Skip to content

fix(ci): reduce Maven publish runner pressure - #953

Merged
jbeckwith-oai merged 1 commit into
mainfrom
codex/fix-release-publish-runner-pressure
Aug 28, 2026
Merged

fix(ci): reduce Maven publish runner pressure#953
jbeckwith-oai merged 1 commit into
mainfrom
codex/fix-release-publish-runner-pressure

Conversation

@jbeckwith-oai

Copy link
Copy Markdown
Contributor

Summary

  • stop the pre-GraalVM Gradle daemon before switching JVMs in the Maven publish job
  • serialize only the final publish graph so concurrent Dokka tasks do not exhaust the standard runner
  • add policy coverage that locks both stability controls to their intended workflow positions

Context

Follow-up to #951. The provenance fix is working, but three guarded v4.53.0 recovery attempts were canceled during the cold Gradle/Dokka publication phase. Logs show the first Gradle daemon remains alive after the JVM switch and multiple Dokka tasks start concurrently during publication.

Verification

  • JAVA_HOME=/opt/homebrew/Cellar/openjdk@21/21.0.12/libexec/openjdk.jdk/Contents/Home GRADLE_USER_HOME=/tmp/openai-java-gradle-950 ./gradlew :buildSrc:test lintKotlin --no-daemon
  • git diff --check
  • security diff review: clean
  • adversarial review: round 1 found and fixed a test-coverage gap; rounds 2 and 3 clean

Security

  • preserves the fresh private release Gradle User Home and cache-disabled setup
  • preserves tag/source verification, provenance attestation, digest continuity, SHA-pinned actions, and publish-step-only signing secrets
  • adds no permissions, actions, cache restore, artifact handoff, or runner dependency

@jbeckwith-oai
jbeckwith-oai requested a review from a team as a code owner August 28, 2026 22:59
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Aug 28, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-08-28T23:01:58.136789Z 65ccb00 PR opened
🔒 Security Review Completed 2026-08-28T23:01:20.022353Z 65ccb00 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@openai-sdks

openai-sdks Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

OkTest Summary

237/237 SDK tests passed in 18.499s for Java SDK PR #953.

Test results — 42 files
Test Result Time
tests/chat-completions-complex-body.test.ts ✅ Passed 260ms
tests/chat-completions-create.test.ts ✅ Passed 538ms
tests/chat-completions-stream.test.ts ✅ Passed 387ms
tests/files-content-binary.test.ts ✅ Passed 232ms
tests/files-create-multipart.test.ts ✅ Passed 278ms
tests/files-list-pagination.test.ts ✅ Passed 261ms
tests/initialize-config.test.ts ✅ Passed 262ms
tests/instance-isolation.test.ts ✅ Passed 214ms
tests/models-list.test.ts ✅ Passed 178ms
tests/responses-background-lifecycle.test.ts ✅ Passed 412ms
tests/responses-body-method-errors.test.ts ✅ Passed 499ms
tests/responses-cancel-timeout.test.ts ✅ Passed 250ms
tests/responses-cancel.test.ts ✅ Passed 318ms
tests/responses-compact-retries.test.ts ✅ Passed 327ms
tests/responses-compact.test.ts ✅ Passed 280ms
tests/responses-create-advanced-stream.test.ts ✅ Passed 649ms
tests/responses-create-advanced.test.ts ✅ Passed 1.124s
tests/responses-create-disconnect.test.ts ✅ Passed 1.059s
tests/responses-create-errors.test.ts ✅ Passed 372ms
tests/responses-create-malformed-api-responses.test.ts ✅ Passed 370ms
tests/responses-create-retries.test.ts ✅ Passed 1.096s
tests/responses-create-stream-failures.test.ts ✅ Passed 226ms
tests/responses-create-stream-timeout.test.ts ✅ Passed 317ms
tests/responses-create-stream-wire.test.ts ✅ Passed 8.117s
tests/responses-create-stream.test.ts ✅ Passed 520ms
tests/responses-create-terminal-states.test.ts ✅ Passed 383ms
tests/responses-create-timeout.test.ts ✅ Passed 222ms
tests/responses-create.test.ts ✅ Passed 264ms
tests/responses-delete.test.ts ✅ Passed 292ms
tests/responses-input-items-errors.test.ts ✅ Passed 295ms
tests/responses-input-items-list.test.ts ✅ Passed 456ms
tests/responses-input-items-options.test.ts ✅ Passed 223ms
tests/responses-input-tokens-count-timeout.test.ts ✅ Passed 241ms
tests/responses-input-tokens-count.test.ts ✅ Passed 383ms
tests/responses-malformed-inputs.test.ts ✅ Passed 6.702s
tests/responses-not-found-errors.test.ts ✅ Passed 407ms
tests/responses-parse.test.ts ✅ Passed 619ms
tests/responses-retrieve-retries.test.ts ✅ Passed 330ms
tests/responses-retrieve.test.ts ✅ Passed 272ms
tests/responses-stored-method-errors.test.ts ✅ Passed 962ms
tests/retry-behavior.test.ts ✅ Passed 3.715s
tests/sdk-error-shape.test.ts ✅ Passed 461ms

