Upstream sync: rust-v0.163.0

.bazelrc

@@ -11,6 +11,12 @@ startup --experimental_remote_repo_contents_cache
 
 common --experimental_platform_in_output_dir
 
+# Match Cargo's MSVC static CRT policy and V8's allocator linkage. Only the
+# MSVC C/C++ toolchain consumes this feature; other toolchains ignore it.
+# Include host dependencies so native build tools use the same runtime.
+build --features=static_link_msvcrt
+build --host_features=static_link_msvcrt
+
 build --workspace_status_command=./scripts/workspace-status.sh
 build:windows --workspace_status_command=./scripts/workspace-status.cmd
 
@@ -225,5 +231,49 @@ common:v8-target-arm64 --@v8//bazel/config:v8_target_cpu=arm64
 # the matching runtime objects.
 common:rusty-v8-upstream-libcxx --@v8//:v8_use_rusty_v8_custom_libcxx=True
 
+# Native Windows MSVC builds inherit the runner's MSVC SDK environment.
+# Client environment capture and repository discovery happen before target
+# transitions, so these runner settings cannot live in runtime_package.bzl.
+# Hermetic LLVM targets the GNU ABI on Windows even on an MSVC platform.
+build:ci-windows-msvc --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=0
+build:ci-windows-msvc --extra_toolchains=@local_config_cc//:cc-toolchain-x64_windows,@local_config_cc//:cc-toolchain-arm64_windows
+build:ci-windows-msvc --action_env=PATH
+build:ci-windows-msvc --host_action_env=PATH
+build:ci-windows-msvc --action_env=INCLUDE
+build:ci-windows-msvc --host_action_env=INCLUDE
+build:ci-windows-msvc --action_env=LIB
+build:ci-windows-msvc --host_action_env=LIB
+build:ci-windows-msvc --action_env=LIBPATH
+build:ci-windows-msvc --host_action_env=LIBPATH
+build:ci-windows-msvc --action_env=SystemRoot
+build:ci-windows-msvc --host_action_env=SystemRoot
+build:ci-windows-msvc --action_env=PROCESSOR_ARCHITECTURE
+build:ci-windows-msvc --host_action_env=PROCESSOR_ARCHITECTURE
+build:ci-windows-msvc --action_env=WindowsSdkDir
+build:ci-windows-msvc --host_action_env=WindowsSdkDir
+build:ci-windows-msvc --action_env=VCINSTALLDIR
+build:ci-windows-msvc --host_action_env=VCINSTALLDIR
+
+# Release profile settings are also defined in codex-rs/Cargo.toml.
+# runtime_package.bzl applies this profile to archive dependencies automatically.
+# Packaging extracts symbols before stripping; the Rust toolchains retain
+# line tables and use split-debuginfo=off. opt mode selects Rust opt-level=3,
+# which disables debug assertions and overflow checks by default.
+build:release --compilation_mode=opt
+build:release --@rules_rust//rust/settings:lto=thin
+build:release --@rules_rust//rust/settings:codegen_units=4
+# Match observed Cargo 1.95 build-tool commands: opt-level=0, assertions off,
+# and rustc's non-incremental default of 16 codegen units (not target's 4).
+build:release --@rules_rust//rust/settings:extra_exec_rustc_flag=-Copt-level=0
+build:release --@rules_rust//rust/settings:extra_exec_rustc_flag=-Ccodegen-units=16
+build:release --@rules_rust//rust/settings:extra_exec_rustc_flag=-Cdebug-assertions=no
+
+# Compatibility: Cargo build scripts consume the Rust profile, including debug
+# info, and choose their native optimization. Preserve explicit user C/C++ flags.
+# Opt in for target and host dependencies; normal Bazel builds keep defaults.
+build:release --features=cargo-release-profile
+build:release --host_features=cargo-release-profile
+# Bubblewrap and voice set release options on their own native rules.
+
 # Optional per-user local overrides.
 try-import %workspace%/user.bazelrc

