build(plugin): bundle verified native runtime artifacts

.github/actions/download-native/action.yml

@@ -0,0 +1,9 @@
+name: Download native runtime
+description: Prepare the verified universal native payload for package builds.
+runs:
+  using: composite
+  steps:
+    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: native-universal-${{ github.sha }}
+        path: plugins/codex-security/native/prebuilt

.github/workflows/container-ci.yml

@@ -5,6 +5,8 @@ on:
     branches: [main]
     paths:
       - .dockerignore
+      - .github/workflows/native-*.yml
+      - .github/actions/download-native/**
       - .github/workflows/container-ci.yml
       - Dockerfile
       - Dockerfile.dockerignore
@@ -18,6 +20,8 @@ on:
   pull_request:
     paths:
       - .dockerignore
+      - .github/workflows/native-*.yml
+      - .github/actions/download-native/**
       - .github/workflows/container-ci.yml
       - Dockerfile
       - Dockerfile.dockerignore
@@ -38,7 +42,11 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
+  native:
+    uses: ./.github/workflows/native-artifacts.yml
+
   container:
+    needs: native
     name: linux-amd64
     runs-on: ubuntu-latest
     timeout-minutes: 30
@@ -48,6 +56,8 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
+      - name: Prepare native runtime
+        uses: ./.github/actions/download-native
 
       - name: Verify customer build excludes secrets and scan data
         shell: bash

.github/workflows/container-release.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
     paths:
       - .dockerignore
+      - .github/workflows/native-*.yml
+      - .github/actions/download-native/**
       - .github/workflows/container-release.yml
       - Dockerfile
       - Dockerfile.dockerignore
@@ -27,7 +29,12 @@ permissions:
   contents: read
 
 jobs:
+  native:
+    if: github.repository == 'openai/codex-security'
+    uses: ./.github/workflows/native-artifacts.yml
+
   validate:
+    needs: native
     if: github.repository == 'openai/codex-security'
     name: validate-linux-${{ matrix.architecture }}
     runs-on: ${{ matrix.runner }}
@@ -46,6 +53,8 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
+      - name: Prepare native runtime
+        uses: ./.github/actions/download-native
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
@@ -353,6 +362,8 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
+      - name: Prepare native runtime
+        uses: ./.github/actions/download-native
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

.github/workflows/native-artifacts.yml

@@ -0,0 +1,34 @@
+name: native-artifacts
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  unix:
+    uses: ./.github/workflows/native-unix.yml
+  windows:
+    uses: ./.github/workflows/native-windows.yml
+  musl:
+    uses: ./.github/workflows/native-musl.yml
+  bundle:
+    needs: [unix, windows, musl]
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Download verified platform payloads
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: native-platform-*-${{ github.sha }}
+          merge-multiple: true
+          path: native
+      - name: Upload universal native payload
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: native-universal-${{ github.sha }}
+          path: native/
+          if-no-files-found: error
+          overwrite: true
+          retention-days: 7

.github/workflows/native-musl.yml

@@ -1,18 +1,11 @@
 name: native-musl
 
 on:
-  push:
-    branches: [main]
-  pull_request:
-    types: [opened, reopened, synchronize]
+  workflow_call:
 
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 jobs:
   primitives:
     name: primitives / linux-${{ matrix.arch }}-musl
@@ -106,7 +99,8 @@ jobs:
       - name: Upload verified native artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: native-linux-${{ matrix.arch }}-musl-${{ github.sha }}
-          path: plugins/codex-security/native/dist/linux-${{ matrix.arch }}-musl/unix.node
+          name: native-platform-linux-${{ matrix.arch }}-musl-${{ github.sha }}
+          path: plugins/codex-security/native/dist/*/*.node
           if-no-files-found: error
+          overwrite: true
           retention-days: 7

.github/workflows/native-unix.yml

@@ -1,18 +1,11 @@
 name: native-unix
 
 on:
-  push:
-    branches: [main]
-  pull_request:
-    types: [opened, reopened, synchronize]
+  workflow_call:
 
