release: bump Codex Security to 0.1.5

[mldangelo-oai]

Summary

• Bump @openai/codex-security from 0.1.4 to 0.1.5 with a one-line manifest change on the current main; preserve the frozen dependency lockfile and protected, provenance-enabled release workflows.
• Ship the 16 commits merged since npm-v0.1.4, including:
  • Private scan output and contributor/runtime security hardening (#118, #152).
  • Resilient finding recovery and actionable missing-artifact/first-scan errors (#83, #159, #167).
  • Nested Git snapshot support, scan comparison matching, clearer scan errors, and polished completion summaries (#113, #114, #115, #116).
  • Verified automated npm/GitHub releases and safe historical release backfills (#91, #165, #166).
  • Protected multi-architecture container publication, manifest verification, and registry-attestation hardening (#17, #161, #162, #163).

Validation

• Confirmed main and the latest public GitHub release are 0.1.4, with no competing 0.1.5 release PR or npm-v0.1.5 tag.
• pnpm install --frozen-lockfile --offline: passed; all 95 locked dependencies restored without changing the lockfile.
• pnpm run types: passed.
• pnpm run format: passed.
• bun test --timeout 30000 ./tests-ts: 706 passed, 5 expected platform/integration skips, 0 failures across 32 files.
• pnpm run build: passed.
• Release automation accepts the stable package version, the 0.1.4 → 0.1.5 increase, and the exact npm-v0.1.5 tag.
• Packed openai-codex-security-0.1.5.tgz using the protected release workflow's exact gitHead stamping procedure for commit 3187364e5aa0d43fc25d47e111e87c1e8d472acc; the temporary stamp is not included in this PR.
• Exact-commit check:package: 179 validated archive entries, matching release provenance, all 95 bundled plugin files, and a fresh-install SDK/CLI smoke.
• Independent pnpm run test:package -- /private/tmp/codex-security-release-0.1.5/openai-codex-security-0.1.5.tgz: passed, including the public SDK import and installed CLI.
• Validated artifact SHA-256: e74ea6b9155e7eec3afe798f17c7e6e92d6da30746dae1f2d6cec3db9130295f.

Release

After review and merge, the existing node-release-cut workflow observes the version change on main, creates npm-v0.1.5 on the exact merged commit, and dispatches the protected, provenance-enabled node-release workflow. Publication still depends on the protected npm release environment and its verification gates; opening this PR does not publish the package.

[mldangelo-oai]

@codex review Please review the exact current release head 3187364, focusing on the one-file 0.1.4 to 0.1.5 version bump, unchanged frozen lockfile, automated main-only release tag, and protected provenance-enabled npm publishing contract.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: 3187364e5a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 3187364e5a

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.