ci: add Bazel clippy workflow for codex-rs by bolinfest · Pull Request #15955 · openai/codex

bolinfest · 2026-03-27T05:19:36Z

Why

bazel.yml already builds and tests the Bazel graph, but rust-ci.yml still runs cargo clippy separately. This PR starts the transition to a Bazel-backed lint lane for codex-rs so we can eventually replace the duplicate Rust build, test, and lint work with Bazel while explicitly keeping the V8 Bazel path out of scope for now.

To make that lane practical, the workflow also needs to look like the Bazel job we already trust. That means sharing the common Bazel setup and invocation logic instead of hand-copying it, and covering the arm64 macOS path in addition to Linux.

Landing the workflow green also required fixing the first lint findings that Bazel surfaced and adding the matching local entrypoint.

What changed

add a reusable build:clippy config to .bazelrc and export codex-rs/clippy.toml from codex-rs/BUILD.bazel so Bazel can run the repository's existing Clippy policy
add just bazel-clippy so the local developer entrypoint matches the new CI lane
extend .github/workflows/bazel.yml with a dedicated Bazel clippy job for codex-rs, scoped to //codex-rs/... -//codex-rs/v8-poc:all
run that clippy job on Linux x64 and arm64 macOS
factor the shared Bazel workflow setup into .github/actions/setup-bazel-ci/action.yml and the shared Bazel invocation logic into .github/scripts/run-bazel-ci.sh so the clippy and build/test jobs stay aligned
fix the first Bazel-clippy findings needed to keep the lane green, including the cross-target cmsghdr::cmsg_len normalization in codex-rs/shell-escalation/src/unix/socket.rs and the no-voice-input dead-code warnings in codex-rs/tui and codex-rs/tui_app_server

Verification

just bazel-clippy
RUNNER_OS=macOS ./.github/scripts/run-bazel-ci.sh -- build --config=clippy --build_metadata=COMMIT_SHA=local-check --build_metadata=TAG_job=clippy -- //codex-rs/... -//codex-rs/v8-poc:all
bazel build --config=clippy //codex-rs/shell-escalation:shell-escalation
CARGO_TARGET_DIR=/tmp/codex4-shell-escalation-test cargo test -p codex-shell-escalation
ruby -e 'require "yaml"; YAML.load_file(".github/workflows/bazel.yml"); YAML.load_file(".github/actions/setup-bazel-ci/action.yml")'

Notes

CARGO_TARGET_DIR=/tmp/codex4-tui-app-server-test cargo test -p codex-tui-app-server still hits existing guardian-approvals test and snapshot failures unrelated to this PR's Bazel-clippy changes.

Related: #15954

chatgpt-codex-connector · 2026-03-27T05:23:23Z

💡 Codex Review

codex/codex-rs/windows-sandbox-rs/Cargo.toml

Line 3 in 34542eb

edition = "2024"

Align Bazel edition with Cargo edition

Updating this crate to Rust 2024 in Cargo without updating Bazel leaves the two build paths out of sync: codex-rs/windows-sandbox-rs/BUILD.bazel still pins crate_edition = "2021". That means Bazel clippy/build will analyze this crate as 2021 while Cargo uses 2024, so edition-specific diagnostics and behavior can diverge and CI may miss issues that only appear in the Cargo configuration.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

## Why `codex-utils-pty` and `codex-windows-sandbox` were the remaining crates in `codex-rs` that still overrode the workspace's Rust 2024 edition. Moving them forward in a separate PR keeps the baseline edition update isolated from the follow-on Bazel clippy workflow in #15955, while making linting and formatting behavior consistent with the rest of the workspace. This PR also needs Cargo and Bazel to agree on the edition for `codex-windows-sandbox`. Without the Bazel-side sync, the experimental Bazel app-server builds fail once they compile `windows-sandbox-rs`. ## What changed - switch `codex-rs/utils/pty` and `codex-rs/windows-sandbox-rs` to `edition = "2024"` - update `codex-utils-pty` callsites and tests to use the collapsed `if let` form that Clippy expects under the new edition - fix the Rust 2024 fallout in `windows-sandbox-rs`, including the reserved `gen` identifier, `unsafe extern` requirements, and new Clippy findings that surfaced under the edition bump - keep the edition bump separate from a larger unsafe cleanup by temporarily allowing `unsafe_op_in_unsafe_fn` in the Windows entrypoint modules that now report it under Rust 2024 - update `codex-rs/windows-sandbox-rs/BUILD.bazel` to `crate_edition = "2024"` so Bazel compiles the crate with the same edition as Cargo --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/openai/codex/pull/15954). * #15976 * #15955 * __->__ #15954

jif-oai · 2026-03-27T17:14:20Z

.github/actions/setup-bazel-ci/action.yml

+    - name: Make DotSlash available in PATH (Unix)
+      if: inputs.install-test-prereqs == 'true' && runner.os != 'Windows'
+      shell: bash
+      run: cp "$(which dotslash)" /usr/local/bin


That sounds a bit hacky no? Why not just updating PATH? 🤔
Also, I though which was considered flaky in bash (we might not care as we are in controlled env though)

Fwiw, we were already doing this in .github/workflows/bazel.yml.

I believe I did this originally because updating PATH here doesn't propagate to subsequent steps and the bookkeeping to do it that way isn't worth it.

