mirror of
https://github.com/openai/codex.git
synced 2026-05-03 21:01:55 +03:00
dee5f5ea38
## Summary This PR hardens package-manager usage across the repo to reduce dependency supply-chain risk. It also removes the stale `codex-cli` Docker path, which was already broken on `main`, instead of keeping a bitrotted container workflow alive. ## What changed - Updated pnpm package manager pins and workspace install settings. - Removed stale `codex-cli` Docker assets instead of trying to keep a broken local container path alive. - Added uv settings and lockfiles for the Python SDK packages. - Updated Python SDK setup docs to use `uv sync`. ## Why This is primarily a security hardening change. It reduces package-install and supply-chain risk by ensuring dependency installs go through pinned package managers, committed lockfiles, release-age settings, and reviewed build-script controls. For `codex-cli`, the right follow-up was to remove the local Docker path rather than keep patching it: - `codex-cli/Dockerfile` installed `codex.tgz` with `npm install -g`, which bypassed the repo lockfile and age-gated pnpm settings. - The local `codex-cli/scripts/build_container.sh` helper was already broken on `main`: it called `pnpm run build`, but `codex-cli/package.json` does not define a `build` script. - The container path itself had bitrotted enough that keeping it would require extra packaging-specific behavior that was not otherwise needed by the repo. ## Gaps addressed - Global npm installs bypassed the repo lockfile in Docker and CLI reinstall paths, including `codex-cli/Dockerfile` and `codex-cli/bin/codex.js`. - CI and Docker pnpm installs used `--frozen-lockfile`, but the repo was missing stricter pnpm workspace settings for dependency build scripts. - Python SDK projects had `pyproject.toml` metadata but no committed `uv.lock` coverage or uv age/index settings in `sdk/python` and `sdk/python-runtime`. - The secure devcontainer install path used npm/global install behavior without a local locked package-manager boundary. - The local `codex-cli` Docker helper was already broken on `main`, so this PR removes that stale Docker path instead of preserving a broken surface. - pnpm was already pinned, but not to the current repo-wide pnpm version target. ## Verification - `pnpm install --frozen-lockfile` - `.devcontainer/codex-install`: `pnpm install --prod --frozen-lockfile` - `.devcontainer/codex-install`: `./node_modules/.bin/codex --version` - `sdk/python`: `uv lock --check`, `uv sync --locked --all-extras --dry-run`, `uv build` - `sdk/python-runtime`: `uv lock --check`, `uv sync --locked --dry-run`, `uv build --wheel` - `pnpm -r --filter ./sdk/typescript run build` - `pnpm -r --filter ./sdk/typescript run lint` - `pnpm -r --filter ./sdk/typescript run test` - `node --check codex-cli/bin/codex.js` - `docker build -f .devcontainer/Dockerfile.secure -t codex-secure-test .` - `cargo build -p codex-cli` - repo-wide package-manager audit
86 lines
2.5 KiB
YAML
86 lines
2.5 KiB
YAML
lockfileVersion: '9.0'
|
|
|
|
settings:
|
|
autoInstallPeers: true
|
|
excludeLinksFromLockfile: false
|
|
|
|
importers:
|
|
|
|
.:
|
|
dependencies:
|
|
'@openai/codex':
|
|
specifier: 0.121.0
|
|
version: 0.121.0
|
|
|
|
packages:
|
|
|
|
'@openai/codex@0.121.0':
|
|
resolution: {integrity: sha512-kCJ2NeATd4QBQRmqV04ymdN1ZU3MSwnJQDm/KzjpuzGvCuUVEn7no/T2mRyxQ2x77AACqriNOyPPoM/yufyvNg==}
|
|
engines: {node: '>=16'}
|
|
hasBin: true
|
|
|
|
'@openai/codex@0.121.0-darwin-arm64':
|
|
resolution: {integrity: sha512-ZyBqIB6Fb4I0hGb/h65Vu7ePYjHSmGiqqfm+/1djEuxDPkqjfi4wkxYxNYNY+6najyNGN4UijOSTTf19eDCrqw==}
|
|
engines: {node: '>=16'}
|
|
cpu: [arm64]
|
|
os: [darwin]
|
|
|
|
'@openai/codex@0.121.0-darwin-x64':
|
|
resolution: {integrity: sha512-1/OAtdkAZ5yPI3xqaEFlHuPziS1yCqL2gOZdswE7HTmmwpIxi6Z3FCo60JWDPluIp89z4tftdjq73/OCN0YVcw==}
|
|
engines: {node: '>=16'}
|
|
cpu: [x64]
|
|
os: [darwin]
|
|
|
|
'@openai/codex@0.121.0-linux-arm64':
|
|
resolution: {integrity: sha512-2UgMmdo237o7SCMsfb529cOSEM2HFUgN6OBkv5SBLwfNY1NO2Ex6JnUjlppEXlX6/4cXfZ5qjDghVz5j/+B9zw==}
|
|
engines: {node: '>=16'}
|
|
cpu: [arm64]
|
|
os: [linux]
|
|
|
|
'@openai/codex@0.121.0-linux-x64':
|
|
resolution: {integrity: sha512-vlpNJXIqss800J+32Vy7TUZzv31n61b45OLxmsVQGFkTNLJcjFrj9jDUC7I62eC4F16gLioilefNfv4CdJQOEw==}
|
|
engines: {node: '>=16'}
|
|
cpu: [x64]
|
|
os: [linux]
|
|
|
|
'@openai/codex@0.121.0-win32-arm64':
|
|
resolution: {integrity: sha512-m88q4f3XI5npn1t6OG0nWGHWWAjO5FgjRwxh4hdujbLO6t9CiCNfhfPZIOSsoATbrCNwLC+6S77m3cjbNToPNg==}
|
|
engines: {node: '>=16'}
|
|
cpu: [arm64]
|
|
os: [win32]
|
|
|
|
'@openai/codex@0.121.0-win32-x64':
|
|
resolution: {integrity: sha512-Fp0ecVOyM+VcBi/y4HVvRzhifO9YqRiHzhV3rhtAppC7flh22WPguLC4kmvXYAR0p3RPzbo35M2CedWnkOT+cw==}
|
|
engines: {node: '>=16'}
|
|
cpu: [x64]
|
|
os: [win32]
|
|
|
|
snapshots:
|
|
|
|
'@openai/codex@0.121.0':
|
|
optionalDependencies:
|
|
'@openai/codex-darwin-arm64': '@openai/codex@0.121.0-darwin-arm64'
|
|
'@openai/codex-darwin-x64': '@openai/codex@0.121.0-darwin-x64'
|
|
'@openai/codex-linux-arm64': '@openai/codex@0.121.0-linux-arm64'
|
|
'@openai/codex-linux-x64': '@openai/codex@0.121.0-linux-x64'
|
|
'@openai/codex-win32-arm64': '@openai/codex@0.121.0-win32-arm64'
|
|
'@openai/codex-win32-x64': '@openai/codex@0.121.0-win32-x64'
|
|
|
|
'@openai/codex@0.121.0-darwin-arm64':
|
|
optional: true
|
|
|
|
'@openai/codex@0.121.0-darwin-x64':
|
|
optional: true
|
|
|
|
'@openai/codex@0.121.0-linux-arm64':
|
|
optional: true
|
|
|
|
'@openai/codex@0.121.0-linux-x64':
|
|
optional: true
|
|
|
|
'@openai/codex@0.121.0-win32-arm64':
|
|
optional: true
|
|
|
|
'@openai/codex@0.121.0-win32-x64':
|
|
optional: true
|