codex 2.4.3__tar.gz → 2.5.1__tar.gz

codex-2.5.1/.dockerignore

@@ -0,0 +1,42 @@
+__pycache__
+!dist
+!docker/debian.sources
+.*cache
+.claude
+.coverage*
+.docker-token
+.DS_Store
+.env*
+.eslintcache
+.ghrc-token
+.git
+.mypy_cache
+.picopt_timestamp
+.picopt_treestamps.yaml
+.pypi-token
+.pytest_cache
+.ropeproject
+.ruff_cache
+.venv*
+*.egg-info
+*.py[co]
+*~
+*Dockerfile
+benchmark
+cache
+codex/static
+codex/static_build
+comics
+config
+dev*
+docker-compose*
+docker*
+MANIFEST
+monkeytype.sqlite3
+NEWS
+node_modules
+site
+test-results
+TODO.md
+update-builder-requirement.sh
+version.sh

codex-2.5.1/.github/actions/devenv-ci-container/action.yml

@@ -0,0 +1,35 @@
+# Managed by devenv (copy/ci). Edit it there, not in a child repo.
+name: devenv CI container
+description: >-
+  Pull the CI image devenv-check's image job pushed, by digest, and start the
+  compose service "ci" from it. CI_CONTAINER comes from the calling
+  workflow's env.
+inputs:
+  image:
+    description: The CI image by digest (devenv-check's needs.image.outputs.image).
+    required: true
+  token:
+    description: Token for logging in to GHCR.
+    default: ${{ github.token }}
+runs:
+  using: composite
+  steps:
+    - name: Log in to GHCR
+      uses: docker/login-action@v4
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ inputs.token }}
+
+    - name: Start Services
+      shell: bash
+      env:
+        # compose.yaml's `image: ${CI_IMAGE}`.
+        CI_IMAGE: ${{ inputs.image }}
+      run: |
+        mkdir -p dist test-results
+        if ! docker pull --quiet "$CI_IMAGE"; then
+          echo "::error::Could not pull $CI_IMAGE. A re-run of a failed job reuses its original CI image, which may have been pruned since; use \"Re-run all jobs\" to rebuild it."
+          exit 1
+        fi
+        docker compose up --detach --no-build ci

codex-2.5.1/.github/actions/devenv-pypi/action.yml

@@ -0,0 +1,50 @@
+# Managed by devenv (copy/ci). Edit it there, not in a child repo.
+#
+# A composite action, not a reusable workflow, so it can run in any job (for
+# example straight after an image manifest) and so PyPI trusted publishing,
+# which PyPI refuses from inside a reusable workflow, stays possible.
+name: devenv PyPI publish
+description: >-
+  Publish the python-dist artifact to PyPI with uv. Files already on PyPI are
+  skipped, so a re-run finishes a partial publish. Without a token it uses
+  trusted publishing, so the job must grant id-token: write and must be a job
+  in the repo's own ci.yml, which is the workflow registered on PyPI, not in a
+  reusable workflow.
+inputs:
+  token:
+    description: >-
+      A PyPI API token (secrets.PYPI_TOKEN). Empty, as a deleted secret is,
+      means trusted publishing.
+    required: false
+    default: ""
+  download:
+    description: >-
+      "false" when the job has already downloaded python-dist into dist/.
+    default: "true"
+runs:
+  using: composite
+  steps:
+    - name: Download dist artifact
+      if: inputs.download == 'true'
+      uses: actions/download-artifact@v8
+      with:
+        name: python-dist
+        path: dist/
+
+    - name: Set up uv
+      uses: astral-sh/setup-uv@v8.0.0
+
+    - name: Publish to PyPI with a token
+      if: inputs.token != ''
+      shell: bash
+      env:
+        UV_PUBLISH_TOKEN: ${{ inputs.token }}
+      run: uv publish --check-url https://pypi.org/simple/ dist/*
+
+    # UV_PUBLISH_TOKEN stays unset: an empty one might count as a token.
+    - name: Publish to PyPI with trusted publishing
+      if: inputs.token == ''
+      shell: bash
+      run: >-
+        uv publish --trusted-publishing always
+        --check-url https://pypi.org/simple/ dist/*

