mirror of
https://github.com/openai/codex.git
synced 2026-10-23 18:08:45 +00:00
Lock Python release build tools with uv (#56290)
## Why Python release jobs installed build tools without a shared lockfile and allowed isolated builds to resolve additional dependencies. Release retries can also build older source revisions, so their tool pins need to come from the running workflow revision. ## What changed - Add a shared setup action with pinned `uv` and locked `sdk` and `runtime` dependency groups. Apply a seven-day dependency age cutoff, with a two-day exception for `certifi` CA trust updates. - Use the action for Python SDK and runtime packaging across Linux, macOS, and Windows. Build with `uv build --offline --no-build-isolation` using the prepared environments. - In the standalone Python build workflows, check out the release tools from `github.workflow_sha` separately from the requested source revision. GitOrigin-RevId: a9c0344930e5b9870ce9f7754a1fee1a9219305c
This commit is contained in:
Adam Perry @ OpenAI
committed by
copyberry
copyberry
parent
9100b9c3d3
commit
66f6da6036
@@ -32,6 +32,15 @@ jobs:
|
||||
ref: ${{ inputs.source_ref || github.sha }}
|
||||
persist-credentials: false
|
||||
|
||||
# A retry can rebuild an older release. Use the tool pins from this workflow.
|
||||
- name: Checkout release build tools
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
with:
|
||||
ref: ${{ github.workflow_sha }}
|
||||
path: release-tools
|
||||
sparse-checkout: .github/actions/setup-python-release-tools
|
||||
persist-credentials: false
|
||||
|
||||
- name: Validate and resolve Python runtime release
|
||||
id: python_runtime
|
||||
shell: bash
|
||||
@@ -72,14 +81,17 @@ jobs:
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Set up Python release tools
|
||||
uses: ./release-tools/.github/actions/setup-python-release-tools
|
||||
with:
|
||||
group: runtime
|
||||
|
||||
- name: Build musllinux Python runtime wheels
|
||||
env:
|
||||
RELEASE_TAG: ${{ steps.python_runtime.outputs.release_tag }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
python3 -m venv "${RUNNER_TEMP}/python-runtime-build-venv"
|
||||
"${RUNNER_TEMP}/python-runtime-build-venv/bin/python" -m pip install build
|
||||
|
||||
while read -r target platform_tag; do
|
||||
stage_dir="${RUNNER_TEMP}/openai-codex-cli-bin-${target}-${platform_tag}"
|
||||
@@ -89,9 +101,10 @@ jobs:
|
||||
"dist/python-runtime-packages/codex-package-${target}.tar.gz" \
|
||||
--codex-version "$RELEASE_TAG" \
|
||||
--platform-tag "$platform_tag"
|
||||
"${RUNNER_TEMP}/python-runtime-build-venv/bin/python" -m build \
|
||||
uv build --offline --no-build-isolation --no-create-gitignore \
|
||||
--python "${RUNNER_TEMP}/python-runtime-build-venv" \
|
||||
--wheel \
|
||||
--outdir dist/python-runtime \
|
||||
--out-dir dist/python-runtime \
|
||||
"$stage_dir"
|
||||
done <<'EOF'
|
||||
aarch64-unknown-linux-musl musllinux_1_1_aarch64
|
||||
|
||||
@@ -31,11 +31,25 @@ jobs:
|
||||
ref: ${{ inputs.source_ref || github.sha }}
|
||||
persist-credentials: false
|
||||
|
||||
# A retry can rebuild an older release. Use the tool pins from this workflow.
|
||||
- name: Checkout release build tools
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
with:
|
||||
ref: ${{ github.workflow_sha }}
|
||||
path: release-tools
|
||||
sparse-checkout: .github/actions/setup-python-release-tools
|
||||
persist-credentials: false
|
||||
|
||||
- name: Setup Python
|
||||
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
|
||||
with:
|
||||
python-version: "3.12"
|
||||
|
||||
- name: Set up Python release tools
|
||||
uses: ./release-tools/.github/actions/setup-python-release-tools
|
||||
with:
|
||||
group: sdk
|
||||
|
||||
- name: Build Python SDK package
|
||||
shell: bash
|
||||
env:
|
||||
@@ -43,17 +57,16 @@ jobs:
|
||||
RUNTIME_VERSION: ${{ inputs.runtime_version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
python3 -m venv "${RUNNER_TEMP}/python-sdk-build-venv"
|
||||
build_python="${RUNNER_TEMP}/python-sdk-build-venv/bin/python"
|
||||
"$build_python" -m pip install build twine packaging==26.2
|
||||
"$build_python" sdk/python/scripts/update_sdk_artifacts.py \
|
||||
stage-sdk "${RUNNER_TEMP}/openai-codex" \
|
||||
--sdk-version "$SDK_VERSION" \
|
||||
--codex-version "$RUNTIME_VERSION"
|
||||
"$build_python" -m build \
|
||||
uv build --offline --no-build-isolation --no-create-gitignore \
|
||||
--force-pep517 --python "$build_python" \
|
||||
--wheel \
|
||||
--sdist \
|
||||
--outdir dist/python-sdk \
|
||||
--out-dir dist/python-sdk \
|
||||
"${RUNNER_TEMP}/openai-codex"
|
||||
"$build_python" -m twine check --strict dist/python-sdk/*
|
||||
|
||||
|
||||
@@ -567,6 +567,12 @@ jobs:
|
||||
python -c 'import sys; from pathlib import Path; sys.path.insert(0, sys.argv[3]); from package_runtime import runtime_files; runtime_files(Path(sys.argv[1]), sys.argv[2], public_release=True)' $voice $target (Join-Path $env:GITHUB_WORKSPACE 'third_party/voice')
|
||||
if ($LASTEXITCODE -ne 0) { throw 'Packaged runtime receipt verification failed' }
|
||||
|
||||
- name: Set up Python release tools
|
||||
if: ${{ matrix.build-system == 'cargo' }}
|
||||
uses: ./.github/actions/setup-python-release-tools
|
||||
with:
|
||||
group: runtime
|
||||
|
||||
- name: Build Python runtime wheel
|
||||
if: ${{ matrix.build-system == 'cargo' }}
|
||||
shell: bash
|
||||
@@ -586,9 +592,6 @@ jobs:
|
||||
;;
|
||||
esac
|
||||
|
||||
python -m venv "${RUNNER_TEMP}/python-runtime-build-venv"
|
||||
"${RUNNER_TEMP}/python-runtime-build-venv/Scripts/python.exe" -m pip install build
|
||||
|
||||
# The wheel's Windows support floor predates the native voice
|
||||
# runtime's verified device/VC++ prerequisites. Keep it voice-free.
|
||||
wheel_package="${RUNNER_TEMP}/codex-package-${{ matrix.target }}"
|
||||
@@ -605,7 +608,8 @@ jobs:
|
||||
"$wheel_package" \
|
||||
--codex-version "${GITHUB_REF_NAME}" \
|
||||
--platform-tag "$platform_tag"
|
||||
"${RUNNER_TEMP}/python-runtime-build-venv/Scripts/python.exe" -m build --wheel --outdir "$wheel_dir" "$stage_dir"
|
||||
uv build --offline --no-build-isolation --no-create-gitignore \
|
||||
--python "${RUNNER_TEMP}/python-runtime-build-venv" --wheel --out-dir "$wheel_dir" "$stage_dir"
|
||||
|
||||
- name: Upload Python runtime wheel
|
||||
if: ${{ matrix.build-system == 'cargo' }}
|
||||
|
||||
@@ -442,6 +442,12 @@ jobs:
|
||||
artifacts-dir: ${{ github.workspace }}/codex-rs/dist/${{ matrix.target }}
|
||||
binaries: codex-package-${{ matrix.target }}.tar.gz codex-package-${{ matrix.target }}.tar.zst
|
||||
|
||||
- name: Set up Python release tools
|
||||
if: ${{ matrix.build-system == 'cargo' && matrix.bundle == 'primary' && runner.os != 'macOS' }}
|
||||
uses: ./.github/actions/setup-python-release-tools
|
||||
with:
|
||||
group: runtime
|
||||
|
||||
- name: Build Python runtime wheel
|
||||
if: ${{ matrix.build-system == 'cargo' && matrix.bundle == 'primary' && runner.os != 'macOS' }}
|
||||
shell: bash
|
||||
@@ -467,11 +473,6 @@ jobs:
|
||||
;;
|
||||
esac
|
||||
|
||||
python3 -m venv "${RUNNER_TEMP}/python-runtime-build-venv"
