Conversation
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7aad628403
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| push: | ||
| tags: | ||
| - "codex-zsh-v*.*.*" |
There was a problem hiding this comment.
This workflow is still invoked from .github/workflows/rust-release.yml:1049 via jobs.zsh-release-assets.uses; after this change its only trigger is push, so the next normal Rust release cannot call it as a reusable workflow because GitHub reusable workflows must declare on.workflow_call. Keep workflow_call alongside the tag trigger, or remove/update the caller, so the main release pipeline does not fail before publishing zsh assets.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Plan:
- merge release: publish standalone zsh artifacts #30114
- push the codex-zsh-v0.1.0 tag and wait for builds to finish
- merge release: consume standalone zsh artifacts #30116
- kick off a new alpha build to verify everything works end-to-end
| # Keep zsh artifact releases out of Codex's normal "latest release" channel. | ||
| prerelease: true | ||
|
|
||
| - name: Amend existing GitHub Release |
There was a problem hiding this comment.
I had this for mine because I was debugging, just making sure that you want this behavior its kinda spooky since it lets us silently skew the backing bits to old releases.
Why
The patched zsh artifacts rarely change, but
.github/workflows/rust-release-zsh.ymlcurrently runs as part of every Rust release. Rebuilding the same four binaries for each Codex version wastes release capacity and ties an independently versioned runtime dependency to the main release cadence.This establishes the producer side of a build-once flow. The existing Rust release workflow remains unchanged until the first standalone artifact release has been published and the checked-in DotSlash manifests can be updated with its URLs and checksums.
What changed
codex-zsh-vX.Y.Ztags instead of as a reusable workflow.codex-zshDotSlash manifest alongside the archives.Tag protection
An active repository tag ruleset named
codex-zsh-v*.*.*targetsrefs/tags/codex-zsh-v*.*.*. It restricts tag creation, updates, deletion, and non-fast-forward changes; requires linear history; and limits bypass to the configured repository role.This was verified with:
The response reported
"enforcement":"active", the expected tag condition, and thecreation,update,deletion,non_fast_forward, andrequired_linear_historyrules.Rollout
After this lands, publish the first
codex-zsh-vX.Y.Zrelease. A follow-up can then update the checked-in DotSlash manifests and remove the zsh rebuild from.github/workflows/rust-release.yml.Stack created with Sapling. Best reviewed with ReviewStack.