From 70526df20d0c54bf07ca0a122244173066e4c1c4 Mon Sep 17 00:00:00 2001 From: Justin Beckwith Date: Fri, 31 Jul 2026 14:56:17 -0700 Subject: [PATCH 1/6] ci: run CodeQL only on main --- .github/workflows/codeql.yml | 8 -------- 1 file changed, 8 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f7e4d32f3..ca34cc913 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -4,14 +4,6 @@ on: push: branches: - main - pull_request: - branches: - - main - workflow_dispatch: - -concurrency: - group: codeql-${{ github.event.pull_request.number || github.run_id }} - cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: analyze: From 0bb4ec7344ac562eb1dc0de49f18b80ad98bd6c6 Mon Sep 17 00:00:00 2001 From: Justin Beckwith Date: Fri, 31 Jul 2026 15:51:11 -0700 Subject: [PATCH 2/6] ci: gate releases on CodeQL --- .github/workflows/create-releases.yml | 87 ++++++++++++++++++++++++--- 1 file changed, 77 insertions(+), 10 deletions(-) diff --git a/.github/workflows/create-releases.yml b/.github/workflows/create-releases.yml index f02ab6786..5251cc764 100644 --- a/.github/workflows/create-releases.yml +++ b/.github/workflows/create-releases.yml @@ -3,7 +3,11 @@ name: Create releases on: schedule: - cron: '0 5 * * *' # every day at 5am UTC - push: + workflow_run: + workflows: + - CodeQL + types: + - completed branches: - main workflow_dispatch: @@ -19,6 +23,7 @@ on: default: false permissions: + actions: read contents: read concurrency: @@ -33,7 +38,11 @@ env: jobs: release: name: Release / select source - if: github.ref == 'refs/heads/main' && github.repository == 'openai/openai-java' + if: >- + github.repository == 'openai/openai-java' && + ((github.event_name == 'workflow_run' && + github.event.workflow_run.conclusion == 'success') || + (github.event_name != 'workflow_run' && github.ref == 'refs/heads/main')) runs-on: ubuntu-24.04 timeout-minutes: 15 environment: publish @@ -50,14 +59,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: persist-credentials: false - - - name: Create release - if: github.event_name != 'workflow_dispatch' - id: automatic - uses: stainless-api/trigger-release-please@bb6677c5a04578eec1ccfd9e1913b5b78ed64c61 # v1.4.0 - with: - repo: ${{ github.event.repository.full_name }} - stainless-api-key: ${{ secrets.STAINLESS_API_KEY }} + ref: ${{ github.event.workflow_run.head_sha || github.sha }} - name: Validate retry request if: github.event_name == 'workflow_dispatch' @@ -123,6 +125,71 @@ jobs: echo "release_tag=$RELEASE_TAG" } >> "$GITHUB_OUTPUT" + - name: Verify successful CodeQL analysis + if: github.event_name != 'workflow_run' + env: + GH_TOKEN: ${{ github.token }} + SOURCE_SHA: ${{ steps.retry.outputs.source_sha || github.sha }} + run: | + set -euo pipefail + + run_json="$( + gh run list \ + --repo "$GITHUB_REPOSITORY" \ + --workflow codeql.yml \ + --commit "$SOURCE_SHA" \ + --event push \ + --limit 1 \ + --json conclusion,headSha,status,url + )" + + if [[ "$(jq 'length' <<< "$run_json")" -ne 1 ]]; then + echo "::error::No CodeQL push analysis found for $SOURCE_SHA" + exit 1 + fi + + analyzed_sha="$(jq -r '.[0].headSha' <<< "$run_json")" + status="$(jq -r '.[0].status' <<< "$run_json")" + conclusion="$(jq -r '.[0].conclusion // ""' <<< "$run_json")" + url="$(jq -r '.