rust-release.yml

name: rust-release

on:
  push:
    branches:
      - main
    # Documentation-only pushes must not trigger (or cancel, via concurrency) a release run.
    paths-ignore:
      - "**.md"
      - "docs/**"
      - ".agents/**"
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true

env:
  CODEX_REPO_ROOT: ${{ github.workspace }}

jobs:
  build-unix:
    name: Build - ${{ matrix.runner }} - ${{ matrix.target }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 240
    permissions:
      contents: read
    defaults:
      run:
        working-directory: codex-rs
    env:
      CARGO_PROFILE_RELEASE_LTO: thin
      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
      # Avoid intermittent SecureTransport/libgit2 failures while fetching
      # libwebrtc's nested libyuv submodule on macOS release runners.
      CARGO_NET_GIT_FETCH_WITH_CLI: "true"
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-24.04
            target: x86_64-unknown-linux-musl
          - runner: ubuntu-24.04-arm
            target: aarch64-unknown-linux-musl
          - runner: macos-15-intel
            target: x86_64-apple-darwin
          - runner: macos-15
            target: aarch64-apple-darwin

    steps:
      - uses: actions/checkout@v6

      - name: Print Linux runner diagnostics
        if: ${{ runner.os == 'Linux' }}
        shell: bash
        run: |
          set -euo pipefail
          echo "runner.os=${RUNNER_OS}"
          echo "runner.arch=${RUNNER_ARCH}"
          echo "target=${{ matrix.target }}"
          echo "nproc=$(nproc)"
          free -h
          df -h
          ulimit -a

      - name: Limit Linux musl Cargo jobs
        if: ${{ contains(matrix.target, 'unknown-linux-musl') }}
        shell: bash
        run: echo "CARGO_BUILD_JOBS=2" >> "$GITHUB_ENV"

      - name: Install Linux build dependencies
        if: ${{ runner.os == 'Linux' }}
        shell: bash
        run: |
          set -euo pipefail
          apt_retry_args=(
            -o Acquire::Retries=5
            -o Acquire::http::Timeout=30
          )
          sudo apt-get "${apt_retry_args[@]}" update -y
          sudo DEBIAN_FRONTEND=noninteractive apt-get "${apt_retry_args[@]}" install -y --no-install-recommends pkg-config libcap-dev libubsan1

      - uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
        with:
          targets: ${{ matrix.target }}

      - name: Use hermetic Cargo home
        if: ${{ contains(matrix.target, 'unknown-linux-musl') }}
        shell: bash
        run: |
          set -euo pipefail
          cargo_home="${GITHUB_WORKSPACE}/.cargo-home"
          mkdir -p "${cargo_home}/bin"
          echo "CARGO_HOME=${cargo_home}" >> "$GITHUB_ENV"
          echo "${cargo_home}/bin" >> "$GITHUB_PATH"
          : > "${cargo_home}/config.toml"

      - name: Cache Cargo home and target dir
        if: ${{ contains(matrix.target, 'unknown-linux-musl') }}
        uses: actions/cache@v5
        with:
          path: |
            ${{ github.workspace }}/.cargo-home/registry
            ${{ github.workspace }}/.cargo-home/git
            codex-rs/target
          key: ${{ runner.os }}-${{ matrix.target }}-cargo-${{ hashFiles('codex-rs/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-${{ matrix.target }}-cargo-

      - name: Cache Cargo home and target dir
        if: ${{ !contains(matrix.target, 'unknown-linux-musl') }}
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            codex-rs/target
          key: ${{ runner.os }}-${{ matrix.target }}-cargo-${{ hashFiles('codex-rs/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-${{ matrix.target }}-cargo-

      - name: Install Zig
        if: ${{ contains(matrix.target, 'unknown-linux-musl') }}
        uses: Loongphy/setup-zig@node24-lts-runtime
        with:
          version: 0.14.0

      - name: Install musl build tools
        if: ${{ contains(matrix.target, 'unknown-linux-musl') }}
        env:
          TARGET: ${{ matrix.target }}
          CODEX_MUSL_RELEASE_LINK_FLAGS: "1"
        shell: bash
        run: bash "${GITHUB_WORKSPACE}/.github/scripts/install-musl-build-tools.sh"

