ci: make Git release builds reusable

The release workflow owns the platform matrix, PGO training, and
packaging checks. Accept a source commit, version, upstream tag, and
recipe pin through workflow_call so callers can reuse those build jobs.

Keep public pushes on the controller-output check and publish only from
that path. Stamp requested builds with the source commit being compiled
and include the version in uploaded artifact names.

Share package checksum and size checks with a manifest helper. Record
one receipt per platform, verify all six against the requested source,
recipe, run, and archive bytes, and attach the manifest to the release.
Give the preview channel its own version suffix.

Signed-off-by: Taylor Blau <ttaylorr@openai.com>

Author: ttaylorr-oai

.github/workflows/codex-release.yml

@@ -1,6 +1,22 @@
 name: Codex Git release
 
 on:
+  workflow_call:
+    inputs:
+      source_sha:
+        description: Full source commit in the caller repository; build only.
+        required: true
+        type: string
+      version:
+        required: true
+        type: string
+      upstream_tag:
+        required: true
+        type: string
+      recipe_sha:
+        description: Full commit used to call this workflow.
+        required: true
+        type: string
   push:
     branches:
       - codex
@@ -10,14 +26,14 @@ permissions:
   contents: read
 
 concurrency:
-  group: codex-git-release-${{ github.sha }}
+  group: codex-git-release-${{ github.repository }}-${{ inputs.source_sha || github.sha }}
   cancel-in-progress: false
 
 jobs:
   publication:
     name: Verify controller publication
     runs-on: ubuntu-24.04
-    if: github.event.deleted == false
+    if: inputs.source_sha == '' && github.event.deleted == false
     outputs:
       published: ${{ steps.verify.outputs.published }}
     steps:
@@ -62,19 +78,21 @@ jobs:
   version:
     name: Determine version
     needs: publication
-    if: needs.publication.outputs.published == 'true'
+    if: ${{ !cancelled() && (inputs.source_sha != '' || needs.publication.outputs.published == 'true') }}
     runs-on: ubuntu-24.04
     outputs:
       describe: ${{ steps.version.outputs.describe }}
-      upstream_tag: ${{ steps.version.outputs.upstream_tag }}
-      version: ${{ steps.version.outputs.version }}
+      upstream_tag: ${{ inputs.upstream_tag || steps.version.outputs.upstream_tag }}
+      version: ${{ inputs.version || steps.version.outputs.version }}
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        if: inputs.source_sha == ''
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Derive OpenAI version from git describe
+        if: inputs.source_sha == ''
         id: version
         shell: bash
         run: |
@@ -95,16 +113,33 @@ jobs:
             upstream_tag=
             version="openai-$describe"
           fi
+          if test "$GITHUB_REF_NAME" = codex-unstable
+          then version="$version.codex-unstable"
+          fi
           git check-ref-format "refs/tags/$version"
           printf 'describe=%s\n' "$describe" | tee -a "$GITHUB_OUTPUT"
           printf 'upstream_tag=%s\n' "$upstream_tag" | tee -a "$GITHUB_OUTPUT"
           printf 'version=%s\n' "$version" | tee -a "$GITHUB_OUTPUT"
 
+      - name: Validate requested build inputs
+        if: inputs.source_sha != ''
+        env:
+          SOURCE_SHA: ${{ inputs.source_sha }}
+          RECIPE_SHA: ${{ inputs.recipe_sha }}
+          VERSION: ${{ inputs.version }}
+        run: |
+          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ && "$RECIPE_SHA" =~ ^[0-9a-f]{40}$ ]]
+          [[ "$VERSION" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]
+
   build:
+    if: ${{ !cancelled() && needs.version.result == 'success' }}
     name: ${{ matrix.name }}
     needs: version
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
+    env:
+      SOURCE_SHA: ${{ inputs.source_sha || github.sha }}
+      RECIPE_SHA: ${{ inputs.recipe_sha || github.sha }}
     strategy:
       fail-fast: false
       matrix:
@@ -120,7 +155,6 @@ jobs:
             lto: thin
             profile_format: LLVM
             llvm_profdata: xcrun llvm-profdata
-            max_tar_bytes: 67108864
           - name: macOS x64
             os: macos-15-intel
             target_platform: macOS
@@ -132,7 +166,6 @@ jobs:
             lto: thin
             profile_format: LLVM
             llvm_profdata: xcrun llvm-profdata
-            max_tar_bytes: 67108864
           # Keep arm64 builds native so release smoke tests can execute them.
           - name: Linux arm64
             os: ubuntu-22.04-arm
@@ -144,7 +177,6 @@ jobs:
             has_gcm: false
             lto: auto
             profile_format: GCC
-            max_tar_bytes: 67108864
           - name: Linux x64
             os: ubuntu-22.04
             target_platform: ubuntu
@@ -155,7 +187,6 @@ jobs:
             has_gcm: false
             lto: auto
             profile_format: GCC
-            max_tar_bytes: 67108864
           - name: Windows arm64
             os: windows-11-arm
             target_platform: win32
@@ -167,7 +198,6 @@ jobs:
             lto: thin
             profile_format: LLVM
             llvm_profdata: llvm-profdata
-            max_tar_bytes: 134217728
             sdk_arch: aarch64
             sdk_flavor: full
             mingw_dir: clangarm64
@@ -185,7 +215,6 @@ jobs:
             has_gcm: true
             lto: auto
             profile_format: GCC
-            max_tar_bytes: 134217728
             sdk_arch: x86_64
             sdk_flavor: full
             mingw_dir: mingw64
@@ -195,21 +224,31 @@ jobs:
             mingit_sha256: e3ea2944cea4b3fabcd69c7c1669ef69b1b66c05ac7806d81224d0abad2dec31
 