codex-2.5.1/.github/workflows/ci.yml

@@ -0,0 +1,254 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize]
+    branches: [main, develop]
+
+env:
+  IMAGE: ghcr.io/${{ github.repository }}
+  HUB_IMAGE: docker.io/ajslater/codex
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# codex composes devenv's CI building blocks (the devenv-* workflows and
+# actions, managed by devenv) with its own image jobs. Every job after ci
+# reads ci's outputs instead of testing the event itself, and checks
+# !cancelled() plus an explicit needs.X.result, so a skipped or cancelled
+# ancestor never lets it run.
+jobs:
+  # ---------------------------------------------------------------------------
+  # devenv-check: the gate (Release Preflight; on a main push, reuse the dist
+  # of an earlier run that passed on the same tree), one codex-ci image, the
+  # fail-fast check matrix, and the required check
+  # "CI / Lint, Test & Build Dist".
+  # ---------------------------------------------------------------------------
+  ci:
+    name: CI
+    uses: ./.github/workflows/devenv-check.yml
+    # test-frontend's make prerequisite builds the choices JSON. Neither
+    # django-check nor pytest needs the frontend or static files. The wheel
+    # ships codex/static, so Build Dist collects it.
+    with:
+      ci-target: codex-ci
+      matrix: >-
+        [{"name": "Lint", "make": "lint"},
+        {"name": "Test Frontend", "make": "test-frontend"},
+        {"name": "Test Python", "make": "django-check test-python", "junit": true},
+        {"name": "Build Dist", "make": "build-choices build-frontend collectstatic build-only", "dist": true}]
+    permissions:
+      contents: read
+      actions: read
+      packages: write
+      checks: write
+
+  # ---------------------------------------------------------------------------
+  # Build per-arch Docker images natively
+  # ---------------------------------------------------------------------------
+  build:
+    name: Build Image (${{ matrix.arch }})
+    needs: ci
+    if: ${{ !cancelled() && needs.ci.result == 'success' && needs.ci.outputs.deploy == 'true' }}
+    strategy:
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+      packages: write
+    env:
+      CODEX_VERSION: ${{ needs.ci.outputs.version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Download dist artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: python-dist
+          path: dist/
+
+      - name: Set Build Context
+        run: echo "CODEX_WHEEL=$(find dist -name '*.whl' -print0 | xargs -0 basename)" >> "$GITHUB_ENV"
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: linux/${{ matrix.arch }}
+          push: true
+          build-args: |
+            CODEX_VERSION=${{ env.CODEX_VERSION }}
+            CODEX_WHEEL=${{ env.CODEX_WHEEL }}
+          tags: ${{ env.IMAGE }}:${{ env.CODEX_VERSION }}-${{ matrix.arch }}
+          cache-from: type=gha,scope=build-${{ matrix.arch }}
+          cache-to: type=gha,scope=build-${{ matrix.arch }},mode=max
+
+  # ---------------------------------------------------------------------------
+  # Create the multi-arch manifest, then publish to PyPI: images first, since
+  # a PyPI version can never be replaced.
+  # ---------------------------------------------------------------------------
+  deploy:
+    name: Deploy
+    needs: [ci, build]
+    if: ${{ !cancelled() && needs.build.result == 'success' }}
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Download dist artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: python-dist
+          path: dist/
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create and push manifest
+        env:
+          VERSION: ${{ needs.ci.outputs.version }}
+          FINAL: ${{ needs.ci.outputs.final }}
+        run: |
+          TAG_ARGS=("-t" "${IMAGE}:${VERSION}")
+
+          # Final versions (X.Y.Z) also get latest.
+          if [[ $FINAL == true ]]; then
+            TAG_ARGS+=("-t" "${IMAGE}:latest")
+          fi
+
+          docker buildx imagetools create \
+            --annotation "index:org.opencontainers.image.title=Codex" \
+            --annotation "index:org.opencontainers.image.description=Codex Comic Server" \
+            --annotation "index:org.opencontainers.image.version=${VERSION}" \
+            --annotation "index:org.opencontainers.image.authors=AJ Slater <aj@slater.net>" \
+            --annotation "index:org.opencontainers.image.url=https://codex-reader.app" \
