR reveals that there are currently issues when running
  the Bash fork in a read-only sandbox on Linux. This will have to be
  fixed in a follow-up PR.
  
  Incidentally, getting this test run to correctly on macOS also requires
  a recent fix we made to `brew` that hasn't hit a mainline release yet,
  so getting CI green in this PR required
  https://github.com/openai/codex/pull/7680.

  Michael Bolin · 2025-12-07 06:39:38 +00:00
  3c3d3d1adc
• fix: ensure macOS CI runners for Rust tests include recent Homebrew fixes (#7680)

  As noted in the code comment, we introduced a key fix for `brew` in
  https://github.com/Homebrew/brew/pull/21157 that Codex needs, but it has
  not hit stable yet, so we update our CI job to use latest `brew` from
  `origin/main`.
  
  This is necessary for the new integration tests introduced in
  https://github.com/openai/codex/pull/7617.

  Michael Bolin · 2025-12-06 22:11:07 -08:00
  3c087e8fda
• fix: clear out space on ubuntu runners before running Rust tests (#7678)

  When I put up https://github.com/openai/codex/pull/7617 for review,
  initially I started seeing failures on the `ubuntu-24.04` runner used
  for Rust test runs for the `x86_64-unknown-linux-gnu` architecture. Chat
  suggested a number of things that could be removed to save space, which
  seems to help.

  Michael Bolin · 2025-12-06 21:46:07 -08:00
  7386e2efbc
• Fixed CLA action to properly exempt dependabot (#7429)
  Eric Traut · 2025-11-30 20:45:17 -08:00
  14df5c9492
• tmp: drop flaky ubuntu (#7300)
  jif-oai · 2025-11-25 18:15:19 +00:00
  865e225bde
• fix: Drop MacOS 13 (#7295)
  jif-oai · 2025-11-25 16:25:44 +00:00
  d8a7a63959
• Windows Sandbox: treat <workspace_root>/.git as read-only in workspace-write mode (#7142)

  this functionality is
  [supported](https://github.com/openai/codex/blob/main/codex-rs/protocol/src/protocol.rs#L421-L422)
  in the MacOs sandbox as well. Adding it to Windows for parity
  
  This PR also changes `rust-ci.yaml` to work around a github `hashFiles`
  issue. Others have done something
  [similar](https://github.com/openai/superassistant/pull/32156) today

  iceweasel-oai · 2025-11-24 12:41:21 -08:00
  99e5340c54
• chore: add cargo-deny configuration (#7119)

  - add GitHub workflow running cargo-deny on push/PR
  - document cargo-deny allowlist with workspace-dep notes and advisory
  ignores
  - align workspace crates to inherit version/edition/license for
  consistent checks

  Josh McKinney · 2025-11-24 12:22:18 -08:00
  ec49b56874
• Added alternate form of dependabot to CLA allow list (#7260)

  This fixes the CI check for CLA, which recently started to flag the
  GitHub dependabot as "not having signed the CLA".

  Eric Traut · 2025-11-24 12:04:27 -08:00
  2c885edefa
• chore(deps): bump actions/checkout from 5 to 6 (#7230)

  Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to
  6.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/checkout/releases">actions/checkout's
  releases</a>.</em></p>
  <blockquote>
  <h2>v6.0.0</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Update README to include Node.js 24 support details and requirements
  by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
  in <a
  href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
  <li>Persist creds to a separate file by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
  <li>v6-beta by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2298">actions/checkout#2298</a></li>
  <li>update readme/changelog for v6 by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2311">actions/checkout#2311</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/checkout/compare/v5.0.0...v6.0.0">https://github.com/actions/checkout/compare/v5.0.0...v6.0.0</a></p>
  <h2>v6-beta</h2>
  <h2>What's Changed</h2>
  <p>Updated persist-credentials to store the credentials under
  <code>$RUNNER_TEMP</code> instead of directly in the local git
  config.</p>
  <p>This requires a minimum Actions Runner version of <a
  href="https://github.com/actions/runner/releases/tag/v2.329.0">v2.329.0</a>
  to access the persisted credentials for <a
  href="https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action">Docker
  container action</a> scenarios.</p>
  <h2>v5.0.1</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Port v6 cleanup to v5 by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/checkout/compare/v5...v5.0.1">https://github.com/actions/checkout/compare/v5...v5.0.1</a></p>
  </blockquote>
  </details>
  <details>
  <summary>Changelog</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
  changelog</a>.</em></p>
  <blockquote>
  <h1>Changelog</h1>
  <h2>V6.0.0</h2>
  <ul>
  <li>Persist creds to a separate file by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
  <li>Update README to include Node.js 24 support details and requirements
  by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
  in <a
  href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
  </ul>
  <h2>V5.0.1</h2>
  <ul>
  <li>Port v6 cleanup to v5 by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
  </ul>
  <h2>V5.0.0</h2>
  <ul>
  <li>Update actions checkout to use node 24 by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
  </ul>
  <h2>V4.3.1</h2>
  <ul>
  <li>Port v6 cleanup to v4 by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
  </ul>
  <h2>V4.3.0</h2>
  <ul>
  <li>docs: update README.md by <a
  href="https://github.com/motss"><code>@​motss</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
  <li>Add internal repos for checking out multiple repositories by <a
  href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
  <li>Documentation update - add recommended permissions to Readme by <a
  href="https://github.com/benwells"><code>@​benwells</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
  <li>Adjust positioning of user email note and permissions heading by <a
  href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
  <li>Update README.md by <a
  href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
  <li>Update CODEOWNERS for actions by <a
  href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
  in <a
  href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
  <li>Update package dependencies by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
  </ul>
  <h2>v4.2.2</h2>
  <ul>
  <li><code>url-helper.ts</code> now leverages well-known environment
  variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
  in <a
  href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
  <li>Expand unit test coverage for <code>isGhes</code> by <a
  href="https://github.com/jww3"><code>@​jww3</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
  </ul>
  <h2>v4.2.1</h2>
  <ul>
  <li>Check out other refs/* by commit if provided, fall back to ref by <a
  href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
  </ul>
  <h2>v4.2.0</h2>
  <ul>
  <li>Add Ref and Commit outputs by <a
  href="https://github.com/lucacome"><code>@​lucacome</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1180">actions/checkout#1180</a></li>
  <li>Dependency updates by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a>- <a
  href="https://redirect.github.com/actions/checkout/pull/1777">actions/checkout#1777</a>,
  <a
  href="https://redirect.github.com/actions/checkout/pull/1872">actions/checkout#1872</a></li>
  </ul>
  <h2>v4.1.7</h2>
  <ul>
  <li>Bump the minor-npm-dependencies group across 1 directory with 4
  updates by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li>
  <li>Bump actions/checkout from 3 to 4 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li>
  <li>Check out other refs/* by commit by <a
  href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li>
  <li>Pin actions/checkout's own workflows to a known, good, stable
  version. by <a href="https://github.com/jww3"><code>@​jww3</code></a> in
  <a
  href="https://redirect.github.com/actions/checkout/pull/1776">actions/checkout#1776</a></li>
  </ul>
  <h2>v4.1.6</h2>
  <ul>
  <li>Check platform to set archive extension appropriately by <a
  href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
  <a
  href="https://redirect.github.com/actions/checkout/pull/1732">actions/checkout#1732</a></li>
  </ul>
  <h2>v4.1.5</h2>
  <ul>
  <li>Update NPM dependencies by <a
  href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
  <a
  href="https://redirect.github.com/actions/checkout/pull/1703">actions/checkout#1703</a></li>
  <li>Bump github/codeql-action from 2 to 3 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1694">actions/checkout#1694</a></li>
  <li>Bump actions/setup-node from 1 to 4 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1696">actions/checkout#1696</a></li>
  <li>Bump actions/upload-artifact from 2 to 4 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1695">actions/checkout#1695</a></li>
  </ul>
  <!-- raw HTML omitted -->
  </blockquote>
  <p>... (truncated)</p>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3"><code>1af3b93</code></a>
  update readme/changelog for v6 (<a
  href="https://redirect.github.com/actions/checkout/issues/2311">#2311</a>)</li>
  <li><a
  href="https://github.com/actions/checkout/commit/71cf2267d89c5cb81562390fa70a37fa40b1305e"><code>71cf226</code></a>
  v6-beta (<a
  href="https://redirect.github.com/actions/checkout/issues/2298">#2298</a>)</li>
  <li><a
  href="https://github.com/actions/checkout/commit/069c6959146423d11cd0184e6accf28f9d45f06e"><code>069c695</code></a>
  Persist creds to a separate file (<a
  href="https://redirect.github.com/actions/checkout/issues/2286">#2286</a>)</li>
  <li><a
  href="https://github.com/actions/checkout/commit/ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493"><code>ff7abcd</code></a>
  Update README to include Node.js 24 support details and requirements (<a
  href="https://redirect.github.com/actions/checkout/issues/2248">#2248</a>)</li>
  <li>See full diff in <a
  href="https://github.com/actions/checkout/compare/v5...v6">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=5&new-version=6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-11-24 11:45:57 -08:00
  6dd3606773
• chore(deps): bump actions/upload-artifact from 4 to 5 (#7229)

  Bumps
  [actions/upload-artifact](https://github.com/actions/upload-artifact)
  from 4 to 5.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's
  releases</a>.</em></p>
  <blockquote>
  <h2>v5.0.0</h2>
  <h2>What's Changed</h2>
  <p><strong>BREAKING CHANGE:</strong> this update supports Node
  <code>v24.x</code>. This is not a breaking change per-se but we're
  treating it as such.</p>
  <ul>
  <li>Update README.md by <a
  href="https://github.com/GhadimiR"><code>@​GhadimiR</code></a> in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/681">actions/upload-artifact#681</a></li>
  <li>Update README.md by <a
  href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/712">actions/upload-artifact#712</a></li>
  <li>Readme: spell out the first use of GHES by <a
  href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
  <a
  href="https://redirect.github.com/actions/upload-artifact/pull/727">actions/upload-artifact#727</a></li>
  <li>Update GHES guidance to include reference to Node 20 version by <a
  href="https://github.com/patrikpolyak"><code>@​patrikpolyak</code></a>
  in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/725">actions/upload-artifact#725</a></li>
  <li>Bump <code>@actions/artifact</code> to <code>v4.0.0</code></li>
  <li>Prepare <code>v5.0.0</code> by <a
  href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
  <a
  href="https://redirect.github.com/actions/upload-artifact/pull/734">actions/upload-artifact#734</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/GhadimiR"><code>@​GhadimiR</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/681">actions/upload-artifact#681</a></li>
  <li><a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/712">actions/upload-artifact#712</a></li>
  <li><a
  href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/727">actions/upload-artifact#727</a></li>
  <li><a
  href="https://github.com/patrikpolyak"><code>@​patrikpolyak</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/725">actions/upload-artifact#725</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/upload-artifact/compare/v4...v5.0.0">https://github.com/actions/upload-artifact/compare/v4...v5.0.0</a></p>
  <h2>v4.6.2</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Update to use artifact 2.3.2 package &amp; prepare for new
  upload-artifact release by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/685">actions/upload-artifact#685</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/685">actions/upload-artifact#685</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/upload-artifact/compare/v4...v4.6.2">https://github.com/actions/upload-artifact/compare/v4...v4.6.2</a></p>
  <h2>v4.6.1</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Update to use artifact 2.2.2 package by <a
  href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/673">actions/upload-artifact#673</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/upload-artifact/compare/v4...v4.6.1">https://github.com/actions/upload-artifact/compare/v4...v4.6.1</a></p>
  <h2>v4.6.0</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Expose env vars to control concurrency and timeout by <a
  href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/662">actions/upload-artifact#662</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/upload-artifact/compare/v4...v4.6.0">https://github.com/actions/upload-artifact/compare/v4...v4.6.0</a></p>
  <h2>v4.5.0</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>fix: deprecated <code>Node.js</code> version in action by <a
  href="https://github.com/hamirmahal"><code>@​hamirmahal</code></a> in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/578">actions/upload-artifact#578</a></li>
  <li>Add new <code>artifact-digest</code> output by <a
  href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/656">actions/upload-artifact#656</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a
  href="https://github.com/hamirmahal"><code>@​hamirmahal</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/actions/upload-artifact/pull/578">actions/upload-artifact#578</a></li>
  </ul>
  <!-- raw HTML omitted -->
  </blockquote>
  <p>... (truncated)</p>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/330a01c490aca151604b8cf639adc76d48f6c5d4"><code>330a01c</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/upload-artifact/issues/734">#734</a>
  from actions/danwkennedy/prepare-5.0.0</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/03f282445299bbefc96171af272a984663b63a26"><code>03f2824</code></a>
  Update <code>github.dep.yml</code></li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/905a1ecb5915b264cbc519e4eb415b5d82916018"><code>905a1ec</code></a>
  Prepare <code>v5.0.0</code></li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/2d9f9cdfa99fedaddba68e9b5b5c281eca26cc63"><code>2d9f9cd</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/upload-artifact/issues/725">#725</a>
  from patrikpolyak/patch-1</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/9687587dec67f2a8bc69104e183d311c42af6d6f"><code>9687587</code></a>
  Merge branch 'main' into patch-1</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/2848b2cda0e5190984587ec6bb1f36730ca78d50"><code>2848b2c</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/upload-artifact/issues/727">#727</a>
  from danwkennedy/patch-1</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/9b511775fd9ce8c5710b38eea671f856de0e70a7"><code>9b51177</code></a>
  Spell out the first use of GHES</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/cd231ca1eda77976a84805c4194a1954f56b0727"><code>cd231ca</code></a>
  Update GHES guidance to include reference to Node 20 version</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/de65e23aa2b7e23d713bb51fbfcb6d502f8667d8"><code>de65e23</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/upload-artifact/issues/712">#712</a>
  from actions/nebuk89-patch-1</li>
  <li><a
  href="https://github.com/actions/upload-artifact/commit/8747d8cd7632611ad6060b528f3e0f654c98869c"><code>8747d8c</code></a>
  Update README.md</li>
  <li>Additional commits viewable in <a
  href="https://github.com/actions/upload-artifact/compare/v4...v5">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/upload-artifact&package-manager=github_actions&previous-version=4&new-version=5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-11-24 11:45:29 -08:00
  35850caff6
• fix: start publishing @openai/codex-shell-tool-mcp to npm (#7123)