     steps:
+      - name: Check out the manifest helper from the recipe
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          repository: openai/git
+          ref: ${{ inputs.recipe_sha || github.sha }}
+          path: release-tooling
+          sparse-checkout: .github/workflows/git-release-manifest.sh
+          sparse-checkout-cone-mode: false
+          persist-credentials: false
+
       # Keep the packaging contract, dependency pins, and platform build logic
       # aligned with the artifacts already consumed by Codex and GitHub Desktop.
       - name: Check out Dugite Native
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
-          repository: desktop/dugite-native
-          ref: f97e50add48cdcff053a69d95aa343a4a4a258c2
+          repository: dreynaud-oai/dugite-native
+          ref: b6f4473557acb85433fdf9deffe0854a34fd9cc5
           path: dugite-native
           fetch-depth: 0
           persist-credentials: false
 
       - name: Check out this Git revision
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
-          ref: ${{ github.sha }}
+          ref: ${{ inputs.source_sha || github.sha }}
           path: dugite-native/git
           fetch-depth: 1
           persist-credentials: false
@@ -411,7 +450,7 @@ jobs:
 
           file "$GIT_BINARY" | tee /tmp/git-file-type
           grep -E "$FILE_PATTERN" /tmp/git-file-type
-          strings "$GIT_BINARY" | grep -F "$GITHUB_SHA"
+          strings "$GIT_BINARY" | grep -F "$SOURCE_SHA"
           grep -F -- "-flto=$LTO" dugite-native/git/GIT-CFLAGS
           if test "$PROFILE_FORMAT" = LLVM
           then
@@ -456,7 +495,7 @@ jobs:
 
           build_options="$(env "${git_env[@]}" "$git_binary" --version --build-options)"
           printf '%s\n' "$build_options"
-          grep -F "built from commit: $GITHUB_SHA" <<<"$build_options"
+          grep -F "built from commit: $SOURCE_SHA" <<<"$build_options"
           env "${git_env[@]}" "$git_binary" lfs version
           if test "$HAS_GCM" = true
           then
@@ -480,7 +519,6 @@ jobs:
           TARGET_PLATFORM: ${{ matrix.target_platform }}
           TARGET_ARCH: ${{ matrix.arch }}
           VERSION: ${{ needs.version.outputs.version }}
-          MAX_TAR_BYTES: ${{ matrix.max_tar_bytes }}
         run: |
           set -euo pipefail
           script/package.sh
@@ -498,28 +536,13 @@ jobs:
             mv "${matches[0]}.sha256" "$destination.sha256"
           done
 
-          for checksum in output/*.sha256
-          do
-            archive="${checksum%.sha256}"
-            expected="$(tr -d '\r\n' <"$checksum")"
-            if command -v sha256sum >/dev/null 2>&1
-            then
-              actual="$(sha256sum "$archive" | awk '{print $1}')"
-            else
-              actual="$(shasum -a 256 "$archive" | awk '{print $1}')"
-            fi
-            test "$actual" = "$expected"
-          done
-
-          tarball="output/git-$VERSION-$ASSET_PLATFORM-$TARGET_ARCH.tar.gz"
-          tar_bytes="$(wc -c <"$tarball")"
-          printf '%s bytes: %s\n' "$tar_bytes" "$tarball"
-          test "$tar_bytes" -le "$MAX_TAR_BYTES"
+          bash ../release-tooling/.github/workflows/git-release-manifest.sh \
+            record output "$ASSET_PLATFORM-$TARGET_ARCH"
 
       - name: Upload release assets
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
-          name: git-${{ matrix.asset_platform }}-${{ matrix.arch }}
+          name: git-${{ needs.version.outputs.version }}-${{ matrix.asset_platform }}-${{ matrix.arch }}
           path: dugite-native/output/git-*
           if-no-files-found: error
           retention-days: 7
@@ -534,6 +557,7 @@ jobs:
             Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
 
   release:
+    if: inputs.source_sha == ''
     name: Publish GitHub prerelease
     needs:
       - version
@@ -543,13 +567,31 @@ jobs:
     permissions:
       contents: write
     steps:
+      - name: Check out the manifest helper
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ github.sha }}
+          sparse-checkout: .github/workflows/git-release-manifest.sh
+          sparse-checkout-cone-mode: false
+          persist-credentials: false
+
       - name: Download release assets
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
-          pattern: git-*
+          pattern: git-${{ needs.version.outputs.version }}-*
           path: artifacts
           merge-multiple: true
 