.github/actions/build-bazel-package-binaries/action.yml

@@ -0,0 +1,35 @@
+name: Build Bazel package binaries
+description: Set up Bazel and stage unstripped runtime package binaries and symbols.
+inputs:
+  target:
+    description: Rust release target triple.
+    required: true
+  build-mode:
+    description: Release optimizations, or debug for faster package smoke builds.
+    default: release
+
+runs:
+  using: composite
+  steps:
+    - name: Set up Bazel
+      uses: ./.github/actions/prepare-bazel-ci
+      with:
+        target: ${{ inputs.target }}
+        cache-scope: bazel-release
+
+    - name: Install Cargo for workspace metadata
+      uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
+
+    - name: Configure MSVC environment
+      if: ${{ runner.os == 'Windows' }}
+      uses: ./.github/actions/setup-msvc-env
+      with:
+        target: ${{ inputs.target }}
+
+    - name: Build Bazel release binaries and symbols
+      uses: ./.github/actions/build-bazel-release
+      with:
+        target: ${{ inputs.target }}
+        bundle: combined
+        release-dir: ${{ env.CARGO_TARGET_DIR }}/${{ inputs.target }}/release
+        build-mode: ${{ inputs.build-mode }}

.github/actions/build-bazel-release/action.yml

@@ -0,0 +1,50 @@
+name: Build Bazel release staging archive
+description: Build a binary/symbol archive and extract writable inputs for existing signing and packaging.
+inputs:
+  target:
+    description: Rust release target triple.
+    required: true
+  bundle:
+    description: Binary bundle (combined, primary, app-server, or helpers).
+    default: combined
+  release-dir:
+    description: Directory where the archive is extracted for signing and packaging.
+    required: true
+  build-mode:
+    description: Release optimizations, or debug for faster package smoke builds.
+    default: release
+
+runs:
+  using: composite
+  steps:
+    - name: Refresh release workspace metadata
+      shell: bash
+      working-directory: ${{ github.workspace }}/codex-rs
+      # Release tags change Cargo.toml; rules_rs needs matching workspace lock entries.
+      run: cargo update --workspace
+
+    - name: Build staging archive
+      shell: bash
+      working-directory: ${{ github.workspace }}
+      env:
+        TARGET: ${{ inputs.target }}
+        BUNDLE: ${{ inputs.bundle }}
+        BUILD_MODE: ${{ inputs.build-mode }}
+        # Keep Git Bash from rewriting Bazel labels as Windows paths.
+        MSYS2_ARG_CONV_EXCL: "*"
+      run: |
+        python3 .github/scripts/run_bazel_with_buildbuddy.py build \
+          ${{ runner.os == 'Windows' && '--config=ci-windows-msvc' || '' }} \
+          "--platforms=@rules_rs//rs/platforms:$TARGET" \
+          "--//codex-rs:runtime_package_build_mode=$BUILD_MODE" \
+          "//codex-rs:runtime_package_$BUNDLE"
+
+    - name: Extract staging archive
+      shell: bash
+      working-directory: ${{ github.workspace }}
+      env:
+        BUNDLE: ${{ inputs.bundle }}
+        RELEASE_DIR: ${{ inputs.release-dir }}
+      run: |
+        mkdir -p "$RELEASE_DIR"
+        tar -xzf "bazel-bin/codex-rs/runtime_package_$BUNDLE.tar.gz" -C "$RELEASE_DIR"

