Conversation
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b2f1426016
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| --entrypoint-dir "target/${TARGET}/release" \ | ||
| --archive-dir "dist/${TARGET}" | ||
| --archive-dir "dist/${TARGET}" \ | ||
| --zsh-manifest "${RUNNER_TEMP}/codex-zsh" |
There was a problem hiding this comment.
When this step passes the generated codex-zsh release manifest into the package builder, the build will reject the manifest that .github/workflows/rust-release-zsh.yml publishes because facebook/dotslash-publish-release defaults platform entries to hash: "blake3", while scripts/codex_package/dotslash.py still hard-fails unless the hash is exactly sha256. The same failure applies to the macOS copy of this step, so release package archives will fail with Unsupported codex-zsh hash 'blake3' unless the zsh DotSlash config explicitly requests sha256 or the fetcher learns BLAKE3 first.
Useful? React with 👍 / 👎.
## Why The patched zsh artifacts rarely change, but `.github/workflows/rust-release-zsh.yml` currently runs as part of every Rust release. Rebuilding the same four binaries for each Codex version wastes release capacity and ties an independently versioned runtime dependency to the main release cadence. This establishes the producer side of a build-once flow. The existing Rust release workflow remains unchanged until the first standalone artifact release has been published and the checked-in DotSlash manifests can be updated with its URLs and checksums. ## What changed - Run the zsh release workflow for protected `codex-zsh-vX.Y.Z` tags instead of as a reusable workflow. - Validate the semantic release tag before starting the platform builds. - Publish the four zsh archives to a GitHub prerelease so the release never becomes the repository latest release. - Publish the generated `codex-zsh` DotSlash manifest alongside the archives. - Document how to publish the next artifact version after changing the pinned zsh commit or patch. ## Tag protection An active repository tag ruleset named `codex-zsh-v*.*.*` targets `refs/tags/codex-zsh-v*.*.*`. It restricts tag creation, updates, deletion, and non-fast-forward changes; requires linear history; and limits bypass to the configured repository role. This was verified with: ```shell gh api repos/openai/codex/rulesets/18140982 ``` The response reported `"enforcement":"active"`, the expected tag condition, and the `creation`, `update`, `deletion`, `non_fast_forward`, and `required_linear_history` rules. ## Rollout After this lands, publish the first `codex-zsh-vX.Y.Z` release. A follow-up can then update the checked-in DotSlash manifests and remove the zsh rebuild from `.github/workflows/rust-release.yml`. --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/openai/codex/pull/30114). * #30116 * __->__ #30114
Why
Once #30114 publishes zsh independently, regular Rust releases should reuse that protected, versioned artifact set instead of rebuilding identical zsh binaries for every Codex version. Keeping the zsh release tag explicit in the workflow also makes future artifact upgrades deliberate and easy to review.
This PR assumes the first standalone artifact release will be published as
codex-zsh-v0.1.0before this change lands.What changed
CODEX_ZSH_RELEASE_TAGnear the top of.github/workflows/rust-release.yml, initially pinned tocodex-zsh-v0.1.0.codex-zshDotSlash manifest before assembling Linux and macOS Codex packages.--zsh-manifestpackage-builder override so release packaging fetches the matching target archive and verifies the size and SHA-256 digest recorded in that manifest.Windows packaging remains unchanged because the patched zsh resource is only shipped for supported Unix targets.
Testing
scripts/codex_packageunit test suite..github/scripts/build-codex-package-archive.shwithbash -n.