rust-release.yml

# Release workflow for codex-rs.
# To release, follow a workflow like:
# ```
# git tag -a rust-v0.1.0 -m "Release 0.1.0"
# git push origin rust-v0.1.0
# ```

name: rust-release
on:
  push:
    tags:
      - "rust-v*.*.*"

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true

# @cometix: use system git for fetching git dependencies — Cargo's built-in
# libgit2 SecureTransport backend fails intermittently on GitHub-hosted macOS
# runners when cloning from chromium.googlesource.com (libyuv submodule).
env:
  CARGO_NET_GIT_FETCH_WITH_CLI: "true"

jobs:
  tag-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
      - name: Validate tag matches Cargo.toml version
        shell: bash
        run: |
          set -euo pipefail
          echo "::group::Tag validation"

          # 1. Must be a tag and match the regex
          [[ "${GITHUB_REF_TYPE}" == "tag" ]] \
            || { echo "❌  Not a tag push"; exit 1; }
          [[ "${GITHUB_REF_NAME}" =~ ^rust-v[0-9]+\.[0-9]+\.[0-9]+(-(alpha|beta|cometix)(\.[0-9]+)?)?$ ]] \
            || { echo "❌  Tag '${GITHUB_REF_NAME}' doesn't match expected format"; exit 1; }

          # 2. Extract versions
          tag_ver="${GITHUB_REF_NAME#rust-v}"
          cargo_ver="$(grep -m1 '^version' codex-rs/Cargo.toml \
                        | sed -E 's/version *= *"([^"]+)".*/\1/')"

          # 3. Compare
          [[ "${tag_ver}" == "${cargo_ver}" ]] \
            || { echo "❌  Tag ${tag_ver} ≠ Cargo.toml ${cargo_ver}"; exit 1; }

          echo "✅  Tag and Cargo.toml agree (${tag_ver})"
          echo "::endgroup::"

  build:
    needs: tag-check
    name: Build - ${{ matrix.runner }} - ${{ matrix.target }}
    runs-on: ${{ matrix.runs_on || matrix.runner }}
    # Release builds can take a long time, so leave some headroom to avoid
    # having to restart the full workflow due to a timeout.
    timeout-minutes: 90
    permissions:
      contents: read
      id-token: write
    defaults:
      run:
        working-directory: codex-rs
    env:
      CARGO_PROFILE_RELEASE_LTO: ${{ (contains(github.ref_name, '-alpha') || contains(github.ref_name, '-cometix')) && 'thin' || 'fat' }}
      CARGO_PROFILE_RELEASE_OPT_LEVEL: ${{ contains(github.ref_name, '-cometix') && 's' || '3' }}

    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-latest
            target: aarch64-apple-darwin
          - runner: macos-latest
            target: x86_64-apple-darwin
          - runner: ubuntu-24.04
            target: x86_64-unknown-linux-musl
          - runner: ubuntu-24.04
            target: x86_64-unknown-linux-gnu
          - runner: ubuntu-24.04-arm
            target: aarch64-unknown-linux-musl
          - runner: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
          - runner: windows-latest
            target: x86_64-pc-windows-msvc

