Skip to content

chore(release): 0.8.0 - #2030

Merged
kmbroai merged 34 commits into
mainfrom
release/next-0.7.0
Oct 28, 2026
Merged

kmbroai merged 34 commits into
mainfrom
release/next-0.7.0

Conversation

@github-actions

@github-actions github-actions Bot commented Oct 26, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Prepare @openai/codex-security@0.8.0. This release adds OpenGrep report support, improves recovery of saved scans, and changes the scan result contract.

Changes

Update the SDK and Action versions, the standalone workflow's CLI version, the release notes, and the rolling proposal state. The release workflow will pin the Action runtime to the published CLI.

Testing

Validated the release notes with the repository’s release parser on Node 22 and ran git diff --check. All 65 source CI jobs passed on e0e01ac2, including the package, cross-platform installation, and Action checks. Codex code and security reviews completed on the same commit.

Risk and rollout

Consumers of scan results should read review instead of coverage. Draft inputs use reviewState, and the SDK no longer exposes coveragePath. New scans do not write coverage.json. Older saved scans remain readable. See the migration details.

Squash-merging starts CI on the release commit. A successful run permits tag creation, package verification, and protected npm publication. The standalone example requires the new version to be available on npm.

Public disclosure review

  • No customer, partner, prospect, or user identities, data, or identifying details are included.
  • No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
  • I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

@github-actions

Copy link
Copy Markdown
Contributor Author

Release proposal updated through main commit 9d6d7a060f66bf0401c190b30d23f3c26871c997.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

No release highlights have been drafted yet.

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head bdc01a9.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 26, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-28T01:56:21.271661Z e0e01ac Manual request
🔒 Security Review ✅ Completed 2026-10-28T01:56:46.227663Z e0e01ac New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector

Copy link
Copy Markdown

@github-actions

Copy link
Copy Markdown
Contributor Author

Release proposal updated through main commit c1db06a96737969e4bf63849760198b6a8685250.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

  • skip Office owner files in knowledge-base folders (#1913)
  • leave Git-ignored SECURITY.md files out of policy discovery (#1535)
  • retain pre-seal warnings across publication failures (#1907)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 204dfa7.

@chatgpt-codex-connector

Copy link
Copy Markdown

@github-actions github-actions Bot changed the title chore(release): 0.7.1 chore(release): 0.8.0 Oct 26, 2026
@github-actions

Copy link
Copy Markdown
Contributor Author

Release proposal updated through main commit 621bad47e69dc41880320259f6fa47bf293c097c.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

  • skip Office owner files in knowledge-base folders (#1913)
  • leave Git-ignored SECURITY.md files out of policy discovery (#1535)
  • retain pre-seal warnings across publication failures (#1907)
  • simplify scan completion and recovery (#1762)

Upgrade notes

Review migration steps for these breaking changes:

  • simplify scan completion and recovery (#1762)

@codex review the current head 493e089.

@chatgpt-codex-connector

Copy link
Copy Markdown

@github-actions

Copy link
Copy Markdown
Contributor Author

Release proposal updated through main commit 4620e04fde4d544eaa520a7122e0a1e18838374e.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

  • skip Office owner files in knowledge-base folders (#1913)
  • leave Git-ignored SECURITY.md files out of policy discovery (#1535)
  • retain pre-seal warnings across publication failures (#1907)
  • simplify scan completion and recovery (#1762)
  • bump fast-uri from 3.1.8 to 3.1.9 in /github-action/runtime (#1914)

Upgrade notes

Review migration steps for these breaking changes:

  • simplify scan completion and recovery (#1762)

@codex review the current head c02c161.

@chatgpt-codex-connector

Copy link
Copy Markdown

@github-actions

Copy link
Copy Markdown
Contributor Author

Release proposal updated through main commit a4ba26171a8b6b773f313cc3345c92a5313246e9.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

  • skip Office owner files in knowledge-base folders (#1913)
  • leave Git-ignored SECURITY.md files out of policy discovery (#1535)
  • retain pre-seal warnings across publication failures (#1907)
  • simplify scan completion and recovery (#1762)
  • bump fast-uri from 3.1.8 to 3.1.9 in /github-action/runtime (#1914)
  • bump fast-uri from 3.1.8 to 3.1.9 in /sdk/typescript (#2061)

Upgrade notes

Review migration steps for these breaking changes:

  • simplify scan completion and recovery (#1762)

@codex review the current head 31f5a41.

@chatgpt-codex-connector

Copy link
Copy Markdown

@github-actions

Copy link
Copy Markdown
Contributor Author

Release proposal updated through main commit a4107f2eee5e24480e80cd28608deda5ec59ae5b.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

  • skip Office owner files in knowledge-base folders (#1913)
  • leave Git-ignored SECURITY.md files out of policy discovery (#1535)
  • retain pre-seal warnings across publication failures (#1907)
  • simplify scan completion and recovery (#1762)
  • bump fast-uri from 3.1.8 to 3.1.9 in /github-action/runtime (#1914)
  • bump fast-uri from 3.1.8 to 3.1.9 in /sdk/typescript (#2061)
  • bump fast-uri from 3.1.8 to 3.1.9 in /plugins/codex-security/mcp-app (#2062)
  • bump fast-uri from 3.1.8 to 3.1.9 in /evals/triage-finding (#2063)
  • stop source excerpts at the end of the file (#2015)
  • update @inquirer/prompts to 8.7.4 in the SDK (#2072)
  • request fields when reading back GitHub issues (#2048)

Upgrade notes

Review migration steps for these breaking changes:

  • simplify scan completion and recovery (#1762)

@codex review the current head 1df9d12.

@chatgpt-codex-connector

Copy link
Copy Markdown

@github-actions

Copy link
Copy Markdown
Contributor Author

Release proposal updated through main commit e2e8c0cb193cd735888521bb87569013922ff58a.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

  • skip Office owner files in knowledge-base folders (#1913)
  • leave Git-ignored SECURITY.md files out of policy discovery (#1535)
  • retain pre-seal warnings across publication failures (#1907)
  • simplify scan completion and recovery (#1762)
  • bump fast-uri from 3.1.8 to 3.1.9 in /github-action/runtime (#1914)
  • bump fast-uri from 3.1.8 to 3.1.9 in /sdk/typescript (#2061)
  • bump fast-uri from 3.1.8 to 3.1.9 in /plugins/codex-security/mcp-app (#2062)
  • bump fast-uri from 3.1.8 to 3.1.9 in /evals/triage-finding (#2063)
  • stop source excerpts at the end of the file (#2015)
  • update @inquirer/prompts to 8.7.4 in the SDK (#2072)
  • request fields when reading back GitHub issues (#2048)
  • resume deep scans after clearing their instructions (#2049)
  • read completed scan artifacts after checkout removal (#2050)
  • skip container builds for SDK test-only pull requests (#2069)

Upgrade notes

Review migration steps for these breaking changes:

  • simplify scan completion and recovery (#1762)

@codex review the current head 4916850.

@chatgpt-codex-connector

Copy link
Copy Markdown

@github-actions

Copy link
Copy Markdown
Contributor Author

Release proposal updated through main commit 6b2d0416e8cb86176224a6a1adc7ccb1dfb31239.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

  • skip Office owner files in knowledge-base folders (#1913)
  • leave Git-ignored SECURITY.md files out of policy discovery (#1535)
  • retain pre-seal warnings across publication failures (#1907)
  • simplify scan completion and recovery (#1762)
  • bump fast-uri from 3.1.8 to 3.1.9 in /github-action/runtime (#1914)
  • bump fast-uri from 3.1.8 to 3.1.9 in /sdk/typescript (#2061)
  • bump fast-uri from 3.1.8 to 3.1.9 in /plugins/codex-security/mcp-app (#2062)
  • bump fast-uri from 3.1.8 to 3.1.9 in /evals/triage-finding (#2063)
  • stop source excerpts at the end of the file (#2015)
  • update @inquirer/prompts to 8.7.4 in the SDK (#2072)
  • request fields when reading back GitHub issues (#2048)
  • resume deep scans after clearing their instructions (#2049)
  • read completed scan artifacts after checkout removal (#2050)
  • skip container builds for SDK test-only pull requests (#2069)
  • clarify recovery for historical scan entries (#2027)

Upgrade notes

Review migration steps for these breaking changes:

  • simplify scan completion and recovery (#1762)

@codex review the current head 25962e2.

@chatgpt-codex-connector

Copy link
Copy Markdown

@github-actions

Copy link
Copy Markdown
Contributor Author

Release proposal updated through main commit 1c98d9556fa3fbece5a019a77463850b28f4d554.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

  • skip Office owner files in knowledge-base folders (#1913)
  • leave Git-ignored SECURITY.md files out of policy discovery (#1535)
  • retain pre-seal warnings across publication failures (#1907)
  • simplify scan completion and recovery (#1762)
  • bump fast-uri from 3.1.8 to 3.1.9 in /github-action/runtime (#1914)
  • bump fast-uri from 3.1.8 to 3.1.9 in /sdk/typescript (#2061)
  • bump fast-uri from 3.1.8 to 3.1.9 in /plugins/codex-security/mcp-app (#2062)
  • bump fast-uri from 3.1.8 to 3.1.9 in /evals/triage-finding (#2063)
  • stop source excerpts at the end of the file (#2015)
  • update @inquirer/prompts to 8.7.4 in the SDK (#2072)
  • request fields when reading back GitHub issues (#2048)
  • resume deep scans after clearing their instructions (#2049)
  • read completed scan artifacts after checkout removal (#2050)
  • skip container builds for SDK test-only pull requests (#2069)
  • clarify recovery for historical scan entries (#2027)
  • add a local Wolfi build for Linux amd64 (#2053)

Upgrade notes

Review migration steps for these breaking changes:

  • simplify scan completion and recovery (#1762)

@codex review the current head 0b1d656.

