[codex] Split Python runtime release workflow#26226
Conversation
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1d802cd293
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - name: Publish Python runtime wheels to PyPI | ||
| uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0 |
There was a problem hiding this comment.
Keep PyPI publishing out of the reusable workflow
When python-sdk-release.yml calls this reusable workflow, this pypa/gh-action-pypi-publish step runs from the called workflow, but PyPI Trusted Publishing explicitly says reusable workflows cannot currently be used as the trusted workflow. In the tag-release path this means the runtime publish step will fail to mint a PyPI token before the SDK build can start; keep the publish job in the top-level SDK workflow (for example by having the reusable workflow only build/upload artifacts) and publish from a non-reusable job.
Useful? React with 👍 / 👎.
Why
Python SDK releases pin an exact
openai-codex-cli-binversion, so all eight platform runtime wheels must be available on PyPI before the SDK package is built and published. PyPI does not support reusable workflows as Trusted Publishers, which means OIDC-backed publishing must run from each top-level release workflow.What changed
python-runtime-build.ymlto prepare and upload all eight runtime wheels without publishingpython-runtime-release.ymlfor manual runtime publication before updating an SDK pinpython-sdk-release.ymlpublish and verify the prepared runtime wheels from its own top-level trusted job before building the SDKPyPI configuration
.github/workflows/python-sdk-release.ymlwith environmentpypi.github/workflows/python-runtime-release.ymlwith environmentpypi.github/workflows/python-runtime-build.ymlValidation
bash -n