## What changed
Replace `softprops/action-gh-release` in `.github/workflows/rust-release.yml` with explicit `gh` commands:
- Look up the release by tag, including drafts, and fail on API errors.
- Create stable releases as drafts until assets are uploaded. Create prereleases directly to preserve prerelease events.
- Upload sorted assets with `--clobber`, then publish the release with the configured title, notes, prerelease status, and latest status.
- Cap release notes at 124,999 characters, including a trailing newline.
GitOrigin-RevId: f343e4f265b06e047d85fe5a2b89a92690c7a7fb
## Why
Hermetic LLVM targets the GNU ABI on Windows even when an MSVC platform is selected. Native MSVC builds need the runner's MSVC toolchains and SDK environment.
## What changed
- Register the local x64 and ARM64 C++ toolchains in `ci-windows-msvc`.
- Apply `--config=ci-windows-msvc` to the native Windows Bazel test job.
- Allow the native Windows test job to run on `workflow_dispatch` as well as pushes to `main` so toolchain changes can be tested manually.
GitOrigin-RevId: b9fbd3f2bba8a3a8bf226cafda19a921c8738acd
## Why
Parallel Bazel artifacts are advisory while Cargo remains the release path.
## What changed
- Set `continue-on-error` for Bazel matrix jobs covering builds, Windows symbols and signing, and macOS signing, packaging, and verification.
- Assign the main release build jobs in both workflows to the `bazel` environment with `deployment: false`.
GitOrigin-RevId: e8a0fd522ec6482c0f39abdfc8677018be409361
## What changed
- Reformat Markdown tables and lists, login pages, inline visualization HTML, and sample JavaScript scripts.
- Escape union-type pipes in Python SDK API tables so they render within their cells.
- Keep the formatting-recipe test focused on the working directory and formatter commands by removing assertions on comment text.
GitOrigin-RevId: ae46d5b40fd013553de8b5ccf2c41d76be65aba8
## What changed
Remove the patched `zsh` resource from package assembly and macOS signing, along with the `--zsh-bin` and `--zsh-manifest` packaging options.
Delete the standalone `codex-zsh` release workflow, build scripts, and DotSlash manifests. Update package documentation and layout and signing tests to match the remaining resources.
GitOrigin-RevId: 429a8db55048fed7facec89957910206523b6013
## What changed
- Use the standard shell executor and remove the zsh fork escalation runtime, `codex-execve-wrapper`, and `shell-escalation` crate.
- Ignore `shell_zsh_fork` and `unified_exec_zsh_fork`, emit migration notices for legacy configuration, and warn when ignoring managed requirements for these flags.
- Keep the active session's `apply_patch` alias directory readable under restricted filesystem permissions.
## Testing
Add coverage for legacy configuration startup and shell execution, migration notice rendering, active alias directory selection, and nested `apply_patch` execution while other files in `CODEX_HOME` remain unreadable.
GitOrigin-RevId: 43af461fea32b4980550ee7237effd2bc0646ed8
## What changed
- Add Cargo and Bazel build matrices for Linux, macOS, and Windows, carrying both through signing, packaging, and artifact verification.
- Publish Bazel binaries, packages, and symbols with a `-bazel` suffix while preserving Cargo artifact names. Keep Python runtime wheels and the Windows installer on the Cargo path.
- Use `--config=release` for native voice builds and Windows voice tests, set the macOS voice build minimum to 14.0, and increase the Windows binary build timeout to 120 minutes while both build paths coexist.
GitOrigin-RevId: 77bcdd7b2a573d0ae2a4c3392e0708445b386f23
## What changed
Add a `build-system` input to `build-codex-packages`, defaulting to `cargo`, and extract binary builds into dedicated Cargo and Bazel actions. The Bazel path stages binaries and symbols for the shared CLI and app-server packaging and smoke-test steps, with support for `release` and `debug` build modes.
Resolve the package source root before invoking nested actions, and use Bash to export the Bazel repository cache path.
GitOrigin-RevId: ebd5e7c84451733419838da5956dc090cd09b19a
## What changed
- Add `runtime_package` targets for combined, primary, app-server, and Windows helper bundles, plus per-binary release archives.
- Apply release settings automatically and retain unstripped binaries with macOS dSYM or Windows PDB symbols. Require platform-specific symbols and validate that dSYM bundles contain nonempty DWARF data.
