github/codex
4
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-21 07:42:01 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
aa6635ece5acecb7dac021b55132d37708f9a9f3
codex/.github/workflows
T
History
chess 7c2ce90716 Sign the PowerShell installer in Windows releases (#51158) 
## What changed

Extend the Windows signing action with an `additional-files` input and sign `scripts/install/install.ps1` with Azure Trusted Signing in the x64 release job. Stage the architecture-independent installer after compression so it remains a plain script, and publish the signed artifact as `install.ps1` instead of copying the unsigned source.

## Testing

The Windows release workflow verifies that the installer has a valid Authenticode signature and a timestamp certificate before staging it, failing the job if either check fails.

GitOrigin-RevId: 6f16a084b8f350fbf3644c36d75651a6f4b88506
2026-10-05 18:54:42 +00:00
..
bazel.yml
Balance Windows Bazel test shards using duration estimates (#49103)
2026-09-28 23:52:19 +00:00
blob-size-policy.yml
Run required CI against pull request merge commits (#38051)
2026-08-11 18:31:31 +00:00
blocking-ci.yml
Run required CI against pull request merge commits (#38051)
2026-08-11 18:31:31 +00:00
cargo-deny.yml
Run required CI against pull request merge commits (#38051)
2026-08-11 18:31:31 +00:00
cla.yml
[codex] Pin GitHub Actions workflow references (#15828)
2026-03-27 23:00:05 +00:00
close-stale-contributor-prs.yml
[codex] Fully qualify hash-pins in GitHub Actions (#21436)
2026-05-07 14:31:20 -07:00
codespell.yml
Run required CI against pull request merge commits (#38051)
2026-08-11 18:31:31 +00:00
Dockerfile.bazel
Remove js_repl feature (#19410)
2026-04-24 17:49:29 -07:00
issue-deduplicator.yml
ci: use issue triage environment for issue workflows (#25134)
2026-05-29 12:06:55 -07:00
issue-labeler.yml
Add dots to issue labeler guidance (#50183)
2026-10-02 05:05:12 +00:00
issue-translator.yml
Translate non-English issues (#27778)
2026-06-11 23:20:36 -07:00
postmerge-ci.yml
[codex] group blocking and postmerge CI workflows (#30146)
2026-06-26 15:07:05 -07:00
python-runtime-build.yml
Publish Python packages after stable CLI releases (#44067)
2026-09-09 05:39:52 +00:00
python-runtime-release.yml
Build Python SDK artifacts before publishing the runtime (#44061)
2026-09-09 05:14:27 +00:00
python-sdk-build.yml
Publish Python packages after stable CLI releases (#44067)
2026-09-09 05:39:52 +00:00
python-sdk-cli-release.yml
Publish Python packages after stable CLI releases (#44067)
2026-09-09 05:39:52 +00:00
python-sdk-release.yml
Build Python SDK artifacts before publishing the runtime (#44061)
2026-09-09 05:14:27 +00:00
r2-release.yml
Guard prerelease channel and canary updates against older versions (#47597)
2026-09-23 17:35:40 +00:00
README.md
Run required CI against pull request merge commits (#38051)
2026-08-11 18:31:31 +00:00
repo-checks.yml
Guard prerelease channel and canary updates against older versions (#47597)
2026-09-23 17:35:40 +00:00
rust-ci-full-nextest-platform.yml
Add opt-in local audio devices to the voice helper (#43079)
2026-09-05 19:11:52 +00:00
rust-ci-full.yml
Update the Rust toolchain action for argument-comment linting (#49801)
2026-10-01 01:26:12 +00:00
rust-ci.yml
Upgrade the argument comment lint toolchain and Dylint (#49706)
2026-09-30 18:49:29 +00:00
rust-release-argument-comment-lint.yml
Update the Rust toolchain action for argument-comment linting (#49801)
2026-10-01 01:26:12 +00:00
rust-release-provisioned-macos.yml
Publish opt-in provisioned macOS packages with Rust releases (#45345)
2026-09-14 04:37:04 +00:00
rust-release-windows.yml
Sign the PowerShell installer in Windows releases (#51158)
2026-10-05 18:54:42 +00:00
rust-release-zsh.yml
Run DotSlash publishing directly on Ubuntu runners (#45035)
2026-09-12 13:07:13 +00:00
rust-release.yml
Sign the PowerShell installer in Windows releases (#51158)
2026-10-05 18:54:42 +00:00
rusty-v8-release.yml
Pin V8 release manifests and prevent published release replacement (#43444)
2026-09-07 11:55:57 +00:00
sdk.yml
Use shared Bazel cache preparation in SDK CI (#45554)
2026-09-15 00:17:24 +00:00
v8-canary.yml
Pin V8 release manifests and prevent published release replacement (#43444)
2026-09-07 11:55:57 +00:00
zstd
ci(windows): use DotSlash for zstd in rust-release-windows (#11542)
2026-02-11 20:57:11 -08:00

README.md

Workflow Strategy

The workflows in this directory are split so that pull requests get fast, review-friendly signal while main still gets the full cross-platform verification pass.

Pull Requests

  • Required checks run against GitHub's synthetic merge commit, not the pull request head alone. This includes changes already on main and catches conflicts before they reach the branch.
  • bazel.yml is the main pre-merge verification path for Rust code. It runs Bazel test and Bazel clippy on the supported Bazel targets, including the generated Rust test binaries needed to lint inline #[cfg(test)] code.
  • rust-ci.yml keeps the Cargo-native PR checks intentionally small:
    • cargo fmt --check
    • cargo shear
    • argument-comment-lint on Linux, macOS, and Windows
    • tools/argument-comment-lint package tests when the lint or its workflow wiring changes

Post-Merge On main

  • bazel.yml also runs on pushes to main. This re-verifies the merged Bazel path and helps keep the BuildBuddy caches warm.
  • rust-ci-full.yml is the full Cargo-native verification workflow. It keeps the heavier checks off the PR path while still validating them after merge:
    • the full Cargo clippy matrix
    • the full Cargo nextest matrix via per-platform archive-backed shards
    • Windows ARM64 nextest archives cross-compiled on Windows x64, then replayed on native Windows ARM64 shards
    • release-profile Cargo builds
    • cross-platform argument-comment-lint
    • Linux remote-env tests

Rule Of Thumb

  • If a build/test/clippy check can be expressed in Bazel, prefer putting the PR-time version in bazel.yml.
  • Keep rust-ci.yml fast enough that it usually does not dominate PR latency.
  • Reserve rust-ci-full.yml for heavyweight Cargo-native coverage that Bazel does not replace yet.
Reference in New Issue View Git Blame Copy Permalink