From 0ce3b8da17688f089dc22c8b62e5e76af02e1d35 Mon Sep 17 00:00:00 2001 From: Hayden Date: Wed, 15 Jul 2026 22:54:50 +0000 Subject: [PATCH 1/3] ci: add Castiron promotion workflow --- .github/workflows/castiron-promote.yml | 117 +++++++++++++++++++++++++ 1 file changed, 117 insertions(+) create mode 100644 .github/workflows/castiron-promote.yml diff --git a/.github/workflows/castiron-promote.yml b/.github/workflows/castiron-promote.yml new file mode 100644 index 0000000000..138b4c0bad --- /dev/null +++ b/.github/workflows/castiron-promote.yml @@ -0,0 +1,117 @@ +# Exact-tree public promotion for a previously reviewed Castiron candidate. +# Keep this wrapper thin: policy and copy mechanics live in the pinned monorepo writer. +# CASTIRON_PROMOTION_ENABLED is a repository/org variable because the job guard +# runs before GitHub attaches the protected environment. +# The protected castiron-promotion environment supplies the container/Azure +# variables plus the openai-sdks App private key. +name: Castiron promotion + +on: + workflow_dispatch: + inputs: + candidate_id: + description: SHA-256 ID of the approved Castiron candidate + required: true + type: string + preflight_contract_sha256: + description: SHA-256 digest of the published promotion preflight contract + required: true + type: string + +permissions: + contents: read + id-token: write + +concurrency: + group: castiron-promotion-${{ github.repository }} + cancel-in-progress: false + +jobs: + promote: + name: open exact-tree draft PR + # Keep the draft-stack pin inert until it is replaced with the merged SHA + # and admins explicitly enable the protected promotion environment. + if: >- + vars.CASTIRON_PROMOTION_ENABLED == 'true' && + github.repository == 'openai/openai-python' && + github.ref == 'refs/heads/main' + runs-on: ubuntu-latest + timeout-minutes: 30 + environment: castiron-promotion + permissions: + contents: read + id-token: write + + steps: + # Temporarily reuse openai-sdks for checkout, but mint a separate token + # scoped only to read openai/openai. Do not reuse the pair-scoped SDK + # write token for checkout. + - name: Mint monorepo checkout token + id: monorepo-token + uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 + with: + app-id: 3705508 # openai-sdks + private-key: ${{ secrets.OPENAI_SDKS_APP_PRIVATE_KEY }} + owner: openai + repositories: openai + permission-contents: read + + - name: Check out pinned Castiron writer + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + repository: openai/openai + # Replace this draft-stack SHA with the merged monorepo SHA before enabling. + ref: 586f788be0094332e6d7f6be3a8195e0356d7dc1 + path: openai + token: ${{ steps.monorepo-token.outputs.token }} + persist-credentials: false + + - name: Set up Python for the pinned writer + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + with: + python-version: '3.12' + + - name: Add pinned monorepo tools to PATH + run: echo "$GITHUB_WORKSPACE/openai/project/dotslash-gen/bin" >> "$GITHUB_PATH" + + - name: Azure login + uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 + with: + client-id: ${{ vars.CASTIRON_AZURE_CLIENT_ID }} + tenant-id: ${{ vars.CASTIRON_AZURE_TENANT_ID }} + allow-no-subscriptions: true + + # Mint this immediately before the writer runs. The writer independently + # verifies the installation scope and expected openai-sdks[bot] identity. + - name: Mint SDK promotion token + id: sdk-token + uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 + with: + app-id: 3705508 # openai-sdks + private-key: ${{ secrets.OPENAI_SDKS_APP_PRIVATE_KEY }} + owner: openai + repositories: | + openai-python + openai-python-internal + permission-actions: read + permission-contents: write + permission-members: read + permission-metadata: read + permission-pull-requests: write + + - name: Open exact-tree public draft PR + working-directory: openai + env: + GH_TOKEN: ${{ steps.sdk-token.outputs.token }} + CANDIDATE_ID: ${{ inputs.candidate_id }} + PREFLIGHT_CONTRACT_SHA256: ${{ inputs.preflight_contract_sha256 }} + CASTIRON_CONTAINER_URI: ${{ vars.CASTIRON_CONTAINER_URI }} + ACTOR: ${{ github.actor }} + run: | + bazel run //api/sdk-worker:castiron_candidate_public_pr_writer -- \ + --target openai-python \ + --container-uri "$CASTIRON_CONTAINER_URI" \ + --candidate-id "$CANDIDATE_ID" \ + --preflight-contract-sha256 "$PREFLIGHT_CONTRACT_SHA256" \ + --actor "$ACTOR" \ + --execute From 0d7710bf5f970b3fbbdf01173888c4aa1cbdd2bc Mon Sep 17 00:00:00 2001 From: Hayden Date: Mon, 20 Jul 2026 17:45:17 +0000 Subject: [PATCH 2/3] ci: pin Castiron delta replay writer --- .github/workflows/castiron-promote.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/castiron-promote.yml b/.github/workflows/castiron-promote.yml index 138b4c0bad..f03cb45f25 100644 --- a/.github/workflows/castiron-promote.yml +++ b/.github/workflows/castiron-promote.yml @@ -61,7 +61,7 @@ jobs: with: repository: openai/openai # Replace this draft-stack SHA with the merged monorepo SHA before enabling. - ref: 586f788be0094332e6d7f6be3a8195e0356d7dc1 + ref: d8cbd94252f90e876d31de7787e543909f9344f6 path: openai token: ${{ steps.monorepo-token.outputs.token }} persist-credentials: false From c999cf782f6afc8e06bccc9a69372dd80c586fe9 Mon Sep 17 00:00:00 2001 From: Hayden Date: Mon, 20 Jul 2026 23:22:06 +0000 Subject: [PATCH 3/3] ci: pin Castiron public-main writer --- .github/workflows/castiron-promote.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/castiron-promote.yml b/.github/workflows/castiron-promote.yml index f03cb45f25..71bc174873 100644 --- a/.github/workflows/castiron-promote.yml +++ b/.github/workflows/castiron-promote.yml @@ -1,4 +1,4 @@ -# Exact-tree public promotion for a previously reviewed Castiron candidate. +# Public-main promotion for a previously reviewed Castiron candidate. # Keep this wrapper thin: policy and copy mechanics live in the pinned monorepo writer. # CASTIRON_PROMOTION_ENABLED is a repository/org variable because the job guard # runs before GitHub attaches the protected environment. @@ -28,7 +28,7 @@ concurrency: jobs: promote: - name: open exact-tree draft PR + name: open public-main draft PR # Keep the draft-stack pin inert until it is replaced with the merged SHA # and admins explicitly enable the protected promotion environment. if: >- @@ -61,7 +61,7 @@ jobs: with: repository: openai/openai # Replace this draft-stack SHA with the merged monorepo SHA before enabling. - ref: d8cbd94252f90e876d31de7787e543909f9344f6 + ref: 7b8693d173a6d00a826817adccc2ceee93c0e1e8 path: openai token: ${{ steps.monorepo-token.outputs.token }} persist-credentials: false @@ -99,7 +99,7 @@ jobs: permission-metadata: read permission-pull-requests: write - - name: Open exact-tree public draft PR + - name: Open public-main draft PR working-directory: openai env: GH_TOKEN: ${{ steps.sdk-token.outputs.token }}