release: bump Codex Security to 0.1.17

[mldangelo-oai]

Summary

Prepare the @openai/codex-security patch release 0.1.17.

This release includes the 36 commits merged since npm-v0.1.16, led by custom validation workflows plus reliability and portability fixes across Windows, the workbench, plugin startup, scan reporting, and session cost attribution.

Changes

• Bump @openai/codex-security from 0.1.16 to 0.1.17.
• Add custom validation workflow support, including SDK and CLI integration and runnable examples.
• Improve Windows and path handling for worktrees, portable paths, multiscan history and publication paths, stdin and UTF-8 process boundaries, tar listings, hard-link fallback, and disappearing ACL entries.
• Improve plugin and scan reliability through managed Node MCP startup, optional security app access, preserved root-cause references, scan instruction persistence before Deep workers start, and clearer failure and status reporting.
• Align scan session and cost attribution, harden authentication and runtime recovery, and use SemVer precedence for update notices.
• Keep the release-specific pull request diff limited to the package version field; the release contents come from current main.

Testing

• git diff --check origin/main...HEAD passed for the release commit.
• Release automation checks passed for the stable version, matching npm-v0.1.17 tag, increase over 0.1.16 and all published npm versions, and publish mode.
• Pull request CI passed at exact head 9e6700a4b3, including Node CI on Linux, macOS, and Windows, container build and release validation, title validation, and release-note categorization.
• Codex code and security reviews completed at the exact head with no posted findings.

Risk and rollout

At the time of this update, main still declares 0.1.16, no npm-v0.1.17 tag exists, and the release branch predates the 36 commits now on main. Merging applies the version bump to the current release contents. Recheck the release delta, required checks, mergeability, and approvals immediately before merge.

After merge, the normal release workflow cuts the matching tag and requests approval through the protected npm environment. This pull request does not publish a package on its own.

Public disclosure review

Reviewed the public pull request material and current-head CI logs. No screenshots or attachments are present.

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-20T12:20:49.081084Z	9e6700a	Manual request
🔒 Security Review	✅ Completed 2026-08-20T12:20:44.421050Z	9e6700a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 9e6700a4b3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".