ci: isolate release checkouts and validate package builds

[mldangelo-oai]

What changed

• Check out the current publishing requirements and the package source in separate directories. The requirements are still copied from the current workflow commit, so manual publishing works for older tags that never included them.
• Run shell steps and uv in the full package checkout, check that pyproject.toml is present before installing dependencies, and upload artifacts from that checkout.
• Run this same package-build job on PRs touching the release workflow or its config. PRs build and validate artifacts with read-only permissions; the PyPI job explicitly excludes PRs.
• Document which events validate, build, and publish releases.

The original 0.2.0 publishing run stopped before publication because the sparse requirements checkout was reused for the tag and uv sync could not see pyproject.toml, even after checkout ran git sparse-checkout disable.

Validation

• actionlint and git diff --check.
• Executed the workflow’s real copy and presence-check shell steps against separate Git checkouts of both promptfoo-v0.2.0 and historical promptfoo-v0.1.3; both had a full package checkout and the current Twine requirements. The historical tag itself has no such requirements file.
• GitHub PR CI should now exercise the formerly skipped release-build job without publishing.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-18T19:47:34.659335Z	d538d46	PR opened
🔒 Security Review	✅ Completed 2026-09-18T19:48:00.855028Z	d538d46	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.