build(deps): bump pulldown-cmark from 0.10.3 to 0.13.3 in /codex-rs

.bazelrc

@@ -136,6 +136,16 @@ common:ci-linux --config=remote
 common:ci-linux --strategy=remote
 common:ci-linux --platforms=//:rbe
 
+# Fork-only Linux jobs that must stay on Bazel but cannot rely on BuildBuddy
+# remote execution should use this explicit local variant instead of trying to
+# partially undo `ci-linux` at the callsite.
+common:ci-linux-local --config=ci-bazel
+common:ci-linux-local --build_metadata=TAG_os=linux
+common:ci-linux-local --extra_execution_platforms=
+common:ci-linux-local --platforms=//:local_linux
+common:ci-linux-local --spawn_strategy=local
+common:ci-linux-local --strategy=local
+
 # On mac, we can run all the build actions remotely but test actions locally.
 common:ci-macos --config=ci-bazel
 common:ci-macos --build_metadata=TAG_os=macos

.github/scripts/run-bazel-ci.sh

@@ -65,6 +65,11 @@ case "${RUNNER_OS:-}" in
     ;;
 esac
 
+force_local_ci_config=
+if [[ "${RUNNER_OS:-}" == "Linux" ]]; then
+  force_local_ci_config=ci-linux-local
+fi
+
 print_bazel_test_log_tails() {
   local console_log="$1"
   local testlogs_dir
@@ -210,7 +215,29 @@ if (( ${#bazel_startup_args[@]} > 0 )); then
   bazel_cmd+=("${bazel_startup_args[@]}")
 fi
 
-if [[ -n "${BUILDBUDDY_API_KEY:-}" ]]; then
+if [[ "${CODEX_BAZEL_FORCE_LOCAL:-0}" == "1" ]]; then
+  echo "CODEX_BAZEL_FORCE_LOCAL=1; using local Bazel configuration."
+  bazel_run_args=(
+    "${bazel_args[@]}"
+    --remote_cache=
+    --remote_executor=
+  )
+  if [[ -n "${force_local_ci_config}" ]]; then
+    bazel_run_args+=("--config=${force_local_ci_config}")
+  fi
+  if (( ${#post_config_bazel_args[@]} > 0 )); then
+    bazel_run_args+=("${post_config_bazel_args[@]}")
+  fi
+  set +e
+  run_bazel "${bazel_cmd[@]:1}" \
+    --noexperimental_remote_repo_contents_cache \
+    "${bazel_run_args[@]}" \
+    -- \
+    "${bazel_targets[@]}" \
+    2>&1 | tee "$bazel_console_log"
+  bazel_status=${PIPESTATUS[0]}
+  set -e
+elif [[ -n "${BUILDBUDDY_API_KEY:-}" ]]; then
   echo "BuildBuddy API key is available; using remote Bazel configuration."
   # Work around Bazel 9 remote repo contents cache / overlay materialization failures
   # seen in CI (for example "is not a symlink" or permission errors while

.github/workflows/README.md

@@ -1,6 +1,7 @@
 # Workflow Strategy
 
-The workflows in this directory are split so that pull requests get fast, review-friendly signal while `main` still gets the full cross-platform verification pass.
+This fork keeps pushes to `main` quiet. Heavier validation runs stay available through
+`workflow_dispatch`, while pull requests can still use targeted review-time checks.
 
 ## Pull Requests
 
@@ -14,18 +15,23 @@ The workflows in this directory are split so that pull requests get fast, review
   - `argument-comment-lint` on Linux, macOS, and Windows
   - `tools/argument-comment-lint` package tests when the lint or its workflow wiring changes
 
-## Post-Merge On `main`
+## Manual Verification
 
-- `bazel.yml` also runs on pushes to `main`.
-  This re-verifies the merged Bazel path and helps keep the BuildBuddy caches warm.
+- `bazel.yml` is available as a manual verification path when the fork needs a full
+  Bazel pass.
 - `rust-ci-full.yml` is the full Cargo-native verification workflow.
-  It keeps the heavier checks off the PR path while still validating them after merge:
+  It keeps the heavier checks off the PR path while still providing an on-demand
+  validation path:
   - the full Cargo `clippy` matrix
   - the full Cargo `nextest` matrix
   - release-profile Cargo builds
   - cross-platform `argument-comment-lint`
   - Linux remote-env tests
 