      - name: Configure rustc UBSan wrapper
        if: ${{ contains(matrix.target, 'unknown-linux-musl') }}
        shell: bash
        run: |
          set -euo pipefail
          ubsan=""
          if command -v ldconfig >/dev/null 2>&1; then
            ubsan="$(ldconfig -p | grep -m1 'libubsan\.so\.1' | sed -E 's/.*=> (.*)$/\1/')"
          fi
          wrapper_root="${RUNNER_TEMP:-/tmp}"
          wrapper="${wrapper_root}/rustc-ubsan-wrapper"
          cat > "${wrapper}" <<EOF
          #!/usr/bin/env bash
          set -euo pipefail
          if [[ -n "${ubsan}" ]]; then
            export LD_PRELOAD="${ubsan}\${LD_PRELOAD:+:\${LD_PRELOAD}}"
          fi
          exec "\$1" "\${@:2}"
          EOF
          chmod +x "${wrapper}"
          echo "RUSTC_WRAPPER=${wrapper}" >> "$GITHUB_ENV"
          echo "RUSTC_WORKSPACE_WRAPPER=" >> "$GITHUB_ENV"

      - name: Clear sanitizer flags
        if: ${{ contains(matrix.target, 'unknown-linux-musl') }}
        shell: bash
        run: |
          set -euo pipefail
          echo "AWS_LC_SYS_NO_JITTER_ENTROPY=1" >> "$GITHUB_ENV"
          target_no_jitter="AWS_LC_SYS_NO_JITTER_ENTROPY_${{ matrix.target }}"
          target_no_jitter="${target_no_jitter//-/_}"
          echo "${target_no_jitter}=1" >> "$GITHUB_ENV"
          echo "RUSTFLAGS=" >> "$GITHUB_ENV"
          echo "CARGO_ENCODED_RUSTFLAGS=" >> "$GITHUB_ENV"
          echo "RUSTDOCFLAGS=" >> "$GITHUB_ENV"
          echo "CARGO_BUILD_RUSTFLAGS=" >> "$GITHUB_ENV"
          echo "CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS=" >> "$GITHUB_ENV"
          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_RUSTFLAGS=" >> "$GITHUB_ENV"
          echo "CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_RUSTFLAGS=" >> "$GITHUB_ENV"
          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_RUSTFLAGS=" >> "$GITHUB_ENV"

      - name: Configure rusty_v8 artifact overrides and verify checksums
        uses: ./.github/actions/setup-rusty-v8
        with:
          target: ${{ matrix.target }}

      - name: Build bwrap and export digest
        if: ${{ contains(matrix.target, 'unknown-linux-musl') }}
        shell: bash
        run: |
          set -euo pipefail
          # The bundled bwrap must be built, stripped, and hashed before the
          # codex binary so the digest is embedded via CODEX_BWRAP_SHA256 at
          # compile time and matches the codex-resources/bwrap payload.
          cargo build --locked --target "${{ matrix.target }}" --release --timings --bin bwrap
          bwrap_path="target/${{ matrix.target }}/release/bwrap"
          if [[ ! -f "${bwrap_path}" ]]; then
            echo "bwrap binary ${bwrap_path} not found" >&2
            exit 1
          fi
          strip --strip-debug --strip-unneeded "${bwrap_path}"
          digest="$(sha256sum "${bwrap_path}" | awk '{print $1}')"
          echo "CODEX_BWRAP_SHA256=${digest}" >> "${GITHUB_ENV}"
          echo "Built bwrap ${bwrap_path} with sha256:${digest}"

      - name: Cargo build
        shell: bash
        run: |
          cargo build --locked --target ${{ matrix.target }} --release --timings \
            --bin codex \
            --bin codex-code-mode-host \
            --bin codex-exec-server

      - name: Stage Unix binary artifact
        shell: bash
        run: |
          set -euo pipefail
          staged_dir="${RUNNER_TEMP}/release-bin/${{ matrix.target }}"
          rm -rf "${staged_dir}"
          mkdir -p "${staged_dir}"
          cp "target/${{ matrix.target }}/release/codex" "${staged_dir}/codex"
          cp "target/${{ matrix.target }}/release/codex-code-mode-host" \
            "${staged_dir}/codex-code-mode-host"
          cp "target/${{ matrix.target }}/release/codex-exec-server" \
            "${staged_dir}/codex-exec-server"
          if [[ "${{ matrix.target }}" == *linux* ]]; then
            cp "target/${{ matrix.target }}/release/bwrap" "${staged_dir}/bwrap"
          fi

      - name: Archive Linux symbols and strip staged binary
        if: ${{ contains(matrix.target, 'unknown-linux-musl') }}
        shell: bash
        run: |
          set -euo pipefail
          staged_dir="${RUNNER_TEMP}/release-bin/${{ matrix.target }}"
          bash "${GITHUB_WORKSPACE}/.github/scripts/archive-release-symbols-and-strip-binaries.sh" \
            --target "${{ matrix.target }}" \
            --artifact-name "${{ matrix.target }}" \
            --release-dir "${staged_dir}" \
            --archive-dir "symbols-dist/${{ matrix.target }}" \
            --binaries "codex codex-code-mode-host codex-exec-server"

      - uses: actions/upload-artifact@v7
        with:
          name: codex-bin-${{ matrix.target }}
          path: |
            ${{ runner.temp }}/release-bin/${{ matrix.target }}/codex
            ${{ runner.temp }}/release-bin/${{ matrix.target }}/codex-code-mode-host
            ${{ runner.temp }}/release-bin/${{ matrix.target }}/codex-exec-server
            ${{ runner.temp }}/release-bin/${{ matrix.target }}/bwrap
          if-no-files-found: error

      - if: ${{ contains(matrix.target, 'unknown-linux-musl') }}
        uses: actions/upload-artifact@v7
        with:
          name: codex-symbols-${{ matrix.target }}
          path: codex-rs/symbols-dist/${{ matrix.target }}/*
          if-no-files-found: error

  build-windows:
    name: Build - windows-2025 - ${{ matrix.target }}
    runs-on: windows-2025
    permissions:
      contents: read
    defaults:
      run:
        working-directory: codex-rs
    env:
      CARGO_NET_GIT_FETCH_WITH_CLI: "true"
    strategy:
      fail-fast: false
      matrix:
        target:
          - x86_64-pc-windows-msvc

    steps:
      - uses: actions/checkout@v6

      - name: Enable Git long paths
        shell: pwsh
        run: git config --global core.longpaths true

      - uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
        with:
          targets: ${{ matrix.target }}

      - name: Cache Cargo home and target dir
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            codex-rs/target
          key: ${{ runner.os }}-${{ matrix.target }}-cargo-${{ hashFiles('codex-rs/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-${{ matrix.target }}-cargo-

      - name: Configure rusty_v8 artifact overrides and verify checksums
        uses: ./.github/actions/setup-rusty-v8
        with:
          target: ${{ matrix.target }}

      - name: Cargo build
        shell: bash
        run: |
          if [[ "${{ matrix.target }}" == "x86_64-pc-windows-msvc" ]]; then
            export LIBSQLITE3_FLAGS=SQLITE_DISABLE_INTRINSIC
          fi
          cargo build --locked --target ${{ matrix.target }} --release --timings \
            --bin codex \
            --bin codex-code-mode-host \
            --bin codex-exec-server \
            --bin codex-windows-sandbox-setup \
            --bin codex-command-runner

      - uses: actions/upload-artifact@v7
        with:
          name: codex-bin-${{ matrix.target }}
          path: |
            codex-rs/target/${{ matrix.target }}/release/codex.exe
            codex-rs/target/${{ matrix.target }}/release/codex-code-mode-host.exe
            codex-rs/target/${{ matrix.target }}/release/codex-exec-server.exe
            codex-rs/target/${{ matrix.target }}/release/codex-windows-sandbox-setup.exe
            codex-rs/target/${{ matrix.target }}/release/codex-command-runner.exe
          if-no-files-found: error

  publish-release:
    needs:
      - build-unix
      - build-windows
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v6

      - name: Compute release version
        id: compute
        shell: bash
        run: |
          set -euo pipefail
          base_version="$(grep -m1 '^version' codex-rs/Cargo.toml | sed -E 's/version *= *"([^"]+)".*/\1/')"
          short_sha="${GITHUB_SHA::7}"
          echo "base_version=${base_version}" >> "$GITHUB_OUTPUT"
          echo "release_version=${base_version}-${short_sha}" >> "$GITHUB_OUTPUT"
          echo "release_tag=codext-v${base_version}-${short_sha}" >> "$GITHUB_OUTPUT"

