## What changed
Pass `BUILDBUDDY_API_KEY` to Linux, macOS, and Windows voice release builds, and give the dedicated macOS and Windows voice jobs access to the `bazel` environment without creating deployments.
Use the shared Bazel preparation action and BuildBuddy wrapper for Linux and macOS voice builds so they inherit the existing repository cache and remote cache configuration.
GitOrigin-RevId: 52cdf05bc4567f3e8c460d2509e57bb30e667868
## Why
Publishing a draft prerelease emits a `published` event instead of a `prereleased` event.
## What changed
Create GitHub prereleases with `--draft=false` so they emit `prereleased` events. Keep stable releases as drafts until all asset uploads succeed.
GitOrigin-RevId: 145fd84f852d7ee9cb3c4edff7007a34c3389e1c
## Why
Prereleases were published before their assets finished uploading, exposing incomplete releases.
## What changed
Create new prereleases as drafts, matching stable releases, and publish them only after all asset uploads succeed. Publishing a draft emits a `published` event rather than a `prereleased` event.
GitOrigin-RevId: 0d1c52038bb9b7beb4b5b9bf52f0ef4c3734de61
## What changed
- Switch argument-comment lint, rusty-v8 release, and V8 canary jobs to `prepare-bazel-ci` to restore repository caches and configure execution logs. Use `bazel-argument-comment-lint` and `bazel-v8` cache scopes.
- Include changes to `prepare-bazel-ci` in V8 canary path detection.
- Pass `BUILDBUDDY_API_KEY` to the `MODULE.bazel.lock` check.
GitOrigin-RevId: 6ef150f93413d1d30287f0728358eed26e792204
## What changed
- Attempt each `npm publish` up to three times, with 10- and 20-second delays and fresh OIDC credentials on each attempt. Continue skipping already-published versions.
- Enable verbose npm logging and retain debug logs as artifacts for seven days, including on failure.
- Use `macos-15-intel` to verify provisioned `x86_64-apple-darwin` packages, while keeping `aarch64-apple-darwin` verification on `macos-15-xlarge`.
GitOrigin-RevId: 1876c66993ecd8cdb44088ab17a3363d21135ec4
## What changed
Replace fixed release pins for app-server/exec-server compatibility tests with the latest stable version and the stable release published closest to 60 days ago. Exclude drafts and prereleases, and prefer the higher version when publication dates are equally close.
Resolve release versions and SHA-256 asset digests before Linux Bazel CI runs, passing them through `CODEX_COMPAT_RELEASES` to the release archive repositories. Reuse the argument comment lint action so it also prepares compatibility releases. Add bounded retries for transient GitHub release reads.
## Testing
Add unit coverage for stable release filtering, version ordering, nearest publication dates, tie-breaking, and deduplication when both selections resolve to the same release.
GitOrigin-RevId: 5a8cf8bdabd77ab3fa89bbb711367b5d9ce8044b
## Why
Optimized `Array.prototype.sort` can write objects into incompatible array element storage when receiver element kinds differ and the comparator mutates the array.
## What changed
- Upgrade `v8` to `152.2.0`, the Bazel V8 source to `15.2.124.1`, and ICU data and initialization to version 78.
- Backport element-kind agreement checks for sort inlining in TurboFan and Maglev. Apply the patch to Bazel builds and Windows MSVC source builds, and include it in source-build cache keys and canary triggers.
- Refresh pinned sandbox archives and bindings, extend Bazel prebuilt coverage to musl Linux, and use matching sandbox bindings on Windows MSVC.
- Update Bazel integration patches and runtime dependencies for the new V8 release, and download the pinned Windows build tools in source-build workflows.
## Testing
Include the upstream sort regression test covering mixed element kinds, comparator mutation, and continued optimization for matching kinds. Add a test requiring canary and Windows source builds when the backport changes, and update artifact-fetch tests for the new version.
GitOrigin-RevId: 138b7821cddd25466c10aced1dd22be24837caf0
## What changed
Replace `softprops/action-gh-release` in `.github/workflows/rust-release.yml` with explicit `gh` commands:
- Look up the release by tag, including drafts, and fail on API errors.
- Create stable releases as drafts until assets are uploaded. Create prereleases directly to preserve prerelease events.
- Upload sorted assets with `--clobber`, then publish the release with the configured title, notes, prerelease status, and latest status.
- Cap release notes at 124,999 characters, including a trailing newline.
GitOrigin-RevId: f343e4f265b06e047d85fe5a2b89a92690c7a7fb
## Why
Hermetic LLVM targets the GNU ABI on Windows even when an MSVC platform is selected. Native MSVC builds need the runner's MSVC toolchains and SDK environment.
## What changed
- Register the local x64 and ARM64 C++ toolchains in `ci-windows-msvc`.
- Apply `--config=ci-windows-msvc` to the native Windows Bazel test job.
- Allow the native Windows test job to run on `workflow_dispatch` as well as pushes to `main` so toolchain changes can be tested manually.
GitOrigin-RevId: b9fbd3f2bba8a3a8bf226cafda19a921c8738acd
## Why
Parallel Bazel artifacts are advisory while Cargo remains the release path.
## What changed
- Set `continue-on-error` for Bazel matrix jobs covering builds, Windows symbols and signing, and macOS signing, packaging, and verification.
- Assign the main release build jobs in both workflows to the `bazel` environment with `deployment: false`.
GitOrigin-RevId: e8a0fd522ec6482c0f39abdfc8677018be409361
## What changed
- Reformat Markdown tables and lists, login pages, inline visualization HTML, and sample JavaScript scripts.
- Escape union-type pipes in Python SDK API tables so they render within their cells.
- Keep the formatting-recipe test focused on the working directory and formatter commands by removing assertions on comment text.
GitOrigin-RevId: ae46d5b40fd013553de8b5ccf2c41d76be65aba8
## What changed
Remove the patched `zsh` resource from package assembly and macOS signing, along with the `--zsh-bin` and `--zsh-manifest` packaging options.
Delete the standalone `codex-zsh` release workflow, build scripts, and DotSlash manifests. Update package documentation and layout and signing tests to match the remaining resources.
GitOrigin-RevId: 429a8db55048fed7facec89957910206523b6013
## What changed
- Use the standard shell executor and remove the zsh fork escalation runtime, `codex-execve-wrapper`, and `shell-escalation` crate.
- Ignore `shell_zsh_fork` and `unified_exec_zsh_fork`, emit migration notices for legacy configuration, and warn when ignoring managed requirements for these flags.
- Keep the active session's `apply_patch` alias directory readable under restricted filesystem permissions.
## Testing
Add coverage for legacy configuration startup and shell execution, migration notice rendering, active alias directory selection, and nested `apply_patch` execution while other files in `CODEX_HOME` remain unreadable.
GitOrigin-RevId: 43af461fea32b4980550ee7237effd2bc0646ed8
## What changed
- Add Cargo and Bazel build matrices for Linux, macOS, and Windows, carrying both through signing, packaging, and artifact verification.
- Publish Bazel binaries, packages, and symbols with a `-bazel` suffix while preserving Cargo artifact names. Keep Python runtime wheels and the Windows installer on the Cargo path.
- Use `--config=release` for native voice builds and Windows voice tests, set the macOS voice build minimum to 14.0, and increase the Windows binary build timeout to 120 minutes while both build paths coexist.
GitOrigin-RevId: 77bcdd7b2a573d0ae2a4c3392e0708445b386f23
## What changed
Add a `build-system` input to `build-codex-packages`, defaulting to `cargo`, and extract binary builds into dedicated Cargo and Bazel actions. The Bazel path stages binaries and symbols for the shared CLI and app-server packaging and smoke-test steps, with support for `release` and `debug` build modes.
Resolve the package source root before invoking nested actions, and use Bash to export the Bazel repository cache path.
GitOrigin-RevId: ebd5e7c84451733419838da5956dc090cd09b19a
## What changed
- Add `runtime_package` targets for combined, primary, app-server, and Windows helper bundles, plus per-binary release archives.
- Apply release settings automatically and retain unstripped binaries with macOS dSYM or Windows PDB symbols. Require platform-specific symbols and validate that dSYM bundles contain nonempty DWARF data.
- Support a `debug` build mode for faster package smoke builds and configure platform-specific release settings, including native Windows MSVC toolchains.
- Add a composite action that refreshes Cargo workspace metadata, builds the selected archive, and extracts writable files for existing signing and packaging steps.
GitOrigin-RevId: 21109875cde228aaef67b2ba9812b3e4854aee84
## What changed
Stop setting `BAZEL_HOST_JVM_ARG=-Xint` in the Windows release workflow and remove support for forwarding `BAZEL_HOST_JVM_ARG` as `--host_jvm_args` in `.github/scripts/run-bazel-ci.sh`.
GitOrigin-RevId: 49ff5a56dc00b14c529ebefab917cb1d68216431
## What changed
Require `--prerelease false` before publishing the R2 `codex/install.sh` and `codex/install.ps1` aliases when updating the `latest` channel. This keeps prereleases marked latest from overwriting the stable installer aliases.
GitOrigin-RevId: 2ee7a8aee03f5242fb3b85af377655017e0d23b8
## Why
Release builds for different tags can run concurrently, but publication must remain serialized so channel checks and updates cannot race or move release pointers backward.
## What changed
Scope workflow concurrency to `${{ github.workflow }}-${{ github.ref }}`. Keep `release`, `publish-r2`, `publish-npm`, `winget`, and `update-branch` on a shared `rust-release` concurrency group with `queue: max` and `cancel-in-progress: false`.
GitOrigin-RevId: 75b42fd765db6091fb9190aae2ecccd2bb959d08
## Why
Publishing an older stable version should not replace a newer release as the default download or installation target.
## What changed
- Compare stable versions before marking a GitHub release as latest, allowing same-version reruns to finish publication.
- Guard npm `latest` and platform dist-tags, publishing older versions under separate `release-<version>-<tag>` tags.
- Check R2's `latest` channel before updating it or the installer aliases, while allowing same-version reruns to repair interrupted installer updates.
- Reject invalid existing stable release metadata and consolidate GitHub latest and canary checks in `releases.py`.
## Testing
Add regression tests for stable version ordering, same-version reruns, npm package and platform tags, and invalid channel metadata. All 21 tests in `.github/scripts/test_releases.py` pass.
GitOrigin-RevId: e6bad3ee163b279ac1661b9070712a41eedd50ff
## What changed
Extend the Windows signing action with an `additional-files` input and sign `scripts/install/install.ps1` with Azure Trusted Signing in the x64 release job. Stage the architecture-independent installer after compression so it remains a plain script, and publish the signed artifact as `install.ps1` instead of copying the unsigned source.
## Testing
The Windows release workflow verifies that the installer has a valid Authenticode signature and a timestamp certificate before staging it, failing the job if either check fails.
GitOrigin-RevId: 6f16a084b8f350fbf3644c36d75651a6f4b88506
Set `OAI_RCODESIGN_ARM64_16K_CODE_PAGES=true` to pass
`--arm64-16k-code-pages` when signing with `rcodesign`. The option is
disabled by default.
GitOrigin-RevId: ee7d4992f89a8fe2eb355fb2516a0188e7583812
Teach the issue labeler to suggest `dots` for issues about setting up
ChatGPT dots or managing their ongoing work. Exclude these issues from
the generic `agent` fallback.
GitOrigin-RevId: 6950c1bbde3aaf7f050e64484658f4ed1e4ae6e8
## Why
Cygwin records installation timestamps in an unused Java truststore, changing Bazel action cache keys when the same tools are reinstalled.
## What changed
Exclude `cygwin/etc/pki/ca-trust/extracted/java/cacerts` from the generated `cygwin` filegroup in `.github/scripts/voice_windows_tools.py`.
GitOrigin-RevId: 8fdd910fadba7d977b45718546232652d073cdc8
## What changed
Pin `dtolnay/rust-toolchain` to a revision from `master` in the argument-comment lint package CI and release build workflows. Both continue to request `nightly-2026-08-20`.
GitOrigin-RevId: 63801f669b91d4bfa1d69fc05d728d838ca8add0
## What changed
- Move the lint to `nightly-2026-08-20` and Dylint `6.1.0`, updating CI, release artifacts, Bazel configuration, and installation instructions.
- Adapt to the updated rustc and Clippy APIs, including resolving `Option::None` through type aliases when checking for uncommented arguments.