+Other repo-level checks that used to run on `push(main)` in upstream, such as
+`ci.yml`, `cargo-deny.yml`, `codespell.yml`, `sdk.yml`, and `v8-canary.yml`, are also
+manual-only in this fork so routine sync pushes do not fan out into unrelated CI.
+
 ## Rule Of Thumb
 
 - If a build/test/clippy check can be expressed in Bazel, prefer putting the PR-time version in `bazel.yml`.

.github/workflows/bazel.yml

@@ -5,9 +5,6 @@ name: Bazel
 
 on:
   pull_request: {}
-  push:
-    branches:
-      - main
   workflow_dispatch:
 
 concurrency:

.github/workflows/cargo-deny.yml

@@ -2,9 +2,7 @@ name: cargo-deny
 
 on:
   pull_request:
-  push:
-    branches:
-      - main
+  workflow_dispatch:
 
 jobs:
   cargo-deny:

.github/workflows/ci.yml

@@ -2,7 +2,7 @@ name: ci
 
 on:
   pull_request: {}
-  push: { branches: [main] }
+  workflow_dispatch:
 
 jobs:
   build-test:
@@ -37,6 +37,7 @@ jobs:
       - uses: facebook/install-dotslash@1e4e7b3e07eaca387acb98f1d4720e0bee8dbb6a # v2
 
       - name: Stage npm package
+        if: ${{ github.repository == 'openai/codex' }}
         id: stage_npm_package
         env:
           GH_TOKEN: ${{ github.token }}
@@ -53,6 +54,7 @@ jobs:
           echo "pack_output=$PACK_OUTPUT" >> "$GITHUB_OUTPUT"
 
       - name: Upload staged npm package artifact
+        if: ${{ github.repository == 'openai/codex' }}
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         with:
           name: codex-npm-staging

.github/workflows/codespell.yml

@@ -3,10 +3,9 @@
 name: Codespell
 
 on:
-  push:
-    branches: [main]
   pull_request:
     branches: [main]
+  workflow_dispatch:
 