      - name: Generate release notes
        id: release_notes
        env:
          BASE_VERSION: ${{ steps.compute.outputs.base_version }}
        shell: bash
        run: |
          set -euo pipefail
          notes_path="${RUNNER_TEMP}/release-notes.md"
          upstream_tag="rust-v${BASE_VERSION}"
          upstream_label="codex-v${BASE_VERSION}"
          upstream_url="https://github.com/openai/codex/releases/tag/${upstream_tag}"
          {
            printf 'For upstream changes, see [%s](%s).\n\n' "${upstream_label}" "${upstream_url}"
            # Cap the commit message the way the upstream publisher does:
            # keep a 124,999-character budget and reserve the last character
            # for a trailing newline so GitHub's markdown renderer does not run
            # the last line into subsequent content.
            git log -1 --format=%B "${GITHUB_SHA}" |
              python3 -c 'import sys; print(sys.stdin.read()[:124998])'
            echo
          } > "${notes_path}"
          echo "path=${notes_path}" >> "$GITHUB_OUTPUT"

      - name: Download build artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: codex-bin-*
          path: ${{ runner.temp }}/artifacts

      - name: Download Linux symbols artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: codex-symbols-*
          path: ${{ runner.temp }}/symbols

      - name: Stage release assets
        env:
          VERSION: ${{ steps.compute.outputs.release_version }}
        shell: bash
        run: |
          set -euo pipefail
          artifacts_root="${RUNNER_TEMP}/artifacts"
          out_dir="${GITHUB_WORKSPACE}/dist/release"
          mkdir -p "${out_dir}"

          # actions/download-artifact drops executable bits; restore them so the
          # package builder accepts the prebuilt binaries.
          find "${artifacts_root}" -type f -exec chmod a+x {} +

          # Each archive ships the canonical codex-package layout produced by
          # scripts/build_codex_package.py (bin/, codex-path/, codex-resources/,
          # codex-package.json) so the app-server daemon can seed a managed
          # install from it. The manifest keeps the codext pre-release version
          # so the managed daemon does not follow upstream's latest channel.
          stage_package() {
            local target="$1" platform="$2"
            local bin_dir="${artifacts_root}/codex-bin-${target}"
            local pkg_dir
            pkg_dir="$(mktemp -d "${RUNNER_TEMP}/codext-pkg-${platform}-XXXXXX")"
            local args=(
              --target "${target}"
              --package-version "${VERSION}"
              --package-dir "${pkg_dir}"
              --force
            )
            if [[ "${target}" == *windows* ]]; then
              args+=(
                --entrypoint-bin "${bin_dir}/codex.exe"
                --code-mode-host-bin "${bin_dir}/codex-code-mode-host.exe"
                --exec-server-bin "${bin_dir}/codex-exec-server.exe"
                --codex-command-runner-bin "${bin_dir}/codex-command-runner.exe"
                --codex-windows-sandbox-setup-bin "${bin_dir}/codex-windows-sandbox-setup.exe"
              )
              python3 scripts/build_codex_package.py "${args[@]}"
              # bin/codext.exe aliases the entrypoint; running any binary inside
              # bin/ still resolves the package layout for the daemon.
              cp "${pkg_dir}/bin/codex.exe" "${pkg_dir}/bin/codext.exe"
              (cd "${pkg_dir}" && zip -q -r "${out_dir}/codext-${platform}-${VERSION}.zip" .)
            else
              args+=(
                --entrypoint-bin "${bin_dir}/codex"
                --code-mode-host-bin "${bin_dir}/codex-code-mode-host"
                --exec-server-bin "${bin_dir}/codex-exec-server"
              )
              if [[ "${target}" == *linux* ]]; then
                args+=(--bwrap-bin "${bin_dir}/bwrap")
              fi
              python3 scripts/build_codex_package.py "${args[@]}"
              # `bin/codext` hardlink keeps the fork's command name inside the
              # canonical bin/ dir, where package-layout detection still sees a
              # bin/ parent. tar stores it as a link entry that Windows bsdtar
              # restores without the privileges a symlink would need.
              ln "${pkg_dir}/bin/codex" "${pkg_dir}/bin/codext"
              tar -C "${pkg_dir}" -czf "${out_dir}/codext-${platform}-${VERSION}.tar.gz" .
            fi
          }

          stage_package x86_64-unknown-linux-musl linux-x64
          stage_package aarch64-unknown-linux-musl linux-arm64
          stage_package x86_64-apple-darwin darwin-x64
          stage_package aarch64-apple-darwin darwin-arm64
          stage_package x86_64-pc-windows-msvc win32-x64

          symbols_root="${RUNNER_TEMP}/symbols"
          if [[ -d "${symbols_root}" ]]; then
            while IFS= read -r symbol_archive; do
              cp "${symbol_archive}" "${out_dir}/"
            done < <(find "${symbols_root}" -type f -name '*.tar.gz' | sort)
          fi

