Build Python SDK artifacts before publishing the runtime (#44061)

## Why

The SDK release workflow published the runtime before building the SDK, so an SDK build failure could leave the runtime published on its own.

## What changed

- Extract a reusable SDK build workflow that packages checked-in generated code and runs alongside runtime preparation. Require both builds before publishing the runtime, and verify runtime availability before publishing the SDK.
- Add `stage-sdk --codex-version` to set an explicit runtime dependency independently of the SDK version, retaining the checked-in pin by default and rejecting missing or duplicate pins.
- Accept Codex release tags in the runtime version resolver and use its normalized Python version for standalone runtime PyPI verification.

## Testing

Add coverage for wheel and source distribution metadata, preservation of checked-in code, independent beta SDK versions, runtime tag normalization, and invalid versions or dependency pins.

GitOrigin-RevId: feb572fadcf5d148814b26b480b4bae5ef6a39c5

.github/workflows/python-runtime-build.yml

@@ -7,6 +7,9 @@ on:
         description: "Runtime version to build, for example 0.136.0, 0.136.0a2, or 0.136.0a2.post1."
         required: true
         type: string
+    outputs:
+      python_version:
+        value: ${{ jobs.build-python-runtime.outputs.python_version }}
 
 jobs:
   build-python-runtime:
@@ -15,6 +18,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+    outputs:
+      python_version: ${{ steps.python_runtime.outputs.python_version }}
 
     steps:
       - name: Checkout repository

.github/workflows/python-runtime-release.yml

@@ -57,7 +57,7 @@ jobs:
 
       - name: Verify Python runtime wheels are available on PyPI
         env:
-          PYTHON_RUNTIME_VERSION: ${{ inputs.runtime_version }}
+          PYTHON_RUNTIME_VERSION: ${{ needs.prepare-python-runtime.outputs.python_version }}
         run: |
           uv run --no-project --with packaging==26.2 python .github/scripts/verify_pypi_release.py \
             openai-codex-cli-bin "$PYTHON_RUNTIME_VERSION"

.github/workflows/python-sdk-build.yml

@@ -0,0 +1,60 @@
+name: python-sdk-build
+
+on:
+  workflow_call:
+    inputs:
+      sdk_version:
+        description: "Python SDK version to build."
+        required: true
+        type: string
+      runtime_version:
+        description: "Exact Python CLI runtime dependency for this SDK release."
+        required: true
+        type: string
+
+jobs:
+  build-python-sdk:
+    if: github.repository == 'openai/codex'
+    name: build-python-sdk
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Setup Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+
+      - name: Build Python SDK package
+        shell: bash
+        env:
+          SDK_VERSION: ${{ inputs.sdk_version }}
+          RUNTIME_VERSION: ${{ inputs.runtime_version }}
+        run: |
+          set -euo pipefail
+          python3 -m venv "${RUNNER_TEMP}/python-sdk-build-venv"
+          build_python="${RUNNER_TEMP}/python-sdk-build-venv/bin/python"
+          "$build_python" -m pip install build twine packaging==26.2
+          "$build_python" sdk/python/scripts/update_sdk_artifacts.py \
+            stage-sdk "${RUNNER_TEMP}/openai-codex" \
+            --sdk-version "$SDK_VERSION" \
+            --codex-version "$RUNTIME_VERSION"
+          "$build_python" -m build \
+            --wheel \
+            --sdist \
+            --outdir dist/python-sdk \
+            "${RUNNER_TEMP}/openai-codex"
+          "$build_python" -m twine check --strict dist/python-sdk/*
+
+      - name: Upload Python SDK package
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: python-sdk-package
+          path: dist/python-sdk/*
+          if-no-files-found: error

.github/workflows/python-sdk-release.yml

@@ -75,14 +75,25 @@ jobs:
     with:
       runtime_version: ${{ needs.resolve-python-release.outputs.runtime_version }}
 
-  # Always publish the exact pinned runtime from this top-level workflow before
-  # building the SDK package. PyPI does not support reusable workflows as
-  # Trusted Publishers.
+  build-python-sdk:
+    name: build-python-sdk
+    needs: resolve-python-release
+    permissions:
+      contents: read
+    uses: ./.github/workflows/python-sdk-build.yml
+    with:
+      sdk_version: ${{ needs.resolve-python-release.outputs.sdk_version }}
+      runtime_version: ${{ needs.resolve-python-release.outputs.runtime_version }}
+
+  # Publish from the top-level workflow: PyPI does not support reusable
+  # workflows as Trusted Publishers. The runtime must be available before
+  # publishing the SDK that depends on it.
   publish-python-runtime:
     if: github.repository == 'openai/codex'
     name: publish-python-runtime
     needs:
       - prepare-python-runtime
+      - build-python-sdk
       - resolve-python-release
     runs-on: ubuntu-latest
     environment: pypi
@@ -120,64 +131,6 @@ jobs:
           uv run --no-project --with packaging==26.2 python .github/scripts/verify_pypi_release.py \
             openai-codex-cli-bin "$PYTHON_RUNTIME_VERSION"
 
-  build-python-sdk:
-    if: github.repository == 'openai/codex'
-    name: build-python-sdk
-    needs:
-      - publish-python-runtime
-      - resolve-python-release
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Build Python SDK package
-        shell: bash
-        env:
-          SDK_VERSION: ${{ needs.resolve-python-release.outputs.sdk_version }}
-        run: |
-          set -euo pipefail
-
-          # Build in a glibc Linux image so release type generation installs
-          # the pinned manylinux runtime wheel.
-          docker run --rm \
-            --user "$(id -u):$(id -g)" \
-            -e HOME=/tmp/codex-python-sdk-home \
-            -e UV_LINK_MODE=copy \
-            -e SDK_VERSION \
-            -e SDK_STAGE_DIR="${RUNNER_TEMP}/openai-codex" \
-            -e SDK_DIST_DIR="${GITHUB_WORKSPACE}/dist/python-sdk" \
-            -v "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}" \
-            -v "${RUNNER_TEMP}:${RUNNER_TEMP}" \
-            -w "${GITHUB_WORKSPACE}/sdk/python" \
-            python:3.12-slim \
-            sh -euxc '
-              python -m venv /tmp/release-tools
-              /tmp/release-tools/bin/python -m pip install build twine uv==0.11.3
-              /tmp/release-tools/bin/uv sync --group dev --frozen
-              /tmp/release-tools/bin/uv run --frozen --no-sync python scripts/update_sdk_artifacts.py \
-                stage-sdk "${SDK_STAGE_DIR}" \
-                --sdk-version "${SDK_VERSION}"
-              /tmp/release-tools/bin/python -m build \
-                --wheel \
-                --sdist \
-                --outdir "${SDK_DIST_DIR}" \
-                "${SDK_STAGE_DIR}"
-              /tmp/release-tools/bin/python -m twine check --strict "${SDK_DIST_DIR}/"*
-            '
-
-      - name: Upload Python SDK package
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: python-sdk-package
-          path: dist/python-sdk/*
-          if-no-files-found: error
-
   publish-python-sdk:
     name: publish-python-sdk
     needs: