Skip to content

fix(runtime): pin codex setup to rust-v0.118.0 for security #663

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sergio-sisternes-epam merged 2 commits into from
Apr 10, 2026
+14 −5
Merged

fix(runtime): pin codex setup to rust-v0.118.0 for security #663

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f0fc20d
fix(runtime): pin codex setup to rust-v0.118.0 for security (#662)
Apr 10, 2026
e1950cd
fix: address Copilot review feedback (#663)
Apr 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Fixed

- Pin codex setup to `rust-v0.118.0` for security and reproducibility; update config to `wire_api = "responses"` (#663)
- Propagate headers and environment variables through OpenCode MCP adapter with defensive copies to prevent mutation (#622)
### Changed

Expand Down
2 changes: 1 addition & 1 deletion docs/src/content/docs/integrations/runtime-compatibility.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,7 +83,7 @@ apm runtime setup codex
```

This automatically:
- Downloads the latest Codex binary for your platform
- Downloads Codex binary `rust-v0.118.0` for your platform (override with `--version`)
- Installs to `~/.apm/runtimes/codex`
- Creates configuration for GitHub Models (`github/gpt-4o`)
- Updates your PATH
Expand Down
8 changes: 6 additions & 2 deletions scripts/runtime/setup-codex.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,11 @@
# Setup script for Codex runtime (Windows)
# Downloads Codex binary from GitHub releases and configures with GitHub Models

# Pin to a known stable release for security and reproducibility (#662).
# Users can override with: apm runtime setup codex --version <version> (e.g. 'latest')
param(
[switch]$Vanilla,
[string]$Version = "latest"
[string]$Version = "rust-v0.118.0"
Comment thread
sergio-sisternes-epam marked this conversation as resolved.
)

$ErrorActionPreference = "Stop"
Expand Down Expand Up @@ -161,10 +163,12 @@ model = "openai/gpt-4o"
name = "GitHub Models"
base_url = "https://models.github.ai/inference/"
env_key = "$githubTokenVar"
wire_api = "chat"
wire_api = "responses"
"@ | Set-Content -Path $codexConfig -Encoding UTF8

Write-Success "Codex configuration created at $codexConfig"
Write-Info "Using Codex $Version."
Write-Info "Override with: apm runtime setup codex --version <version> (e.g. 'latest')"
} else {
Write-Info "Vanilla mode: Skipping APM configuration"
}
Expand Down
8 changes: 6 additions & 2 deletions scripts/runtime/setup-codex.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,9 @@ source "$SCRIPT_DIR/setup-common.sh"

# Configuration
CODEX_REPO="openai/codex"
CODEX_VERSION="latest" # Default version
# Pin to a known stable release for security and reproducibility (#662).
# Users can override with: apm runtime setup codex --version <version> (e.g. 'latest')
CODEX_VERSION="rust-v0.118.0"
Comment thread
sergio-sisternes-epam marked this conversation as resolved.
Comment thread
sergio-sisternes-epam marked this conversation as resolved.
VANILLA_MODE=false

# Parse command line arguments
Expand Down Expand Up @@ -204,10 +206,12 @@ model = "openai/gpt-4o"
name = "GitHub Models"
base_url = "https://models.github.ai/inference/"
env_key = "$github_token_var"
wire_api = "chat"
wire_api = "responses"
EOF

log_success "Codex configuration created at $codex_config"
log_info "Using Codex $CODEX_VERSION."
log_info "Override with: apm runtime setup codex --version <version> (e.g. 'latest')"
log_info "APM configured Codex with GitHub Models as default provider"
log_info "Use 'apm install' to configure MCP servers for your projects"
else
Expand Down
Loading