From 3d2b0e76e2c77d6c24ac45c9279b8ff73f815434 Mon Sep 17 00:00:00 2001 From: Hayden Date: Wed, 15 Jul 2026 22:54:50 +0000 Subject: [PATCH 1/5] ci: add Castiron promotion workflow --- .github/workflows/castiron-promote.yml | 117 +++++++++++++++++++++++++ 1 file changed, 117 insertions(+) create mode 100644 .github/workflows/castiron-promote.yml diff --git a/.github/workflows/castiron-promote.yml b/.github/workflows/castiron-promote.yml new file mode 100644 index 000000000..00b2226d6 --- /dev/null +++ b/.github/workflows/castiron-promote.yml @@ -0,0 +1,117 @@ +# Exact-tree public promotion for a previously reviewed Castiron candidate. +# Keep this wrapper thin: policy and copy mechanics live in the pinned monorepo writer. +# CASTIRON_PROMOTION_ENABLED is a repository/org variable because the job guard +# runs before GitHub attaches the protected environment. +# The protected castiron-promotion environment supplies the container/Azure +# variables plus the openai-sdks App private key. +name: Castiron promotion + +on: + workflow_dispatch: + inputs: + candidate_id: + description: SHA-256 ID of the approved Castiron candidate + required: true + type: string + preflight_contract_sha256: + description: SHA-256 digest of the published promotion preflight contract + required: true + type: string + +permissions: + contents: read + id-token: write + +concurrency: + group: castiron-promotion-${{ github.repository }} + cancel-in-progress: false + +jobs: + promote: + name: open exact-tree draft PR + # Keep the draft-stack pin inert until it is replaced with the merged SHA + # and admins explicitly enable the protected promotion environment. + if: >- + vars.CASTIRON_PROMOTION_ENABLED == 'true' && + github.repository == 'openai/openai-node' && + github.ref == 'refs/heads/main' + runs-on: ubuntu-latest + timeout-minutes: 30 + environment: castiron-promotion + permissions: + contents: read + id-token: write + + steps: + # Temporarily reuse openai-sdks for checkout, but mint a separate token + # scoped only to read openai/openai. Do not reuse the pair-scoped SDK + # write token for checkout. + - name: Mint monorepo checkout token + id: monorepo-token + uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 + with: + app-id: 3705508 # openai-sdks + private-key: ${{ secrets.OPENAI_SDKS_APP_PRIVATE_KEY }} + owner: openai + repositories: openai + permission-contents: read + + - name: Check out pinned Castiron writer + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + repository: openai/openai + # Replace this draft-stack SHA with the merged monorepo SHA before enabling. + ref: 586f788be0094332e6d7f6be3a8195e0356d7dc1 + path: openai + token: ${{ steps.monorepo-token.outputs.token }} + persist-credentials: false + + - name: Set up Python for the pinned writer + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + with: + python-version: '3.12' + + - name: Add pinned monorepo tools to PATH + run: echo "$GITHUB_WORKSPACE/openai/project/dotslash-gen/bin" >> "$GITHUB_PATH" + + - name: Azure login + uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 + with: + client-id: ${{ vars.CASTIRON_AZURE_CLIENT_ID }} + tenant-id: ${{ vars.CASTIRON_AZURE_TENANT_ID }} + allow-no-subscriptions: true + + # Mint this immediately before the writer runs. The writer independently + # verifies the installation scope and expected openai-sdks[bot] identity. + - name: Mint SDK promotion token + id: sdk-token + uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 + with: + app-id: 3705508 # openai-sdks + private-key: ${{ secrets.OPENAI_SDKS_APP_PRIVATE_KEY }} + owner: openai + repositories: | + openai-node + openai-node-internal + permission-actions: read + permission-contents: write + permission-members: read + permission-metadata: read + permission-pull-requests: write + + - name: Open exact-tree public draft PR + working-directory: openai + env: + GH_TOKEN: ${{ steps.sdk-token.outputs.token }} + CANDIDATE_ID: ${{ inputs.candidate_id }} + PREFLIGHT_CONTRACT_SHA256: ${{ inputs.preflight_contract_sha256 }} + CASTIRON_CONTAINER_URI: ${{ vars.CASTIRON_CONTAINER_URI }} + ACTOR: ${{ github.actor }} + run: | + bazel run //api/sdk-worker:castiron_candidate_public_pr_writer -- \ + --target openai-node \ + --container-uri "$CASTIRON_CONTAINER_URI" \ + --candidate-id "$CANDIDATE_ID" \ + --preflight-contract-sha256 "$PREFLIGHT_CONTRACT_SHA256" \ + --actor "$ACTOR" \ + --execute From 4f249933e85b9e160b560be3c5e0f3a2c140166d Mon Sep 17 00:00:00 2001 From: Hayden Date: Mon, 20 Jul 2026 17:45:17 +0000 Subject: [PATCH 2/5] ci: pin Castiron delta replay writer --- .github/workflows/castiron-promote.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/castiron-promote.yml b/.github/workflows/castiron-promote.yml index 00b2226d6..eb343994d 100644 --- a/.github/workflows/castiron-promote.yml +++ b/.github/workflows/castiron-promote.yml @@ -61,7 +61,7 @@ jobs: with: repository: openai/openai # Replace this draft-stack SHA with the merged monorepo SHA before enabling. - ref: 586f788be0094332e6d7f6be3a8195e0356d7dc1 + ref: d8cbd94252f90e876d31de7787e543909f9344f6 path: openai token: ${{ steps.monorepo-token.outputs.token }} persist-credentials: false From 574c605e333af02e77d07114b0ed9a14ba1c0dec Mon Sep 17 00:00:00 2001 From: Hayden Date: Mon, 20 Jul 2026 23:22:09 +0000 Subject: [PATCH 3/5] ci: pin Castiron public-main writer --- .github/workflows/castiron-promote.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/castiron-promote.yml b/.github/workflows/castiron-promote.yml index eb343994d..5c8c75101 100644 --- a/.github/workflows/castiron-promote.yml +++ b/.github/workflows/castiron-promote.yml @@ -1,4 +1,4 @@ -# Exact-tree public promotion for a previously reviewed Castiron candidate. +# Public-main promotion for a previously reviewed Castiron candidate. # Keep this wrapper thin: policy and copy mechanics live in the pinned monorepo writer. # CASTIRON_PROMOTION_ENABLED is a repository/org variable because the job guard # runs before GitHub attaches the protected environment. @@ -28,7 +28,7 @@ concurrency: jobs: promote: - name: open exact-tree draft PR + name: open public-main draft PR # Keep the draft-stack pin inert until it is replaced with the merged SHA # and admins explicitly enable the protected promotion environment. if: >- @@ -61,7 +61,7 @@ jobs: with: repository: openai/openai # Replace this draft-stack SHA with the merged monorepo SHA before enabling. - ref: d8cbd94252f90e876d31de7787e543909f9344f6 + ref: 7b8693d173a6d00a826817adccc2ceee93c0e1e8 path: openai token: ${{ steps.monorepo-token.outputs.token }} persist-credentials: false @@ -99,7 +99,7 @@ jobs: permission-metadata: read permission-pull-requests: write - - name: Open exact-tree public draft PR + - name: Open public-main draft PR working-directory: openai env: GH_TOKEN: ${{ steps.sdk-token.outputs.token }} From 840f2a5d5c2ce119b1e97af5b1a433fe256a410e Mon Sep 17 00:00:00 2001 From: Hayden Date: Thu, 23 Jul 2026 19:07:56 +0000 Subject: [PATCH 4/5] ci: pin merged Castiron orchestration writer --- .github/workflows/castiron-promote.yml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/.github/workflows/castiron-promote.yml b/.github/workflows/castiron-promote.yml index 5c8c75101..da6f59778 100644 --- a/.github/workflows/castiron-promote.yml +++ b/.github/workflows/castiron-promote.yml @@ -29,8 +29,7 @@ concurrency: jobs: promote: name: open public-main draft PR - # Keep the draft-stack pin inert until it is replaced with the merged SHA - # and admins explicitly enable the protected promotion environment. + # Keep promotion inert until admins explicitly configure and enable it. if: >- vars.CASTIRON_PROMOTION_ENABLED == 'true' && github.repository == 'openai/openai-node' && @@ -60,8 +59,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: repository: openai/openai - # Replace this draft-stack SHA with the merged monorepo SHA before enabling. - ref: 7b8693d173a6d00a826817adccc2ceee93c0e1e8 + ref: d2dbbaefab9ec4c7513abe593015a9f97597c18c path: openai token: ${{ steps.monorepo-token.outputs.token }} persist-credentials: false From f6af01b00ae10024c4e24e1ae794140a52916c82 Mon Sep 17 00:00:00 2001 From: Hayden Date: Thu, 23 Jul 2026 19:18:26 +0000 Subject: [PATCH 5/5] [ci] validate Castiron promotion inputs early --- .github/workflows/castiron-promote.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.github/workflows/castiron-promote.yml b/.github/workflows/castiron-promote.yml index da6f59778..269443bde 100644 --- a/.github/workflows/castiron-promote.yml +++ b/.github/workflows/castiron-promote.yml @@ -42,6 +42,22 @@ jobs: id-token: write steps: + # The pinned writer revalidates these values, but only after this wrapper + # has set up credentials. Reject malformed dispatches before any token mint. + - name: Validate dispatch inputs + env: + candidate_id: ${{ inputs.candidate_id }} + preflight_contract_sha256: ${{ inputs.preflight_contract_sha256 }} + run: | + set -euo pipefail + for input_name in candidate_id preflight_contract_sha256; do + input_value="${!input_name}" + if [[ ! "$input_value" =~ ^[0-9a-f]{64}$ ]]; then + echo "::error title=Invalid ${input_name}::${input_name} must be a lowercase SHA-256 hex digest." + exit 1 + fi + done + # Temporarily reuse openai-sdks for checkout, but mint a separate token # scoped only to read openai/openai. Do not reuse the pair-scoped SDK # write token for checkout.