ci: make the fork's PR checks meaningful

.codespellignore

@@ -5,3 +5,5 @@ psuedo
 SOM
 te
 TE
+WRONLY
+oint

.github/scripts/verify_cargo_workspace_manifests.py

@@ -26,7 +26,6 @@
     "path-utils": "codex-utils-path",
 }
 MANIFEST_FEATURE_EXCEPTIONS = {
-    "codex-rs/code-mode/Cargo.toml": {"sandbox": ("v8/v8_enable_sandbox",)},
     "codex-rs/v8-poc/Cargo.toml": {"sandbox": ("v8/v8_enable_sandbox",)},
 }
 OPTIONAL_DEPENDENCY_EXCEPTIONS = set()

.github/workflows/blocking-ci.yml

@@ -10,11 +10,13 @@ on:
 jobs:
   # Keep reusable workflow calls alphabetized. The `required` job below is the
   # version-controlled list that the main-branch ruleset should require.
-  bazel:
-    name: Bazel
-    uses: ./.github/workflows/bazel.yml
-    secrets: inherit
-
+  #
+  # Fork (JSBtechnologies/codex): the `bazel` and `sdk` calls are left out.
+  # Upstream runs them on OpenAI's self-hosted runner groups (<repo>-runners,
+  # <repo>-windows-x64, macos-15-xlarge) with a BuildBuddy remote cache. None of
+  # that exists here, so they fail in seconds or queue forever and only produce
+  # false positives. Re-add them (and their `required.needs` entries) if that
+  # infrastructure is ever set up. See docs/fork-ci.md.
   blob-size-policy:
     name: Blob size policy
     uses: ./.github/workflows/blob-size-policy.yml
@@ -40,24 +42,17 @@ jobs:
     uses: ./.github/workflows/rust-ci.yml
     secrets: inherit
 
-  sdk:
-    name: sdk
-    uses: ./.github/workflows/sdk.yml
-    secrets: inherit
-
   required:
     name: CI required
     # Without `always()`, GitHub skips this job after a failed dependency and a
     # required check can appear successful instead of reporting the failure.
     if: ${{ always() }}
     needs:
-      - bazel
       - blob-size-policy
       - cargo-deny
       - codespell
       - repo-checks
       - rust-ci
-      - sdk
     runs-on: ubuntu-24.04
     steps:
       # Keep the helper on the same combined revision as the child workflows so

.github/workflows/rust-ci.yml

@@ -166,6 +166,11 @@ jobs:
     runs-on: ${{ matrix.runs_on || matrix.runner }}
     timeout-minutes: ${{ matrix.timeout_minutes }}
     needs: changed
+    # Fork: this job runs Bazel through OpenAI's BuildBuddy cache on a
+    # self-hosted Windows runner and a paid macOS runner. In the fork it fails
+    # instantly or queues forever, so it is upstream-only; `results` below
+    # accepts it being skipped outside openai/codex. See docs/fork-ci.md.
+    if: ${{ github.repository == 'openai/codex' }}
     environment:
       name: bazel
       deployment: false
@@ -249,7 +254,13 @@ jobs:
           fi
 
           if [[ "${NEEDS_CHANGED_OUTPUTS_ARGUMENT_COMMENT_LINT}" == 'true' || "${NEEDS_CHANGED_OUTPUTS_WORKFLOWS}" == 'true' ]]; then
-            [[ '${{ needs.argument_comment_lint_prebuilt.result }}' == 'success' ]] || { echo 'argument_comment_lint_prebuilt failed'; exit 1; }
+            # Fork: the prebuilt lint is upstream-only (see its `if`), so a
+            # skipped result is acceptable outside openai/codex.
+            if [[ '${{ github.repository }}' == 'openai/codex' ]]; then
+              [[ '${{ needs.argument_comment_lint_prebuilt.result }}' == 'success' ]] || { echo 'argument_comment_lint_prebuilt failed'; exit 1; }
+            else
+              [[ '${{ needs.argument_comment_lint_prebuilt.result }}' == 'success' || '${{ needs.argument_comment_lint_prebuilt.result }}' == 'skipped' ]] || { echo 'argument_comment_lint_prebuilt failed'; exit 1; }
+            fi
           fi
 
           if [[ "${NEEDS_CHANGED_OUTPUTS_CODEX}" == 'true' || "${NEEDS_CHANGED_OUTPUTS_WORKFLOWS}" == 'true' ]]; then