  Start publishing as part of the normal release process.

  Michael Bolin · 2025-11-21 15:03:50 -08:00
  af63e6eccc
• fix: clear out duplicate entries for bash in the GitHub release (#7103)

  https://github.com/openai/codex/pull/7005 introduced a new part of the
  release process that added multiple files named `bash` in the `dist/`
  folder used as the basis of the GitHub Release. I believe that all file
  names in a GitHub Release have to be unique, which is why the recent
  release build failed:
  
  https://github.com/openai/codex/actions/runs/19577669780/job/56070183504
  
  Based on the output of the **List** step, I believe these are the
  appropriate artifacts to delete as a quick fix.

  Michael Bolin · 2025-11-21 09:59:30 -08:00
  40d14c0756
• feat: codex-shell-tool-mcp (#7005)

  This adds a GitHub workflow for building a new npm module we are
  experimenting with that contains an MCP server for running Bash
  commands. The new workflow, `shell-tool-mcp`, is a dependency of the
  general `release` workflow so that we continue to use one version number
  for all artifacts across the project in one GitHub release.
  
  `.github/workflows/shell-tool-mcp.yml` is the primary workflow
  introduced by this PR, which does the following:
  
  - builds the `codex-exec-mcp-server` and `codex-execve-wrapper`
  executables for both arm64 and x64 versions of Mac and Linux (preferring
  the MUSL version for Linux)
  - builds Bash (dynamically linked) for a [comically] large number of
  platforms (both x64 and arm64 for most) with a small patch specified by
  `shell-tool-mcp/patches/bash-exec-wrapper.patch`:
    - `debian-11`
    - `debian-12`
    - `ubuntu-20.04`
    - `ubuntu-22.04`
    - `ubuntu-24.04`
    - `centos-9`
    - `macos-13` (x64 only)
    - `macos-14` (arm64 only)
    - `macos-15` (arm64 only)
  - builds the TypeScript for the [new] Node module declared in the
  `shell-tool-mcp/` folder, which creates `bin/mcp-server.js`
  - adds all of the native binaries to `shell-tool-mcp/vendor/` folder;
  `bin/mcp-server.js` does a runtime check to determine which ones to
  execute
  - uses `npm pack` to create the `.tgz` for the module
  - if `publish: true` is set, invokes the `npm publish` call with the
  `.tgz`
  
  The justification for building Bash for so many different operating
  systems is because, since it is dynamically linked, we want to increase
  our confidence that the version we build is compatible with the glibc
  whatever OS we end up running on. (Note this is less of a concern with
  `codex-exec-mcp-server` and `codex-execve-wrapper` on Linux, as they are
  statically linked.)
  
  This PR also introduces the code for the npm module in `shell-tool-mcp/`
  (the proposed module name is `@openai/codex-shell-tool-mcp`). Initially,
  I intended the module to be a single file of vanilla JavaScript (like
  [`codex-cli/bin/codex.js`](https://github.com/openai/codex/blob/ab5972d447da78d3e4dd8461cf7d43a22e5d2acb/codex-cli/bin/codex.js)),
  but some of the logic seemed a bit tricky, so I decided to port it to
  TypeScript and add unit tests.
  
  `shell-tool-mcp/src/index.ts` defines the `main()` function for the
  module, which performs runtime checks to determine the clang triple to
  find the path to the Rust executables within the `vendor/` folder
  (`resolveTargetTriple()`). It uses a combination of `readOsRelease()`
  and `resolveBashPath()` to determine the correct Bash executable to run
  in the environment. Ultimately, it spawns a command like the following:
  
  ```
  codex-exec-mcp-server \
      --execve codex-execve-wrapper \
      --bash custom-bash "$@"
  ```
  
  Note `.github/workflows/shell-tool-mcp-ci.yml` defines a fairly standard
  CI job for the module (`format`/`build`/`test`).
  
  To test this PR, I pushed this branch to my personal fork of Codex and
  ran the CI job there:
  
  https://github.com/bolinfest/codex/actions/runs/19564311320
  
  Admittedly, the graph looks a bit wild now:
  
  <img width="5115" height="2969" alt="Screenshot 2025-11-20 at 11 44
  58 PM"
  src="https://github.com/user-attachments/assets/cc5ef306-efc1-4ed7-a137-5347e394f393"
  />
  
  But when it finished, I was able to download `codex-shell-tool-mcp-npm`
  from the **Artifacts** for the workflow in an empty temp directory,
  unzip the `.zip` and then the `.tgz` inside it, followed by `xattr -rc
  .` to remove the quarantine bits. Then I ran:
  
  ```shell
  npx @modelcontextprotocol/inspector node /private/tmp/foobar4/package/bin/mcp-server.js
  ```
  
  which launched the MCP Inspector and I was able to use it as expected!
  This bodes well that this should work once the package is published to
  npm:
  
  ```shell
  npx @modelcontextprotocol/inspector npx @openai/codex-shell-tool-mcp
  ```
  
  Also, to verify the package contains what I expect:
  
  ```shell
  /tmp/foobar4/package$ tree
  .
  ├── bin
  │   └── mcp-server.js
  ├── package.json
  ├── README.md
  └── vendor
      ├── aarch64-apple-darwin
      │   ├── bash
      │   │   ├── macos-14
      │   │   │   └── bash
      │   │   └── macos-15
      │   │       └── bash
      │   ├── codex-exec-mcp-server
      │   └── codex-execve-wrapper
      ├── aarch64-unknown-linux-musl
      │   ├── bash
      │   │   ├── centos-9
      │   │   │   └── bash
      │   │   ├── debian-11
      │   │   │   └── bash
      │   │   ├── debian-12
      │   │   │   └── bash
      │   │   ├── ubuntu-20.04
      │   │   │   └── bash
      │   │   ├── ubuntu-22.04
      │   │   │   └── bash
      │   │   └── ubuntu-24.04
      │   │       └── bash
      │   ├── codex-exec-mcp-server
      │   └── codex-execve-wrapper
      ├── x86_64-apple-darwin
      │   ├── bash
      │   │   └── macos-13
      │   │       └── bash
      │   ├── codex-exec-mcp-server
      │   └── codex-execve-wrapper
      └── x86_64-unknown-linux-musl
          ├── bash
          │   ├── centos-9
          │   │   └── bash
          │   ├── debian-11
          │   │   └── bash
          │   ├── debian-12
          │   │   └── bash
          │   ├── ubuntu-20.04
          │   │   └── bash
          │   ├── ubuntu-22.04
          │   │   └── bash
          │   └── ubuntu-24.04
          │       └── bash
          ├── codex-exec-mcp-server
          └── codex-execve-wrapper
  
  26 directories, 26 files
  ```

