name: python-sdk-release

on:
  push:
    tags:
      - "python-v*"

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

jobs:
  build-python-sdk:
    if: github.repository == 'openai/codex'
    name: build-python-sdk
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Validate tag and build Python SDK package
        shell: bash
        run: |
          set -euo pipefail

          sdk_version="${GITHUB_REF_NAME#python-v}"
          if [[ ! "${sdk_version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+b[0-9]+$ ]]; then
            echo "Python SDK release tags must identify a beta release, for example python-v0.1.0b1."
            exit 1
          fi

          # The pinned runtime currently publishes a musllinux Linux wheel.
          # Build in Alpine so release type generation installs that wheel.
          docker run --rm \
            --user "$(id -u):$(id -g)" \
            -e HOME=/tmp/codex-python-sdk-home \
            -e UV_LINK_MODE=copy \
            -e SDK_VERSION="${sdk_version}" \
            -e SDK_STAGE_DIR="${RUNNER_TEMP}/openai-codex" \
            -e SDK_DIST_DIR="${GITHUB_WORKSPACE}/dist/python-sdk" \
            -v "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}" \
            -v "${RUNNER_TEMP}:${RUNNER_TEMP}" \
            -w "${GITHUB_WORKSPACE}/sdk/python" \
            python:3.12-alpine \
            sh -euxc '
              python -m venv /tmp/release-tools
              /tmp/release-tools/bin/python -m pip install build twine uv==0.11.3
              /tmp/release-tools/bin/uv sync --extra dev --frozen
              /tmp/release-tools/bin/uv run --extra dev --frozen python scripts/update_sdk_artifacts.py \
                stage-sdk "${SDK_STAGE_DIR}" \
                --sdk-version "${SDK_VERSION}"
              /tmp/release-tools/bin/python -m build \
                --wheel \
                --sdist \
                --outdir "${SDK_DIST_DIR}" \
                "${SDK_STAGE_DIR}"
              /tmp/release-tools/bin/python -m twine check --strict "${SDK_DIST_DIR}/"*
            '

      - name: Upload Python SDK package
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: python-sdk-package
          path: dist/python-sdk/*
          if-no-files-found: error

  publish-python-sdk:
    name: publish-python-sdk
    needs: build-python-sdk
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      contents: read
      id-token: write # Required for PyPI trusted publishing.

    steps:
      - name: Download Python SDK package
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: python-sdk-package
          path: dist/python-sdk

      - name: Publish Python SDK to PyPI
        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
        with:
          packages-dir: dist/python-sdk