mirror of
https://github.com/openai/codex.git
synced 2026-05-01 09:56:37 +00:00
9b8a1fbefc
## Why The VS Code extension and desktop app do not need the full TUI binary, and `codex-app-server` is materially smaller than standalone `codex`. We still want to publish it as an official release artifact, but building it by tacking another `--bin` onto the existing release `cargo build` invocations would lengthen those jobs. This change keeps `codex-app-server` on its own release bundle so it can build in parallel with the existing `codex` and helper bundles. ## What changed - Made `.github/workflows/rust-release.yml` bundle-aware so each macOS and Linux MUSL target now builds either the existing `primary` bundle (`codex` and `codex-responses-api-proxy`) or a standalone `app-server` bundle (`codex-app-server`). - Preserved the historical artifact names for the primary macOS/Linux bundles so `scripts/stage_npm_packages.py` and `codex-cli/scripts/install_native_deps.py` continue to find release assets under the paths they already expect, while giving the new app-server artifacts distinct names. - Added a matching `app-server` bundle to `.github/workflows/rust-release-windows.yml`, and updated the final Windows packaging job to download, sign, stage, and archive `codex-app-server.exe` alongside the existing release binaries. - Generalized the shared signing actions in `.github/actions/linux-code-sign/action.yml`, `.github/actions/macos-code-sign/action.yml`, and `.github/actions/windows-code-sign/action.yml` so each workflow row declares its binaries once and reuses that list for build, signing, and staging. - Added `codex-app-server` to `.github/dotslash-config.json` so releases also publish a generated DotSlash manifest for the standalone app-server binary. - Kept the macOS DMG focused on the existing `primary` bundle; `codex-app-server` ships as the regular standalone archives and DotSlash manifest. ## Verification - Parsed the modified workflow and action YAML files locally with `python3` + `yaml.safe_load(...)`. - Parsed `.github/dotslash-config.json` locally with `python3` + `json.loads(...)`. - Reviewed the resulting release matrices, artifact names, and packaging paths to confirm that `codex-app-server` is built separately on macOS, Linux MUSL, and Windows, while the existing npm staging and Windows `codex` zip bundling contracts remain intact.
50 lines
1.4 KiB
YAML
50 lines
1.4 KiB
YAML
name: linux-code-sign
|
|
description: Sign Linux artifacts with cosign.
|
|
inputs:
|
|
target:
|
|
description: Target triple for the artifacts to sign.
|
|
required: true
|
|
artifacts-dir:
|
|
description: Absolute path to the directory containing built binaries to sign.
|
|
required: true
|
|
binaries:
|
|
description: Space-delimited binary basenames to sign.
|
|
default: "codex codex-responses-api-proxy"
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Install cosign
|
|
uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
|
|
|
|
- name: Cosign Linux artifacts
|
|
shell: bash
|
|
env:
|
|
ARTIFACTS_DIR: ${{ inputs.artifacts-dir }}
|
|
BINARIES: ${{ inputs.binaries }}
|
|
COSIGN_EXPERIMENTAL: "1"
|
|
COSIGN_YES: "true"
|
|
COSIGN_OIDC_CLIENT_ID: "sigstore"
|
|
COSIGN_OIDC_ISSUER: "https://oauth2.sigstore.dev/auth"
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
dest="$ARTIFACTS_DIR"
|
|
if [[ ! -d "$dest" ]]; then
|
|
echo "Destination $dest does not exist"
|
|
exit 1
|
|
fi
|
|
|
|
for binary in ${BINARIES}; do
|
|
artifact="${dest}/${binary}"
|
|
if [[ ! -f "$artifact" ]]; then
|
|
echo "Binary $artifact not found"
|
|
exit 1
|
|
fi
|
|
|
|
cosign sign-blob \
|
|
--yes \
|
|
--bundle "${artifact}.sigstore" \
|
|
"$artifact"
|
|
done
|