chore(deps): bump openai/codex-action from 1.11 to 1.12

[dependabot]

Bumps openai/codex-action from 1.11 to 1.12.

Changelog

Sourced from openai/codex-action's changelog.

codex-action Changelog

v1.12 (2026-08-20)

• Strengthen Linux runner privilege isolation and Responses API proxy credential handling.
• Reject Codex arguments and configuration overrides that conflict with protected execution settings.
• Require unprivileged user namespaces for Linux drop-sudo; run the action after steps that need sudo, Docker, or privileged service sockets.
• Document runner requirements, permission-profile behavior, and trusted configuration boundaries.

v1.11 (2026-07-04)

• #116 keep the permission profile helper backward compatible

v1.10 (2026-07-02)

• #113 add Codex permission profile support

v1.9 (2026-06-22)

• #85 update the internal setup-node pin to v6.3.0

v1.8 (2026-04-29)

• #91 tighten what bots are allowed

v1.7 (2026-04-24)

• #89 restrict bot permission bypass

v1.6 (2026-03-16)

• #77 enable GitHub-hosted Linux bubblewrap support

v1.5 (2026-03-16)

• #74 harden shell interpolation in action workflows

v1.4 (2025-11-19)

• #58 revert #56 and use the latest stable version of Codex CLI again

v1.3 (2025-11-19)

• #56 temporarily set the default version of Codex CLI to 0.58.0

v1.2 (2025-11-07)

• #52 add baseUrl to Octokit constructor, if appropriate, for GHE

v1.1 (2025-11-05)

... (truncated)

Commits

• 8636508 fix: improve runner setup and configuration handling
• c385816 Retry network errors/transient HTTP errors in GitHub API requests (#128)
• dd78cb6 docs: update CHANGELOG for v1.11 (#117)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 9.208s for Python SDK PR #3768.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	154ms
tests/chat-completions-create.test.ts	✅ Passed	215ms
tests/chat-completions-stream.test.ts	✅ Passed	103ms
tests/files-content-binary.test.ts	✅ Passed	142ms
tests/files-create-multipart.test.ts	✅ Passed	227ms
tests/files-list-pagination.test.ts	✅ Passed	106ms
tests/initialize-config.test.ts	✅ Passed	141ms
tests/instance-isolation.test.ts	✅ Passed	135ms
tests/models-list.test.ts	✅ Passed	106ms
tests/responses-background-lifecycle.test.ts	✅ Passed	194ms
tests/responses-body-method-errors.test.ts	✅ Passed	167ms
tests/responses-cancel-timeout.test.ts	✅ Passed	163ms
tests/responses-cancel.test.ts	✅ Passed	147ms
tests/responses-compact-retries.test.ts	✅ Passed	314ms
tests/responses-compact.test.ts	✅ Passed	212ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	100ms
tests/responses-create-advanced.test.ts	✅ Passed	168ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.003s
tests/responses-create-errors.test.ts	✅ Passed	209ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	115ms
tests/responses-create-retries.test.ts	✅ Passed	345ms
tests/responses-create-stream-failures.test.ts	✅ Passed	88ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	177ms
tests/responses-create-stream-wire.test.ts	✅ Passed	2.898s
tests/responses-create-stream.test.ts	✅ Passed	50ms
tests/responses-create-terminal-states.test.ts	✅ Passed	141ms
tests/responses-create-timeout.test.ts	✅ Passed	261ms
tests/responses-create.test.ts	✅ Passed	179ms
tests/responses-delete.test.ts	✅ Passed	155ms
tests/responses-input-items-errors.test.ts	✅ Passed	260ms
tests/responses-input-items-list.test.ts	✅ Passed	217ms
tests/responses-input-items-options.test.ts	✅ Passed	262ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	181ms
tests/responses-input-tokens-count.test.ts	✅ Passed	252ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.213s
tests/responses-not-found-errors.test.ts	✅ Passed	137ms
tests/responses-parse.test.ts	✅ Passed	259ms
tests/responses-retrieve-retries.test.ts	✅ Passed	339ms
tests/responses-retrieve.test.ts	✅ Passed	162ms
tests/responses-stored-method-errors.test.ts	✅ Passed	639ms
tests/retry-behavior.test.ts	✅ Passed	3.116s
tests/sdk-error-shape.test.ts	✅ Passed	234ms

View OkTest run #33379259423

_{SDK merge (278d1c05a678) · head (bf201d836eb2) · base (b19c2161b1ea) · OkTest (2b1bdfd25e98)}

[github-actions]

Castiron custom code

✅ No new custom-code files detected.

34 mixed files remain; 0 existing customizations changed.

Compared b19c2161b1ea → bf201d836eb2. Generated baselines verified.

34 existing customizations unchanged

• api.md
• scripts/castiron/README.md
• scripts/castiron/custom_code_report.py
• scripts/castiron/test_custom_code_report.py
• src/openai/init.py
• src/openai/_client.py
• src/openai/resources/audio/transcriptions.py
• src/openai/resources/audio/translations.py
• src/openai/resources/beta/beta.py
• src/openai/resources/beta/responses/responses.py
• src/openai/resources/beta/threads/runs/runs.py
• src/openai/resources/beta/threads/threads.py
• src/openai/resources/chat/completions/completions.py
• src/openai/resources/embeddings.py
• src/openai/resources/files.py
• src/openai/resources/realtime/realtime.py
• src/openai/resources/responses/responses.py
• src/openai/resources/uploads/uploads.py
• src/openai/resources/vector_stores/file_batches.py
• src/openai/resources/vector_stores/files.py
• src/openai/resources/videos.py
• src/openai/resources/webhooks/init.py
• src/openai/resources/webhooks/webhooks.py
• src/openai/types/chat/init.py
• src/openai/types/chat/chat_completion_message_tool_call.py
• src/openai/types/fine_tuning/fine_tuning_job_integration.py
• src/openai/types/responses/init.py
• src/openai/types/responses/response.py
• src/openai/types/responses/response_function_web_search.py
• src/openai/types/responses/response_function_web_search_param.py
• src/openai/types/responses/tool.py
• src/openai/types/responses/tool_param.py
• src/openai/types/webhooks/init.py
• tests/api_resources/test_videos.py

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 33379289018 --repo openai/openai-python \
  --name castiron-custom-code-33379289018-1 --dir /tmp/castiron-custom-code-33379289018-1
git apply --stat /tmp/castiron-custom-code-33379289018-1/custom-code.patch
cat /tmp/castiron-custom-code-33379289018-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin b19c2161b1eac80fbf1f6f67a64a50af99c53356 bf201d836eb231313ad0055f985cf1cfbf2bcbbb
python3 scripts/castiron/custom_code_report.py report \
  --base b19c2161b1eac80fbf1f6f67a64a50af99c53356 \
  --head bf201d836eb231313ad0055f985cf1cfbf2bcbbb --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-bf201d836eb2
cat /tmp/castiron-custom-code-bf201d836eb2/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch