mirror of
https://github.com/pchuan98/codex.git
synced 2026-07-01 00:31:56 +08:00
Ahmed Ibrahim
34dc08c214
## Summary - stop publishing Python runtime wheels as a side effect of Rust releases - publish runtime wheels from the Python SDK release workflow, either explicitly before updating the SDK pin or immediately before a `python-v*` SDK release - resolve the runtime release from the requested version or the SDK package's exact `openai-codex-cli-bin` pin - build two musllinux-tagged wheels from the Rust-release Linux package archives alongside the six existing runtime wheels - validate SDK beta tags before any PyPI write ## Release configuration - update the `openai-codex-cli-bin` PyPI trusted publisher to trust `.github/workflows/python-sdk-release.yml` and the `publish-python-runtime` job ## Pin update flow - run the `python-sdk-release` workflow manually with the new runtime version before opening or updating the SDK pin PR - after the pin lands, a `python-v*` SDK tag republishes with `skip-existing: true` before publishing the SDK package ## Validation - ran `just fmt` - validated the edited workflow YAML - validated the embedded `publish-python-runtime` Bash with `bash -n` - validated manual `0.136.0 -> rust-v0.136.0` mapping - validated tag-driven `python-v0.1.0b3 -> 0.132.0 -> rust-v0.132.0` mapping - validated rejection of an invalid SDK tag before publication - confirmed `rust-v0.136.0` contains the two required Linux package archives - CI will provide the full test signal
233 lines
8.8 KiB
YAML
233 lines
8.8 KiB
YAML
name: python-sdk-release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "python-v*"
|
|
workflow_dispatch:
|
|
inputs:
|
|
runtime_version:
|
|
description: "Runtime version to publish before updating the SDK pin, for example 0.136.0 or 0.136.0a2."
|
|
required: true
|
|
type: string
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
# Publish the platform-specific Python runtime wheels before building the SDK
|
|
# package that pins them, or explicitly before updating the SDK runtime pin.
|
|
# PyPI project configuration must trust this workflow and job for publishing.
|
|
publish-python-runtime:
|
|
if: github.repository == 'openai/codex'
|
|
name: publish-python-runtime
|
|
runs-on: ubuntu-latest
|
|
environment: pypi
|
|
permissions:
|
|
contents: read
|
|
id-token: write # Required for PyPI trusted publishing.
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Validate SDK tag and resolve Python runtime release
|
|
id: python_runtime
|
|
shell: bash
|
|
env:
|
|
REQUESTED_RUNTIME_VERSION: ${{ inputs.runtime_version }}
|
|
run: |
|
|
set -euo pipefail
|
|
python3 - <<'PY'
|
|
import os
|
|
import re
|
|
import tomllib
|
|
from pathlib import Path
|
|
|
|
event_name = os.environ["GITHUB_EVENT_NAME"]
|
|
if event_name == "workflow_dispatch":
|
|
python_version = os.environ["REQUESTED_RUNTIME_VERSION"]
|
|
elif event_name == "push":
|
|
sdk_version = os.environ["GITHUB_REF_NAME"].removeprefix("python-v")
|
|
if not re.fullmatch(r"[0-9]+\.[0-9]+\.[0-9]+b[0-9]+", sdk_version):
|
|
raise SystemExit(
|
|
"Python SDK release tags must identify a beta release, "
|
|
"for example python-v0.1.0b1."
|
|
)
|
|
|
|
pyproject = tomllib.loads(Path("sdk/python/pyproject.toml").read_text())
|
|
prefix = "openai-codex-cli-bin=="
|
|
versions = [
|
|
dependency.removeprefix(prefix)
|
|
for dependency in pyproject["project"]["dependencies"]
|
|
if dependency.startswith(prefix)
|
|
]
|
|
if len(versions) != 1:
|
|
raise SystemExit(f"Expected exactly one pinned {prefix} dependency, found {versions}")
|
|
python_version = versions[0]
|
|
else:
|
|
raise SystemExit(f"Unsupported workflow event: {event_name}")
|
|
|
|
if match := re.fullmatch(r"([0-9]+\.[0-9]+\.[0-9]+)a([0-9]+)", python_version):
|
|
release_version = f"{match.group(1)}-alpha.{match.group(2)}"
|
|
elif re.fullmatch(r"[0-9]+\.[0-9]+\.[0-9]+", python_version):
|
|
release_version = python_version
|
|
else:
|
|
raise SystemExit(
|
|
"Python runtime version must be stable or a numbered alpha, "
|
|
f"for example 0.136.0 or 0.136.0a2; found {python_version}"
|
|
)
|
|
|
|
with Path(os.environ["GITHUB_OUTPUT"]).open("a") as output:
|
|
print(f"python_version={python_version}", file=output)
|
|
print(f"release_tag=rust-v{release_version}", file=output)
|
|
PY
|
|
|
|
- name: Download Python runtime release artifacts
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
PYTHON_RUNTIME_VERSION: ${{ steps.python_runtime.outputs.python_version }}
|
|
RELEASE_TAG: ${{ steps.python_runtime.outputs.release_tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p dist/python-runtime dist/python-runtime-packages
|
|
gh release download "$RELEASE_TAG" \
|
|
--repo "${GITHUB_REPOSITORY}" \
|
|
--pattern "openai_codex_cli_bin-${PYTHON_RUNTIME_VERSION}-*.whl" \
|
|
--dir dist/python-runtime
|
|
gh release download "$RELEASE_TAG" \
|
|
--repo "${GITHUB_REPOSITORY}" \
|
|
--pattern "codex-package-*-unknown-linux-musl.tar.gz" \
|
|
--dir dist/python-runtime-packages
|
|
|
|
shopt -s nullglob
|
|
wheels=(dist/python-runtime/*.whl)
|
|
if [[ "${#wheels[@]}" -ne 6 ]]; then
|
|
echo "Expected 6 Python runtime wheels for ${PYTHON_RUNTIME_VERSION}, found ${#wheels[@]}."
