From 192d12fe75708a4e27c3fec96e4ca2a9747040ad Mon Sep 17 00:00:00 2001 From: Justin Beckwith Date: Mon, 3 Aug 2026 16:14:50 -0700 Subject: [PATCH 1/2] ci: use GitHub App for Release Please --- .github/workflows/ci.yml | 18 ++-- .github/workflows/create-releases.yml | 95 +++---------------- .github/workflows/detect-breaking-changes.yml | 17 +--- 3 files changed, 22 insertions(+), 108 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6b77b106e4..70a27d8ead 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,12 +18,6 @@ on: types: - checks_requested workflow_dispatch: - inputs: - release_pr: - description: Run required CI for a Release Please branch - required: false - default: false - type: boolean # Exercise the complete supported matrix and the next CPython prerelease # even when the repository has not changed. schedule: @@ -37,7 +31,7 @@ jobs: timeout-minutes: 10 name: lint runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }} - if: (github.event_name == 'push' || github.event_name == 'merge_group' || (github.event_name == 'workflow_dispatch' && inputs.release_pr && github.ref == 'refs/heads/release-please--branches--main') || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata') + if: (github.event_name == 'push' || github.event_name == 'merge_group' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata') steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 @@ -54,7 +48,7 @@ jobs: run: ./scripts/lint build: - if: (github.event_name == 'push' || github.event_name == 'merge_group' || (github.event_name == 'workflow_dispatch' && inputs.release_pr && github.ref == 'refs/heads/release-please--branches--main') || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata') + if: (github.event_name == 'push' || github.event_name == 'merge_group' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata') timeout-minutes: 10 name: build permissions: @@ -150,7 +144,7 @@ jobs: timeout-minutes: 15 name: test (Python ${{ matrix.python-version }}) runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }} - if: github.event_name == 'push' || github.event_name == 'merge_group' || (github.event_name == 'workflow_dispatch' && inputs.release_pr && github.ref == 'refs/heads/release-please--branches--main') || github.event.pull_request.head.repo.fork + if: github.event_name == 'push' || github.event_name == 'merge_group' || github.event.pull_request.head.repo.fork strategy: fail-fast: false matrix: @@ -192,7 +186,7 @@ jobs: timeout-minutes: 20 name: test (HTTPX2) runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }} - if: github.event_name == 'push' || github.event_name == 'merge_group' || (github.event_name == 'workflow_dispatch' && inputs.release_pr && github.ref == 'refs/heads/release-please--branches--main') || github.event.pull_request.head.repo.fork + if: github.event_name == 'push' || github.event_name == 'merge_group' || github.event.pull_request.head.repo.fork steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 @@ -230,7 +224,7 @@ jobs: name: examples environment: ci runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }} - if: github.repository == 'openai/openai-python' && (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata') + if: github.repository == 'openai/openai-python' && github.ref != 'refs/heads/release-please--branches--main' && (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata') steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 @@ -270,7 +264,7 @@ jobs: timeout-minutes: 20 name: compatibility (Python ${{ matrix.python-version }}) runs-on: ubuntu-latest - if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && !inputs.release_pr) + if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' continue-on-error: ${{ matrix.experimental }} strategy: fail-fast: false diff --git a/.github/workflows/create-releases.yml b/.github/workflows/create-releases.yml index 51264e6dfa..f5a620fbbc 100644 --- a/.github/workflows/create-releases.yml +++ b/.github/workflows/create-releases.yml @@ -9,99 +9,30 @@ jobs: name: release if: github.ref == 'refs/heads/main' && github.repository == 'openai/openai-python' runs-on: ubuntu-latest + environment: castiron-promotion outputs: releases_created: ${{ steps.release.outputs.releases_created }} - release_pr_branch: ${{ steps.release_pr.outputs.branch }} - release_pr_number: ${{ steps.release_pr.outputs.number }} - # Release Please writes its PR branch, tags/releases, PR, and PR labels. - permissions: - contents: write - issues: write - pull-requests: write + permissions: {} steps: + - name: Create release app token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.OPENAI_SDKS_APP_CLIENT_ID }} + private-key: ${{ secrets.OPENAI_SDKS_APP_PRIVATE_KEY }} + permission-contents: write + permission-issues: write + permission-pull-requests: write + - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 id: release with: - token: ${{ secrets.GITHUB_TOKEN }} + token: ${{ steps.app-token.outputs.token }} target-branch: main config-file: release-please-config.json manifest-file: .release-please-manifest.json - - name: Capture release PR - if: steps.release.outputs.prs_created == 'true' - id: release_pr - env: - RELEASE_PR: ${{ steps.release.outputs.pr }} - run: | - branch="$(jq -er '.headBranchName | select(. == "release-please--branches--main")' <<<"$RELEASE_PR")" - number="$(jq -er '.number | select(type == "number")' <<<"$RELEASE_PR")" - echo "branch=$branch" >> "$GITHUB_OUTPUT" - echo "number=$number" >> "$GITHUB_OUTPUT" - - release-pr-ci: - name: release PR CI - needs: release - if: ${{ needs.release.outputs.release_pr_branch != '' }} - runs-on: ubuntu-latest - # Read the release PR's current base SHA, then dispatch its required - # workflows. Keeping this separate prevents Release Please from receiving - # Actions write access. - permissions: - actions: write - pull-requests: read - - steps: - - name: Run required checks for release PR - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 - env: - RELEASE_PR_BRANCH: ${{ needs.release.outputs.release_pr_branch }} - RELEASE_PR_NUMBER: ${{ needs.release.outputs.release_pr_number }} - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - const expectedRef = process.env.RELEASE_PR_BRANCH; - const pullNumber = Number(process.env.RELEASE_PR_NUMBER); - if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) { - throw new Error('Release Please returned an invalid PR number'); - } - - const { data: pull } = await github.rest.pulls.get({ - owner: context.repo.owner, - repo: context.repo.repo, - pull_number: pullNumber, - }); - if (pull.head.ref !== expectedRef) { - throw new Error(`Release PR branch changed: expected ${expectedRef}, got ${pull.head.ref}`); - } - - const ref = pull.head.ref; - await Promise.all([ - github.rest.actions.createWorkflowDispatch({ - owner: context.repo.owner, - repo: context.repo.repo, - workflow_id: 'ci.yml', - ref, - inputs: { release_pr: 'true' }, - }), - github.rest.actions.createWorkflowDispatch({ - owner: context.repo.owner, - repo: context.repo.repo, - workflow_id: 'detect-breaking-changes.yml', - ref, - inputs: { - release_pr: 'true', - base_sha: pull.base.sha, - }, - }), - github.rest.actions.createWorkflowDispatch({ - owner: context.repo.owner, - repo: context.repo.repo, - workflow_id: 'codeql.yml', - ref, - }), - ]); - build: name: build needs: release diff --git a/.github/workflows/detect-breaking-changes.yml b/.github/workflows/detect-breaking-changes.yml index a68f49dc31..a1d2624e5d 100644 --- a/.github/workflows/detect-breaking-changes.yml +++ b/.github/workflows/detect-breaking-changes.yml @@ -7,17 +7,6 @@ on: merge_group: types: - checks_requested - workflow_dispatch: - inputs: - release_pr: - description: Run checks for a Release Please branch - required: false - default: false - type: boolean - base_sha: - description: Base commit for breaking-change comparison - required: false - type: string permissions: contents: read @@ -26,9 +15,9 @@ jobs: detect_breaking_changes: runs-on: 'ubuntu-latest' name: detect-breaking-changes - if: github.repository == 'openai/openai-python' && (github.event_name == 'pull_request' || github.event_name == 'merge_group' || (inputs.release_pr && github.ref == 'refs/heads/release-please--branches--main')) + if: github.repository == 'openai/openai-python' && (github.event_name == 'pull_request' || github.event_name == 'merge_group') env: - BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event_name == 'merge_group' && github.event.merge_group.base_sha || inputs.base_sha }} + BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.merge_group.base_sha }} FETCH_DEPTH: 0 steps: - name: Calculate fetch-depth @@ -63,7 +52,7 @@ jobs: agents_sdk: runs-on: 'ubuntu-latest' name: Detect Agents SDK regressions - if: github.repository == 'openai/openai-python' && (github.event_name == 'pull_request' || (inputs.release_pr && github.ref == 'refs/heads/release-please--branches--main')) + if: github.repository == 'openai/openai-python' && github.event_name == 'pull_request' steps: # Setup this sdk - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 From c223a72a5809730b3f2c1a57c56f7c4f694b8f3c Mon Sep 17 00:00:00 2001 From: Justin Beckwith Date: Tue, 4 Aug 2026 14:42:08 -0700 Subject: [PATCH 2/2] ci: use release environment for app token --- .github/workflows/create-releases.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/create-releases.yml b/.github/workflows/create-releases.yml index f5a620fbbc..cb1c8cc427 100644 --- a/.github/workflows/create-releases.yml +++ b/.github/workflows/create-releases.yml @@ -9,7 +9,7 @@ jobs: name: release if: github.ref == 'refs/heads/main' && github.repository == 'openai/openai-python' runs-on: ubuntu-latest - environment: castiron-promotion + environment: release outputs: releases_created: ${{ steps.release.outputs.releases_created }} permissions: {}