build(deps): bump webbrowser from 1.0.6 to 1.2.0 in /codex-rs

.bazelrc

@@ -136,6 +136,16 @@ common:ci-linux --config=remote
 common:ci-linux --strategy=remote
 common:ci-linux --platforms=//:rbe
 
+# Fork-only Linux jobs that must stay on Bazel but cannot rely on BuildBuddy
+# remote execution should use this explicit local variant instead of trying to
+# partially undo `ci-linux` at the callsite.
+common:ci-linux-local --config=ci-bazel
+common:ci-linux-local --build_metadata=TAG_os=linux
+common:ci-linux-local --extra_execution_platforms=
+common:ci-linux-local --platforms=//:local_linux
+common:ci-linux-local --spawn_strategy=local
+common:ci-linux-local --strategy=local
+
 # On mac, we can run all the build actions remotely but test actions locally.
 common:ci-macos --config=ci-bazel
 common:ci-macos --build_metadata=TAG_os=macos

.github/scripts/run-bazel-ci.sh

@@ -65,6 +65,11 @@ case "${RUNNER_OS:-}" in
     ;;
 esac
 
+force_local_ci_config=
+if [[ "${RUNNER_OS:-}" == "Linux" ]]; then
+  force_local_ci_config=ci-linux-local
+fi
+
 print_bazel_test_log_tails() {
   local console_log="$1"
   local testlogs_dir
@@ -210,7 +215,29 @@ if (( ${#bazel_startup_args[@]} > 0 )); then
   bazel_cmd+=("${bazel_startup_args[@]}")
 fi
 
-if [[ -n "${BUILDBUDDY_API_KEY:-}" ]]; then
+if [[ "${CODEX_BAZEL_FORCE_LOCAL:-0}" == "1" ]]; then
+  echo "CODEX_BAZEL_FORCE_LOCAL=1; using local Bazel configuration."
+  bazel_run_args=(
+    "${bazel_args[@]}"
+    --remote_cache=
+    --remote_executor=
+  )
+  if [[ -n "${force_local_ci_config}" ]]; then
+    bazel_run_args+=("--config=${force_local_ci_config}")
+  fi
+  if (( ${#post_config_bazel_args[@]} > 0 )); then
+    bazel_run_args+=("${post_config_bazel_args[@]}")
+  fi
+  set +e
+  run_bazel "${bazel_cmd[@]:1}" \
+    --noexperimental_remote_repo_contents_cache \
+    "${bazel_run_args[@]}" \
+    -- \
+    "${bazel_targets[@]}" \
+    2>&1 | tee "$bazel_console_log"
+  bazel_status=${PIPESTATUS[0]}
+  set -e
+elif [[ -n "${BUILDBUDDY_API_KEY:-}" ]]; then
   echo "BuildBuddy API key is available; using remote Bazel configuration."
   # Work around Bazel 9 remote repo contents cache / overlay materialization failures
   # seen in CI (for example "is not a symlink" or permission errors while

.github/workflows/ci.yml

@@ -37,6 +37,7 @@ jobs:
       - uses: facebook/install-dotslash@1e4e7b3e07eaca387acb98f1d4720e0bee8dbb6a # v2
 
       - name: Stage npm package
+        if: ${{ github.repository == 'openai/codex' }}
         id: stage_npm_package
         env:
           GH_TOKEN: ${{ github.token }}
@@ -53,6 +54,7 @@ jobs:
           echo "pack_output=$PACK_OUTPUT" >> "$GITHUB_OUTPUT"
 
       - name: Upload staged npm package artifact
+        if: ${{ github.repository == 'openai/codex' }}
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         with:
           name: codex-npm-staging

.github/workflows/rust-ci.yml

@@ -134,19 +134,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - name: Linux
-            runner: ubuntu-24.04
-            timeout_minutes: 30
-          - name: macOS
-            runner: macos-15-xlarge
-            timeout_minutes: 30
-          - name: Windows
-            runner: windows-x64
-            timeout_minutes: 30
-            runs_on:
-              group: codex-runners
-              labels: codex-windows-x64
+        include: ${{ fromJSON(github.repository == 'openai/codex' && '[{"name":"Linux","runner":"ubuntu-24.04","timeout_minutes":30},{"name":"macOS","runner":"macos-15-xlarge","timeout_minutes":30},{"name":"Windows","runner":"windows-x64","timeout_minutes":30,"runs_on":{"group":"codex-runners","labels":"codex-windows-x64"}}]' || '[{"name":"Linux","runner":"ubuntu-24.04","timeout_minutes":120}]') }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: ./.github/actions/setup-bazel-ci
@@ -159,8 +147,60 @@ jobs:
         run: |
           sudo DEBIAN_FRONTEND=noninteractive apt-get update
           sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends pkg-config libcap-dev
+      - name: Run argument comment lint on codex-rs via source wrapper
+        if: ${{ runner.os == 'Linux' && github.repository != 'openai/codex' }}
+        shell: bash
+        run: |
+          heartbeat() {
+            while true; do
+              sleep 60
+              echo "argument comment lint still running via source wrapper ($(date -u '+%Y-%m-%dT%H:%M:%SZ'))"
+            done
+          }
+
+          heartbeat &
+          heartbeat_pid=$!
+          cleanup() {
+            kill "$heartbeat_pid" 2>/dev/null || true
+          }
+          trap cleanup EXIT
+
+          rustup toolchain install nightly-2025-09-18 \
+            --profile minimal \
+            --component llvm-tools-preview \
+            --component rustc-dev \
+            --component rust-src \
+            --no-self-update
+          cargo install --locked cargo-dylint dylint-link
+
+          set +e
+          timeout --foreground --signal=TERM --kill-after=30s 110m \
+            ./tools/argument-comment-lint/run.py
+          status=$?
+          set -e
+
+          if [[ $status -eq 124 ]]; then
+            echo "argument comment lint source-wrapper step exceeded 110 minutes; failing explicitly before the 120-minute job timeout so shared CI follow-up can diagnose it."
+          fi
+
+          exit "$status"
+      - name: Run argument comment lint on codex-rs via Bazel
+        if: ${{ runner.os == 'Linux' && github.repository == 'openai/codex' }}
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
+        shell: bash
+        run: |
+          bazel_targets="$(./tools/argument-comment-lint/list-bazel-targets.sh)"
+          ./.github/scripts/run-bazel-ci.sh \
+            -- \
+            build \
+            --config=argument-comment-lint \
+            --keep_going \
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA} \
+            -- \
+            ${bazel_targets}
       - name: Run argument comment lint on codex-rs via Bazel
-        if: ${{ runner.os != 'Windows' }}
+        if: ${{ runner.os == 'macOS' }}
         env:
           BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         shell: bash