Skip to content

fix(runtime): pin codex setup to rust-v0.118.0 for security #663

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sergio-sisternes-epam merged 2 commits into from
Apr 10, 2026
Merged

fix(runtime): pin codex setup to rust-v0.118.0 for security #663

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f0fc20d
fix(runtime): pin codex setup to rust-v0.118.0 for security (#662)
Apr 10, 2026
e1950cd
fix: address Copilot review feedback (#663)
Apr 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Fixed

- Pin codex setup to `rust-v0.118.0` for security and reproducibility; update config to `wire_api = "responses"` (#662)
Comment thread
sergio-sisternes-epam marked this conversation as resolved.
Outdated
- Propagate headers and environment variables through OpenCode MCP adapter with defensive copies to prevent mutation (#622)
### Changed

Expand Down
8 changes: 6 additions & 2 deletions scripts/runtime/setup-codex.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,11 @@
# Setup script for Codex runtime (Windows)
# Downloads Codex binary from GitHub releases and configures with GitHub Models

# Pin to a known stable release for security and reproducibility (#662).
# Users can override with: apm runtime setup codex -Version <version> (e.g. 'latest')
param(
[switch]$Vanilla,
[string]$Version = "latest"
[string]$Version = "rust-v0.118.0"
Comment thread
sergio-sisternes-epam marked this conversation as resolved.
)

$ErrorActionPreference = "Stop"
Expand Down Expand Up @@ -161,10 +163,12 @@ model = "openai/gpt-4o"
name = "GitHub Models"
base_url = "https://models.github.ai/inference/"
env_key = "$githubTokenVar"
wire_api = "chat"
wire_api = "responses"
"@ | Set-Content -Path $codexConfig -Encoding UTF8

Write-Success "Codex configuration created at $codexConfig"
Write-Info "Codex is pinned to $Version for reproducibility."
Write-Info "To use a different version, run: apm runtime setup codex -Version <version> (e.g. 'latest')"
Comment thread
sergio-sisternes-epam marked this conversation as resolved.
Outdated
} else {
Write-Info "Vanilla mode: Skipping APM configuration"
}
Expand Down
8 changes: 6 additions & 2 deletions scripts/runtime/setup-codex.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,9 @@ source "$SCRIPT_DIR/setup-common.sh"

# Configuration
CODEX_REPO="openai/codex"
CODEX_VERSION="latest" # Default version
# Pin to a known stable release for security and reproducibility (#662).
# Users can override with: apm runtime setup codex <version> (e.g. 'latest')
CODEX_VERSION="rust-v0.118.0"
Comment thread
sergio-sisternes-epam marked this conversation as resolved.
Comment thread
sergio-sisternes-epam marked this conversation as resolved.
VANILLA_MODE=false

# Parse command line arguments
Expand Down Expand Up @@ -204,10 +206,12 @@ model = "openai/gpt-4o"
name = "GitHub Models"
base_url = "https://models.github.ai/inference/"
env_key = "$github_token_var"
wire_api = "chat"
wire_api = "responses"
EOF

log_success "Codex configuration created at $codex_config"
log_info "Codex is pinned to $CODEX_VERSION for reproducibility."
log_info "To use a different version, run: apm runtime setup codex <version> (e.g. 'latest')"
Comment thread
sergio-sisternes-epam marked this conversation as resolved.
Outdated
log_info "APM configured Codex with GitHub Models as default provider"
log_info "Use 'apm install' to configure MCP servers for your projects"
else
Expand Down
Loading