fix(ci): preserve release source in Maven provenance by jbeckwith-oai · Pull Request #951 · openai/openai-java

jbeckwith-oai · 2026-08-28T04:16:55Z

Summary

keep the OIDC-authenticated workflow ref and SHA as the canonical first SLSA dependency so GitHub can persist Maven attestations
retain the verified release tag and checked-out release commit as a second resolved dependency, including historical manual retries
update workflow-policy coverage for both provenance identities

Verification

env JAVA_HOME=/opt/homebrew/opt/openjdk@21/libexec/openjdk.jdk/Contents/Home GRADLE_USER_HOME=/tmp/openai-java-gradle-950 ./gradlew :buildSrc:test
env JAVA_HOME=/opt/homebrew/opt/openjdk@21/libexec/openjdk.jdk/Contents/Home GRADLE_USER_HOME=/tmp/openai-java-gradle-950 ./gradlew lintKotlin
git diff --check

Fixes #950

openai-sdks · 2026-08-28T04:17:21Z

OkTest Summary

✅ 237/237 SDK tests passed in 17.591s for Java SDK PR #951.

Test results — 42 files

Test	Result	Time
`tests/chat-completions-complex-body.test.ts`	✅ Passed	423ms
`tests/chat-completions-create.test.ts`	✅ Passed	932ms
`tests/chat-completions-stream.test.ts`	✅ Passed	468ms
`tests/files-content-binary.test.ts`	✅ Passed	241ms
`tests/files-create-multipart.test.ts`	✅ Passed	273ms
`tests/files-list-pagination.test.ts`	✅ Passed	297ms
`tests/initialize-config.test.ts`	✅ Passed	188ms
`tests/instance-isolation.test.ts`	✅ Passed	234ms
`tests/models-list.test.ts`	✅ Passed	175ms
`tests/responses-background-lifecycle.test.ts`	✅ Passed	328ms
`tests/responses-body-method-errors.test.ts`	✅ Passed	477ms
`tests/responses-cancel-timeout.test.ts`	✅ Passed	218ms
`tests/responses-cancel.test.ts`	✅ Passed	263ms
`tests/responses-compact-retries.test.ts`	✅ Passed	458ms
`tests/responses-compact.test.ts`	✅ Passed	293ms
`tests/responses-create-advanced-stream.test.ts`	✅ Passed	725ms
`tests/responses-create-advanced.test.ts`	✅ Passed	1.218s
`tests/responses-create-disconnect.test.ts`	✅ Passed	1.088s
`tests/responses-create-errors.test.ts`	✅ Passed	430ms
`tests/responses-create-malformed-api-responses.test.ts`	✅ Passed	418ms
`tests/responses-create-retries.test.ts`	✅ Passed	288ms
`tests/responses-create-stream-failures.test.ts`	✅ Passed	214ms
`tests/responses-create-stream-timeout.test.ts`	✅ Passed	335ms
`tests/responses-create-stream-wire.test.ts`	✅ Passed	6.515s
`tests/responses-create-stream.test.ts`	✅ Passed	602ms
`tests/responses-create-terminal-states.test.ts`	✅ Passed	400ms
`tests/responses-create-timeout.test.ts`	✅ Passed	203ms
`tests/responses-create.test.ts`	✅ Passed	680ms
`tests/responses-delete.test.ts`	✅ Passed	265ms
`tests/responses-input-items-errors.test.ts`	✅ Passed	293ms
`tests/responses-input-items-list.test.ts`	✅ Passed	360ms
`tests/responses-input-items-options.test.ts`	✅ Passed	316ms
`tests/responses-input-tokens-count-timeout.test.ts`	✅ Passed	322ms
`tests/responses-input-tokens-count.test.ts`	✅ Passed	357ms
`tests/responses-malformed-inputs.test.ts`	✅ Passed	5.202s
`tests/responses-not-found-errors.test.ts`	✅ Passed	588ms
`tests/responses-parse.test.ts`	✅ Passed	642ms
`tests/responses-retrieve-retries.test.ts`	✅ Passed	372ms
`tests/responses-retrieve.test.ts`	✅ Passed	422ms
`tests/responses-stored-method-errors.test.ts`	✅ Passed	1.154s
`tests/retry-behavior.test.ts`	✅ Passed	3.69s
`tests/sdk-error-shape.test.ts`	✅ Passed	496ms

View OkTest run #33141366099

_{SDK merge (d8f85a8ecb6e) · head (3934ccdb3f24) · base (9684d5255f5a) · OkTest (2b1bdfd25e98)}

chatgpt-codex-connector · 2026-08-28T04:17:22Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-28T04:18:26.468914Z	`3934ccd`	PR opened
🔒 Security Review	✅ Completed 2026-08-28T04:18:38.236213Z	`3934ccd`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

github-actions · 2026-08-28T04:17:54Z

Castiron custom code

✅ No new custom-code files detected.

53 mixed files remain; 0 existing customizations changed.

Compared 9684d5255f5a → 3934ccdb3f24. Generated baselines verified.

53 existing customizations unchanged

openai-java-core/src/main/kotlin/com/openai/models/audio/AudioResponseFormat.kt
openai-java-core/src/main/kotlin/com/openai/models/chat/completions/ChatCompletionCreateParams.kt
openai-java-core/src/main/kotlin/com/openai/models/chat/completions/ChatCompletionMessageFunctionToolCall.kt
openai-java-core/src/main/kotlin/com/openai/models/chat/completions/ChatCompletionToolMessageParam.kt
openai-java-core/src/main/kotlin/com/openai/models/embeddings/Embedding.kt
openai-java-core/src/main/kotlin/com/openai/models/embeddings/EmbeddingCreateParams.kt
openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseCreateParams.kt
openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseFunctionToolCall.kt
openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseFunctionWebSearch.kt
openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseInputItem.kt
openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseTextConfig.kt
openai-java-core/src/main/kotlin/com/openai/models/videos/Video.kt
openai-java-core/src/main/kotlin/com/openai/services/async/BetaServiceAsync.kt
openai-java-core/src/main/kotlin/com/openai/services/async/BetaServiceAsyncImpl.kt
openai-java-core/src/main/kotlin/com/openai/services/async/ResponseServiceAsync.kt
openai-java-core/src/main/kotlin/com/openai/services/async/ResponseServiceAsyncImpl.kt
openai-java-core/src/main/kotlin/com/openai/services/async/WebhookServiceAsync.kt
openai-java-core/src/main/kotlin/com/openai/services/async/WebhookServiceAsyncImpl.kt
openai-java-core/src/main/kotlin/com/openai/services/async/audio/TranscriptionServiceAsyncImpl.kt
openai-java-core/src/main/kotlin/com/openai/services/async/chat/ChatCompletionServiceAsync.kt
openai-java-core/src/main/kotlin/com/openai/services/async/finetuning/checkpoints/PermissionServiceAsyncImpl.kt
openai-java-core/src/main/kotlin/com/openai/services/blocking/BetaService.kt
openai-java-core/src/main/kotlin/com/openai/services/blocking/BetaServiceImpl.kt
openai-java-core/src/main/kotlin/com/openai/services/blocking/ResponseService.kt
openai-java-core/src/main/kotlin/com/openai/services/blocking/ResponseServiceImpl.kt
openai-java-core/src/main/kotlin/com/openai/services/blocking/WebhookService.kt
openai-java-core/src/main/kotlin/com/openai/services/blocking/WebhookServiceImpl.kt
openai-java-core/src/main/kotlin/com/openai/services/blocking/audio/TranscriptionServiceImpl.kt
openai-java-core/src/main/kotlin/com/openai/services/blocking/chat/ChatCompletionService.kt
openai-java-core/src/main/kotlin/com/openai/services/blocking/finetuning/checkpoints/PermissionServiceImpl.kt
openai-java-core/src/test/kotlin/com/openai/models/beta/responses/BetaResponsesServerEventTest.kt
openai-java-core/src/test/kotlin/com/openai/models/responses/ResponsesServerEventTest.kt
openai-java-core/src/test/kotlin/com/openai/services/async/CompletionServiceAsyncTest.kt
openai-java-core/src/test/kotlin/com/openai/services/async/ImageServiceAsyncTest.kt
openai-java-core/src/test/kotlin/com/openai/services/async/ResponseServiceAsyncTest.kt
openai-java-core/src/test/kotlin/com/openai/services/async/WebhookServiceAsyncTest.kt
openai-java-core/src/test/kotlin/com/openai/services/async/audio/TranscriptionServiceAsyncTest.kt
openai-java-core/src/test/kotlin/com/openai/services/async/beta/ResponseServiceAsyncTest.kt
openai-java-core/src/test/kotlin/com/openai/services/async/beta/ThreadServiceAsyncTest.kt
openai-java-core/src/test/kotlin/com/openai/services/async/beta/threads/RunServiceAsyncTest.kt

13 more in the full report.

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 33141383080 --repo openai/openai-java \
  --name castiron-custom-code-33141383080-1 --dir /tmp/castiron-custom-code-33141383080-1
git apply --stat /tmp/castiron-custom-code-33141383080-1/custom-code.patch
cat /tmp/castiron-custom-code-33141383080-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 9684d5255f5a6b52234ad4dee461300ac2bc9e5a 3934ccdb3f248416afb61605825663ae762262cf
python3 scripts/castiron/custom_code_report.py report \
  --base 9684d5255f5a6b52234ad4dee461300ac2bc9e5a \
  --head 3934ccdb3f248416afb61605825663ae762262cf --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-3934ccdb3f24
cat /tmp/castiron-custom-code-3934ccdb3f24/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

jbeckwith-oai

Reviewed the exact current head. The provenance statement restores the workflow ref/SHA as the canonical first resolved dependency while preserving the checked-out release tag/source commit as the second dependency, with policy coverage for both identities. No blocking findings. (GitHub does not permit this account to formally approve its own PR.)

## Summary - stop the pre-GraalVM Gradle daemon before switching JVMs in the Maven publish job - serialize only the final publish graph so concurrent Dokka tasks do not exhaust the standard runner - add policy coverage that locks both stability controls to their intended workflow positions ## Context Follow-up to openai#951. The provenance fix is working, but three guarded v4.53.0 recovery attempts were canceled during the cold Gradle/Dokka publication phase. Logs show the first Gradle daemon remains alive after the JVM switch and multiple Dokka tasks start concurrently during publication. ## Verification - JAVA_HOME=/opt/homebrew/Cellar/openjdk@21/21.0.12/libexec/openjdk.jdk/Contents/Home GRADLE_USER_HOME=/tmp/openai-java-gradle-950 ./gradlew :buildSrc:test lintKotlin --no-daemon - git diff --check - security diff review: clean - adversarial review: round 1 found and fixed a test-coverage gap; rounds 2 and 3 clean ## Security - preserves the fresh private release Gradle User Home and cache-disabled setup - preserves tag/source verification, provenance attestation, digest continuity, SHA-pinned actions, and publish-step-only signing secrets - adds no permissions, actions, cache restore, artifact handoff, or runner dependency

Automated Release PR --- ## [4.55.0](openai/openai-java@v4.54.0...v4.55.0) (2026-08-31) ### Features * **api:** add compute_units to Responses and Chat Completions usage ([openai#944](openai#944)) ([3e45ffb](openai@3e45ffb)) * **auth:** add X.509 token exchange ([openai#940](openai#940)) ([df0c88d](openai@df0c88d)) * integrate X.509 workload identity with OkHttp clients ([openai#948](openai#948)) ([9684d52](openai@9684d52)) ### Bug Fixes * **auth:** bind X.509 bearer attachment to its mTLS transport ([openai#949](openai#949)) ([5f3ab4a](openai@5f3ab4a)) * bind X.509 transport clients to trusted origins ([openai#946](openai#946)) ([bccb100](openai@bccb100)) * **ci:** preserve release source in Maven provenance ([openai#951](openai#951)) ([0382c7c](openai@0382c7c)), closes [openai#950](openai#950) * **ci:** reduce Maven publish runner pressure ([openai#953](openai#953)) ([02b2d0d](openai@02b2d0d)) * fail closed when protected X.509 verification cannot run ([openai#945](openai#945)) ([24089bd](openai@24089bd)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: openai-sdks[bot] <284451331+openai-sdks[bot]@users.noreply.github.com>

fix(ci): preserve release source in Maven provenance

3934ccd

jbeckwith-oai requested a review from a team as a code owner August 28, 2026 04:16

jbeckwith-oai commented Aug 28, 2026

View reviewed changes

apcha-oai approved these changes Aug 28, 2026

View reviewed changes

jbeckwith-oai added this pull request to the merge queue Aug 28, 2026

Merged via the queue into main with commit 0382c7c Aug 28, 2026
13 checks passed

openai-sdks Bot mentioned this pull request Aug 28, 2026

release: 4.55.0 #943

Merged

jbeckwith-oai mentioned this pull request Aug 28, 2026

fix(ci): reduce Maven publish runner pressure #953

Merged

Navigation Menu

Uh oh!

fix(ci): preserve release source in Maven provenance - #951

fix(ci): preserve release source in Maven provenance#951
jbeckwith-oai merged 1 commit into
mainfrom
codex/fix-maven-release-attestation

jbeckwith-oai commented Aug 28, 2026

Uh oh!

openai-sdks Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 28, 2026

Uh oh!

jbeckwith-oai left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

jbeckwith-oai commented Aug 28, 2026

Summary

Verification

Uh oh!

openai-sdks Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

OkTest Summary

Uh oh!

chatgpt-codex-connector Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

github-actions Bot commented Aug 28, 2026

Castiron custom code

Uh oh!

jbeckwith-oai left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

openai-sdks Bot commented Aug 28, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Aug 28, 2026 •

edited

Loading