- Set the `chatgpt` crate's `recursion_limit` to `256`.
## Testing
Extend the UI fixture to expect an uncommented-argument warning for `OptionalString::None`, where `OptionalString` aliases `Option<String>`.
GitOrigin-RevId: 34e1b173972f0bfa9b6c8fd3342ca652539efe2f
## Why
Publishing an older alpha or alpha hotfix can overwrite npm dist-tags that already point to a newer release.
## What changed
Check each package's current npm dist-tag before publishing an alpha release, using the existing release version comparison and workflow concurrency lock. Handle `alpha` and platform-specific tags independently for Codex, the SDK, and the responses API proxy.
When the release does not advance the current version, publish under `release-<version>-<tag>` to keep it installable without changing the alpha or `latest` tags. Abort publishing if the registry lookup fails.
## Testing
Add unit tests for package and platform tag selection, older releases, dotted alpha hotfixes, missing tags, and registry lookup failures.
GitOrigin-RevId: 9c0edec1149bf78c01aac0f700e963630316eaea
## Why
Hash-based sharding does not account for differences in test duration. Use estimated test time to balance the Windows Bazel workload across shards.
## What changed
- Add checked-in duration weights and a deterministic selector that assigns the longest targets first to the least-loaded shard.
- Assign every queried target exactly once, default missing weights to one second, and ignore stale weights.
- Run queries and selection in the foreground so failures stop the job before tests run with a partial target list.
- Emit LF-delimited target labels for Git Bash and report estimated shard loads on stderr.
## Testing
Add seven passing selector tests covering deterministic coverage and balancing, missing and stale weights, invalid inputs, duration-file overrides, and CLI output. Run them on the first Windows CI shard.
GitOrigin-RevId: d415ae093bfe57794ee53a2eb9d712022202dad8
Set `CFBundleName` to `ChatGPT` and add `CFBundleDisplayName` with the same
value in the generated `Info.plist`.
GitOrigin-RevId: e40a0b10895227148d6fdc199b1c4166b5c59372
Create a temporary `.curlrc` containing `retry-all-errors` and set
`CURL_HOME` for the DotSlash installer in the shared CI setup action.
GitOrigin-RevId: 920a71c1d1e42016e46c3dd01baa97e082cb4045
## Why
Publishing a hotfix for an older release line or alpha can replace a newer prerelease pointer. Release pointers should advance according to version order.
## What changed
- Share release version validation and numeric comparison across publishing scripts, including alpha hotfix suffixes and alpha, beta, and stable ordering.
- Read the prerelease pointer directly from R2 and update it only for a newer version or missing or invalid version metadata.
- Restrict `latest-alpha-cli` updates to alpha releases with successful R2 and npm publishing, and compare against the branch's Cargo version before advancing it. Allow replacement when the manifest version cannot be parsed or validated.
## Testing
Add 15 passing unit tests covering version validation, older release lines and alphas, numeric hotfix ordering, prerelease precedence, equal versions, and missing or invalid versions.
GitOrigin-RevId: 6bee3906a47f613b662ef2b2224cfcbd1b56650c
Delete the workflow that refreshed `codex-rs/models-manager/models.json`
and opened update pull requests every four hours or on manual dispatch.
GitOrigin-RevId: 0179d8af57b17fd69e9b7e94b7f7ed7b0c6dcc24
## What changed
Add `build-codex-packages` to build unsigned CLI and app-server packages for a supplied Rust target and package version. Support release optimizations or faster, unoptimized builds using the release profile.
Prepare platform-specific tools and bundled binaries, archive debug symbols, and produce both `.tar.gz` and `.tar.zst` packages.
## Testing
Run the existing package smoke tests against both compression formats and the symbols archive. Reject host `rg`, and host `bwrap` on Linux, on `PATH` so the tests exercise packaged tools.
GitOrigin-RevId: e843db1ec94681a33a37862fa0cbbb8d715f3b5f
## Why
The WinGet Releaser action references `cargo-binstall@main`, violating the requirement for full commit SHA action pins.
## What changed
Replace the action with explicit steps that install SHA-pinned `cargo-binstall` version `1.23.0` and `komac` version `2.16.0`. Discover the published Windows archive URLs and require two matching assets before submitting the `OpenAI.Codex` update.