      - name: Create or update GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_NAME: ${{ steps.compute.outputs.release_version }}
          RELEASE_TAG: ${{ steps.compute.outputs.release_tag }}
          RELEASE_NOTES: ${{ steps.release_notes.outputs.path }}
        shell: bash
        run: |
          set -euo pipefail
          if gh release view "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
            gh release edit "${RELEASE_TAG}" \
              --repo "${GITHUB_REPOSITORY}" \
              --title "codext ${RELEASE_NAME}" \
              --notes-file "${RELEASE_NOTES}" \
              --latest
          else
            gh release create "${RELEASE_TAG}" \
              --repo "${GITHUB_REPOSITORY}" \
              --title "codext ${RELEASE_NAME}" \
              --notes-file "${RELEASE_NOTES}" \
              --latest
          fi

          gh release upload "${RELEASE_TAG}" dist/release/* \
            --repo "${GITHUB_REPOSITORY}" \
            --clobber

  publish-npm:
    needs:
      - build-unix
      - build-windows
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    steps:
      - uses: actions/checkout@v6

      - name: Compute release version
        id: compute
        shell: bash
        run: |
          set -euo pipefail
          base_version="$(grep -m1 '^version' codex-rs/Cargo.toml | sed -E 's/version *= *"([^"]+)".*/\1/')"
          short_sha="${GITHUB_SHA::7}"
          echo "release_version=${base_version}-${short_sha}" >> "$GITHUB_OUTPUT"

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          # Trusted publishing requires the selected Node.js release to include npm >= 11.5.1.
          node-version-file: .nvmrc
          registry-url: https://registry.npmjs.org

      - name: Download build artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: codex-bin-*
          path: ${{ runner.temp }}/artifacts

      - name: Assemble vendor tree
        env:
          VERSION: ${{ steps.compute.outputs.release_version }}
        shell: bash
        run: |
          set -euo pipefail
          artifacts_root="${RUNNER_TEMP}/artifacts"
          vendor_root="${RUNNER_TEMP}/npm-root/vendor"

          # actions/download-artifact drops executable bits; restore them so the
          # package builder accepts the prebuilt binaries.
          find "${artifacts_root}" -type f -exec chmod a+x {} +

          # Each platform package vendors a complete canonical package dir built
          # by scripts/build_codex_package.py (bin/, codex-path/,
          # codex-resources/, codex-package.json), which also fetches rg via a
          # DotSlash manifest.
          assemble_vendor() {
            local target="$1"
            local bin_dir="${artifacts_root}/codex-bin-${target}"
            local args=(
              --target "${target}"
              --package-version "${VERSION}"
              --package-dir "${vendor_root}/${target}"
              --force
            )
            if [[ "${target}" == *windows* ]]; then
              args+=(
                --entrypoint-bin "${bin_dir}/codex.exe"
                --code-mode-host-bin "${bin_dir}/codex-code-mode-host.exe"
                --exec-server-bin "${bin_dir}/codex-exec-server.exe"
                --codex-command-runner-bin "${bin_dir}/codex-command-runner.exe"
                --codex-windows-sandbox-setup-bin "${bin_dir}/codex-windows-sandbox-setup.exe"
              )
            else
              args+=(
                --entrypoint-bin "${bin_dir}/codex"
                --code-mode-host-bin "${bin_dir}/codex-code-mode-host"
                --exec-server-bin "${bin_dir}/codex-exec-server"
              )
              if [[ "${target}" == *linux* ]]; then
                args+=(--bwrap-bin "${bin_dir}/bwrap")
              fi
            fi
            python3 scripts/build_codex_package.py "${args[@]}"
          }

          assemble_vendor x86_64-unknown-linux-musl
          assemble_vendor aarch64-unknown-linux-musl
          assemble_vendor x86_64-apple-darwin
          assemble_vendor aarch64-apple-darwin
          assemble_vendor x86_64-pc-windows-msvc