.github/actions/build-cargo-package-binaries/action.yml

@@ -0,0 +1,135 @@
+name: Build Cargo package binaries
+description: Set up Cargo and build unstripped runtime package binaries and symbols.
+inputs:
+  target:
+    description: Rust release target triple.
+    required: true
+  binaries:
+    description: Space-separated binary target names.
+    required: true
+  build-mode:
+    description: Release optimizations, or debug for faster package smoke builds.
+    default: release
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/setup-ci
+
+    - name: Configure Cargo release profile
+      shell: bash
+      env:
+        BUILD_MODE: ${{ inputs.build-mode }}
+        # macOS symbol extraction needs packed dSYM bundles before binaries are stripped.
+        CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO: ${{ contains(inputs.target, 'apple-darwin') && 'packed' || 'off' }}
+      run: |
+        set -euo pipefail
+        echo "CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO=$CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO" >> "$GITHUB_ENV"
+        case "$BUILD_MODE" in
+          release) ;;
+          debug)
+            # Use the release profile so assertions, symbols and packaging match production.
+            # Only trade compiler optimizations for faster builds.
+            {
+              echo "CARGO_PROFILE_RELEASE_OPT_LEVEL=0"
+              echo "CARGO_PROFILE_RELEASE_LTO=off"
+              echo "CARGO_PROFILE_RELEASE_CODEGEN_UNITS=256"
+            } >> "$GITHUB_ENV"
+            ;;
+          *) echo "Unsupported build mode: $BUILD_MODE" >&2; exit 1 ;;
+        esac
+
+    - uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
+      with:
+        targets: ${{ inputs.target }}
+
+    - name: Use hermetic Cargo home (musl)
+      if: ${{ runner.os == 'Linux' }}
+      shell: bash
+      working-directory: codex-rs
+      run: |
+        set -euo pipefail
+        cargo_home="${GITHUB_WORKSPACE}/.cargo-home"
+        mkdir -p "${cargo_home}/bin"
+        echo "CARGO_HOME=${cargo_home}" >> "$GITHUB_ENV"
+        echo "${cargo_home}/bin" >> "$GITHUB_PATH"
+        : > "${cargo_home}/config.toml"
+
+    - name: Install Zig
+      if: ${{ runner.os == 'Linux' }}
+      uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
+      with:
+        version: 0.14.0
+        use-cache: false
+
+    - name: Install musl build tools
+      if: ${{ runner.os == 'Linux' }}
+      shell: bash
+      working-directory: codex-rs
+      env:
+        TARGET: ${{ inputs.target }}
+      run: bash "${GITHUB_WORKSPACE}/.github/scripts/install-musl-build-tools.sh"
+
+    - name: Disable aws-lc jitter entropy (musl)
+      if: ${{ runner.os == 'Linux' }}
+      shell: bash
+      working-directory: codex-rs
+      env:
+        TARGET: ${{ inputs.target }}
+      run: |
+        set -euo pipefail
+        # aws-lc's jitter entropy path does not work reliably on musl builders,
+        # so disable it globally and per target.
+        echo "AWS_LC_SYS_NO_JITTER_ENTROPY=1" >> "$GITHUB_ENV"
+        target_no_jitter="AWS_LC_SYS_NO_JITTER_ENTROPY_${TARGET}"
+        target_no_jitter="${target_no_jitter//-/_}"
+        echo "${target_no_jitter}=1" >> "$GITHUB_ENV"
+
+    - name: Configure rusty_v8 artifact overrides and verify checksums
+      uses: ./.github/actions/setup-rusty-v8
+      with:
+        target: ${{ inputs.target }}
+
+    - name: Configure MSVC environment
+      if: ${{ runner.os == 'Windows' }}
+      uses: ./.github/actions/setup-msvc-env
+      with:
+        target: ${{ inputs.target }}
+
+    - name: Build bwrap and export digest
+      if: ${{ runner.os == 'Linux' }}
+      shell: bash
+      working-directory: codex-rs
+      env:
+        TARGET: ${{ inputs.target }}
+      run: |
+        set -euo pipefail
+        cargo build --target "${TARGET}" --release --timings --bin bwrap
+
+        bwrap_path="${CARGO_TARGET_DIR}/${TARGET}/release/bwrap"
+        # Codex embeds this digest at build time and verifies the packaged
+        # bwrap at runtime, so hash its final stripped bytes first.
+        strip --strip-debug --strip-unneeded "$bwrap_path"
+        digest="$(sha256sum "$bwrap_path" | awk '{print $1}')"
+        echo "CODEX_BWRAP_SHA256=${digest}" >> "$GITHUB_ENV"
+
+    - name: Build Codex package binaries
+      shell: bash
+      working-directory: codex-rs
+      env:
+        TARGET: ${{ inputs.target }}
+        BINARIES: ${{ inputs.binaries }}
+      run: |
+        set -euo pipefail
+        build_args=()
+        for binary in $BINARIES; do
+          build_args+=(--bin "$binary")
+        done
+        # SQLite intrinsics can emit instructions unsupported by older x64
+        # CPUs, causing Windows release binaries to crash during startup.
+        if [[ "${TARGET}" == "x86_64-pc-windows-msvc" ]]; then
+          export LIBSQLITE3_FLAGS=SQLITE_DISABLE_INTRINSIC
+        fi
+        STABLE_GIT_COMMIT="$(git rev-parse HEAD)"
+        export STABLE_GIT_COMMIT
+        cargo build --target "${TARGET}" --release --timings "${build_args[@]}"