mirror of
https://github.com/openai/codex.git
synced 2026-10-23 18:08:45 +00:00
Adam Perry @ OpenAI
66f6da6036
## Why Python release jobs installed build tools without a shared lockfile and allowed isolated builds to resolve additional dependencies. Release retries can also build older source revisions, so their tool pins need to come from the running workflow revision. ## What changed - Add a shared setup action with pinned `uv` and locked `sdk` and `runtime` dependency groups. Apply a seven-day dependency age cutoff, with a two-day exception for `certifi` CA trust updates. - Use the action for Python SDK and runtime packaging across Linux, macOS, and Windows. Build with `uv build --offline --no-build-isolation` using the prepared environments. - In the standalone Python build workflows, check out the release tools from `github.workflow_sha` separately from the requested source revision. GitOrigin-RevId: a9c0344930e5b9870ce9f7754a1fee1a9219305c
79 lines
2.6 KiB
YAML
79 lines
2.6 KiB
YAML
name: python-sdk-build
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
source_ref:
|
|
description: "Source revision to build; defaults to the calling workflow revision."
|
|
required: false
|
|
type: string
|
|
sdk_version:
|
|
description: "Python SDK version to build."
|
|
required: true
|
|
type: string
|
|
runtime_version:
|
|
description: "Exact Python CLI runtime dependency for this SDK release."
|
|
required: true
|
|
type: string
|
|
|
|
jobs:
|
|
build-python-sdk:
|
|
if: github.repository == 'openai/codex'
|
|
name: build-python-sdk
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
ref: ${{ inputs.source_ref || github.sha }}
|
|
persist-credentials: false
|
|
|
|
# A retry can rebuild an older release. Use the tool pins from this workflow.
|
|
- name: Checkout release build tools
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
ref: ${{ github.workflow_sha }}
|
|
path: release-tools
|
|
sparse-checkout: .github/actions/setup-python-release-tools
|
|
persist-credentials: false
|
|
|
|
- name: Setup Python
|
|
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Set up Python release tools
|
|
uses: ./release-tools/.github/actions/setup-python-release-tools
|
|
with:
|
|
group: sdk
|
|
|
|
- name: Build Python SDK package
|
|
shell: bash
|
|
env:
|
|
SDK_VERSION: ${{ inputs.sdk_version }}
|
|
RUNTIME_VERSION: ${{ inputs.runtime_version }}
|
|
run: |
|
|
set -euo pipefail
|
|
build_python="${RUNNER_TEMP}/python-sdk-build-venv/bin/python"
|
|
"$build_python" sdk/python/scripts/update_sdk_artifacts.py \
|
|
stage-sdk "${RUNNER_TEMP}/openai-codex" \
|
|
--sdk-version "$SDK_VERSION" \
|
|
--codex-version "$RUNTIME_VERSION"
|
|
uv build --offline --no-build-isolation --no-create-gitignore \
|
|
--force-pep517 --python "$build_python" \
|
|
--wheel \
|
|
--sdist \
|
|
--out-dir dist/python-sdk \
|
|
"${RUNNER_TEMP}/openai-codex"
|
|
"$build_python" -m twine check --strict dist/python-sdk/*
|
|
|
|
- name: Upload Python SDK package
|
|
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
|
|
with:
|
|
name: python-sdk-package
|
|
path: dist/python-sdk/*
|
|
if-no-files-found: error
|