      - name: Stage npm tarballs
        env:
          VERSION: ${{ steps.compute.outputs.release_version }}
        shell: bash
        run: |
          set -euo pipefail
          out_dir="${GITHUB_WORKSPACE}/dist/npm"
          mkdir -p "${out_dir}"
          vendor_src="${RUNNER_TEMP}/npm-root/vendor"
          packages=(
            codex
            codex-linux-x64
            codex-linux-arm64
            codex-darwin-x64
            codex-darwin-arm64
            codex-win32-x64
          )

          for package in "${packages[@]}"; do
            stage_dir="$(mktemp -d "${RUNNER_TEMP}/npm-stage-${package}-XXXXXX")"
            if [[ "${package}" == "codex" ]]; then
              pack_output="${out_dir}/codex-npm-${VERSION}.tgz"
              python3 codex-cli/scripts/build_npm_package.py \
                --package "${package}" \
                --release-version "${VERSION}" \
                --staging-dir "${stage_dir}" \
                --pack-output "${pack_output}"
            else
              platform="${package#codex-}"
              pack_output="${out_dir}/codex-npm-${platform}-${VERSION}.tgz"
              python3 codex-cli/scripts/build_npm_package.py \
                --package "${package}" \
                --release-version "${VERSION}" \
                --staging-dir "${stage_dir}" \
                --pack-output "${pack_output}" \
                --vendor-src "${vendor_src}"
            fi
            rm -rf "${stage_dir}"
          done

      - name: Publish to npm
        env:
          VERSION: ${{ steps.compute.outputs.release_version }}
          NPM_CONFIG_LOGLEVEL: verbose
          NPM_CONFIG_LOGS_DIR: ${{ runner.temp }}/npm-publish-logs
          NPM_CONFIG_LOGS_MAX: "100"
        shell: bash
        run: |
          set -euo pipefail
          shopt -s nullglob
          tarballs=(dist/npm/*-"${VERSION}".tgz)
          if [[ ${#tarballs[@]} -eq 0 ]]; then
            echo "No npm tarballs found in dist/npm for version ${VERSION}"
            exit 1
          fi

          # Publish platform tarballs first: the main package's
          # optionalDependencies alias to their versions, so publishing it last
          # keeps fresh installs resolvable during the release window.
          main_tarball="dist/npm/codex-npm-${VERSION}.tgz"
          ordered_tarballs=()
          for tarball in "${tarballs[@]}"; do
            if [[ "${tarball}" != "${main_tarball}" ]]; then
              ordered_tarballs+=("${tarball}")
            fi
          done
          if [[ -f "${main_tarball}" ]]; then
            ordered_tarballs+=("${main_tarball}")
          fi
          tarballs=("${ordered_tarballs[@]}")

          for tarball in "${tarballs[@]}"; do
            filename="$(basename "${tarball}")"
            publish_cmd=(npm publish "${GITHUB_WORKSPACE}/${tarball}" --access public)
            tag=""

            case "${filename}" in
              codex-npm-linux-*-"${VERSION}".tgz)
                tag="${filename#codex-npm-}"
                tag="${tag%-${VERSION}.tgz}"
                ;;
              codex-npm-darwin-*-"${VERSION}".tgz)
                tag="${filename#codex-npm-}"
                tag="${tag%-${VERSION}.tgz}"
                ;;
              codex-npm-win32-*-"${VERSION}".tgz)
                tag="${filename#codex-npm-}"
                tag="${tag%-${VERSION}.tgz}"
                ;;
              codex-npm-"${VERSION}".tgz)
                tag="latest"
                ;;
              *)
                echo "Unexpected npm tarball: ${filename}"
                exit 1
                ;;
            esac

            if [[ -n "${tag}" ]]; then
              publish_cmd+=(--tag "${tag}")
            fi

            echo "+ ${publish_cmd[*]}"
            # A fresh npm process obtains new OIDC credentials on each attempt.
            for attempt in 1 2 3; do
              echo "+ ${publish_cmd[*]} (attempt ${attempt}/3)"
              set +e
              publish_output="$("${publish_cmd[@]}" 2>&1)"
              publish_status=$?
              set -e

              echo "${publish_output}"
              if [[ ${publish_status} -eq 0 ]]; then
                break
              fi

              if grep -qiE "previously published|cannot publish over|version already exists" <<< "${publish_output}"; then
                echo "Skipping already-published package version for ${filename}"
                break
              fi

              if [[ ${attempt} -eq 3 ]]; then
                exit "${publish_status}"
              fi
              delay=$((attempt * 10))
              echo "Publishing ${filename} failed; retrying in ${delay} seconds."
              sleep "${delay}"
            done
          done

      - name: Retain npm debug logs
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: npm-publish-logs-${{ github.run_attempt }}
          path: ${{ runner.temp }}/npm-publish-logs/
          if-no-files-found: ignore
          retention-days: 7