[0].url' <<< "$run_json")" + if [[ "$analyzed_sha" != "$SOURCE_SHA" || + "$status" != "completed" || "$conclusion" != "success" ]]; then + echo "::error::CodeQL analysis for $SOURCE_SHA is $status/$conclusion: $url" + exit 1 + fi + + echo "Verified successful CodeQL analysis for $SOURCE_SHA: $url" + + - name: Ensure automatic source is still current + if: github.event_name != 'workflow_dispatch' + id: automatic_source + env: + GH_TOKEN: ${{ github.token }} + SOURCE_SHA: ${{ github.event.workflow_run.head_sha || github.sha }} + run: | + set -euo pipefail + + main_sha="$( + gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/main" --jq '.object.sha' + )" + if [[ "$main_sha" != "$SOURCE_SHA" ]]; then + echo "Skipping stale source $SOURCE_SHA; main is now $main_sha" + echo "is_current=false" >> "$GITHUB_OUTPUT" + exit 0 + fi + + echo "is_current=true" >> "$GITHUB_OUTPUT" + + - name: Create release + if: >- + github.event_name != 'workflow_dispatch' && + steps.automatic_source.outputs.is_current == 'true' + id: automatic + uses: stainless-api/trigger-release-please@bb6677c5a04578eec1ccfd9e1913b5b78ed64c61 # v1.4.0 + with: + repo: ${{ github.event.repository.full_name }} + stainless-api-key: ${{ secrets.STAINLESS_API_KEY }} + runtime_compatibility: name: Release / runtime compatibility needs: release From 1525b5cc959f69abab859361f417a4a6cb6d97c9 Mon Sep 17 00:00:00 2001 From: Justin Beckwith Date: Fri, 31 Jul 2026 16:05:47 -0700 Subject: [PATCH 3/6] ci: retain manual CodeQL controls --- .github/workflows/codeql.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ca34cc913..720a5c975 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -4,6 +4,11 @@ on: push: branches: - main + workflow_dispatch: + +concurrency: + group: codeql-${{ github.ref }} + cancel-in-progress: true jobs: analyze: From 3ad03df500d8ffc34dea6ac108b6b0ca727c1b5c Mon Sep 17 00:00:00 2001 From: Justin Beckwith Date: Fri, 31 Jul 2026 16:33:34 -0700 Subject: [PATCH 4/6] ci: restrict release trigger to CodeQL pushes --- .github/workflows/create-releases.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/create-releases.yml b/.github/workflows/create-releases.yml index 5251cc764..b93ef4866 100644 --- a/.github/workflows/create-releases.yml +++ b/.github/workflows/create-releases.yml @@ -41,6 +41,7 @@ jobs: if: >- github.repository == 'openai/openai-java' && ((github.event_name == 'workflow_run' && + github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success') || (github.event_name != 'workflow_run' && github.ref == 'refs/heads/main')) runs-on: ubuntu-24.04 From d5a8f6d00a4d52e122f58bf4d37be5772a1f1cee Mon Sep 17 00:00:00 2001 From: Justin Beckwith Date: Fri, 31 Jul 2026 16:39:10 -0700 Subject: [PATCH 5/6] ci: harden CodeQL release orchestration --- .github/workflows/codeql.yml | 2 +- .github/workflows/create-releases.yml | 74 +++++++++++++++------------ 2 files changed, 41 insertions(+), 35 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 720a5c975..19020ee24 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -7,7 +7,7 @@ on: workflow_dispatch: concurrency: - group: codeql-${{ github.ref }} + group: codeql-${{ github.event_name }}-${{ github.ref }} cancel-in-progress: true jobs: diff --git a/.github/workflows/create-releases.yml b/.github/workflows/create-releases.yml index b93ef4866..99e9be990 100644 --- a/.github/workflows/create-releases.yml +++ b/.github/workflows/create-releases.yml @@ -126,8 +126,31 @@ jobs: echo "release_tag=$RELEASE_TAG" } >> "$GITHUB_OUTPUT" + - name: Ensure automatic source is still current + if: github.event_name != 'workflow_dispatch' + id: automatic_source + env: + GH_TOKEN: ${{ github.token }} + SOURCE_SHA: ${{ github.event.workflow_run.head_sha || github.sha }} + run: | + set -euo pipefail + + main_sha="$( + gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/main" --jq '.object.sha' + )" + if [[ "$main_sha" != "$SOURCE_SHA" ]]; then + echo "Skipping stale source $SOURCE_SHA; main is now $main_sha" + echo "is_current=false" >> "$GITHUB_OUTPUT" + exit 0 + fi + + echo "is_current=true" >> "$GITHUB_OUTPUT" + - name: Verify successful CodeQL analysis - if: github.event_name != 'workflow_run' + if: >- + github.event_name != 'workflow_run' && + (github.event_name == 'workflow_dispatch' || + steps.automatic_source.outputs.is_current == 'true') env: GH_TOKEN: ${{ github.token }} SOURCE_SHA: ${{ steps.retry.outputs.source_sha || github.sha }} @@ -140,47 +163,30 @@ jobs: --workflow codeql.yml \ --commit "$SOURCE_SHA" \ --event push \ - --limit 1 \ + --limit 100 \ --json conclusion,headSha,status,url )" + successful_run="$( + jq -c --arg source_sha "$SOURCE_SHA" ' + first( + .[] | + select( + .headSha == $source_sha and + .status == "completed" and + .conclusion == "success" + ) + ) // empty + ' <<< "$run_json" + )" - if [[ "$(jq 'length' <<< "$run_json")" -ne 1 ]]; then - echo "::error::No CodeQL push analysis found for $SOURCE_SHA" - exit 1 - fi - - analyzed_sha="$(jq -r '.[0].headSha' <<< "$run_json")" - status="$(jq -r '.[0].status' <<< "$run_json")" - conclusion="$(jq -r '.[0].conclusion // ""' <<< "$run_json")" - url="$(jq -r '.[0].url' <<< "$run_json")" - if [[ "$analyzed_sha" != "$SOURCE_SHA" || - "$status" != "completed" || "$conclusion" != "success" ]]; then - echo "::error::CodeQL analysis for $SOURCE_SHA is $status/$conclusion: $url" + if [[ -z "$successful_run" ]]; then + echo "::error::No successful CodeQL push analysis found for $SOURCE_SHA" exit 1 fi + url="$(jq -r '.url' <<< "$successful_run")" echo "Verified successful CodeQL analysis for $SOURCE_SHA: $url" - - name: Ensure automatic source is still current - if: github.event_name != 'workflow_dispatch' - id: automatic_source - env: - GH_TOKEN: ${{ github.token }} - SOURCE_SHA: ${{ github.event.workflow_run.head_sha || github.sha }} - run: | - set -euo pipefail - - main_sha="$( - gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/main" --jq '.object.sha' - )" - if [[ "$main_sha" != "$SOURCE_SHA" ]]; then - echo "Skipping stale source $SOURCE_SHA; main is now $main_sha" - echo "is_current=false" >> "$GITHUB_OUTPUT" - exit 0 - fi - - echo "is_current=true" >> "$GITHUB_OUTPUT" - - name: Create release if: >- github.event_name != 'workflow_dispatch' && From 9f69c3cb28137757b52f3fd0bfb3b59283c747df Mon Sep 17 00:00:00 2001 From: Justin Beckwith Date: Mon, 3 Aug 2026 08:52:36 -0700 Subject: [PATCH 6/6] ci: keep CodeQL informational for releases --- .github/workflows/codeql.yml | 2 +- .github/workflows/create-releases.yml | 94 +++------------------------ 2 files changed, 11 insertions(+), 85 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 19020ee24..720a5c975 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -7,7 +7,7 @@ on: workflow_dispatch: concurrency: - group: codeql-${{ github.event_name }}-${{ github.ref }} + group: codeql-${{ github.ref }} cancel-in-progress: true jobs: diff --git a/.github/workflows/create-releases.yml b/.github/workflows/create-releases.yml index 99e9be990..f02ab6786 100644 --- a/.github/workflows/create-releases.yml +++ b/.github/workflows/create-releases.yml @@ -3,11 +3,7 @@ name: Create releases on: schedule: - cron: '0 5 * * *' # every day at 5am UTC - workflow_run: - workflows: - - CodeQL - types: - - completed + push: branches: - main workflow_dispatch: @@ -23,7 +19,6 @@ on: default: false permissions: - actions: read contents: read concurrency: @@ -38,12 +33,7 @@ env: jobs: release: name: Release / select source - if: >- - github.repository == 'openai/openai-java' && - ((github.event_name == 'workflow_run' && - github.event.workflow_run.event == 'push' && - github.event.workflow_run.conclusion == 'success') || - (github.event_name != 'workflow_run' && github.ref == 'refs/heads/main')) + if: github.ref == 'refs/heads/main' && github.repository == 'openai/openai-java' runs-on: ubuntu-24.04 timeout-minutes: 15 environment: publish @@ -60,7 +50,14 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: persist-credentials: false - ref: ${{ github.event.workflow_run.head_sha || github.sha }} + + - name: Create release + if: github.event_name != 'workflow_dispatch' + id: automatic + uses: stainless-api/trigger-release-please@bb6677c5a04578eec1ccfd9e1913b5b78ed64c61 # v1.4.0 + with: + repo: ${{ github.event.repository.full_name }} + stainless-api-key: ${{ secrets.STAINLESS_API_KEY }} - name: Validate retry request if: github.event_name == 'workflow_dispatch' @@ -126,77 +123,6 @@ jobs: echo "release_tag=$RELEASE_TAG" } >> "$GITHUB_OUTPUT" - - name: Ensure automatic source is still current - if: github.event_name != 'workflow_dispatch' - id: automatic_source - env: - GH_TOKEN: ${{ github.token }} - SOURCE_SHA: ${{ github.event.workflow_run.head_sha || github.sha }} - run: | - set -euo pipefail - - main_sha="$( - gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/main" --jq '.object.sha' - )" - if [[ "$main_sha" != "$SOURCE_SHA" ]]; then - echo "Skipping stale source $SOURCE_SHA; main is now $main_sha" - echo "is_current=false" >> "$GITHUB_OUTPUT" - exit 0 - fi - - echo "is_current=true" >> "$GITHUB_OUTPUT" - - - name: Verify successful CodeQL analysis - if: >- - github.event_name != 'workflow_run' && - (github.event_name == 'workflow_dispatch' || - steps.automatic_source.outputs.is_current == 'true') - env: - GH_TOKEN: ${{ github.token }} - SOURCE_SHA: ${{ steps.retry.outputs.source_sha || github.sha }} - run: | - set -euo pipefail - - run_json="$( - gh run list \ - --repo "$GITHUB_REPOSITORY" \ - --workflow codeql.yml \ - --commit "$SOURCE_SHA" \ - --event push \ - --limit 100 \ - --json conclusion,headSha,status,url - )" - successful_run="$( - jq -c --arg source_sha "$SOURCE_SHA" ' - first( - .[] | - select( - .headSha == $source_sha and - .status == "completed" and - .conclusion == "success" - ) - ) // empty - ' <<< "$run_json" - )" - - if [[ -z "$successful_run" ]]; then - echo "::error::No successful CodeQL push analysis found for $SOURCE_SHA" - exit 1 - fi - - url="$(jq -r '.url' <<< "$successful_run")" - echo "Verified successful CodeQL analysis for $SOURCE_SHA: $url" - - - name: Create release - if: >- - github.event_name != 'workflow_dispatch' && - steps.automatic_source.outputs.is_current == 'true' - id: automatic - uses: stainless-api/trigger-release-please@bb6677c5a04578eec1ccfd9e1913b5b78ed64c61 # v1.4.0 - with: - repo: ${{ github.event.repository.full_name }} - stainless-api-key: ${{ secrets.STAINLESS_API_KEY }} - runtime_compatibility: name: Release / runtime compatibility needs: release