  Michael Bolin · 2025-11-21 08:16:36 -08:00
  d363a0968e
• Fixed the deduplicator github action (#7070)

  It stopped working (found zero duplicates) starting three days ago when
  the model was switched from `gpt-5` to `gpt-5.1`. I'm not sure why it
  stopped working. This is an attempt to get it working again by using the
  default model for the codex action (which is presumably
  `gpt-5.1-codex-max`).

  Eric Traut · 2025-11-20 22:46:55 -08:00
  b315b22f7b
• Update defaults to gpt-5.1 (#6652)

  ## Summary
  - update documentation, example configs, and automation defaults to
  reference gpt-5.1 / gpt-5.1-codex
  - bump the CLI and core configuration defaults, model presets, and error
  messaging to the new models while keeping the model-family/tool coverage
  for legacy slugs
  - refresh tests, fixtures, and TUI snapshots so they expect the upgraded
  defaults
  
  ## Testing
  - `cargo test -p codex-core
  config::tests::test_precedence_fixture_with_gpt5_profile`
  
  
  ------
  [Codex
  Task](https://chatgpt.com/codex/tasks/task_i_6916c5b3c2b08321ace04ee38604fc6b)

  Ahmed Ibrahim · 2025-11-17 17:40:11 -08:00
  ddcc60a085
• tmp: drop sccache for windows 2 (#6775)
  jif-oai · 2025-11-17 16:39:15 +00:00
  98a90a3bb2
• Exempt the "codex" github user from signing the CLA (#6724)

  This fixes bug #6697

  Eric Traut · 2025-11-16 20:49:31 -08:00
  a52cf4d2b4
• chore(deps): bump actions/github-script from 7 to 8 (#6755)

  Bumps [actions/github-script](https://github.com/actions/github-script)
  from 7 to 8.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/github-script/releases">actions/github-script's
  releases</a>.</em></p>
  <blockquote>
  <h2>v8.0.0</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Update Node.js version support to 24.x by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/github-script/pull/637">actions/github-script#637</a></li>
  <li>README for updating actions/github-script from v7 to v8 by <a
  href="https://github.com/sneha-krip"><code>@​sneha-krip</code></a> in <a
  href="https://redirect.github.com/actions/github-script/pull/653">actions/github-script#653</a></li>
  </ul>
  <h2>⚠️ Minimum Compatible Runner Version</h2>
  <p><strong>v2.327.1</strong><br />
  <a
  href="https://github.com/actions/runner/releases/tag/v2.327.1">Release
  Notes</a></p>
  <p>Make sure your runner is updated to this version or newer to use this
  release.</p>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/github-script/pull/637">actions/github-script#637</a></li>
  <li><a
  href="https://github.com/sneha-krip"><code>@​sneha-krip</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/actions/github-script/pull/653">actions/github-script#653</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/github-script/compare/v7.1.0...v8.0.0">https://github.com/actions/github-script/compare/v7.1.0...v8.0.0</a></p>
  <h2>v7.1.0</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Upgrade husky to v9 by <a
  href="https://github.com/benelan"><code>@​benelan</code></a> in <a
  href="https://redirect.github.com/actions/github-script/pull/482">actions/github-script#482</a></li>
  <li>Add workflow file for publishing releases to immutable action
  package by <a
  href="https://github.com/Jcambass"><code>@​Jcambass</code></a> in <a
  href="https://redirect.github.com/actions/github-script/pull/485">actions/github-script#485</a></li>
  <li>Upgrade IA Publish by <a
  href="https://github.com/Jcambass"><code>@​Jcambass</code></a> in <a
  href="https://redirect.github.com/actions/github-script/pull/486">actions/github-script#486</a></li>
  <li>Fix workflow status badges by <a
  href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
  href="https://redirect.github.com/actions/github-script/pull/497">actions/github-script#497</a></li>
  <li>Update usage of <code>actions/upload-artifact</code> by <a
  href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
  href="https://redirect.github.com/actions/github-script/pull/512">actions/github-script#512</a></li>
  <li>Clear up package name confusion by <a
  href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
  href="https://redirect.github.com/actions/github-script/pull/514">actions/github-script#514</a></li>
  <li>Update dependencies with <code>npm audit fix</code> by <a
  href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
  href="https://redirect.github.com/actions/github-script/pull/515">actions/github-script#515</a></li>
  <li>Specify that the used script is JavaScript by <a
  href="https://github.com/timotk"><code>@​timotk</code></a> in <a
  href="https://redirect.github.com/actions/github-script/pull/478">actions/github-script#478</a></li>
  <li>chore: Add Dependabot for NPM and Actions by <a
  href="https://github.com/nschonni"><code>@​nschonni</code></a> in <a
  href="https://redirect.github.com/actions/github-script/pull/472">actions/github-script#472</a></li>
  <li>Define <code>permissions</code> in workflows and update actions by
  <a href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in
  <a
  href="https://redirect.github.com/actions/github-script/pull/531">actions/github-script#531</a></li>
  <li>chore: Add Dependabot for .github/actions/install-dependencies by <a
  href="https://github.com/nschonni"><code>@​nschonni</code></a> in <a
  href="https://redirect.github.com/actions/github-script/pull/532">actions/github-script#532</a></li>
  <li>chore: Remove .vscode settings by <a
  href="https://github.com/nschonni"><code>@​nschonni</code></a> in <a
  href="https://redirect.github.com/actions/github-script/pull/533">actions/github-script#533</a></li>
  <li>ci: Use github/setup-licensed by <a
  href="https://github.com/nschonni"><code>@​nschonni</code></a> in <a
  href="https://redirect.github.com/actions/github-script/pull/473">actions/github-script#473</a></li>
  <li>make octokit instance available as octokit on top of github, to make
  it easier to seamlessly copy examples from GitHub rest api or octokit
  documentations by <a
  href="https://github.com/iamstarkov"><code>@​iamstarkov</code></a> in <a
  href="https://redirect.github.com/actions/github-script/pull/508">actions/github-script#508</a></li>
  <li>Remove <code>octokit</code> README updates for v7 by <a
  href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
  href="https://redirect.github.com/actions/github-script/pull/557">actions/github-script#557</a></li>
  <li>docs: add &quot;exec&quot; usage examples by <a
  href="https://github.com/neilime"><code>@​neilime</code></a> in <a
  href="https://redirect.github.com/actions/github-script/pull/546">actions/github-script#546</a></li>
  <li>Bump ruby/setup-ruby from 1.213.0 to 1.222.0 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
  in <a
  href="https://redirect.github.com/actions/github-script/pull/563">actions/github-script#563</a></li>
  <li>Bump ruby/setup-ruby from 1.222.0 to 1.229.0 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
  in <a
  href="https://redirect.github.com/actions/github-script/pull/575">actions/github-script#575</a></li>
  <li>Clearly document passing inputs to the <code>script</code> by <a
  href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
  href="https://redirect.github.com/actions/github-script/pull/603">actions/github-script#603</a></li>
  <li>Update README.md by <a
  href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
  href="https://redirect.github.com/actions/github-script/pull/610">actions/github-script#610</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/benelan"><code>@​benelan</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/actions/github-script/pull/482">actions/github-script#482</a></li>
  <li><a href="https://github.com/Jcambass"><code>@​Jcambass</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/github-script/pull/485">actions/github-script#485</a></li>
  <li><a href="https://github.com/timotk"><code>@​timotk</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/actions/github-script/pull/478">actions/github-script#478</a></li>
  <li><a
  href="https://github.com/iamstarkov"><code>@​iamstarkov</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/actions/github-script/pull/508">actions/github-script#508</a></li>
  <li><a href="https://github.com/neilime"><code>@​neilime</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/actions/github-script/pull/546">actions/github-script#546</a></li>
  <li><a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/actions/github-script/pull/610">actions/github-script#610</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/github-script/compare/v7...v7.1.0">https://github.com/actions/github-script/compare/v7...v7.1.0</a></p>
  <!-- raw HTML omitted -->
  </blockquote>
  <p>... (truncated)</p>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/actions/github-script/commit/ed597411d8f924073f98dfc5c65a23a2325f34cd"><code>ed59741</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/github-script/issues/653">#653</a>
  from actions/sneha-krip/readme-for-v8</li>
  <li><a
  href="https://github.com/actions/github-script/commit/2dc352e4baefd91bec0d06f6ae2f1045d1687ca3"><code>2dc352e</code></a>
  Bold minimum Actions Runner version in README</li>
  <li><a
  href="https://github.com/actions/github-script/commit/01e118c8d0d22115597e46514b5794e7bc3d56f1"><code>01e118c</code></a>
  Update README for Node 24 runtime requirements</li>
  <li><a
  href="https://github.com/actions/github-script/commit/8b222ac82eda86dcad7795c9d49b839f7bf5b18b"><code>8b222ac</code></a>
  Apply suggestion from <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a></li>
  <li><a
  href="https://github.com/actions/github-script/commit/adc0eeac992408a7b276994ca87edde1c8ce4d25"><code>adc0eea</code></a>
  README for updating actions/github-script from v7 to v8</li>
  <li><a
  href="https://github.com/actions/github-script/commit/20fe497b3fe0c7be8aae5c9df711ac716dc9c425"><code>20fe497</code></a>
  Merge pull request <a
  href="https://redirect.github.com/actions/github-script/issues/637">#637</a>
  from actions/node24</li>
  <li><a
  href="https://github.com/actions/github-script/commit/e7b7f222b11a03e8b695c4c7afba89a02ea20164"><code>e7b7f22</code></a>
  update licenses</li>
  <li><a
  href="https://github.com/actions/github-script/commit/2c81ba05f308415d095291e6eeffe983d822345b"><code>2c81ba0</code></a>
  Update Node.js version support to 24.x</li>
  <li>See full diff in <a
  href="https://github.com/actions/github-script/compare/v7...v8">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/github-script&package-manager=github_actions&previous-version=7&new-version=8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-11-16 19:53:19 -08:00
  e70c52a3af
• Revert "tmp: drop sccache for windows (#6673)" (#6751)

  This reverts commit 4719cba19a

  Eric Traut · 2025-11-16 18:37:12 -08:00
  fa5f6e76c9
• Revert "templates and build step for validating/submitting winget package" (#6696)

  Reverts openai/codex#6485

  Ahmed Ibrahim · 2025-11-15 03:47:58 +00:00
  b560c5cef1
• ci: only run CLA assistant for openai org repos (#6687)

  This prevents notifications coming from PRs on forked repos

  Josh McKinney · 2025-11-14 17:34:14 -08:00
  4ae986967c
• templates and build step for validating/submitting winget package (#6485)
  iceweasel-oai · 2025-11-14 11:06:44 -08:00
  37fba28ac3
• tmp: drop sccache for windows (#6673)
  jif-oai · 2025-11-14 17:29:05 +01:00
  4719cba19a
• Only list failed tests (#6619)

  Makes output easier to parse

  pakrym-oai · 2025-11-13 13:50:33 -08:00
  547be54ee8
• Enable close-stale-contributor-prs.yml workflow (#6615)

  Tested on https://github.com/openai/codex/pull/3036

  pakrym-oai · 2025-11-13 11:50:54 -08:00
  c95bd345ea
• Close stale PRs workflow (#6594)

  Closes stale PRs from OpenAI employees.

  pakrym-oai · 2025-11-13 10:01:51 -08:00
  6cda3de3a4
• upload Windows .exe file artifacts for CLI releases (#6478)

  This PR is to unlock future WinGet installation. WinGet struggles to
  create command aliases when installing from nested ZIPs on some clients,
  so adding raw Windows x64/Arm64 executables lets the manifest use
  InstallerType: portable with direct EXEs, which reliably registers the
  codex alias. This makes “winget install → codex” work out of the box
  without PATH changes.
  
  ---------
  
  Co-authored-by: Michael Bolin <mbolin@openai.com>

  iceweasel-oai · 2025-11-10 23:31:06 +00:00
  9aff64e017