mirror of
https://github.com/openai/codex.git
synced 2026-04-24 22:54:54 +00:00
d9a385ac8c
## Summary - Pin Rust git patch dependencies to immutable revisions and make cargo-deny reject unknown git and registry sources unless explicitly allowlisted. - Add checked-in SHA-256 coverage for the current rusty_v8 release assets, wire those hashes into Bazel, and verify CI override downloads before use. - Add rusty_v8 MODULE.bazel update/check tooling plus a Bazel CI guard so future V8 bumps cannot drift from the checked-in checksum manifest. - Pin release/lint cargo installs and all external GitHub Actions refs to immutable inputs. ## Future V8 bump flow Run these after updating the resolved `v8` crate version and checksum manifest: ```bash python3 .github/scripts/rusty_v8_bazel.py update-module-bazel python3 .github/scripts/rusty_v8_bazel.py check-module-bazel ``` The update command rewrites the matching `rusty_v8_<crate_version>` `http_file` SHA-256 values in `MODULE.bazel` from `third_party/v8/rusty_v8_<crate_version>.sha256`. The check command is also wired into Bazel CI to block drift. ## Notes - This intentionally excludes RustSec dependency upgrades and bubblewrap-related changes per request. - The branch was rebased onto the latest origin/main before opening the PR. ## Validation - cargo fetch --locked - cargo deny check advisories - cargo deny check - cargo deny check sources - python3 .github/scripts/rusty_v8_bazel.py check-module-bazel - python3 .github/scripts/rusty_v8_bazel.py update-module-bazel - python3 -m unittest discover -s .github/scripts -p 'test_rusty_v8_bazel.py' - python3 -m py_compile .github/scripts/rusty_v8_bazel.py .github/scripts/rusty_v8_module_bazel.py .github/scripts/test_rusty_v8_bazel.py - repo-wide GitHub Actions `uses:` audit: all external action refs are pinned to 40-character SHAs - yq eval on touched workflows and local actions - git diff --check - just bazel-lock-check ## Hash verification - Confirmed `MODULE.bazel` hashes match `third_party/v8/rusty_v8_146_4_0.sha256`. - Confirmed GitHub release asset digests for denoland/rusty_v8 `v146.4.0` and openai/codex `rusty-v8-v146.4.0` match the checked-in hashes. - Streamed and SHA-256 hashed all 10 `MODULE.bazel` rusty_v8 asset URLs locally; every downloaded byte stream matched both `MODULE.bazel` and the checked-in manifest. ## Pin verification - Confirmed signing-action pins match the peeled commits for their tag comments: `sigstore/cosign-installer@v3.7.0`, `azure/login@v2`, and `azure/trusted-signing-action@v0`. - Pinned the remaining tag-based action refs in Bazel CI/setup: `actions/setup-node@v6`, `facebook/install-dotslash@v2`, `bazelbuild/setup-bazelisk@v3`, and `actions/cache/restore@v5`. - Normalized all `bazelbuild/setup-bazelisk@v3` refs to the peeled commit behind the annotated tag. - Audited Cargo git dependencies: every manifest git dependency uses `rev` only, every `Cargo.lock` git source has `?rev=<sha>#<same-sha>`, and `cargo deny check sources` passes with `required-git-spec = "rev"`. - Shallow-fetched each distinct git dependency repo at its pinned SHA and verified Git reports each object as a commit.
50 lines
1.9 KiB
YAML
50 lines
1.9 KiB
YAML
name: setup-rusty-v8-musl
|
|
description: Download and verify musl rusty_v8 artifacts for Cargo builds.
|
|
inputs:
|
|
target:
|
|
description: Rust musl target triple.
|
|
required: true
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Configure musl rusty_v8 artifact overrides and verify checksums
|
|
shell: bash
|
|
env:
|
|
TARGET: ${{ inputs.target }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
case "${TARGET}" in
|
|
x86_64-unknown-linux-musl|aarch64-unknown-linux-musl)
|
|
;;
|
|
*)
|
|
echo "Unsupported musl rusty_v8 target: ${TARGET}" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
version="$(python3 "${GITHUB_WORKSPACE}/.github/scripts/rusty_v8_bazel.py" resolved-v8-crate-version)"
|
|
release_tag="rusty-v8-v${version}"
|
|
base_url="https://github.com/openai/codex/releases/download/${release_tag}"
|
|
binding_dir="${RUNNER_TEMP}/rusty_v8"
|
|
archive_path="${binding_dir}/librusty_v8_release_${TARGET}.a.gz"
|
|
binding_path="${binding_dir}/src_binding_release_${TARGET}.rs"
|
|
checksums_path="${binding_dir}/rusty_v8_release_${TARGET}.sha256"
|
|
checksums_source="${GITHUB_WORKSPACE}/third_party/v8/rusty_v8_${version//./_}.sha256"
|
|
|
|
mkdir -p "${binding_dir}"
|
|
curl -fsSL "${base_url}/librusty_v8_release_${TARGET}.a.gz" -o "${archive_path}"
|
|
curl -fsSL "${base_url}/src_binding_release_${TARGET}.rs" -o "${binding_path}"
|
|
grep -E " (librusty_v8_release_${TARGET}[.]a[.]gz|src_binding_release_${TARGET}[.]rs)$" \
|
|
"${checksums_source}" > "${checksums_path}"
|
|
|
|
if [[ "$(wc -l < "${checksums_path}")" -ne 2 ]]; then
|
|
echo "Expected exactly two checksums for ${TARGET} in ${checksums_source}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
(cd "${binding_dir}" && sha256sum -c "${checksums_path}")
|
|
echo "RUSTY_V8_ARCHIVE=${archive_path}" >> "${GITHUB_ENV}"
|
|
echo "RUSTY_V8_SRC_BINDING_PATH=${binding_path}" >> "${GITHUB_ENV}"
|