|
|
exit 1
|
|
fi
|
|
packages=(dist/python-runtime-packages/*.tar.gz)
|
|
if [[ "${#packages[@]}" -ne 2 ]]; then
|
|
echo "Expected 2 Linux package archives for ${PYTHON_RUNTIME_VERSION}, found ${#packages[@]}."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Build musllinux Python runtime wheels
|
|
env:
|
|
RELEASE_TAG: ${{ steps.python_runtime.outputs.release_tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
python3 -m venv "${RUNNER_TEMP}/python-runtime-build-venv"
|
|
"${RUNNER_TEMP}/python-runtime-build-venv/bin/python" -m pip install build
|
|
|
|
while read -r target platform_tag; do
|
|
stage_dir="${RUNNER_TEMP}/openai-codex-cli-bin-${target}-${platform_tag}"
|
|
python3 sdk/python/scripts/update_sdk_artifacts.py \
|
|
stage-runtime \
|
|
"$stage_dir" \
|
|
"dist/python-runtime-packages/codex-package-${target}.tar.gz" \
|
|
--codex-version "$RELEASE_TAG" \
|
|
--platform-tag "$platform_tag"
|
|
"${RUNNER_TEMP}/python-runtime-build-venv/bin/python" -m build \
|
|
--wheel \
|
|
--outdir dist/python-runtime \
|
|
"$stage_dir"
|
|
done <<'EOF'
|
|
aarch64-unknown-linux-musl musllinux_1_1_aarch64
|
|
x86_64-unknown-linux-musl musllinux_1_1_x86_64
|
|
EOF
|
|
|
|
shopt -s nullglob
|
|
wheels=(dist/python-runtime/*.whl)
|
|
if [[ "${#wheels[@]}" -ne 8 ]]; then
|
|
echo "Expected 8 Python runtime wheels, found ${#wheels[@]}."
|
|
exit 1
|
|
fi
|
|
ls -lh dist/python-runtime
|
|
|
|
- name: Publish Python runtime wheels to PyPI
|
|
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
|
|
with:
|
|
packages-dir: dist/python-runtime
|
|
skip-existing: true
|
|
|
|
build-python-sdk:
|
|
if: github.event_name == 'push' && github.repository == 'openai/codex'
|
|
name: build-python-sdk
|
|
needs: publish-python-runtime
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Validate tag and build Python SDK package
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
sdk_version="${GITHUB_REF_NAME#python-v}"
|
|
# Build in a glibc Linux image so release type generation installs
|
|
# the pinned manylinux runtime wheel.
|
|
docker run --rm \
|
|
--user "$(id -u):$(id -g)" \
|
|
-e HOME=/tmp/codex-python-sdk-home \
|
|
-e UV_LINK_MODE=copy \
|
|
-e SDK_VERSION="${sdk_version}" \
|
|
-e SDK_STAGE_DIR="${RUNNER_TEMP}/openai-codex" \
|
|
-e SDK_DIST_DIR="${GITHUB_WORKSPACE}/dist/python-sdk" \
|
|
-v "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}" \
|
|
-v "${RUNNER_TEMP}:${RUNNER_TEMP}" \
|
|
-w "${GITHUB_WORKSPACE}/sdk/python" \
|
|
python:3.12-slim \
|
|
sh -euxc '
|
|
python -m venv /tmp/release-tools
|
|
/tmp/release-tools/bin/python -m pip install build twine uv==0.11.3
|
|
/tmp/release-tools/bin/uv sync --extra dev --frozen
|
|
/tmp/release-tools/bin/uv run --extra dev --frozen python scripts/update_sdk_artifacts.py \
|
|
stage-sdk "${SDK_STAGE_DIR}" \
|
|
--sdk-version "${SDK_VERSION}"
|
|
/tmp/release-tools/bin/python -m build \
|
|
--wheel \
|
|
--sdist \
|
|
--outdir "${SDK_DIST_DIR}" \
|
|
"${SDK_STAGE_DIR}"
|
|
/tmp/release-tools/bin/python -m twine check --strict "${SDK_DIST_DIR}/"*
|
|
'
|
|
|
|
- name: Upload Python SDK package
|
|
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
|
|
with:
|
|
name: python-sdk-package
|
|
path: dist/python-sdk/*
|
|
if-no-files-found: error
|
|
|
|
publish-python-sdk:
|
|
name: publish-python-sdk
|
|
needs: build-python-sdk
|
|
runs-on: ubuntu-latest
|
|
environment: pypi
|
|
permissions:
|
|
contents: read
|
|
id-token: write # Required for PyPI trusted publishing.
|
|
|
|
steps:
|
|
- name: Download Python SDK package
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: python-sdk-package
|
|
path: dist/python-sdk
|
|
|
|
- name: Publish Python SDK to PyPI
|
|
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
|
|
with:
|
|
packages-dir: dist/python-sdk
|