+      - name: Combine the verified native receipts
+        env:
+          SOURCE_SHA: ${{ github.sha }}
+          RECIPE_SHA: ${{ github.sha }}
+          VERSION: ${{ needs.version.outputs.version }}
+          UPSTREAM_TAG: ${{ needs.version.outputs.upstream_tag }}
+          CHANNEL: ${{ github.ref_name }}
+          VISIBILITY: public
+        run: bash .github/workflows/git-release-manifest.sh collect artifacts >manifest.json
+
       - name: Publish immutable prerelease
         env:
           GH_TOKEN: ${{ github.token }}
@@ -558,7 +600,12 @@ jobs:
           VERSION: ${{ needs.version.outputs.version }}
         run: |
           set -euo pipefail
-          assets=(artifacts/git-*)
+          assets=(manifest.json)
+          for file in artifacts/git-*
+          do
+            case "$file" in *.build.json) continue ;; esac
+            assets+=("$file")
+          done
           release_notes=$(
             printf '%s\n' \
               "source_ref=$SOURCE_REF" \

.github/workflows/git-release-manifest.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# Record native artifacts, then combine only matching receipts into a manifest.
+set -euo pipefail
+test "$#" -ge 2
+mode=$1 directory=$2
+scratch=$(mktemp -d)
+trap 'rm -rf "$scratch"' EXIT
+[[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ && "$RECIPE_SHA" =~ ^[0-9a-f]{40}$ ]]
+[[ "$VERSION" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]
+hash () {
+	if command -v sha256sum >/dev/null
+	then sha256sum "$1"
+	else shasum -a 256 "$1"
+	fi | awk '{print $1}'
+}
+record () {
+	local target=$1 archive file sum bytes limit=67108864
+	case "$target" in
+	windows-arm64|windows-x64) limit=134217728 ;;
+	macOS-arm64|macOS-x64|ubuntu-arm64|ubuntu-x64) ;;
+	*) return 1 ;;
+	esac
+	: >"$scratch/assets"
+	for extension in tar.gz lzma
+	do
+		archive=$directory/git-$VERSION-$target.$extension
+		for file in "$archive" "$archive.sha256"
+		do
+			test -f "$file" && test ! -L "$file"
+			sum=$(hash "$file"); bytes=$(wc -c <"$file")
+			test "$bytes" -gt 0
+			jq -n --arg name "${file##*/}" --arg hash "$sum" --argjson size "$bytes" \
+				'{name:$name,sha256:$hash,size:$size}' >>"$scratch/assets"
+		done
+		test "$(tr -d '\r\n' <"$archive.sha256")" = "$(hash "$archive")"
+	done
+	test "$(wc -c <"$directory/git-$VERSION-$target.tar.gz")" -le "$limit"
+	jq -S -a -s --arg repository "$GITHUB_REPOSITORY" --arg version "$VERSION" \
+		--arg source "$SOURCE_SHA" --arg recipe "$RECIPE_SHA" --arg run "$GITHUB_RUN_ID" \
+		--arg target "$target" '{repository:$repository,source_sha:$source,version:$version,
+		recipe:{repository:"openai/git",sha:$recipe},run_id:$run,target:$target,assets:.}' "$scratch/assets"
+}
+case "$mode" in
+record) record "${3:?target required}" >"$directory/git-$VERSION-$3.build.json" ;;
+collect)
+	for target in macOS-arm64 macOS-x64 ubuntu-arm64 ubuntu-x64 windows-arm64 windows-x64
+	do
+		receipt=$directory/git-$VERSION-$target.build.json
+		test -f "$receipt" && test ! -L "$receipt"
+		record "$target" >"$scratch/$target.json"
+		cmp "$scratch/$target.json" "$receipt"
+	done
+	shopt -s nullglob dotglob
+	files=("$directory"/*)
+	test "${#files[@]}" -eq 30
+	jq -S -a -s --arg channel "$CHANNEL" --arg tag "$UPSTREAM_TAG" --arg visibility "$VISIBILITY" '
+		.[0] as $first | {schema_version:1,repository:$first.repository,visibility:$visibility,
+		channel:$channel,version:$first.version,source_sha:$first.source_sha,upstream_tag:$tag,
+		recipe:$first.recipe,targets:(map({key:.target,value:.assets}) | from_entries),
+		builds:(map({key:.target,value:.}) | from_entries)}' "$scratch/"*.json
+	;;
+*) echo 'usage: git-release-manifest.sh record <directory> <target> | collect <directory>' >&2; exit 129 ;;
+esac