docs/fork-ci.md

@@ -0,0 +1,47 @@
+# CI in the fork (JSBtechnologies/codex)
+
+Upstream's CI assumes OpenAI infrastructure: self-hosted runner groups
+(`<repo>-runners`, `<repo>-windows-x64`, `<repo>-linux-x64-xl`), paid
+`macos-15-xlarge` runners, a BuildBuddy remote cache, code-signing and
+publishing secrets, and an OpenAI API key for the issue bots. None of that
+exists in the fork, so those jobs either fail in seconds or queue forever, and
+every PR shows red checks that mean nothing. This document records exactly what
+the fork turns off, so a red check here is a real finding.
+
+## What runs on a PR
+
+`blocking-ci.yml` is the PR gate. In the fork it calls:
+
+| reusable workflow      | what it checks                                                                                  |
+| ---------------------- | ----------------------------------------------------------------------------------------------- |
+| `blob-size-policy.yml` | no oversized blobs committed                                                                    |
+| `cargo-deny.yml`       | licenses and advisories                                                                         |
+| `codespell.yml`        | spelling                                                                                        |
+| `repo-checks.yml`      | Cargo manifests inherit workspace settings, TUI/core boundary, Bazel clippy lints               |
+| `rust-ci.yml`          | format, clippy, tests for changed crates, `cargo shear`, the argument-comment lint for packages |
+
+Removed from the gate in the fork, in the workflow file with a comment: the
+`bazel` and `sdk` calls. Inside `rust-ci.yml`, the "Argument comment lint -
+Linux/macOS/Windows" job is guarded with `if: github.repository ==
+'openai/codex'` and the `results` job accepts it being skipped outside upstream.
+
+## What is disabled as a repository setting
+
+`scripts/fork-ci-disable.sh` disables, via `gh workflow disable`, the workflows
+that only make sense upstream: post-merge full CI on self-hosted runners, the
+V8 canary, all upstream release and publishing workflows, the issue bots, the
+stale-PR sweeper and the CLA assistant. Run it again after merging upstream if
+new infra-bound workflows appear. `gh workflow enable <file>` reverts any of
+them.
+
+## What the fork adds
+
+`fork-release.yml` builds and publishes fork releases on `fork-v*` tags using
+GitHub-hosted runners only. See the header of that file.
+
+## Merging upstream
+
+The fork's edits to upstream workflow files are deliberately small and marked
+with `Fork:` comments: `blocking-ci.yml` (two calls and two `needs` entries
+removed) and `rust-ci.yml` (one `if:` and one branch in `results`). When an
+upstream merge conflicts there, keep the fork's version of those lines.

scripts/fork-ci-disable.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Fork (JSBtechnologies/codex): disable the upstream workflows that cannot run
+# here, so they stop producing false-positive failures in the Actions tab.
+#
+# Everything listed needs OpenAI-only infrastructure: self-hosted runner groups
+# (<repo>-runners, <repo>-windows-x64, <repo>-linux-x64-xl), paid macOS runners,
+# a BuildBuddy remote cache, code-signing / notarization secrets, an OpenAI API
+# key for the issue bots, or publishing credentials (R2, PyPI, winget).
+#
+# This is a repository setting, not a code change, so it survives upstream
+# merges but must be re-run if upstream adds new infra-bound workflows. It is
+# reversible with `gh workflow enable <file>`. The PR gate itself
+# (blocking-ci.yml) is trimmed in the workflow file instead; see docs/fork-ci.md.
+#
+# Usage: scripts/fork-ci-disable.sh [owner/repo]   (needs a logged-in `gh`)
+set -eu
+repo="${1:-JSBtechnologies/codex}"
+
+disable=(
+  postmerge-ci.yml                       # push to main -> rust-ci-full on self-hosted runners + v8-canary
+  rust-ci-full.yml                       # also has its own push trigger; 32 self-hosted runner references
+  v8-canary.yml                          # pull_request -> Bazel via BuildBuddy
+  rust-release.yml                       # upstream release: self-hosted runners, signing, R2, winget
+  rust-release-windows.yml               # upstream Windows release: self-hosted + Azure signing
+  rust-release-provisioned-macos.yml     # upstream macOS release: notarization secrets
+  rusty-v8-release.yml                   # upstream V8 prebuilt publishing (BuildBuddy)
+  python-sdk-release.yml                 # PyPI publishing
+  python-sdk-cli-release.yml             # PyPI publishing
+  python-runtime-release.yml             # upstream runtime publishing
+  issue-deduplicator.yml                 # needs CODEX_OPENAI_API_KEY
+  issue-labeler.yml                      # needs CODEX_OPENAI_API_KEY
+  issue-translator.yml                   # needs CODEX_OPENAI_API_KEY
+  close-stale-contributor-prs.yml        # upstream contributor-PR policy
+  cla.yml                                # upstream CLA assistant
+)
+
+for wf in "${disable[@]}"; do
+  if gh workflow disable "$wf" --repo "$repo" 2>/dev/null; then
+    echo "disabled  $wf"
+  else
+    echo "skipped   $wf (not found or already disabled)"
+  fi
+done
+
+echo
+echo "Still enabled (expected: blocking-ci and the reusable workflows it calls, plus fork-release):"
+gh workflow list --repo "$repo" --json name,path,state --jq '.[] | select(.state == "active") | "  " + .path'