@chatgpt-codex-connector

Copy link
Copy Markdown

@github-actions

Copy link
Copy Markdown
Contributor Author

Release proposal updated through main commit 0fb953b0f54234888a3514160efe26de2cc801fe.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

  • skip Office owner files in knowledge-base folders (#1913)
  • leave Git-ignored SECURITY.md files out of policy discovery (#1535)
  • retain pre-seal warnings across publication failures (#1907)
  • simplify scan completion and recovery (#1762)
  • bump fast-uri from 3.1.8 to 3.1.9 in /github-action/runtime (#1914)
  • bump fast-uri from 3.1.8 to 3.1.9 in /sdk/typescript (#2061)
  • bump fast-uri from 3.1.8 to 3.1.9 in /plugins/codex-security/mcp-app (#2062)
  • bump fast-uri from 3.1.8 to 3.1.9 in /evals/triage-finding (#2063)
  • stop source excerpts at the end of the file (#2015)
  • update @inquirer/prompts to 8.7.4 in the SDK (#2072)
  • request fields when reading back GitHub issues (#2048)
  • resume deep scans after clearing their instructions (#2049)
  • read completed scan artifacts after checkout removal (#2050)
  • skip container builds for SDK test-only pull requests (#2069)
  • clarify recovery for historical scan entries (#2027)
  • add a local Wolfi build for Linux amd64 (#2053)
  • continue hosted reviews after a missing submission (#2090)

Upgrade notes

Review migration steps for these breaking changes:

  • simplify scan completion and recovery (#1762)

@codex review the current head 5c5a04b.

@chatgpt-codex-connector

Copy link
Copy Markdown

@github-actions

Copy link
Copy Markdown
Contributor Author

Release proposal updated through main commit 5523afdec0bee4574f76b81d890d469ac6613f4c.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

  • skip Office owner files in knowledge-base folders (#1913)
  • leave Git-ignored SECURITY.md files out of policy discovery (#1535)
  • retain pre-seal warnings across publication failures (#1907)
  • simplify scan completion and recovery (#1762)
  • bump fast-uri from 3.1.8 to 3.1.9 in /github-action/runtime (#1914)
  • bump fast-uri from 3.1.8 to 3.1.9 in /sdk/typescript (#2061)
  • bump fast-uri from 3.1.8 to 3.1.9 in /plugins/codex-security/mcp-app (#2062)
  • bump fast-uri from 3.1.8 to 3.1.9 in /evals/triage-finding (#2063)
  • stop source excerpts at the end of the file (#2015)
  • update @inquirer/prompts to 8.7.4 in the SDK (#2072)
  • request fields when reading back GitHub issues (#2048)
  • resume deep scans after clearing their instructions (#2049)
  • read completed scan artifacts after checkout removal (#2050)
  • skip container builds for SDK test-only pull requests (#2069)
  • clarify recovery for historical scan entries (#2027)
  • add a local Wolfi build for Linux amd64 (#2053)
  • continue hosted reviews after a missing submission (#2090)
  • count Cloud request bytes without reserializing batches (#2079)
  • avoid redundant SQLite reads and parsing on replay (#2083)
  • map scanner evidence and test cross-provider replay (#2080)
  • distinguish Snyk evidence changes from finding edits (#2081)
  • support OpenGrep reports locally and in Cloud (#1872)

Upgrade notes

Review migration steps for these breaking changes:

  • simplify scan completion and recovery (#1762)

@codex review the current head 4c7b979.

@chatgpt-codex-connector

Copy link
Copy Markdown

@kmbroai

kmbroai commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator

@codex review the release proposal at 4c7b979.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4c7b979a15

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread .github/release-notes.md Outdated
Comment thread .github/release-notes.md Outdated
@kmbroai

kmbroai commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator

@codex review e0e01ac. The release notes now summarize OpenGrep and recovery changes and document the SDK, JSON, and Action migration.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: e0e01ac2e4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@github-actions github-actions Bot added the skip-release-notes Omit internal changes from generated release notes label Oct 28, 2026
@kmbroai
kmbroai merged commit 71bd7ae into main Oct 28, 2026
91 checks passed
@kmbroai
kmbroai deleted the release/next-0.7.0 branch October 28, 2026 02:14
@github-actions

github-actions Bot commented Oct 28, 2026 •

Copy link
Copy Markdown
Contributor Author

Release progress

Stage Status Details
Post-merge CI Passed View run
npm release status Passed View run
Release verification Passed View run
Protected npm publication Passed View run
Start GitHub publication Passed View run
Public npm package and provenance Passed View run
Published installation checks Passed View run
GitHub Action Passed View run
Container image Waiting for container approval View run
Final release status Waiting for approval View run

Approve the protected container deployment in the linked release run.
GitHub Marketplace publication is a separate manual step.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

skip-release-notes Omit internal changes from generated release notes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant