chore(deps): bump openai/codex-action from 1.12 to 1.13

[dependabot]

Bumps openai/codex-action from 1.12 to 1.13.

Changelog

Sourced from openai/codex-action's changelog.

codex-action Changelog

v1.13 (2026-10-05)

• #183 preserve system service access when restricting runner sockets under Linux drop-sudo.
• Bound output draining to five seconds after Codex exits so descendants retaining log streams cannot keep the action open.
• Linux drop-sudo now requires setfacl (the acl package) and ACL support on /run.

v1.12 (2026-08-20)

• Strengthen Linux runner privilege isolation and Responses API proxy credential handling.
• Reject Codex arguments and configuration overrides that conflict with protected execution settings.
• Require unprivileged user namespaces for Linux drop-sudo; run the action after steps that need sudo, Docker, or privileged service sockets.
• Document runner requirements, permission-profile behavior, and trusted configuration boundaries.

v1.11 (2026-07-04)

• #116 keep the permission profile helper backward compatible

v1.10 (2026-07-02)

• #113 add Codex permission profile support

v1.9 (2026-06-22)

• #85 update the internal setup-node pin to v6.3.0

v1.8 (2026-04-29)

• #91 tighten what bots are allowed

v1.7 (2026-04-24)

• #89 restrict bot permission bypass

v1.6 (2026-03-16)

• #77 enable GitHub-hosted Linux bubblewrap support

v1.5 (2026-03-16)

• #74 harden shell interpolation in action workflows

v1.4 (2025-11-19)

• #58 revert #56 and use the latest stable version of Codex CLI again

v1.3 (2025-11-19)

• #56 temporarily set the default version of Codex CLI to 0.58.0

... (truncated)

Commits

• bdf19a4 docs: update changelog for v1.13 (#185)
• 66a8149 fix: preserve service access and bound log draining (#183)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T04:19:56.422107Z	9e5f95a	PR opened
🔒 Security Review	✅ Completed 2026-10-13T04:23:09.290732Z	9e5f95a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[openai-sdks]

OkTest Summary

✅ 236/236 SDK tests passed in 8.156s for Python SDK PR #4070.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	258ms
tests/chat-completions-create.test.ts	✅ Passed	270ms
tests/chat-completions-stream.test.ts	✅ Passed	212ms
tests/files-content-binary.test.ts	✅ Passed	285ms
tests/files-create-multipart.test.ts	✅ Passed	287ms
tests/files-list-pagination.test.ts	✅ Passed	115ms
tests/initialize-config.test.ts	✅ Passed	175ms
tests/instance-isolation.test.ts	✅ Passed	158ms
tests/models-list.test.ts	✅ Passed	111ms
tests/responses-background-lifecycle.test.ts	✅ Passed	393ms
tests/responses-body-method-errors.test.ts	✅ Passed	195ms
tests/responses-cancel-timeout.test.ts	✅ Passed	207ms
tests/responses-cancel.test.ts	✅ Passed	195ms
tests/responses-compact-retries.test.ts	✅ Passed	270ms
tests/responses-compact.test.ts	✅ Passed	239ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	293ms
tests/responses-create-advanced.test.ts	✅ Passed	163ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.062s
tests/responses-create-errors.test.ts	✅ Passed	178ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	218ms
tests/responses-create-retries.test.ts	✅ Passed	352ms
tests/responses-create-stream-failures.test.ts	✅ Passed	92ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	256ms
tests/responses-create-stream-wire.test.ts	✅ Passed	1.731s
tests/responses-create-stream.test.ts	✅ Passed	113ms
tests/responses-create-terminal-states.test.ts	✅ Passed	274ms
tests/responses-create-timeout.test.ts	✅ Passed	204ms
tests/responses-create.test.ts	✅ Passed	245ms
tests/responses-delete.test.ts	✅ Passed	145ms
tests/responses-input-items-errors.test.ts	✅ Passed	276ms
tests/responses-input-items-list.test.ts	✅ Passed	226ms
tests/responses-input-items-options.test.ts	✅ Passed	200ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	229ms
tests/responses-input-tokens-count.test.ts	✅ Passed	152ms
tests/responses-malformed-inputs.test.ts	✅ Passed	1.257s
tests/responses-not-found-errors.test.ts	✅ Passed	219ms
tests/responses-parse.test.ts	✅ Passed	186ms
tests/responses-retrieve-retries.test.ts	✅ Passed	244ms
tests/responses-retrieve.test.ts	✅ Passed	191ms
tests/responses-stored-method-errors.test.ts	✅ Passed	433ms
tests/retry-behavior.test.ts	✅ Passed	3.045s
tests/sdk-error-shape.test.ts	✅ Passed	266ms

View OkTest run #38345855804

_{SDK merge (e079b0289eb0) · head (9e5f95a5960e) · base (1f05e33eaca6) · OkTest (63b471b22245)}

[github-actions]

Castiron custom code

Evaluated main: 1f05e33eaca67e4a6913888aec279b66ac1db206.

✅ No new custom-code files detected.

40 mixed files remain; 0 existing customizations changed.

Compared 1f05e33eaca6 → 9e5f95a5960e. Generated baselines verified.

40 existing customizations unchanged

• api.md
• scripts/castiron/custom_code_budget.py
• scripts/castiron/test_custom_code_github.py
• scripts/castiron/test_custom_code_publication.py
• scripts/castiron/test_custom_code_report.py
• src/openai/init.py
• src/openai/_client.py
• src/openai/resources/audio/transcriptions.py
• src/openai/resources/audio/translations.py
• src/openai/resources/beta/agents/environments/files.py
• src/openai/resources/beta/agents/sessions/artifacts.py
• src/openai/resources/beta/agents/sessions/sessions.py
• src/openai/resources/beta/beta.py
• src/openai/resources/beta/responses/responses.py
• src/openai/resources/beta/threads/runs/runs.py
• src/openai/resources/beta/threads/threads.py
• src/openai/resources/chat/completions/completions.py
• src/openai/resources/embeddings.py
• src/openai/resources/files.py
• src/openai/resources/live/forks.py
• src/openai/resources/live/live.py
• src/openai/resources/live/sideband.py
• src/openai/resources/realtime/api.md
• src/openai/resources/realtime/realtime.py
• src/openai/resources/responses/responses.py
• src/openai/resources/uploads/uploads.py
• src/openai/resources/vector_stores/file_batches.py
• src/openai/resources/vector_stores/files.py
• src/openai/resources/videos.py
• src/openai/resources/webhooks/init.py
• src/openai/resources/webhooks/webhooks.py
• src/openai/types/fine_tuning/fine_tuning_job_integration.py
• src/openai/types/realtime/conversation_item_input_audio_transcription_delta_event.py
• src/openai/types/realtime/realtime_error_event.py
• src/openai/types/responses/tool.py
• src/openai/types/responses/tool_param.py
• src/openai/types/webhooks/init.py
• src/openai/types/webhooks/live_call_incoming_webhook_event.py
• src/openai/types/webhooks/unwrap_webhook_event.py
• tests/api_resources/test_videos.py

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 38345883616 --repo openai/openai-python \
  --name castiron-custom-code-38345883616-1 --dir /tmp/castiron-custom-code-38345883616-1
git apply --stat /tmp/castiron-custom-code-38345883616-1/custom-code.patch
cat /tmp/castiron-custom-code-38345883616-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 1f05e33eaca67e4a6913888aec279b66ac1db206 9e5f95a5960e508d843572e0a8a9bfa0c7b98dbd
python3 scripts/castiron/custom_code_report.py report \
  --base 1f05e33eaca67e4a6913888aec279b66ac1db206 \
  --head 9e5f95a5960e508d843572e0a8a9bfa0c7b98dbd --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-9e5f95a5960e
cat /tmp/castiron-custom-code-9e5f95a5960e/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch