From 41d5adfbe69ae4eb6a4b442464b40d9caa2a3272 Mon Sep 17 00:00:00 2001 From: Dmitriy Kovalenko Date: Wed, 7 Oct 2026 21:38:52 +0000 Subject: [PATCH] Add Bazel support to the Codex package build action (#51855) ## What changed Add a `build-system` input to `build-codex-packages`, defaulting to `cargo`, and extract binary builds into dedicated Cargo and Bazel actions. The Bazel path stages binaries and symbols for the shared CLI and app-server packaging and smoke-test steps, with support for `release` and `debug` build modes. Resolve the package source root before invoking nested actions, and use Bash to export the Bazel repository cache path. GitOrigin-RevId: ebd5e7c84451733419838da5956dc090cd09b19a --- .../build-bazel-package-binaries/action.yml | 35 +++++ .../build-cargo-package-binaries/action.yml | 135 +++++++++++++++++ .../actions/build-codex-packages/action.yml | 139 ++++-------------- .github/actions/setup-bazel-ci/action.yml | 4 +- 4 files changed, 201 insertions(+), 112 deletions(-) create mode 100644 .github/actions/build-bazel-package-binaries/action.yml create mode 100644 .github/actions/build-cargo-package-binaries/action.yml diff --git a/.github/actions/build-bazel-package-binaries/action.yml b/.github/actions/build-bazel-package-binaries/action.yml new file mode 100644 index 0000000000..dd918ba0bc --- /dev/null +++ b/.github/actions/build-bazel-package-binaries/action.yml @@ -0,0 +1,35 @@ +name: Build Bazel package binaries +description: Set up Bazel and stage unstripped runtime package binaries and symbols. +inputs: + target: + description: Rust release target triple. + required: true + build-mode: + description: Release optimizations, or debug for faster package smoke builds. + default: release + +runs: + using: composite + steps: + - name: Set up Bazel + uses: ./.github/actions/prepare-bazel-ci + with: + target: ${{ inputs.target }} + cache-scope: bazel-release + + - name: Install Cargo for workspace metadata + uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0 + + - name: Configure MSVC environment + if: ${{ runner.os == 'Windows' }} + uses: ./.github/actions/setup-msvc-env + with: + target: ${{ inputs.target }} + + - name: Build Bazel release binaries and symbols + uses: ./.github/actions/build-bazel-release + with: + target: ${{ inputs.target }} + bundle: combined + release-dir: ${{ env.CARGO_TARGET_DIR }}/${{ inputs.target }}/release + build-mode: ${{ inputs.build-mode }} diff --git a/.github/actions/build-cargo-package-binaries/action.yml b/.github/actions/build-cargo-package-binaries/action.yml new file mode 100644 index 0000000000..84a35f5ec2 --- /dev/null +++ b/.github/actions/build-cargo-package-binaries/action.yml @@ -0,0 +1,135 @@ +name: Build Cargo package binaries +description: Set up Cargo and build unstripped runtime package binaries and symbols. +inputs: + target: + description: Rust release target triple. + required: true + binaries: + description: Space-separated binary target names. + required: true + build-mode: + description: Release optimizations, or debug for faster package smoke builds. + default: release + +runs: + using: composite + steps: + - uses: ./.github/actions/setup-ci + + - name: Configure Cargo release profile + shell: bash + env: + BUILD_MODE: ${{ inputs.build-mode }} + # macOS symbol extraction needs packed dSYM bundles before binaries are stripped. + CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO: ${{ contains(inputs.target, 'apple-darwin') && 'packed' || 'off' }} + run: | + set -euo pipefail + echo "CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO=$CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO" >> "$GITHUB_ENV" + case "$BUILD_MODE" in + release) ;; + debug) + # Use the release profile so assertions, symbols and packaging match production. + # Only trade compiler optimizations for faster builds. + { + echo "CARGO_PROFILE_RELEASE_OPT_LEVEL=0" + echo "CARGO_PROFILE_RELEASE_LTO=off" + echo "CARGO_PROFILE_RELEASE_CODEGEN_UNITS=256" + } >> "$GITHUB_ENV" + ;; + *) echo "Unsupported build mode: $BUILD_MODE" >&2; exit 1 ;; + esac + + - uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0 + with: + targets: ${{ inputs.target }} + + - name: Use hermetic Cargo home (musl) + if: ${{ runner.os == 'Linux' }} + shell: bash + working-directory: codex-rs + run: | + set -euo pipefail + cargo_home="${GITHUB_WORKSPACE}/.cargo-home" + mkdir -p "${cargo_home}/bin" + echo "CARGO_HOME=${cargo_home}" >> "$GITHUB_ENV" + echo "${cargo_home}/bin" >> "$GITHUB_PATH" + : > "${cargo_home}/config.toml" + + - name: Install Zig + if: ${{ runner.os == 'Linux' }} + uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1 + with: + version: 0.14.0 + use-cache: false + + - name: Install musl build tools + if: ${{ runner.os == 'Linux' }} + shell: bash + working-directory: codex-rs + env: + TARGET: ${{ inputs.target }} + run: bash "${GITHUB_WORKSPACE}/.github/scripts/install-musl-build-tools.sh" + + - name: Disable aws-lc jitter entropy (musl) + if: ${{ runner.os == 'Linux' }} + shell: bash + working-directory: codex-rs + env: + TARGET: ${{ inputs.target }} + run: | + set -euo pipefail + # aws-lc's jitter entropy path does not work reliably on musl builders, + # so disable it globally and per target. + echo "AWS_LC_SYS_NO_JITTER_ENTROPY=1" >> "$GITHUB_ENV" + target_no_jitter="AWS_LC_SYS_NO_JITTER_ENTROPY_${TARGET}" + target_no_jitter="${target_no_jitter//-/_}" + echo "${target_no_jitter}=1" >> "$GITHUB_ENV" + + - name: Configure rusty_v8 artifact overrides and verify checksums + uses: ./.github/actions/setup-rusty-v8 + with: + target: ${{ inputs.target }} + + - name: Configure MSVC environment + if: ${{ runner.os == 'Windows' }} + uses: ./.github/actions/setup-msvc-env + with: + target: ${{ inputs.target }} + + - name: Build bwrap and export digest + if: ${{ runner.os == 'Linux' }} + shell: bash + working-directory: codex-rs + env: + TARGET: ${{ inputs.target }} + run: | + set -euo pipefail + cargo build --target "${TARGET}" --release --timings --bin bwrap + + bwrap_path="${CARGO_TARGET_DIR}/${TARGET}/release/bwrap" + # Codex embeds this digest at build time and verifies the packaged + # bwrap at runtime, so hash its final stripped bytes first. + strip --strip-debug --strip-unneeded "$bwrap_path" + digest="$(sha256sum "$bwrap_path" | awk '{print $1}')" + echo "CODEX_BWRAP_SHA256=${digest}" >> "$GITHUB_ENV" + + - name: Build Codex package binaries + shell: bash + working-directory: codex-rs + env: + TARGET: ${{ inputs.target }} + BINARIES: ${{ inputs.binaries }} + run: | + set -euo pipefail + build_args=() + for binary in $BINARIES; do + build_args+=(--bin "$binary") + done + # SQLite intrinsics can emit instructions unsupported by older x64 + # CPUs, causing Windows release binaries to crash during startup. + if [[ "${TARGET}" == "x86_64-pc-windows-msvc" ]]; then + export LIBSQLITE3_FLAGS=SQLITE_DISABLE_INTRINSIC + fi + STABLE_GIT_COMMIT="$(git rev-parse HEAD)" + export STABLE_GIT_COMMIT + cargo build --target "${TARGET}" --release --timings "${build_args[@]}" diff --git a/.github/actions/build-codex-packages/action.yml b/.github/actions/build-codex-packages/action.yml index ac1bd2ea54..704f6470b7 100644 --- a/.github/actions/build-codex-packages/action.yml +++ b/.github/actions/build-codex-packages/action.yml @@ -10,44 +10,42 @@ inputs: build-mode: description: Use release optimizations (release) or disable them for faster smoke coverage (debug). required: true + build-system: + description: Build package binaries with Cargo or Bazel. + default: cargo # Resolve package sources relative to the action so it works in both repository layouts. runs: using: composite steps: - name: Select release binaries + id: package_setup shell: bash working-directory: codex-rs env: BASE_BINARIES: "codex codex-app-server codex-code-mode-host" WINDOWS_ONLY_BINARIES: "codex-command-runner codex-windows-sandbox-setup" BUILD_MODE: ${{ inputs.build-mode }} - # macOS symbol extraction needs packed dSYM bundles before binaries are stripped. - CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO: ${{ contains(inputs.target, 'apple-darwin') && 'packed' || 'off' }} + BUILD_SYSTEM: ${{ inputs.build-system }} + PACKAGE_ACTION_PATH: ${{ github.action_path }} run: | set -euo pipefail + package_source_root="$(cd "${PACKAGE_ACTION_PATH}/../../.." && pwd)" + echo "source_root=$package_source_root" >> "$GITHUB_OUTPUT" needed_binaries="$BASE_BINARIES" if [[ "$RUNNER_OS" == "Windows" ]]; then needed_binaries+=" $WINDOWS_ONLY_BINARIES" fi echo "NEEDED_BINARIES=$needed_binaries" >> "$GITHUB_ENV" - echo "CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO=$CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO" >> "$GITHUB_ENV" + case "$BUILD_SYSTEM" in + cargo|bazel) ;; + *) echo "Unsupported build system: $BUILD_SYSTEM" >&2; exit 1 ;; + esac case "$BUILD_MODE" in - release) ;; - debug) - # Use the release profile so assertions, symbols and packaging match production. - # Only trade compiler optimizations for faster builds. - { - echo "CARGO_PROFILE_RELEASE_OPT_LEVEL=0" - echo "CARGO_PROFILE_RELEASE_LTO=off" - echo "CARGO_PROFILE_RELEASE_CODEGEN_UNITS=256" - } >> "$GITHUB_ENV" - ;; + release|debug) ;; *) echo "Unsupported build mode: $BUILD_MODE" >&2; exit 1 ;; esac - - uses: ./.github/actions/setup-ci - - name: Set up Python 3.12 uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: @@ -67,99 +65,20 @@ runs: sudo apt-get update -y sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends binutils make pkg-config libcap-dev - - uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0 - with: - targets: ${{ inputs.target }} - - - name: Use hermetic Cargo home (musl) - if: ${{ runner.os == 'Linux' }} - shell: bash - working-directory: codex-rs - run: | - set -euo pipefail - cargo_home="${GITHUB_WORKSPACE}/.cargo-home" - mkdir -p "${cargo_home}/bin" - echo "CARGO_HOME=${cargo_home}" >> "$GITHUB_ENV" - echo "${cargo_home}/bin" >> "$GITHUB_PATH" - : > "${cargo_home}/config.toml" - - - name: Install Zig - if: ${{ runner.os == 'Linux' }} - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1 - with: - version: 0.14.0 - use-cache: false - - - name: Install musl build tools - if: ${{ runner.os == 'Linux' }} - shell: bash - working-directory: codex-rs - env: - TARGET: ${{ inputs.target }} - run: bash "${GITHUB_WORKSPACE}/.github/scripts/install-musl-build-tools.sh" - - - name: Disable aws-lc jitter entropy (musl) - if: ${{ runner.os == 'Linux' }} - shell: bash - working-directory: codex-rs - env: - TARGET: ${{ inputs.target }} - run: | - set -euo pipefail - # Match public releases: aws-lc's jitter entropy path does not work - # reliably on musl builders, so disable it globally and per target. - echo "AWS_LC_SYS_NO_JITTER_ENTROPY=1" >> "$GITHUB_ENV" - target_no_jitter="AWS_LC_SYS_NO_JITTER_ENTROPY_${TARGET}" - target_no_jitter="${target_no_jitter//-/_}" - echo "${target_no_jitter}=1" >> "$GITHUB_ENV" - - - name: Configure rusty_v8 artifact overrides and verify checksums - uses: ./.github/actions/setup-rusty-v8 + - name: Build Cargo package binaries + if: inputs.build-system == 'cargo' + uses: ./.github/actions/build-cargo-package-binaries with: target: ${{ inputs.target }} + binaries: ${{ env.NEEDED_BINARIES }} + build-mode: ${{ inputs.build-mode }} - - name: Configure MSVC environment - if: ${{ runner.os == 'Windows' }} - uses: ./.github/actions/setup-msvc-env + - name: Build Bazel package binaries + if: inputs.build-system == 'bazel' + uses: ./.github/actions/build-bazel-package-binaries with: target: ${{ inputs.target }} - - - name: Build bwrap and export digest - if: ${{ runner.os == 'Linux' }} - shell: bash - working-directory: codex-rs - env: - TARGET: ${{ inputs.target }} - run: | - set -euo pipefail - cargo build --target "${TARGET}" --release --timings --bin bwrap - - bwrap_path="${CARGO_TARGET_DIR}/${TARGET}/release/bwrap" - # Codex embeds this digest at build time and verifies the packaged - # bwrap at runtime, so hash its final stripped bytes first. - strip --strip-debug --strip-unneeded "$bwrap_path" - digest="$(sha256sum "$bwrap_path" | awk '{print $1}')" - echo "CODEX_BWRAP_SHA256=${digest}" >> "$GITHUB_ENV" - - - name: Build Codex package binaries - shell: bash - working-directory: codex-rs - env: - TARGET: ${{ inputs.target }} - run: | - set -euo pipefail - build_args=() - for binary in $NEEDED_BINARIES; do - build_args+=(--bin "$binary") - done - # SQLite intrinsics can emit instructions unsupported by older x64 - # CPUs, causing Windows release binaries to crash during startup. - if [[ "${TARGET}" == "x86_64-pc-windows-msvc" ]]; then - export LIBSQLITE3_FLAGS=SQLITE_DISABLE_INTRINSIC - fi - STABLE_GIT_COMMIT="$(git rev-parse HEAD)" - export STABLE_GIT_COMMIT - cargo build --target "${TARGET}" --release --timings "${build_args[@]}" + build-mode: ${{ inputs.build-mode }} - name: Normalize Windows PDB filenames if: ${{ runner.os == 'Windows' }} @@ -199,10 +118,10 @@ runs: working-directory: codex-rs env: TARGET: ${{ inputs.target }} - PACKAGE_ACTION_PATH: ${{ github.action_path }} + PACKAGE_SOURCE_ROOT: ${{ steps.package_setup.outputs.source_root }} run: | set -euo pipefail - bash "${PACKAGE_ACTION_PATH}/../../../.github/scripts/archive-release-symbols-and-strip-binaries.sh" \ + bash "${PACKAGE_SOURCE_ROOT}/.github/scripts/archive-release-symbols-and-strip-binaries.sh" \ --target "${TARGET}" \ --artifact-name "${TARGET}" \ --release-dir "${CARGO_TARGET_DIR}/${TARGET}/release" \ @@ -215,7 +134,7 @@ runs: env: TARGET: ${{ inputs.target }} CODEX_PACKAGE_VERSION: ${{ inputs.package-version }} - PACKAGE_ACTION_PATH: ${{ github.action_path }} + PACKAGE_SOURCE_ROOT: ${{ steps.package_setup.outputs.source_root }} run: | set -euo pipefail target="${TARGET}" @@ -245,7 +164,7 @@ runs: package_args+=(--zsh-manifest "${RUNNER_TEMP}/codex-zsh") fi - python3 "${PACKAGE_ACTION_PATH}/../../../scripts/build_codex_package.py" \ + python3 "${PACKAGE_SOURCE_ROOT}/scripts/build_codex_package.py" \ "${package_args[@]}" \ --variant codex \ --entrypoint-bin "${release_dir}/codex${exe_suffix}" \ @@ -253,7 +172,7 @@ runs: --archive-output "${archive_dir}/codex-package-${target}.tar.gz" \ --archive-output "${archive_dir}/codex-package-${target}.tar.zst" - python3 "${PACKAGE_ACTION_PATH}/../../../scripts/build_codex_package.py" \ + python3 "${PACKAGE_SOURCE_ROOT}/scripts/build_codex_package.py" \ "${package_args[@]}" \ --variant codex-app-server \ --entrypoint-bin "${release_dir}/codex-app-server${exe_suffix}" \ @@ -267,10 +186,10 @@ runs: env: TARGET: ${{ inputs.target }} PYTHONPATH: ${{ github.workspace }}/sdk/python/src${{ runner.os == 'Windows' && ';' || ':' }}${{ github.workspace }}/sdk/python/tests - PACKAGE_ACTION_PATH: ${{ github.action_path }} + PACKAGE_SOURCE_ROOT: ${{ steps.package_setup.outputs.source_root }} run: | set -euo pipefail - cd "${PACKAGE_ACTION_PATH}/../../../scripts/codex_package/smoke_tests" + cd "${PACKAGE_SOURCE_ROOT}/scripts/codex_package/smoke_tests" target="${TARGET}" archive_dir="${GITHUB_WORKSPACE}/dist/${target}" mkdir -p "${GITHUB_WORKSPACE}/codex-rs/target" diff --git a/.github/actions/setup-bazel-ci/action.yml b/.github/actions/setup-bazel-ci/action.yml index ac4f5aa97c..7ae28498fb 100644 --- a/.github/actions/setup-bazel-ci/action.yml +++ b/.github/actions/setup-bazel-ci/action.yml @@ -27,9 +27,9 @@ runs: - name: Configure Bazel repository cache id: configure_bazel_repository_cache - shell: pwsh + shell: bash run: | - "repository-cache-path=$env:BAZEL_REPOSITORY_CACHE" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append + echo "repository-cache-path=$BAZEL_REPOSITORY_CACHE" >> "$GITHUB_OUTPUT" - name: Expose MSVC SDK environment (Windows) if: runner.os == 'Windows'