Use `komac` to sync the publishing fork, submit the WinGet update, and clean up merged branches.
GitOrigin-RevId: da4da51937a372b841f42420b5bf775a9c151e4e
## Why
Existing login-keychain access rules identify the CLI as `codex`. Packaging it in an app bundle must preserve that code-signing identifier independently of the bundle identifier and provisioned App ID.
## What changed
- Sign the provisioned CLI with the identifier `codex`, retaining `com.openai.codex.cli` as its bundle identifier.
- Require the expected signing identifier and team during signature verification, and reject unexpected bundle identifiers, executable names, or package types.
- Document the identity distinction and keychain compatibility limits.
## Testing
Extend signing-driver tests to check the signing identifier, verification requirement, bundle metadata, and provisioned entitlements, and to reject altered bundle identity fields. These tests use generated credentials and stubbed native tools; they do not verify runtime keychain access or credential recovery.
GitOrigin-RevId: ab00072e48189551adb0e70008210fee6d36241d
Upgrade `softprops/action-gh-release` from `v2.6.1` to `v3.0.3` and enable
`preserve_order` in the Rust release workflow to upload assets serially,
following GitHub's recommendation to avoid concurrent REST API requests.
GitOrigin-RevId: d1fbbbb01e191967be303040cfa2949146a2292d
## Why
The release publisher uploads objects in parallel. Serializing transfers within each object avoids additional concurrency that can trigger R2 throttling.
## What changed
Configure the AWS CLI to use the `classic` S3 transfer client with `max_concurrent_requests` set to `1`. Enable `standard` retry mode with a maximum of six attempts for R2 release publishing.
GitOrigin-RevId: a029341e37ea36cfd077d13ff929963e3f697542
## Why
A release can succeed with the optional `provisioned-macos-candidate` job
skipped. R2 publishing needs explicit status conditions to avoid inheriting
GitHub Actions' default skip behavior from upstream jobs.
## What changed
Add `!cancelled()` and explicit dependency success checks to both R2 jobs in
`.github/workflows/rust-release.yml`. Asset publishing requires `release` to
succeed; finalization also requires `publish-dotslash` and `publish-r2-assets`
to succeed.
GitOrigin-RevId: dbb975b79592df26d128ebf5ea770d92555d431d
## What changed
Set the `publish-dotslash` job condition to `!cancelled() && needs.release.result == 'success'` so it runs after a successful release unless the workflow is cancelled.
GitOrigin-RevId: 38e7a00fc50839b660e2d0cfed71002338387ffe
## What changed
Switch the SDK workflow to `prepare-bazel-ci` with the `sdk` cache scope to restore the Bazel repository cache using a dedicated namespace. Use the action's cache key and hit outputs when saving, and save only after a successful Bazel build when no exact cache hit was found.
GitOrigin-RevId: 15bad8ccf1a45685e0ab0191d1aa514b4ccb06bf
Sort top-level artifact files by descending size before dispatching them to
`xargs -P2`, so both compression workers stay busy.
GitOrigin-RevId: a459af0a0c50ead1aaf2a7c19563d8100cd63f0e
## Why
The Windows release workflow builds an extra package archive only to extract it again when staging the Python runtime wheel. Reuse the package directory to avoid this round trip.
## What changed
- Allow `stage-runtime` to accept a Codex package directory as well as a `.tar.gz` archive, with the same package layout validation.
- Reject overlapping source and staging directories, symlinks, and non-regular directory entries before staging.
- Stage Windows runtime wheels from the existing package directory and retain the check that voice resources are absent.
## Testing
Add coverage for matching directory and archive output, including file permissions, source preservation, invalid layouts, non-regular entries, overlapping directories, and CLI handling of both source formats.
GitOrigin-RevId: bf6d1e05888367d482d8d51a4a8061f92a9cae8b
## What changed
- When `CODEX_PROVISIONED_MACOS_CANDIDATE` is `true`, require the provisioned macOS job to succeed and upload its verified packages as release assets. Allow releases to proceed when the job is disabled and skipped.
- Include provisioned archives in `codex-package_SHA256SUMS` and remove per-architecture `SHA256SUMS` files before upload.
- Publish a `codex-provisioned` DotSlash manifest for macOS ARM64 and x86_64 packages, pointing to `bin/codex`.
GitOrigin-RevId: 7e36df484a3b7da6b66180fa31418a6958d1fe77
## Why
The latest `openssl-src` 300.x crate still bundles OpenSSL 3.6.3. Build the 3.6.4 security release directly while preserving the existing 3.x ABI.
## What changed
- Build static OpenSSL libraries with the musl compiler for `x86_64` and `aarch64`, verifying the source archive's SHA-256 checksum.
- Set target-specific OpenSSL overrides to bypass vendored builds without affecting host build dependencies.
- Add `perl` and `make` to the musl build prerequisites and reuse completed OpenSSL installations.
GitOrigin-RevId: 4276c7d6cf30c31c8554246cea2f406dfbf7568b
Download target artifacts, supplemental release assets, and staged npm
packages in a single `actions/download-artifact` step in
`.github/workflows/rust-release.yml` using a combined artifact pattern.
GitOrigin-RevId: 64c63cc7a2e263418b2a4064c1fd46e1c514cc29
## Why
Avoid rebuilding the upstream Docker image and downloading its apt dependencies for each release by using the Python and `gh` already available on Ubuntu runners.
## What changed
Add a shared composite action that checks out the pinned upstream publisher and uses pinned `uv` to install hash-verified Python dependencies from wheels in a virtual environment. Accept multiple configuration paths and publish each manifest for the requested tag.
Update the Rust and zsh release workflows to use the action, combining the Codex and argument-comment-lint manifests into one invocation.
GitOrigin-RevId: 2a7ffef9a076a1d426349bcea587b10599cb8175
## Why
Windows release packages need the voice helper and native audio libraries. Realtime TLS connections on fresh Windows installations also need platform certificate validation so Windows can retrieve missing trusted roots on demand.
## What changed
- Build and sign the voice helper and audio DLLs for Windows x64 and ARM64, bundle a pinned Microsoft CRT DLL, and verify signatures and runtime receipts before packaging.
- Add verified, pinned Cygwin and native build tools plus MSVC linker, compiler, and path handling fixes for the Windows Bazel builds.
- Include voice resources in primary release archives and WinGet packages. Preserve WinGet executable names, update manifest hashes, and recognize the package root through matching entrypoint metadata. Keep Python runtime wheels voice-free to preserve their existing Windows support floor.
- Use Windows platform TLS validation for realtime WebSockets when no custom CA bundle is configured, preserving custom CA behavior.
## Testing
Add coverage for build-input integrity and unsafe paths, signed Windows runtime assembly, WinGet file and hash preservation, package discovery, and TLS trust selection, untrusted certificate rejection, and hostname validation.
GitOrigin-RevId: 423da35872fa5549d69fd4ca97d922bb49599386
## Why
Linux voice needs system ALSA plugins and enough buffering to accommodate PipeWire graph cycles without losing capture samples. Voice startup failures also need actionable diagnostics without exposing native error details.
## What changed
- Build and bundle GNU voice helpers and runtimes with primary Linux musl release archives, and sign the archives. Keep Python wheels free of these libraries to preserve `manylinux_2_17` compatibility.
- Discover ALSA plugins in fixed system directories and increase Linux capture and playback buffering to support larger PipeWire graph cycles.
- Report voice failures by stage, preserve negotiation timeout classification, and discard native error sources. Suppress the misleading `requested` closure message after failure cleanup.
- Add explicit Windows MSVC, pkgconf, and CMake toolchain configuration and preserve host architecture in native build environments.
## Testing
Add coverage for Linux release assembly, ALSA plugin discovery, PipeWire capture and playback, classified startup failures, failure cleanup rendering, and Windows build environment handling.
GitOrigin-RevId: d805eace96a669ce3a4489f12e2db6f68f9f7f53
Add `codex-windows-sandbox-service` to the Windows release binaries and
helper builds for x86_64 and ARM64. Register both architectures in the
DotSlash configuration to resolve their compressed service executables.
GitOrigin-RevId: 363ad9229856391b283e57cfb10f28910fed96fb
Adam Perry @ OpenAI