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Print runner specs (Linux)
        if: ${{ runner.os == 'Linux' }}
        shell: bash
        run: |
          set -euo pipefail
          cpu_model="$(lscpu | awk -F: '/Model name/ {gsub(/^[ \t]+/, "", $2); print $2; exit}')"
          total_ram="$(awk '/MemTotal/ {printf "%.1f GiB\n", $2 / 1024 / 1024}' /proc/meminfo)"
          echo "Runner: ${RUNNER_NAME:-unknown}"
          echo "OS: $(uname -a)"
          echo "CPU model: ${cpu_model}"
          echo "Logical CPUs: $(nproc)"
          echo "Total RAM: ${total_ram}"
          echo "Disk usage:"
          df -h .
      - name: Print runner specs (macOS)
        if: ${{ runner.os == 'macOS' }}
        shell: bash
        run: |
          set -euo pipefail
          total_ram="$(sysctl -n hw.memsize | awk '{printf "%.1f GiB\n", $1 / 1024 / 1024 / 1024}')"
          echo "Runner: ${RUNNER_NAME:-unknown}"
          echo "OS: $(sw_vers -productName) $(sw_vers -productVersion)"
          echo "Hardware model: $(sysctl -n hw.model)"
          echo "CPU architecture: $(uname -m)"
          echo "Logical CPUs: $(sysctl -n hw.logicalcpu)"
          echo "Physical CPUs: $(sysctl -n hw.physicalcpu)"
          echo "Total RAM: ${total_ram}"
          echo "Disk usage:"
          df -h .
      - name: Install Linux bwrap build dependencies
        if: ${{ runner.os == 'Linux' }}
        shell: bash
        run: |
          set -euo pipefail
          sudo apt-get update -y
          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends pkg-config libcap-dev
      - uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
        with:
          targets: ${{ matrix.target }}

      - if: ${{ matrix.target == 'x86_64-unknown-linux-musl' || matrix.target == 'aarch64-unknown-linux-musl'}}
        name: Use hermetic Cargo home (musl)
        shell: bash
        run: |
          set -euo pipefail
          cargo_home="${GITHUB_WORKSPACE}/.cargo-home"
          mkdir -p "${cargo_home}/bin"
          echo "CARGO_HOME=${cargo_home}" >> "$GITHUB_ENV"
          echo "${cargo_home}/bin" >> "$GITHUB_PATH"
          : > "${cargo_home}/config.toml"

      - if: ${{ matrix.target == 'x86_64-unknown-linux-musl' || matrix.target == 'aarch64-unknown-linux-musl'}}
        name: Install Zig
        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
        with:
          version: 0.14.0

      - if: ${{ matrix.target == 'x86_64-unknown-linux-musl' || matrix.target == 'aarch64-unknown-linux-musl'}}
        name: Install musl build tools
        env:
          TARGET: ${{ matrix.target }}
        run: bash "${GITHUB_WORKSPACE}/.github/scripts/install-musl-build-tools.sh"

      - if: ${{ matrix.target == 'x86_64-unknown-linux-musl' || matrix.target == 'aarch64-unknown-linux-musl'}}
        name: Disable aws-lc jitter entropy (musl)
        shell: bash
        run: |
          set -euo pipefail
          # Avoid problematic aws-lc jitter entropy code path on musl builders.
          echo "AWS_LC_SYS_NO_JITTER_ENTROPY=1" >> "$GITHUB_ENV"
          target_no_jitter="AWS_LC_SYS_NO_JITTER_ENTROPY_${{ matrix.target }}"
          target_no_jitter="${target_no_jitter//-/_}"
          echo "${target_no_jitter}=1" >> "$GITHUB_ENV"

      # @cometix: skip Windows — openai/codex only publishes non-ptrcomp v8 artifacts for Unix targets
      - if: ${{ !contains(matrix.target, 'windows') }}
        name: Configure rusty_v8 artifact overrides and verify checksums
        uses: ./.github/actions/setup-rusty-v8
        with:
          target: ${{ matrix.target }}

      # @cometix: build bwrap on all Linux targets (upstream gates on matrix.bundle which we don't use)
      - if: ${{ contains(matrix.target, 'linux') }}
        name: Build bwrap and export digest
        shell: bash
        run: |
          set -euo pipefail
          target="${{ matrix.target }}"
          cargo build --target "$target" --release --timings --bin bwrap

          bwrap_path="target/${target}/release/bwrap"
          if [[ ! -f "$bwrap_path" ]]; then
            echo "bwrap binary ${bwrap_path} not found"
            exit 1
          fi

          digest="$(sha256sum "$bwrap_path" | awk '{print $1}')"
          echo "CODEX_BWRAP_SHA256=${digest}" >> "$GITHUB_ENV"
          echo "Built bwrap ${bwrap_path} with sha256:${digest}"

      - name: Cargo build
        shell: bash
        run: |
          target="${{ matrix.target }}"
          if [[ "$target" == "x86_64-pc-windows-msvc" ]]; then
            export LIBSQLITE3_FLAGS=SQLITE_DISABLE_INTRINSIC
          fi
          if [[ "${{ contains(matrix.target, 'windows') }}" == 'true' ]]; then
            cargo build --target "$target" --release --timings --bin codex --bin codex-windows-sandbox-setup --bin codex-command-runner
          else
            cargo build --target "$target" --release --timings --bin codex
          fi

      - name: Upload Cargo timings
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: cargo-timings-rust-release-${{ matrix.target }}
          path: codex-rs/target/**/cargo-timings/cargo-timing.html
          if-no-files-found: warn


      - name: Stage artifacts
        shell: bash
        run: |
          dest="dist/${{ matrix.target }}"
          mkdir -p "$dest"

          if [[ "${{ matrix.runner }}" == windows* ]]; then
            cp target/${{ matrix.target }}/release/codex.exe "$dest/codex-${{ matrix.target }}.exe"
            cp target/${{ matrix.target }}/release/codex-windows-sandbox-setup.exe "$dest/codex-windows-sandbox-setup-${{ matrix.target }}.exe"
            cp target/${{ matrix.target }}/release/codex-command-runner.exe "$dest/codex-command-runner-${{ matrix.target }}.exe"
          else
            cp target/${{ matrix.target }}/release/codex "$dest/codex-${{ matrix.target }}"
            # @cometix: include bwrap for Linux npm packages
            if [[ -f target/${{ matrix.target }}/release/bwrap ]]; then
              cp target/${{ matrix.target }}/release/bwrap "$dest/bwrap-${{ matrix.target }}"
            fi
          fi

      - name: Compress artifacts
        shell: bash
        run: |
          # Path that contains the uncompressed binaries for the current
          # ${{ matrix.target }}
          dest="dist/${{ matrix.target }}"
          repo_root=$PWD

          # We want to ship the raw Windows executables in the GitHub Release
          # in addition to the compressed archives. Keep the originals for
          # Windows targets; remove them elsewhere to limit the number of
          # artifacts that end up in the GitHub Release.
          keep_originals=false
          if [[ "${{ matrix.runner }}" == windows* ]]; then
            keep_originals=true
          fi

          # For compatibility with environments that lack the `zstd` tool we
          # additionally create a `.tar.gz` for all platforms and `.zip` for
          # Windows alongside every single binary that we publish. The end result is:
          #   codex-<target>.zst          (existing)
          #   codex-<target>.tar.gz       (new)
          #   codex-<target>.zip          (only for Windows)

          for f in "$dest"/*; do
            base="$(basename "$f")"
            # Skip files that are already archives.
            if [[ "$base" == *.tar.gz || "$base" == *.tar.zst || "$base" == *.zip || "$base" == *.dmg ]]; then
              continue
            fi

            # Don't try to compress signature bundles.
            if [[ "$base" == *.sigstore ]]; then
              continue
            fi

            # Create per-binary tar.gz
            tar -C "$dest" -czf "$dest/${base}.tar.gz" "$base"

            # Create zip archive for Windows binaries
            if [[ "${{ matrix.runner }}" == windows* ]]; then
              if [[ "$base" == "codex-${{ matrix.target }}.exe" ]]; then
                # Bundle the sandbox helper binaries into the main codex zip so
                # WinGet installs include the required helpers next to codex.exe.
                bundle_dir="$(mktemp -d)"
                runner_src="$dest/codex-command-runner-${{ matrix.target }}.exe"
                setup_src="$dest/codex-windows-sandbox-setup-${{ matrix.target }}.exe"
                if [[ -f "$runner_src" && -f "$setup_src" ]]; then
                  cp "$dest/$base" "$bundle_dir/$base"
                  cp "$runner_src" "$bundle_dir/codex-command-runner.exe"
                  cp "$setup_src" "$bundle_dir/codex-windows-sandbox-setup.exe"
                  (cd "$bundle_dir" && 7z a "$repo_root/$dest/${base}.zip" .)
                else
                  echo "warning: missing sandbox binaries; falling back to single-binary zip"
                  (cd "$dest" && 7z a "${base}.zip" "$base")
                fi
                rm -rf "$bundle_dir"
              else
                (cd "$dest" && 7z a "${base}.zip" "$base")
              fi
            fi

