fix: harden npm package lifecycle and Node support by mldangelo-oai · Pull Request #104 · openai/codex-security

mldangelo-oai · 2026-07-29T21:43:13Z

Summary

Build the distributable SDK and CLI automatically before either npm pack or pnpm pack, so a clean checkout cannot produce an npm tarball missing dist.
Use Node's native script runner for both build and prepack, so packaging does not require pnpm, npm, or Corepack to already exist on PATH.
Declare only the Node.js release lines actually supported and tested: Node 22.13.0 or later within 22.x, Node 24.x, and Node 26.x.
Run the exact Node 22.13.0 minimum on Linux, macOS, and Windows while retaining the repository's protected node-22 status-check names.
Test both the exact 24.0.0 and 26.0.0 minimums and the latest 24.x and 26.x releases without discarding the latest-version coverage from main.
Add a high-severity production dependency audit to pull-request CI and the Socket Firewall-protected release verification job.
Add failing-first regression coverage for the complete supported Node matrix, protected status-check identities, the package-manager-independent prepack lifecycle, and the production audit command.

Main merge and review feedback

Merged current main without discarding its managed-credential changes, protected Node 22 check identities, immutable action pins, package-manager caching, latest Node 24 and Node 26 coverage, Windows package-smoke timeout protections, or protected release and provenance safeguards.

Addressed every actionable Copilot and Codex review comment:

Test the exact advertised Node 22.13.0 minimum on every supported operating system.
Preserve all three existing branch-protected node-22 checks.
Pin dedicated Linux jobs to the exact advertised Node 24.0.0 and 26.0.0 minimums.
Preserve separate Linux jobs covering the latest Node 24.x and 26.x releases.
Run the production audit against the correctly pinned Node 22.13.0 Linux job.
Restrict the engine range to the tested Node 22, 24, and 26 release lines, excluding too-old Node 22 and unsupported odd-numbered majors.
Name and behavior-test the supported release contract, CI matrix, and protected-check names without promising unknown future majors.
Keep both public READMEs aligned with the actual manifest and CI coverage.
Make both package lifecycles work without preinstalled pnpm or Corepack, including on Node 26, and regression-test the native build commands.

Validation

Full Bun test suite: 468 passed, 6 expected platform/integration skips, 0 failed.
Confirmed the strengthened lifecycle, minimum-version, and protected-check regressions fail against the prior implementations and pass with their fixes.
Verified the three required CI contexts against the repository's effective main branch-protection rules.
Frozen-lockfile install with the existing, unchanged lockfile.
Generated-model verification, TypeScript checking, and lint.
Package, root README, and all affected GitHub workflow formatting checks.
Production-only and full dependency audits: no known vulnerabilities.
Standard npm pack with pnpm, npm, and Corepack unavailable on PATH; verified all 179 expected tarball entries.
Standard pnpm pack; independently verified all 179 expected tarball entries.
Native clean builds and fresh installed SDK, CLI, and all 95 bundled plugin files on the exact minimum versions Node 22.13.0, 24.0.0, and 26.0.0.
Complete tarball, package-contract, and provenance-boundary verification.
actionlint for the Node CI, protected Node release, and container workflows.
git diff --check; no unresolved merge-conflict paths.

mldangelo-oai · 2026-07-29T22:12:41Z

@codex review

Please review the clean-checkout npm/pnpm prepack lifecycle and complete tarball contents, the Node 22.13.0 minimum and Node 22/24 compatibility matrix, the high-severity production dependency audit in PR and release CI, and preservation of Socket Firewall, release provenance, artifact validation, and trusted-publishing security boundaries.

Copilot

Pull request overview

This PR hardens the TypeScript SDK/CLI packaging and CI expectations by aligning declared Node.js support with actual dependency requirements, ensuring packages build before pack, and adding a production-only vulnerability audit to CI/release verification.

Changes:

Tighten the declared minimum Node.js engine to >=22.13.0 and update both READMEs accordingly.
Add prepack and audit:prod scripts to make npm/pnpm pack self-contained and enforce high-severity production audits.
Expand CI to keep Node 22 coverage across OSes while adding a focused Linux Node 24 job, plus audit steps in CI and release verification.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
sdk/typescript/tests-ts/skeleton.test.ts	Adds regression tests for Node engine range and packaging/audit scripts.
sdk/typescript/README.md	Updates documented minimum Node.js requirement to 22.13.0.
sdk/typescript/package.json	Sets `engines.node` to `>=22.13.0`; adds `audit:prod` and `prepack`.
README.md	Updates documented minimum Node.js requirement to 22.13.0.
.github/workflows/node-release.yml	Adds production dependency audit to release verification flow.
.github/workflows/node-ci.yml	Introduces Node version matrix (Node 22 across OSes + Node 24 on Linux) and adds prod audit step in PR CI.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a3d1fea047

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

ianw-oai

Looks good. Node support, package creation, and the production dependency audit are covered.

mldangelo-oai · 2026-07-29T23:53:02Z

@codex review

Please review the updated head 4da57f3d6ef02732309daef19a4e98a67295d906 after merging current main. Focus on the exact Node.js 22.13.0 minimum across Linux, macOS, and Windows; explicit and actually tested Node 22, 24, and 26 engine support; the production audit and protected-release boundary; clean-checkout packaging; and preservation of main's Node 26 coverage, Windows package-smoke protections, immutable action pins, and release provenance.