- Support a `debug` build mode for faster package smoke builds and configure platform-specific release settings, including native Windows MSVC toolchains.
- Add a composite action that refreshes Cargo workspace metadata, builds the selected archive, and extracts writable files for existing signing and packaging steps.
GitOrigin-RevId: 21109875cde228aaef67b2ba9812b3e4854aee84
## What changed
Stop setting `BAZEL_HOST_JVM_ARG=-Xint` in the Windows release workflow and remove support for forwarding `BAZEL_HOST_JVM_ARG` as `--host_jvm_args` in `.github/scripts/run-bazel-ci.sh`.
GitOrigin-RevId: 49ff5a56dc00b14c529ebefab917cb1d68216431
## What changed
Require `--prerelease false` before publishing the R2 `codex/install.sh` and `codex/install.ps1` aliases when updating the `latest` channel. This keeps prereleases marked latest from overwriting the stable installer aliases.
GitOrigin-RevId: 2ee7a8aee03f5242fb3b85af377655017e0d23b8
## Why
Release builds for different tags can run concurrently, but publication must remain serialized so channel checks and updates cannot race or move release pointers backward.
## What changed
Scope workflow concurrency to `${{ github.workflow }}-${{ github.ref }}`. Keep `release`, `publish-r2`, `publish-npm`, `winget`, and `update-branch` on a shared `rust-release` concurrency group with `queue: max` and `cancel-in-progress: false`.
GitOrigin-RevId: 75b42fd765db6091fb9190aae2ecccd2bb959d08
## Why
Publishing an older stable version should not replace a newer release as the default download or installation target.
## What changed
- Compare stable versions before marking a GitHub release as latest, allowing same-version reruns to finish publication.
- Guard npm `latest` and platform dist-tags, publishing older versions under separate `release-<version>-<tag>` tags.
- Check R2's `latest` channel before updating it or the installer aliases, while allowing same-version reruns to repair interrupted installer updates.
- Reject invalid existing stable release metadata and consolidate GitHub latest and canary checks in `releases.py`.
## Testing
Add regression tests for stable version ordering, same-version reruns, npm package and platform tags, and invalid channel metadata. All 21 tests in `.github/scripts/test_releases.py` pass.
GitOrigin-RevId: e6bad3ee163b279ac1661b9070712a41eedd50ff
## What changed
Extend the Windows signing action with an `additional-files` input and sign `scripts/install/install.ps1` with Azure Trusted Signing in the x64 release job. Stage the architecture-independent installer after compression so it remains a plain script, and publish the signed artifact as `install.ps1` instead of copying the unsigned source.
## Testing
The Windows release workflow verifies that the installer has a valid Authenticode signature and a timestamp certificate before staging it, failing the job if either check fails.
GitOrigin-RevId: 6f16a084b8f350fbf3644c36d75651a6f4b88506
Set `OAI_RCODESIGN_ARM64_16K_CODE_PAGES=true` to pass
`--arm64-16k-code-pages` when signing with `rcodesign`. The option is
disabled by default.
GitOrigin-RevId: ee7d4992f89a8fe2eb355fb2516a0188e7583812
Teach the issue labeler to suggest `dots` for issues about setting up
ChatGPT dots or managing their ongoing work. Exclude these issues from
the generic `agent` fallback.
GitOrigin-RevId: 6950c1bbde3aaf7f050e64484658f4ed1e4ae6e8
## Why
Cygwin records installation timestamps in an unused Java truststore, changing Bazel action cache keys when the same tools are reinstalled.
## What changed
Exclude `cygwin/etc/pki/ca-trust/extracted/java/cacerts` from the generated `cygwin` filegroup in `.github/scripts/voice_windows_tools.py`.
GitOrigin-RevId: 8fdd910fadba7d977b45718546232652d073cdc8
## What changed
Pin `dtolnay/rust-toolchain` to a revision from `master` in the argument-comment lint package CI and release build workflows. Both continue to request `nightly-2026-08-20`.
GitOrigin-RevId: 63801f669b91d4bfa1d69fc05d728d838ca8add0
## What changed
- Move the lint to `nightly-2026-08-20` and Dylint `6.1.0`, updating CI, release artifacts, Bazel configuration, and installation instructions.