            # Create .zst; keep originals on Windows, remove elsewhere.
            zstd_args=(-T0 -19)
            if [[ "${keep_originals}" == false ]]; then
              zstd_args+=(--rm)
            fi
            zstd "${zstd_args[@]}" "$dest/$base"
          done

      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ matrix.target }}
          # Upload the per-binary .zst files as well as the new .tar.gz
          # equivalents we generated in the previous step.
          path: |
            codex-rs/dist/${{ matrix.target }}/*

  release:
    needs:
      - build
    name: release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      actions: read
    outputs:
      version: ${{ steps.release_name.outputs.name }}
      tag: ${{ github.ref_name }}
      should_publish_npm: ${{ steps.npm_publish_settings.outputs.should_publish }}
      npm_tag: ${{ steps.npm_publish_settings.outputs.npm_tag }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Generate release notes from tag commit message
        id: release_notes
        shell: bash
        run: |
          set -euo pipefail

          # On tag pushes, GITHUB_SHA may be a tag object for annotated tags;
          # peel it to the underlying commit.
          commit="$(git rev-parse "${GITHUB_SHA}^{commit}")"
          notes_path="${RUNNER_TEMP}/release-notes.md"

          # Use the commit message for the commit the tag points at (not the
          # annotated tag message).
          git log -1 --format=%B "${commit}" > "${notes_path}"
          # Ensure trailing newline so GitHub's markdown renderer doesn't
          # occasionally run the last line into subsequent content.
          echo >> "${notes_path}"

          echo "path=${notes_path}" >> "${GITHUB_OUTPUT}"

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: dist

      - name: List
        run: ls -R dist/

      # This is a temporary fix: we should modify shell-tool-mcp.yml so these
      # files do not end up in dist/ in the first place.
      - name: Delete entries from dist/ that should not go in the release
        run: |
          rm -rf dist/shell-tool-mcp*
          rm -rf dist/windows-binaries*
          # cargo-timing.html appears under multiple target-specific directories.
          # If included in files: dist/**, release upload races on duplicate
          # asset names and can fail with 404s.
          find dist -type f -name 'cargo-timing.html' -delete
          find dist -type d -empty -delete

          ls -R dist/

      - name: Add config schema release asset
        run: |
          cp codex-rs/core/config.schema.json dist/config-schema.json


      - name: Define release name
        id: release_name
        run: |
          # Extract the version from the tag name, which is in the format
          # "rust-v0.1.0".
          version="${GITHUB_REF_NAME#rust-v}"
          echo "name=${version}" >> $GITHUB_OUTPUT

      - name: Determine npm publish settings
        id: npm_publish_settings
        env:
          VERSION: ${{ steps.release_name.outputs.name }}
        run: |
          set -euo pipefail
          version="${VERSION}"

          if [[ "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "should_publish=true" >> "$GITHUB_OUTPUT"
            echo "npm_tag=" >> "$GITHUB_OUTPUT"
          elif [[ "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+-alpha\.[0-9]+$ ]]; then
            echo "should_publish=true" >> "$GITHUB_OUTPUT"
            echo "npm_tag=alpha" >> "$GITHUB_OUTPUT"
          elif [[ "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+-cometix(\.[0-9]+)?$ ]]; then
            echo "should_publish=true" >> "$GITHUB_OUTPUT"
            echo "npm_tag=latest" >> "$GITHUB_OUTPUT"
          else
            echo "should_publish=false" >> "$GITHUB_OUTPUT"
            echo "npm_tag=" >> "$GITHUB_OUTPUT"
          fi

