Tools
Codex pins V8 release manifest digests in-repo and stops its own release workflow from overwriting published assets
openai/codex#43444 (merged 2026-09-07T11:57Z) records trusted digests for the V8 150.4.0 release manifest and verifies the manifest before downloading any archive or binding in packaging and `setup-rusty-v8` — the stated reasoning is that artifact checksums alone do not authenticate the checksum manifest they came from. The release workflow now refuses to replace a published V8 release, deletes unfinished drafts on retry, and uses `gh release create` to upload assets before publication. Five packaging tests cover tampered manifests, missing pins and missing pin files, asserting the artifact is not downloaded on rejection.
Source
↳ Follow the thread