chatgpt-codex-connector · 2026-07-29T23:54:57Z

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: 4da57f3d6e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

sdk/typescript/tests-ts/skeleton.test.ts:66

If prepack is switched to use Corepack (so npm pack works without pnpm preinstalled), this assertion should be updated to match the new command string.

    expect(packageJson.scripts.prepack).toBe("pnpm run build");
    expect(packageJson.scripts["audit:prod"]).toBe(
      "pnpm audit --prod --audit-level high",
    );

mldangelo-oai · 2026-07-30T00:00:33Z

@codex review

Please review the final head 2856cd8c89883325a9052ed9b0722a3f18ba9305, including the follow-up addressing Copilot's packaging finding. In particular, verify the Node-native, package-manager-independent build and prepack lifecycle on Node 22.13.0, 24.0.0, and 26.0.0; exact-minimum cross-platform CI; bounded 22/24/26 engine support; the production audit; and preservation of the merged Windows smoke, Socket Firewall, protected-publishing, and release-provenance safeguards.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2856cd8c89

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

mldangelo-oai · 2026-07-30T00:07:36Z

@codex review

Please review current head 9a7520e19f388b28d8d88815bda3556022b9f2e5, especially the fixes for both previous review rounds: exact Node 22.13.0 coverage on all three operating systems; dedicated Node 24.0.0 and 26.0.0 minimum-version jobs; preserved latest Node 24.x and 26.x jobs; regression coverage for the whole matrix; package-manager-independent Node-native build and prepack; and the existing production audit, Windows package smoke, Socket Firewall, and release-provenance protections.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

chatgpt-codex-connector · 2026-07-30T00:09:34Z

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 9a7520e19f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

mldangelo-oai · 2026-07-30T00:14:48Z

@codex review

Please review current head a75ed5c3ba47e893ff9d4e17bcaa17fdad2c5ee6, including the final branch-protection fix. Verify that Linux, macOS, and Windows retain their required node-22 check names while actually running Node 22.13.0; that dedicated 24.0.0 and 26.0.0 minimum jobs preserve the latest 24.x/26.x coverage; and that regression tests, package-manager-independent prepack, protected publishing, Windows smoke, Socket Firewall, and release provenance are intact.

chatgpt-codex-connector · 2026-07-30T00:16:49Z

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: a75ed5c3ba

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

fix: harden npm package lifecycle and Node support

a3d1fea

mldangelo-oai marked this pull request as ready for review July 29, 2026 21:50

mldangelo-oai requested a review from Copilot July 29, 2026 22:12

Copilot started reviewing on behalf of mldangelo-oai July 29, 2026 22:13 View session

Copilot AI reviewed Jul 29, 2026

View reviewed changes

Comment thread sdk/typescript/tests-ts/skeleton.test.ts Outdated

Comment thread .github/workflows/node-ci.yml Outdated

Comment thread .github/workflows/node-ci.yml Outdated

chatgpt-codex-connector Bot reviewed Jul 29, 2026

View reviewed changes

Comment thread .github/workflows/node-ci.yml Outdated

Comment thread sdk/typescript/package.json Outdated

ianw-oai previously approved these changes Jul 29, 2026

View reviewed changes

merge: resolve main conflicts and address package review

4da57f3

mldangelo-oai dismissed ianw-oai’s stale review via 4da57f3 July 29, 2026 23:51

mldangelo-oai requested a review from Copilot July 29, 2026 23:52

Copilot started reviewing on behalf of mldangelo-oai July 29, 2026 23:53 View session

Copilot AI reviewed Jul 29, 2026

View reviewed changes

Comment thread sdk/typescript/package.json

fix: make npm package lifecycle package-manager agnostic

2856cd8

mldangelo-oai requested a review from Copilot July 30, 2026 00:00

Copilot started reviewing on behalf of mldangelo-oai July 30, 2026 00:00 View session

Copilot AI reviewed Jul 30, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Jul 30, 2026

View reviewed changes

Comment thread sdk/typescript/package.json

fix: test every supported minimum Node.js version

9a7520e

mldangelo-oai requested a review from Copilot July 30, 2026 00:07

Copilot started reviewing on behalf of mldangelo-oai July 30, 2026 00:07 View session

Copilot AI reviewed Jul 30, 2026

View reviewed changes

fix: preserve required Node CI status checks

a75ed5c

mldangelo-oai requested a review from Copilot July 30, 2026 00:14

Copilot started reviewing on behalf of mldangelo-oai July 30, 2026 00:15 View session

zcrab-oai approved these changes Jul 30, 2026

View reviewed changes

Copilot AI reviewed Jul 30, 2026

View reviewed changes

mldangelo-oai merged commit 3e863a7 into main Jul 30, 2026
9 checks passed

mldangelo-oai deleted the mdangelo/codex/package-manifest-hardening branch July 30, 2026 00:19

Uh oh!

Conversation

mldangelo-oai commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Main merge and review feedback

Validation

Uh oh!

mldangelo-oai commented Jul 29, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

ianw-oai left a comment

Choose a reason for hiding this comment

Uh oh!

mldangelo-oai commented Jul 29, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 29, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

mldangelo-oai commented Jul 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

mldangelo-oai commented Jul 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

chatgpt-codex-connector Bot commented Jul 30, 2026

Uh oh!

mldangelo-oai commented Jul 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

mldangelo-oai commented Jul 29, 2026 •

edited

Loading