Or at least, facebook/install-dotslash@v2 normally does seem to work that way, but something (Bazel?) I think uses a more sanitized version of PATH that excludes the entry where GitHub Actions normally introduce executables.

jif-oai · 2026-03-27T17:16:48Z

.github/actions/setup-bazel-ci/action.yml

+      with:
+        path: |
+          ~/.cache/bazel-repo-cache
+        key: bazel-cache-${{ inputs.target }}-${{ hashFiles('MODULE.bazel', 'codex-rs/Cargo.lock', 'codex-rs/Cargo.toml') }}


OOC, why not using MODULE.bazel.lock ?

@siggisim This is from #14495, can you speak to this?

Either should be fine, especially since the lock file is checked in here. MODULE.bazel.lock will probably get you more granular buckets which is nice (but since items in the repository cache are keyed under a hash of contents, it shouldn't be a big deal either way).

jif-oai · 2026-03-27T17:17:38Z

.github/scripts/run-bazel-ci.sh

+#!/usr/bin/env bash
+
+set -euo pipefail
+set -o pipefail


OOC, isn't it redundant with the previous line?

Good catch!

jif-oai · 2026-03-27T17:19:01Z

.github/scripts/run-bazel-ci.sh

+
+bazel_startup_args=()
+if [[ -n "${BAZEL_STARTUP_ARGS:-}" ]]; then
+  read -r -a bazel_startup_args <<< "${BAZEL_STARTUP_ARGS}"


I think this will break if you have space in the startup args

Something like

--host_jvm_args=-Dfoo="bar baz"

Probably not a big deal though

Great catch! Asked Codex to fix.

Though maybe the real fix is to rewrite this file in Python...

bolinfest changed the base branch from main to pr15954 March 27, 2026 05:19

bolinfest mentioned this pull request Mar 27, 2026

chore: move pty and windows sandbox to Rust 2024 #15954

Merged

bolinfest force-pushed the pr15954 branch from 68af048 to 987742a Compare March 27, 2026 05:25

bolinfest force-pushed the pr15955 branch from 34542eb to a6932eb Compare March 27, 2026 05:25

bolinfest force-pushed the pr15954 branch from 987742a to 1664d0a Compare March 27, 2026 05:42

bolinfest force-pushed the pr15955 branch from a6932eb to 03a2300 Compare March 27, 2026 05:42

bolinfest force-pushed the pr15954 branch from 1664d0a to 1dfa6e0 Compare March 27, 2026 05:54

bolinfest force-pushed the pr15955 branch 2 times, most recently from c08ee08 to 33e587e Compare March 27, 2026 06:27

bolinfest force-pushed the pr15954 branch from 1dfa6e0 to 343fd48 Compare March 27, 2026 06:35

bolinfest force-pushed the pr15955 branch 3 times, most recently from 40849a1 to f6e90ad Compare March 27, 2026 06:59

bolinfest mentioned this pull request Mar 27, 2026

ci: refactor Bazel workflow setup #15976

Closed

Base automatically changed from pr15954 to main March 27, 2026 09:31

bolinfest force-pushed the pr15955 branch 3 times, most recently from 620f7a4 to fb4e76b Compare March 27, 2026 16:23

bolinfest requested review from aibrahim-oai, jif-oai and nornagon-openai March 27, 2026 16:55

aibrahim-oai approved these changes Mar 27, 2026

View reviewed changes

bolinfest enabled auto-merge (squash) March 27, 2026 17:13

jif-oai approved these changes Mar 27, 2026

View reviewed changes

bolinfest disabled auto-merge March 27, 2026 17:24

ci: add Bazel clippy workflow for codex-rs

e5463fc

bolinfest force-pushed the pr15955 branch from fb4e76b to e5463fc Compare March 27, 2026 17:38

bolinfest enabled auto-merge (squash) March 27, 2026 17:50

bolinfest disabled auto-merge March 27, 2026 18:13

bolinfest enabled auto-merge (squash) March 27, 2026 18:13

bolinfest disabled auto-merge March 27, 2026 19:02

bolinfest merged commit 2616c7c into main Mar 27, 2026
87 of 101 checks passed

bolinfest deleted the pr15955 branch March 27, 2026 19:02

github-actions bot locked and limited conversation to collaborators Mar 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: add Bazel clippy workflow for codex-rs#15955

ci: add Bazel clippy workflow for codex-rs#15955
bolinfest merged 1 commit intomainfrom
pr15955

bolinfest commented Mar 27, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector bot commented Mar 27, 2026

Uh oh!

jif-oai Mar 27, 2026

Uh oh!

bolinfest Mar 27, 2026

Uh oh!

jif-oai Mar 27, 2026

Uh oh!

bolinfest Mar 27, 2026

Uh oh!

siggisim Mar 27, 2026

Uh oh!

jif-oai Mar 27, 2026

Uh oh!

bolinfest Mar 27, 2026

Uh oh!

jif-oai Mar 27, 2026

Uh oh!

bolinfest Mar 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

bolinfest commented Mar 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What changed

Verification

Notes

Uh oh!

chatgpt-codex-connector bot commented Mar 27, 2026

💡 Codex Review

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

bolinfest commented Mar 27, 2026 •

edited

Loading