+            --annotation "index:org.opencontainers.image.source=https://github.com/ajslater/codex" \
+            --annotation "index:org.opencontainers.image.licenses=GPL-3.0-only" \
+            "${TAG_ARGS[@]}" \
+            "${IMAGE}:${VERSION}-amd64" \
+            "${IMAGE}:${VERSION}-arm64"
+
+      - name: Publish to PyPI
+        uses: ./.github/actions/devenv-pypi
+        with:
+          token: ${{ secrets.PYPI_TOKEN }}
+          download: "false"
+
+      - name: Discord notification (Deploy Results)
+        if: "!cancelled() && false"
+        uses: sarisia/actions-status-discord@v1
+        with:
+          webhook: ${{ secrets.DISCORD_WEBHOOK }}
+          status: ${{ job.status }}
+          title: Deploy
+          description: "Deploy ${{ github.ref_name }} #${{ github.run_number }} ${{ job.status == 'success' && 'succeeded' || 'FAILED' }}"
+          color: ${{ job.status == 'success' && '0x28a745' || '0xd73a49' }}
+          url: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
+  # ---------------------------------------------------------------------------
+  # Republish final releases to Docker Hub as a deprecated derivative of the
+  # ghcr.io image: identical layers, one ENV and two labels, so stranded
+  # docker.io users get the in-app "move to ghcr.io" warning. Alphas never
+  # reach Docker Hub: nothing prunes them there and the only tag stranded
+  # users pull is latest.
+  # ---------------------------------------------------------------------------
+  deploy-hub:
+    name: Deploy Deprecated Docker Hub Image
+    needs: [ci, deploy]
+    if: ${{ !cancelled() && needs.deploy.result == 'success' && needs.ci.outputs.final == 'true' }}
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    # DOCKER_USER / DOCKER_PASS are the Docker Hub credentials the old CI
+    # and bin/docker-tag-latest.sh already use. The secrets context is not
+    # allowed in a step if; a job env is. Forks and pull requests receive no
+    # secrets and skip cleanly, and deleting DOCKER_PASS is the switch that
+    # ends Docker Hub publishing.
+    env:
+      DOCKERHUB_ENABLED: ${{ secrets.DOCKER_PASS != '' }}
+      VERSION: ${{ needs.ci.outputs.version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to Docker Hub
+        if: env.DOCKERHUB_ENABLED == 'true'
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+
+      - name: Build and push deprecated image
+        if: env.DOCKERHUB_ENABLED == 'true'
+        run: |
+          # No RUN steps: buildx rewrites the config blob per platform and
+          # copies the ghcr.io layers across unchanged, so no QEMU is needed.
+          docker buildx build \
+            --file hub.Dockerfile \
+            --platform linux/amd64,linux/arm64 \
+            --build-arg "CODEX_VERSION=${VERSION}" \
+            --provenance=false \
+            --sbom=false \
+            --annotation "index:org.opencontainers.image.title=Codex" \
+            --annotation "index:org.opencontainers.image.description=DEPRECATED: this image has moved to ghcr.io/ajslater/codex" \
+            --annotation "index:org.opencontainers.image.version=${VERSION}" \
+            --annotation "index:org.opencontainers.image.authors=AJ Slater <aj@slater.net>" \
+            --annotation "index:org.opencontainers.image.url=https://codex-reader.app" \
+            --annotation "index:org.opencontainers.image.source=https://github.com/ajslater/codex" \
+            --annotation "index:org.opencontainers.image.licenses=GPL-3.0-only" \
+            --annotation "index:org.opencontainers.image.base.name=${IMAGE}:${VERSION}" \
+            --annotation "index:org.opencontainers.image.deprecated=true" \
+            --tag "${HUB_IMAGE}:${VERSION}" \
+            --tag "${HUB_IMAGE}:latest" \
+            --push \
+            .
+
+  # ---------------------------------------------------------------------------
+  # Last step of a main release: tag, GitHub Release from NEWS.md, merge-back.
+  # deploy-hub is skipped for alphas, so skipped counts as done there.
+  # ---------------------------------------------------------------------------
+  release:
+    name: Release
+    needs: [ci, deploy, deploy-hub]
+    if: >-
+      ${{ !cancelled() && needs.ci.outputs.release == 'true'
+      && needs.deploy.result == 'success'
+      && (needs.deploy-hub.result == 'success' || needs.deploy-hub.result == 'skipped') }}
+    uses: ./.github/workflows/devenv-release.yml
+    permissions:
+      contents: write