|
||||
# Do not install into the runner's system Python; macOS runners mark
|
||||
# the Homebrew Python as externally managed under PEP 668.
|
||||
"${RUNNER_TEMP}/python-runtime-build-venv/bin/python" -m pip install build
|
||||
|
||||
# Keep the existing manylinux_2_17 wheel compatible with older glibc.
|
||||
# GNU voice libraries belong in the signed release package archives,
|
||||
# but their minimum glibc version is not covered by this wheel tag.
|
||||
@@ -500,7 +501,8 @@ jobs:
|
||||
--platform-tag "$platform_tag"
|
||||
)
|
||||
python3 "${stage_runtime_args[@]}"
|
||||
"${RUNNER_TEMP}/python-runtime-build-venv/bin/python" -m build --wheel --outdir "$wheel_dir" "$stage_dir"
|
||||
uv build --offline --no-build-isolation --no-create-gitignore \
|
||||
--python "${RUNNER_TEMP}/python-runtime-build-venv" --wheel --out-dir "$wheel_dir" "$stage_dir"
|
||||
|
||||
- name: Upload Python runtime wheel
|
||||
if: ${{ matrix.build-system == 'cargo' && matrix.bundle == 'primary' && runner.os != 'macOS' }}
|
||||
@@ -1081,6 +1083,12 @@ jobs:
|
||||
path: codex-rs/target/${{ matrix.target }}/release/codex-${{ matrix.target }}.dmg
|
||||
if-no-files-found: error
|
||||
|
||||
- name: Set up Python release tools
|
||||
if: ${{ matrix.build-system == 'cargo' && matrix.bundle == 'primary' }}
|
||||
uses: ./.github/actions/setup-python-release-tools
|
||||
with:
|
||||
group: runtime
|
||||
|
||||
- name: Build Python runtime wheel
|
||||
if: ${{ matrix.build-system == 'cargo' && matrix.bundle == 'primary' }}
|
||||
shell: bash
|
||||
@@ -1100,9 +1108,6 @@ jobs:
|
||||
;;
|
||||
esac
|
||||
|
||||
python3 -m venv "${RUNNER_TEMP}/python-runtime-build-venv"
|
||||
"${RUNNER_TEMP}/python-runtime-build-venv/bin/python" -m pip install build
|
||||
|
||||
# The wheel keeps its macOS 10.9/11 tags. The native voice build
|
||||
# currently targets macOS 14, so keep it in the release archives and
|
||||
# DMG but leave this older-OS-compatible wheel unchanged.
|
||||
@@ -1130,7 +1135,8 @@ jobs:
|
||||
"$wheel_archive" \
|
||||
--codex-version "${GITHUB_REF_NAME}" \
|
||||
--platform-tag "$platform_tag"
|
||||
"${RUNNER_TEMP}/python-runtime-build-venv/bin/python" -m build --wheel --outdir "$wheel_dir" "$stage_dir"
|
||||
uv build --offline --no-build-isolation --no-create-gitignore \
|
||||
--python "${RUNNER_TEMP}/python-runtime-build-venv" --wheel --out-dir "$wheel_dir" "$stage_dir"
|
||||
|
||||
- name: Upload Python runtime wheel
|
||||
if: ${{ matrix.build-system == 'cargo' && matrix.bundle == 'primary' }}
|
||||
|
||||
Reference in New Issue
Block a user