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 jobs:
   primitives:
     name: primitives / ${{ matrix.artifact }}
@@ -73,6 +66,9 @@ jobs:
           cargo fmt --check
           cargo clippy --locked -- -D warnings
           cargo fetch --locked
+      - name: Prepare shared native notices
+        if: matrix.platform == 'linux' && matrix.arch == 'x64'
+        run: node notices.mjs
       - name: Build and verify Linux on glibc 2.28 with Node.js 22
         if: matrix.platform == 'linux'
         run: |
@@ -125,7 +121,12 @@ jobs:
       - name: Upload verified native artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: native-${{ matrix.artifact }}-${{ github.sha }}
-          path: plugins/codex-security/native/dist/${{ matrix.artifact }}/unix.node
+          name: native-platform-${{ matrix.artifact }}-${{ github.sha }}
+          path: |
+            plugins/codex-security/native/dist/*/*.node
+            plugins/codex-security/native/dist/THIRD_PARTY_NOTICES.txt
+            plugins/codex-security/native/dist/COPYRIGHT-library.html
+            plugins/codex-security/native/dist/licenses/*.txt
           if-no-files-found: error
+          overwrite: true
           retention-days: 7

.github/workflows/native-windows.yml

@@ -1,18 +1,11 @@
 name: native-windows
 
 on:
-  push:
-    branches: [main]
-  pull_request:
-    types: [opened, reopened, synchronize]
+  workflow_call:
 
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 jobs:
   primitives:
     name: primitives / win32-${{ matrix.arch }}
@@ -83,7 +76,8 @@ jobs:
       - name: Upload verified native artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: native-win32-${{ matrix.arch }}-${{ github.sha }}
-          path: plugins/codex-security/native/dist/win32-${{ matrix.arch }}/windows.node
+          name: native-platform-win32-${{ matrix.arch }}-${{ github.sha }}
+          path: plugins/codex-security/native/dist/*/*.node
           if-no-files-found: error
+          overwrite: true
           retention-days: 7

.github/workflows/node-ci.yml

@@ -156,9 +156,14 @@ jobs:
       - name: Check formatting
         run: pnpm --dir sdk/typescript run format
 
+  native:
+    needs: validate-title
+    if: needs.validate-title.outputs.ci-mode == 'full'
+    uses: ./.github/workflows/native-artifacts.yml
+
   package:
     name: build and check package
-    needs: validate-title
+    needs: [validate-title, native]
     if: needs.validate-title.outputs.ci-mode == 'full'
     runs-on: ubuntu-latest
     timeout-minutes: 20
@@ -169,6 +174,8 @@ jobs:
           persist-credentials: false
       - name: Check plugin source boundary
         run: node sdk/typescript/scripts/check-plugin-source.mjs
+      - name: Prepare native runtime
+        uses: ./.github/actions/download-native
       - name: Set up pnpm
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
@@ -219,6 +226,8 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
+      - name: Prepare native runtime
+        uses: ./.github/actions/download-native
       - name: Set up pnpm
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
@@ -319,6 +328,8 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
+      - name: Prepare native runtime
+        uses: ./.github/actions/download-native
       - name: Set up pnpm
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
@@ -457,6 +468,8 @@ jobs:
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.12"
+      - name: Prepare native runtime
+        uses: ./.github/actions/download-native
       - name: Set up Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:

.github/workflows/node-release.yml

@@ -11,7 +11,12 @@ concurrency:
   queue: max
 
 jobs:
+  native:
+    if: github.repository == 'openai/codex-security'
+    uses: ./.github/workflows/native-artifacts.yml
+
   verify:
+    needs: native
     if: github.repository == 'openai/codex-security'
     name: verify
     runs-on: ubuntu-latest
@@ -33,6 +38,8 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
+      - name: Prepare native runtime
+        uses: ./.github/actions/download-native
 
       - name: Set up Socket Firewall
         uses: SocketDev/action@937f824ec476dfd164d4a4d9995751427b0be143 # v1

.github/workflows/test-quality.yml

@@ -20,7 +20,11 @@ env:
   CODEX_SECURITY_ALLOW_MACHINE_POLICY_TEST: "false"
 
 jobs:
+  native:
+    uses: ./.github/workflows/native-artifacts.yml
+
   runner:
+    needs: native
     name: ${{ matrix.os }} / ${{ matrix.mode }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
@@ -63,6 +67,8 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
+      - name: Prepare native runtime
+        uses: ./.github/actions/download-native
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: "22.13.0"

docker/README.md

@@ -55,6 +55,8 @@ than build arguments.
 
 Before the first release, an administrator must prepare the package:
 
+Prepare the [universal native payload](../plugins/codex-security/native/README.md#package-inputs) before building an image from source.
+
 1. Allow organization package creation and, if the package is missing, bootstrap
    it with a reviewed image and a non-release tag:
 
@@ -135,7 +137,7 @@ Git authentication uses the existing `GH_TOKEN`/`GITHUB_TOKEN` and optional
 the findings service's embedding credentials are configured separately.
 Use a version or digest in `CODEX_SECURITY_IMAGE` for repeatable deployments.
 To test an unreleased checkout, build the same scanner target locally instead
-of pulling:
+of pulling. First prepare the [universal native payload](../plugins/codex-security/native/README.md#package-inputs):
 
 ```bash
 docker build --target scanner -t codex-security:local .

plugins/codex-security/mcp-app/TESTING.md

@@ -1,6 +1,6 @@
 # MCP tests
 
-From `sdk/typescript`, install both packages' dependencies and run `pnpm run test:mcp`. That command builds the bundled plugin before testing it. To rerun only the tests after a build, run `pnpm run test:mcp` from this directory.
+From `sdk/typescript`, install both packages' dependencies, prepare the [universal native payload](../native/README.md#package-inputs), and run `pnpm run test:mcp`. That command builds the bundled plugin before testing it. To rerun only the tests after a build, run `pnpm run test:mcp` from this directory.
 
 Node's test runner discovers `tests/test_*.mjs` and runs at most two files at once, each in a separate process. Assertions within a file remain sequential. Keep shared helpers outside that filename pattern. A failing script fails the command. The reporter streams Node's TAP output and then tries to write Node's JUnit report to `reports/junit.xml`; an unavailable report path warns without changing the test result. CI uploads that file with the Node 22 reports.
 

plugins/codex-security/mcp-app/scripts/build_mcp_app.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { join, resolve } from "node:path";
+import { copyFile, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { brotliCompressSync, constants as zlibConstants } from "node:zlib";
 import { execFileSync } from "node:child_process";
@@ -20,6 +20,33 @@ export async function buildMcpApp({ output }) {
   await mkdir(mcpDir, { recursive: true });
 
   await writeRuntime("server", "main.ts");
+  for (const target of [
+    "darwin-arm64",
+    "darwin-x64",
+    "linux-arm64-gnu",
+    "linux-arm64-musl",
+    "linux-x64-gnu",
+    "linux-x64-musl",
+    "win32-arm64",
+    "win32-x64"
+  ]) {
+    const name = target.startsWith("win32-") ? "windows.node" : "unix.node";
+    const destination = join(mcpDir, "native", target);
+    await mkdir(destination, { recursive: true });
+    await copyFile(
+      join(root, "../native/prebuilt", target, name),
+      join(destination, name)
+    );
+  }
+  for (const path of [
+    "THIRD_PARTY_NOTICES.txt", "COPYRIGHT-library.html",
+    "licenses/MIT.txt", "licenses/Apache-2.0.txt",
+    "licenses/Unicode-3.0.txt", "licenses/BSD-2-Clause.txt"
+  ]) {
+    const destination = join(mcpDir, "native", path);
+    await mkdir(dirname(destination), { recursive: true });
+    await copyFile(join(root, "../native/prebuilt", path), destination);
+  }
 
   async function writeRuntime(name, entryPoint) {
     const bundle = join(mcpDir, name + ".bundle.cjs");

plugins/codex-security/native/.gitignore

@@ -1,3 +1,4 @@
 /target/
 /dist/
+/prebuilt/
 /*.mjs