Build Python wheel in release-build, publish from artifact in release-publish

Move wheel build to a separate python-wheel job in release-build so
it can be scanned alongside the Go binaries. The publish workflow
downloads the pre-built wheel instead of building it.

Co-authored-by: Isaac

Author: pietern

.github/workflows/release-build.yml

@@ -122,3 +122,30 @@ jobs:
           files: |-
             dist/databricks_cli_*.zip
             dist/databricks_cli_*.tar.gz
+
+  python-wheel:
+    runs-on:
+      group: databricks-deco-testing-runner-group
+      labels: ubuntu-latest-deco
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        with:
+          version: "0.6.5"
+
+      - name: Build wheel
+        working-directory: python
+        run: make build
+
+      - name: Upload Python wheel
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: python-wheel
+          path: python/dist/*

.github/workflows/release-publish.yml

@@ -286,24 +286,18 @@ jobs:
       id-token: write
 
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ inputs.tag }}
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+      - name: Download Python wheel
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          version: "0.6.5"
-
-      - name: Build wheel
-        working-directory: python
-        run: make build
+          name: python-wheel
+          path: dist
+          run-id: ${{ inputs.build_run_id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Publish package distributions to PyPI
         uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
         with:
-          packages-dir: python/dist
+          packages-dir: dist
 
   publish-to-winget-pkgs:
     if: ${{ !inputs.dry_run }}