      - name: Setup pnpm
        uses: pnpm/action-setup@a8198c4bff370c8506180b035930dea56dbd5288 # v5
        with:
          run_install: false

      - name: Setup Node.js for npm packaging
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: latest

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # stage_npm_packages.py requires DotSlash when staging releases.
      - uses: facebook/install-dotslash@1e4e7b3e07eaca387acb98f1d4720e0bee8dbb6a # v2
      - name: Stage npm packages
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_VERSION: ${{ steps.release_name.outputs.name }}
        run: |
          ./scripts/stage_npm_packages.py \
            --release-version "$RELEASE_VERSION" \
            --package codex

      - name: Create GitHub Release
        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
        with:
          name: ${{ steps.release_name.outputs.name }}
          tag_name: ${{ github.ref_name }}
          body_path: ${{ steps.release_notes.outputs.path }}
          files: dist/**
          # Mark as prerelease only when the version has a suffix after x.y.z
          # (e.g. -alpha, -beta). Otherwise publish a normal release.
          prerelease: ${{ contains(steps.release_name.outputs.name, '-') }}

      # @cometix: removed dotslash-publish-release and developers.openai.com deploy
      # (not applicable to fork)

  # Publish to npm using OIDC authentication.
  # July 31, 2025: https://github.blog/changelog/2025-07-31-npm-trusted-publishing-with-oidc-is-generally-available/
  # npm docs: https://docs.npmjs.com/trusted-publishers
  publish-npm:
    # Publish to npm for stable releases and alpha pre-releases with numeric suffixes.
    if: ${{ needs.release.outputs.should_publish_npm == 'true' }}
    name: publish-npm
    needs: release
    runs-on: ubuntu-latest
    permissions:
      id-token: write # Required for OIDC
      contents: read

    steps:
      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: latest
          registry-url: "https://registry.npmjs.org"
          scope: "@cometix"

      - name: Download npm tarballs from release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_TAG: ${{ needs.release.outputs.tag }}
          RELEASE_VERSION: ${{ needs.release.outputs.version }}
        run: |
          set -euo pipefail
          version="$RELEASE_VERSION"
          tag="$RELEASE_TAG"
          mkdir -p dist/npm
          # @cometix: download all npm tarballs (main + platform packages)
          gh release download "$tag" \
            --repo "${GITHUB_REPOSITORY}" \
            --pattern "codex-npm-*.tgz" \
            --dir dist/npm
          ls -la dist/npm/

      - name: Publish platform packages to npm
        env:
          VERSION: ${{ needs.release.outputs.version }}
        run: |
          set -euo pipefail
          # @cometix: publish platform-specific tarballs first (they use
          # dist-tag matching the platform, e.g. linux-x64, darwin-arm64).
          for platform_tgz in dist/npm/codex-npm-*-"${VERSION}".tgz; do
            [ -f "$platform_tgz" ] || continue
            # Extract platform tag from filename: codex-npm-{platform}-{version}.tgz
            basename="$(basename "$platform_tgz" .tgz)"
            platform_tag="${basename#codex-npm-}"
            platform_tag="${platform_tag%-"${VERSION}"}"
            echo "Publishing platform package: $platform_tgz (tag: $platform_tag)"
            npm publish "$platform_tgz" --tag "$platform_tag"
          done

      - name: Publish main package to npm
        env:
          VERSION: ${{ needs.release.outputs.version }}
          NPM_TAG: ${{ needs.release.outputs.npm_tag }}
        run: |
          set -euo pipefail
          tag_args=()
          if [[ -n "${NPM_TAG}" ]]; then
            tag_args+=(--tag "${NPM_TAG}")
          fi
          # @cometix: publish main package last (it has optionalDependencies
          # on platform packages, so those must exist first).
          npm publish "${GITHUB_WORKSPACE}/dist/npm/codex-npm-${VERSION}.tgz" "${tag_args[@]}"