 permissions:
   contents: read

.github/workflows/pypi-release-artifacts.yml

@@ -0,0 +1,165 @@
+name: pypi-release-artifacts
+
+on:
+  workflow_call:
+    inputs:
+      checkout_ref:
+        required: true
+        type: string
+      release_tag:
+        required: true
+        type: string
+
+concurrency:
+  group: pypi-release-artifacts-${{ inputs.release_tag }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: build-artifact-${{ matrix.target }}
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+    env:
+      CARGO_INCREMENTAL: "0"
+      RUSTC_WRAPPER: ""
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-14
+            target: aarch64-apple-darwin
+            runtime_binary_name: codex
+            release_asset_name: codex-aarch64-apple-darwin.tar.gz
+            build_args: --bin codex
+          - runner: macos-15-intel
+            target: x86_64-apple-darwin
+            runtime_binary_name: codex
+            release_asset_name: codex-x86_64-apple-darwin.tar.gz
+            build_args: --bin codex
+          - runner: ubuntu-24.04
+            target: x86_64-unknown-linux-gnu
+            runtime_binary_name: codex
+            release_asset_name: codex-x86_64-unknown-linux-gnu.tar.gz
+            build_args: --bin codex
+          - runner: windows-2022
+            target: x86_64-pc-windows-msvc
+            runtime_binary_name: codex.exe
+            release_asset_name: codex-x86_64-pc-windows-msvc.zip
+            build_args: --bin codex --bin codex-windows-sandbox-setup --bin codex-command-runner
+    steps:
+      - name: Checkout release ref
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.checkout_ref }}
+
+      - uses: dtolnay/rust-toolchain@1.93.0
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Clear workspace build rustflags for CI release builds
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "RUSTFLAGS=" >> "$GITHUB_ENV"
+          echo "CARGO_ENCODED_RUSTFLAGS=" >> "$GITHUB_ENV"
+          echo "CARGO_BUILD_RUSTFLAGS=" >> "$GITHUB_ENV"
+
+      - name: Use default macOS linker
+        if: ${{ runner.os == 'macOS' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "RUSTFLAGS=" >> "$GITHUB_ENV"
+          echo "CARGO_ENCODED_RUSTFLAGS=" >> "$GITHUB_ENV"
+          echo "CARGO_BUILD_RUSTFLAGS=" >> "$GITHUB_ENV"
+          echo "CARGO_TARGET_AARCH64_APPLE_DARWIN_RUSTFLAGS=" >> "$GITHUB_ENV"
+          echo "CARGO_TARGET_X86_64_APPLE_DARWIN_RUSTFLAGS=" >> "$GITHUB_ENV"
+
+      - name: Install Linux build dependencies
+        if: ${{ runner.os == 'Linux' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y libcap-dev pkg-config protobuf-compiler
+
+      - name: Install macOS build dependencies
+        if: ${{ runner.os == 'macOS' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if ! command -v protoc >/dev/null 2>&1; then
+            brew install protobuf
+          fi
+
+      - name: Install Windows build dependencies
+        if: ${{ runner.os == 'Windows' }}
+        shell: pwsh
+        run: |
+          if (-not (Get-Command protoc -ErrorAction SilentlyContinue)) {
+            choco install protoc -y --no-progress
+          }
+
+      - name: Build release binaries
+        shell: bash
+        working-directory: codex-rs
+        run: |
+          set -euo pipefail
+          cargo build --locked --release --target "${{ matrix.target }}" ${{ matrix.build_args }}
+
+      - name: Stage runtime artifact
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "${RUNNER_TEMP}/runtime-artifact"
+          cp "codex-rs/target/${{ matrix.target }}/release/${{ matrix.runtime_binary_name }}" \
+            "${RUNNER_TEMP}/runtime-artifact/${{ matrix.runtime_binary_name }}"
+
+      - name: Stage release asset
+        shell: bash
+        run: |
+          set -euo pipefail
+          release_dir="${RUNNER_TEMP}/release-asset"
+          mkdir -p "${release_dir}"
+
+          if [[ "${{ runner.os }}" == "Windows" ]]; then
+            cp "codex-rs/target/${{ matrix.target }}/release/codex.exe" "${release_dir}/codex.exe"
+            cp "codex-rs/target/${{ matrix.target }}/release/codex-windows-sandbox-setup.exe" "${release_dir}/codex-windows-sandbox-setup.exe"
+            cp "codex-rs/target/${{ matrix.target }}/release/codex-command-runner.exe" "${release_dir}/codex-command-runner.exe"
+          else
+            cp "codex-rs/target/${{ matrix.target }}/release/codex" "${release_dir}/codex"
+          fi
+
+      - name: Archive Unix release asset
+        if: ${{ runner.os != 'Windows' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          release_dir="${RUNNER_TEMP}/release-asset"
+          archive_dir="${RUNNER_TEMP}/release-archive"
+          mkdir -p "${archive_dir}"
+          tar -C "${release_dir}" -czf "${archive_dir}/${{ matrix.release_asset_name }}" codex
+
+      - name: Archive Windows release asset
+        if: ${{ runner.os == 'Windows' }}
+        shell: pwsh
+        run: |
+          $releaseDir = Join-Path $env:RUNNER_TEMP "release-asset"
+          $archiveDir = Join-Path $env:RUNNER_TEMP "release-archive"
+          New-Item -ItemType Directory -Path $archiveDir -Force | Out-Null
+          Compress-Archive -Path (Join-Path $releaseDir '*') -DestinationPath (Join-Path $archiveDir '${{ matrix.release_asset_name }}') -Force
+
+      - name: Upload runtime binary artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: pypi-runtime-${{ matrix.target }}
+          path: ${{ runner.temp }}/runtime-artifact/*
+          if-no-files-found: error
+
+      - name: Upload GitHub release asset
+        uses: actions/upload-artifact@v4
+        with:
+          name: pypi-release-asset-${{ matrix.target }}
+          path: ${{ runner.temp }}/release-archive/*
+          if-no-files-found: error