ci: migrate release-please to upstream action

[jbeckwith-oai]

Summary

• replace the Stainless release trigger with the pinned upstream googleapis/release-please-action v5.0.0
• run release-please explicitly against main using the repository manifest and ${{ secrets.GITHUB_TOKEN }}
• switch to the upstream configuration schema and remove prerelease/beta versioning
• include CONTRIBUTING.md, whose release-please version markers were previously omitted from extra-files
• remove the STAINLESS_API_KEY workflow input and keep publish-environment secrets isolated to the publish job
• deny token permissions by default and split automatic release creation, release-PR CI dispatch, manual retry handling, and publishing so each job receives only the scopes it needs
• explicitly dispatch full CI for GITHUB_TOKEN-generated release PRs, including API compatibility and the required aggregate check
• reject untrusted manual CI dispatches by requiring the exact bot-authored release PR head and deriving the compatibility baseline from that PR's GitHub-reported base
• refuse to run upstream release-please while legacy release PR release: 4.49.1 #835 remains open, preventing competing release PRs

The automatic release job alone receives contents, issues, and pull-requests write access. A separate release-PR CI job receives only actions: write; retry selection, runtime compatibility, and publishing receive only contents: read; the source selector receives no token permissions. The dispatched compatibility check adds only job-scoped pull-requests: read to validate the generated PR. Both the upstream action and retry verification explicitly use the built-in GITHUB_TOKEN—there is no private GitHub App credential or Stainless key in either path.

The live stainless release-please branches ruleset now excludes only refs/heads/release-please--branches--main from its create/update/delete restriction. GitHub does not permit its built-in Actions integration to be a ruleset bypass actor, so this exact-branch exclusion is required for GITHUB_TOKEN; every other release-please--* branch and all main protections remain unchanged.

Cutover requirement: merge or close legacy release PR #835 before the first upstream release run. The workflow enforces this and fails before creating a competing PR.

After this PR lands and the upstream workflow is in use, STAINLESS_API_KEY can be deleted from the publish environment.

Validation

• actionlint v1.7.12
• zizmor v1.28.0 workflow audit: no findings
• config validation against the release-please v17.6.0 JSON schema bundled by action v5.0.0
• release-please v17.6.0 resolved-config validation against main
• synthetic feature dry run produced stable release: 4.50.0 on release-please--branches--main and loaded all annotated version files
• legacy-PR guard confirmed against open PR release: 4.49.1 #835
• pinned upstream source confirms created and updated release PRs populate both prs_created and pr; unchanged PRs are omitted by release-please's update path
• required CI and CodeQL passed on 676311eb
• OkTest: 237/237 SDK tests passed on 676311eb
• thermo-nuclear code-quality review after the permission/job split and dispatch hardening: no findings

[Copilot]

Pull request overview

This PR migrates the repository’s automated release triggering workflow from the Stainless wrapper action to the upstream googleapis/release-please-action v5, aligning configuration with the upstream schema and simplifying credentials/secrets handling.

Changes:

• Switch release triggering to pinned googleapis/release-please-action v5 and run it explicitly against main using the repository manifest.
• Update release-please-config.json to the upstream schema and remove prerelease/beta versioning configuration.
• Add CONTRIBUTING.md to extra-files so its release-please version markers are included.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
release-please-config.json	Updates schema reference, removes prerelease settings, and adds CONTRIBUTING.md to extra-files.
.github/workflows/create-releases.yml	Replaces the Stainless trigger with the upstream release-please action and adjusts job permissions/secrets isolation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jbeckwith-oai]

Addressed the least-privilege feedback in 2e0588c1: the workflow now defaults to permissions: {}, automatic release creation is isolated with only contents, issues, and pull-requests write access, manual retry/compatibility/publish jobs have only contents: read, and the selector has no token permissions. Re-ran actionlint, the release-please schema validation, and the required thermo-nuclear review successfully.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[jbeckwith-oai]

Completed the comprehensive permissions and credential follow-up on the final rebased head:

• the upstream release action explicitly receives ${{ secrets.GITHUB_TOKEN }}
• manual retry verification explicitly uses the same built-in GITHUB_TOKEN
• no STAINLESS_API_KEY, Stainless action input, private key, or GitHub App ID remains in the release workflow
• automatic release creation alone has contents: write, issues: write, and pull-requests: write; those are the scopes release-please uses for tags/releases, its release PR, and the enabled release labels
• retry, compatibility, and publish jobs are contents: read; the selector is permissions: {}
• the publish environment is attached only to the Maven publishing job

Post-rebase validation passed: actionlint, pinned v17.6.0 schema validation, release-please resolved-config and stable-release dry runs, zizmor (no findings), diff checks, and the required thermo-nuclear review. The only inline review thread remains fixed and resolved.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 17.601s for Java SDK PR #836.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	672ms
tests/chat-completions-create.test.ts	✅ Passed	861ms
tests/chat-completions-stream.test.ts	✅ Passed	457ms
tests/files-content-binary.test.ts	✅ Passed	187ms
tests/files-create-multipart.test.ts	✅ Passed	270ms
tests/files-list-pagination.test.ts	✅ Passed	255ms
tests/initialize-config.test.ts	✅ Passed	218ms
tests/instance-isolation.test.ts	✅ Passed	281ms
tests/models-list.test.ts	✅ Passed	219ms
tests/responses-background-lifecycle.test.ts	✅ Passed	327ms
tests/responses-body-method-errors.test.ts	✅ Passed	593ms
tests/responses-cancel-timeout.test.ts	✅ Passed	262ms
tests/responses-cancel.test.ts	✅ Passed	281ms
tests/responses-compact-retries.test.ts	✅ Passed	457ms
tests/responses-compact.test.ts	✅ Passed	383ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	407ms
tests/responses-create-advanced.test.ts	✅ Passed	1.428s
tests/responses-create-disconnect.test.ts	✅ Passed	1.072s
tests/responses-create-errors.test.ts	✅ Passed	363ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	283ms
tests/responses-create-retries.test.ts	✅ Passed	317ms
tests/responses-create-stream-failures.test.ts	✅ Passed	217ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	232ms
tests/responses-create-stream-wire.test.ts	✅ Passed	6.727s
tests/responses-create-stream.test.ts	✅ Passed	120ms
tests/responses-create-terminal-states.test.ts	✅ Passed	496ms
tests/responses-create-timeout.test.ts	✅ Passed	237ms
tests/responses-create.test.ts	✅ Passed	322ms
tests/responses-delete.test.ts	✅ Passed	227ms
tests/responses-input-items-errors.test.ts	✅ Passed	303ms
tests/responses-input-items-list.test.ts	✅ Passed	438ms
tests/responses-input-items-options.test.ts	✅ Passed	636ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	244ms
tests/responses-input-tokens-count.test.ts	✅ Passed	557ms
tests/responses-malformed-inputs.test.ts	✅ Passed	5.197s
tests/responses-not-found-errors.test.ts	✅ Passed	482ms
tests/responses-parse.test.ts	✅ Passed	573ms
tests/responses-retrieve-retries.test.ts	✅ Passed	791ms
tests/responses-retrieve.test.ts	✅ Passed	299ms
tests/responses-stored-method-errors.test.ts	✅ Passed	1.065s
tests/retry-behavior.test.ts	✅ Passed	3.637s
tests/sdk-error-shape.test.ts	✅ Passed	500ms

View OkTest run #30839623390

_{SDK merge (3be52f570dca) · head (676311ebb22c) · base (c4a8d6c22d50) · OkTest (91635c6a2723)}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9eb639cee5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[HAYDEN-OAI]

Reviewed commit 9eb639cee5d2fc417489b8c3dbcc01be1df2d33c against the complete diff, upstream release-please source/documentation, live repository rulesets, workflow triggers, publishing environment, and existing release PRs.

There are two independent P1 release-path failures:

1. The active stainless release-please branches ruleset blocks creation/update of release-please--* branches unless the actor is the Stainless GitHub App (integration 378072) or @openai/sdks-team; the GITHUB_TOKEN actor is the GitHub Actions integration (15368) and has neither bypass.
2. The existing unresolved review conversation is also correct: GITHUB_TOKEN-generated release PRs do not trigger pull_request workflows, while the active main ruleset requires the GitHub Actions CI / required status check. Even granting this token branch-rule bypass would therefore still leave release PRs unable to satisfy the required check.

There is also a P2 migration issue: currently-open release PR #835 uses Stainless's release-please--branches--main--changes--next branch, whereas upstream generates release-please--branches--main and matches existing release PRs by exact head branch, so merging this migration first produces competing pending release PRs.

A narrowly scoped GitHub App installation token, explicitly authorized by the release-branch ruleset and capable of triggering downstream workflows, can address both P1 issues without broadly weakening branch protections; the in-flight Stainless release should also be drained or migrated before cutover.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[HAYDEN-OAI]

Reviewed exact head ba5195bf7d5ce984f72eb532810bc0a0a2113471 against the complete diff, pinned upstream action and release-please source, live repository/effective branch rulesets, release-token scopes, required-check provenance, legacy PR #835, and current GitHub Actions event semantics. The previously reported release-branch authorization, explicitly dispatched release-PR checks, least-privilege token split, and legacy-PR cutover guard are resolved. One new P1 remains: unrestricted manual CI dispatch plus a caller-selected base SHA can bypass the protected branch's API-compatibility gate; see the inline comment.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/create-releases.yml:88

• release_pr_ci is gated on prs_created == 'true', but the job consumes the release_pr payload. If release-please updates an existing release PR (common when new commits land on main) without treating it as “created”, this job won’t run and the release PR’s CI can become stale. Consider dispatching CI whenever release_pr is non-empty instead of only when prs_created is true.

    needs: automatic_release
    if: needs.automatic_release.outputs.prs_created == 'true'
    permissions:

[jbeckwith-oai]

Reviewed the suppressed Copilot note about updates to an existing release PR. No code change is needed: pinned release-please v17.6.0 returns a PullRequest when it creates or updates an existing PR, and returns undefined only when the existing PR body is unchanged. Pinned action v5 filters that result and derives both prs_created and pr from the same non-empty array. Therefore every real update dispatches CI; an unchanged PR does not need a rerun. Sources: https://github.com/googleapis/release-please/blob/v17.6.0/src/manifest.ts#L922-L966 and https://github.com/googleapis/release-please-action/blob/45996ed1f6d02564a971a2fa1b5860e934307cf7/src/index.ts#L219-L225. This verification is also recorded in the PR body.

[HAYDEN-OAI]

Reviewed exact head 676311ebb22cbb95e73bacc6ba6a14dea15ebe90 across the complete diff, live protections, pinned upstream release-please outputs, and release/retry/publishing paths. The prior P1 is fixed: manual CI no longer accepts a caller-controlled baseline, requires the exact same-repository bot-authored release PR/ref/head, and derives the compatibility base SHA from GitHub using job-scoped PR-read access. No substantive findings.