- Adapt to the updated rustc and Clippy APIs, including resolving `Option::None` through type aliases when checking for uncommented arguments.
- Set the `chatgpt` crate's `recursion_limit` to `256`.
## Testing
Extend the UI fixture to expect an uncommented-argument warning for `OptionalString::None`, where `OptionalString` aliases `Option<String>`.
GitOrigin-RevId: 34e1b173972f0bfa9b6c8fd3342ca652539efe2f
## Why
Publishing an older alpha or alpha hotfix can overwrite npm dist-tags that already point to a newer release.
## What changed
Check each package's current npm dist-tag before publishing an alpha release, using the existing release version comparison and workflow concurrency lock. Handle `alpha` and platform-specific tags independently for Codex, the SDK, and the responses API proxy.
When the release does not advance the current version, publish under `release-<version>-<tag>` to keep it installable without changing the alpha or `latest` tags. Abort publishing if the registry lookup fails.
## Testing
Add unit tests for package and platform tag selection, older releases, dotted alpha hotfixes, missing tags, and registry lookup failures.
GitOrigin-RevId: 9c0edec1149bf78c01aac0f700e963630316eaea
## Why
Hash-based sharding does not account for differences in test duration. Use estimated test time to balance the Windows Bazel workload across shards.
## What changed
- Add checked-in duration weights and a deterministic selector that assigns the longest targets first to the least-loaded shard.
- Assign every queried target exactly once, default missing weights to one second, and ignore stale weights.
- Run queries and selection in the foreground so failures stop the job before tests run with a partial target list.
- Emit LF-delimited target labels for Git Bash and report estimated shard loads on stderr.
## Testing
Add seven passing selector tests covering deterministic coverage and balancing, missing and stale weights, invalid inputs, duration-file overrides, and CLI output. Run them on the first Windows CI shard.
GitOrigin-RevId: d415ae093bfe57794ee53a2eb9d712022202dad8
Set `CFBundleName` to `ChatGPT` and add `CFBundleDisplayName` with the same
value in the generated `Info.plist`.
GitOrigin-RevId: e40a0b10895227148d6fdc199b1c4166b5c59372
Create a temporary `.curlrc` containing `retry-all-errors` and set
`CURL_HOME` for the DotSlash installer in the shared CI setup action.
GitOrigin-RevId: 920a71c1d1e42016e46c3dd01baa97e082cb4045
## Why
Publishing a hotfix for an older release line or alpha can replace a newer prerelease pointer. Release pointers should advance according to version order.
## What changed
- Share release version validation and numeric comparison across publishing scripts, including alpha hotfix suffixes and alpha, beta, and stable ordering.
- Read the prerelease pointer directly from R2 and update it only for a newer version or missing or invalid version metadata.
- Restrict `latest-alpha-cli` updates to alpha releases with successful R2 and npm publishing, and compare against the branch's Cargo version before advancing it. Allow replacement when the manifest version cannot be parsed or validated.
## Testing
Add 15 passing unit tests covering version validation, older release lines and alphas, numeric hotfix ordering, prerelease precedence, equal versions, and missing or invalid versions.
GitOrigin-RevId: 6bee3906a47f613b662ef2b2224cfcbd1b56650c
Delete the workflow that refreshed `codex-rs/models-manager/models.json`
and opened update pull requests every four hours or on manual dispatch.
GitOrigin-RevId: 0179d8af57b17fd69e9b7e94b7f7ed7b0c6dcc24
## What changed
Add `build-codex-packages` to build unsigned CLI and app-server packages for a supplied Rust target and package version. Support release optimizations or faster, unoptimized builds using the release profile.
Prepare platform-specific tools and bundled binaries, archive debug symbols, and produce both `.tar.gz` and `.tar.zst` packages.
## Testing
Run the existing package smoke tests against both compression formats and the symbols archive. Reject host `rg`, and host `bwrap` on Linux, on `PATH` so the tests exercise packaged tools.
GitOrigin-RevId: e843db1ec94681a33a37862fa0cbbb8d715f3b5f
## Why
The WinGet Releaser action references `cargo-binstall@main`, violating the requirement for full commit SHA action pins.
## What changed
Replace the action with explicit steps that install SHA-pinned `cargo-binstall` version `1.23.0` and `komac` version `2.16.0`. Discover the published Windows archive URLs and require two matching assets before submitting the `OpenAI.Codex` update.
Use `komac` to sync the publishing fork, submit the WinGet update, and clean up merged branches.
GitOrigin-RevId: da4da51937a372b841f42420b5bf775a9c151e4e
## Why
Existing login-keychain access rules identify the CLI as `codex`. Packaging it in an app bundle must preserve that code-signing identifier independently of the bundle identifier and provisioned App ID.
## What changed
- Sign the provisioned CLI with the identifier `codex`, retaining `com.openai.codex.cli` as its bundle identifier.
- Require the expected signing identifier and team during signature verification, and reject unexpected bundle identifiers, executable names, or package types.
- Document the identity distinction and keychain compatibility limits.
## Testing
Extend signing-driver tests to check the signing identifier, verification requirement, bundle metadata, and provisioned entitlements, and to reject altered bundle identity fields. These tests use generated credentials and stubbed native tools; they do not verify runtime keychain access or credential recovery.
GitOrigin-RevId: ab00072e48189551adb0e70008210fee6d36241d
Upgrade `softprops/action-gh-release` from `v2.6.1` to `v3.0.3` and enable
`preserve_order` in the Rust release workflow to upload assets serially,
following GitHub's recommendation to avoid concurrent REST API requests.
GitOrigin-RevId: d1fbbbb01e191967be303040cfa2949146a2292d
## Why
The release publisher uploads objects in parallel. Serializing transfers within each object avoids additional concurrency that can trigger R2 throttling.
## What changed
Configure the AWS CLI to use the `classic` S3 transfer client with `max_concurrent_requests` set to `1`. Enable `standard` retry mode with a maximum of six attempts for R2 release publishing.
GitOrigin-RevId: a029341e37ea36cfd077d13ff929963e3f697542
## Why
A release can succeed with the optional `provisioned-macos-candidate` job
skipped. R2 publishing needs explicit status conditions to avoid inheriting
GitHub Actions' default skip behavior from upstream jobs.
## What changed
Add `!cancelled()` and explicit dependency success checks to both R2 jobs in
`.github/workflows/rust-release.yml`. Asset publishing requires `release` to
succeed; finalization also requires `publish-dotslash` and `publish-r2-assets`
to succeed.
GitOrigin-RevId: dbb975b79592df26d128ebf5ea770d92555d431d
## What changed
Set the `publish-dotslash` job condition to `!cancelled() && needs.release.result == 'success'` so it runs after a successful release unless the workflow is cancelled.
GitOrigin-RevId: 38e7a00fc50839b660e2d0cfed71002338387ffe
## What changed
Switch the SDK workflow to `prepare-bazel-ci` with the `sdk` cache scope to restore the Bazel repository cache using a dedicated namespace. Use the action's cache key and hit outputs when saving, and save only after a successful Bazel build when no exact cache hit was found.
GitOrigin-RevId: 15bad8ccf1a45685e0ab0191d1aa514b4ccb06bf
Sort top-level artifact files by descending size before dispatching them to
`xargs -P2`, so both compression workers stay busy.
GitOrigin-RevId: a459af0a0c50ead1aaf2a7c19563d8100cd63f0e
## Why
The Windows release workflow builds an extra package archive only to extract it again when staging the Python runtime wheel. Reuse the package directory to avoid this round trip.
## What changed
- Allow `stage-runtime` to accept a Codex package directory as well as a `.tar.gz` archive, with the same package layout validation.
- Reject overlapping source and staging directories, symlinks, and non-regular directory entries before staging.
- Stage Windows runtime wheels from the existing package directory and retain the check that voice resources are absent.
## Testing
Add coverage for matching directory and archive output, including file permissions, source preservation, invalid layouts, non-regular entries, overlapping directories, and CLI handling of both source formats.
GitOrigin-RevId: bf6d1e05888367d482d8d51a4a8061f92a9cae8b
## What changed
- When `CODEX_PROVISIONED_MACOS_CANDIDATE` is `true`, require the provisioned macOS job to succeed and upload its verified packages as release assets. Allow releases to proceed when the job is disabled and skipped.
- Include provisioned archives in `codex-package_SHA256SUMS` and remove per-architecture `SHA256SUMS` files before upload.
- Publish a `codex-provisioned` DotSlash manifest for macOS ARM64 and x86_64 packages, pointing to `bin/codex`.
GitOrigin-RevId: 7e36df484a3b7da6b66180fa31418a6958d1fe77
## Why
The latest `openssl-src` 300.x crate still bundles OpenSSL 3.6.3. Build the 3.6.4 security release directly while preserving the existing 3.x ABI.
## What changed
- Build static OpenSSL libraries with the musl compiler for `x86_64` and `aarch64`, verifying the source archive's SHA-256 checksum.
- Set target-specific OpenSSL overrides to bypass vendored builds without affecting host build dependencies.
- Add `perl` and `make` to the musl build prerequisites and reuse completed OpenSSL installations.
GitOrigin-RevId: 4276c7d6cf30c31c8554246cea2f406dfbf7568b
Download target artifacts, supplemental release assets, and staged npm
packages in a single `actions/download-artifact` step in
`.github/workflows/rust-release.yml` using a combined artifact pattern.
GitOrigin-RevId: 64c63cc7a2e263418b2a4064c1fd46e1c514cc29
## Why
Avoid rebuilding the upstream Docker image and downloading its apt dependencies for each release by using the Python and `gh` already available on Ubuntu runners.
## What changed
Add a shared composite action that checks out the pinned upstream publisher and uses pinned `uv` to install hash-verified Python dependencies from wheels in a virtual environment. Accept multiple configuration paths and publish each manifest for the requested tag.
Update the Rust and zsh release workflows to use the action, combining the Codex and argument-comment-lint manifests into one invocation.
GitOrigin-RevId: 2a7ffef9a076a1d426349bcea587b10599cb8175
## Why
Windows release packages need the voice helper and native audio libraries. Realtime TLS connections on fresh Windows installations also need platform certificate validation so Windows can retrieve missing trusted roots on demand.
## What changed
- Build and sign the voice helper and audio DLLs for Windows x64 and ARM64, bundle a pinned Microsoft CRT DLL, and verify signatures and runtime receipts before packaging.
- Add verified, pinned Cygwin and native build tools plus MSVC linker, compiler, and path handling fixes for the Windows Bazel builds.
- Include voice resources in primary release archives and WinGet packages. Preserve WinGet executable names, update manifest hashes, and recognize the package root through matching entrypoint metadata. Keep Python runtime wheels voice-free to preserve their existing Windows support floor.
- Use Windows platform TLS validation for realtime WebSockets when no custom CA bundle is configured, preserving custom CA behavior.
## Testing
Add coverage for build-input integrity and unsafe paths, signed Windows runtime assembly, WinGet file and hash preservation, package discovery, and TLS trust selection, untrusted certificate rejection, and hostname validation.
GitOrigin-RevId: 423da35872fa5549d69fd4ca97d922bb49599386
## Why
Linux voice needs system ALSA plugins and enough buffering to accommodate PipeWire graph cycles without losing capture samples. Voice startup failures also need actionable diagnostics without exposing native error details.
## What changed
- Build and bundle GNU voice helpers and runtimes with primary Linux musl release archives, and sign the archives. Keep Python wheels free of these libraries to preserve `manylinux_2_17` compatibility.
- Discover ALSA plugins in fixed system directories and increase Linux capture and playback buffering to support larger PipeWire graph cycles.
- Report voice failures by stage, preserve negotiation timeout classification, and discard native error sources. Suppress the misleading `requested` closure message after failure cleanup.
- Add explicit Windows MSVC, pkgconf, and CMake toolchain configuration and preserve host architecture in native build environments.
## Testing
Add coverage for Linux release assembly, ALSA plugin discovery, PipeWire capture and playback, classified startup failures, failure cleanup rendering, and Windows build environment handling.
GitOrigin-RevId: d805eace96a669ce3a4489f12e2db6f68f9f7f53
Add `codex-windows-sandbox-service` to the Windows release binaries and
helper builds for x86_64 and ARM64. Register both architectures in the
DotSlash configuration to resolve their compressed service executables.
GitOrigin-RevId: 363ad9229856391b283e57cfb10f28910fed96fb
## What changed
- Add a tag-release workflow gated by `CODEX_PROVISIONED_MACOS_CANDIDATE` for Apple Silicon and Intel macOS candidate artifacts.
- Package the CLI in `CodexCLI.app` with an embedded provisioning profile and a relocatable `bin/codex` launcher. Validate independently supplied profile, certificate, and team expectations before signing.
- Sign and notarize candidates, then verify signatures, entitlements, architecture, stapling, and Gatekeeper acceptance on macOS. Retain verified artifacts after package smoke tests pass.
- Filter code-mode smoke-test requests to `/v1/responses` so analytics requests are excluded from response parsing.
## Testing
Add tests for profile validation, launcher relocation and symlink handling, standard and provisioned signing flows, and rejection of signing, notarization, identity, and entitlement failures. The candidate workflow runs package smoke tests, including sandboxed code mode.
GitOrigin-RevId: f214f6a23dd10df62cd72a2c63c20cb0864fbc9c
Guard the `voice_args` array expansion to avoid unbound-variable errors
under `set -u` when packaging bundles without voice arguments. Preserve
quoted arguments for the `primary` bundle.
GitOrigin-RevId: 677a565d1678dc1e218cd9a98298aa6a26873643
## Why
GNU tar extraction and signing require writable copies of Bazel outputs.
## What changed
Recursively add owner write permission to the staged macOS voice runtime before creating the unsigned release archive.
GitOrigin-RevId: 1d415251b26303ac17cf886f35ae18277e9e6032
## What changed
Add a downstream workflow that builds the Python SDK and runtime from the stable CLI release commit, using the CLI version for both packages and the SDK's exact runtime dependency. Publish and verify the runtime on PyPI before publishing the SDK.
Require a successful CLI `release` job, an unchanged release tag, and complete runtime assets. Skip CLI prereleases and allow publication despite unrelated publisher failures. Support retries by CLI workflow run ID and accept existing PyPI uploads while verifying the complete release.
Document release setup, retry procedures, and independent SDK releases.
## Testing
Add resolver unit tests covering tag resolution, prerelease skipping, partial reruns, pagination, invalid runs, moved tags, missing assets, and equivalent automatic and manual release resolution.
GitOrigin-RevId: 4ec6b2e77c94c851507dbe7200ea420994fce36e
## What changed
- Build the voice host and native runtime with Bazel's `-c opt` configuration.
- Resolve runtime paths before validating their contents in the release workflow.
- Make `runtime.json` owner-writable before sealing the post-signing release receipt.
- Use `scripts` in `PYTHONPATH` so archive creation can import `codex_package.archive`.
GitOrigin-RevId: 02f960573a4151f52cde486e17e1d45b73435306
## Why
The SDK release workflow published the runtime before building the SDK, so an SDK build failure could leave the runtime published on its own.
## What changed
- Extract a reusable SDK build workflow that packages checked-in generated code and runs alongside runtime preparation. Require both builds before publishing the runtime, and verify runtime availability before publishing the SDK.
- Add `stage-sdk --codex-version` to set an explicit runtime dependency independently of the SDK version, retaining the checked-in pin by default and rejecting missing or duplicate pins.
- Accept Codex release tags in the runtime version resolver and use its normalized Python version for standalone runtime PyPI verification.
## Testing
Add coverage for wheel and source distribution metadata, preservation of checked-in code, independent beta SDK versions, runtime tag normalization, and invalid versions or dependency pins.
GitOrigin-RevId: feb572fadcf5d148814b26b480b4bae5ef6a39c5
## Why
The SDK publish job needs to wait for runtime wheels to become available on PyPI, and release reruns need to tolerate SDK files that have already been uploaded.
## What changed
- Require runtime publication and verification before publishing the SDK, and enable `skip-existing` for SDK uploads.
- Share a PyPI verifier between runtime and SDK releases. Require the exact expected artifact set, including the SDK wheel and source distribution.
- Canonicalize versions with `packaging.version.Version` and retry registry errors, malformed responses, and incomplete artifact sets with a bounded retry loop.
## Testing
Add unit tests for transient failures and malformed responses, waiting for complete SDK artifacts, canonical version lookup, and retry exhaustion when runtime wheels are missing. Run them in repository checks.
GitOrigin-RevId: 9cb2ddced4ce6d509ebfd130511ab3f39239dd62
jif