View OkTest run #33218851731

SDK merge (42223e2db4ff) · head (65ccb009a89a) · base (5f3ab4a3e839) · OkTest (2b1bdfd25e98)

@github-actions

Copy link
Copy Markdown
Contributor

Castiron custom code

✅ No new custom-code files detected.

53 mixed files remain; 0 existing customizations changed.

Compared 0382c7cfacf065ccb009a89a. Generated baselines verified.

53 existing customizations unchanged
  • openai-java-core/src/main/kotlin/com/openai/models/audio/AudioResponseFormat.kt
  • openai-java-core/src/main/kotlin/com/openai/models/chat/completions/ChatCompletionCreateParams.kt
  • openai-java-core/src/main/kotlin/com/openai/models/chat/completions/ChatCompletionMessageFunctionToolCall.kt
  • openai-java-core/src/main/kotlin/com/openai/models/chat/completions/ChatCompletionToolMessageParam.kt
  • openai-java-core/src/main/kotlin/com/openai/models/embeddings/Embedding.kt
  • openai-java-core/src/main/kotlin/com/openai/models/embeddings/EmbeddingCreateParams.kt
  • openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseCreateParams.kt
  • openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseFunctionToolCall.kt
  • openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseFunctionWebSearch.kt
  • openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseInputItem.kt
  • openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseTextConfig.kt
  • openai-java-core/src/main/kotlin/com/openai/models/videos/Video.kt
  • openai-java-core/src/main/kotlin/com/openai/services/async/BetaServiceAsync.kt
  • openai-java-core/src/main/kotlin/com/openai/services/async/BetaServiceAsyncImpl.kt
  • openai-java-core/src/main/kotlin/com/openai/services/async/ResponseServiceAsync.kt
  • openai-java-core/src/main/kotlin/com/openai/services/async/ResponseServiceAsyncImpl.kt
  • openai-java-core/src/main/kotlin/com/openai/services/async/WebhookServiceAsync.kt
  • openai-java-core/src/main/kotlin/com/openai/services/async/WebhookServiceAsyncImpl.kt
  • openai-java-core/src/main/kotlin/com/openai/services/async/audio/TranscriptionServiceAsyncImpl.kt
  • openai-java-core/src/main/kotlin/com/openai/services/async/chat/ChatCompletionServiceAsync.kt
  • openai-java-core/src/main/kotlin/com/openai/services/async/finetuning/checkpoints/PermissionServiceAsyncImpl.kt
  • openai-java-core/src/main/kotlin/com/openai/services/blocking/BetaService.kt
  • openai-java-core/src/main/kotlin/com/openai/services/blocking/BetaServiceImpl.kt
  • openai-java-core/src/main/kotlin/com/openai/services/blocking/ResponseService.kt
  • openai-java-core/src/main/kotlin/com/openai/services/blocking/ResponseServiceImpl.kt
  • openai-java-core/src/main/kotlin/com/openai/services/blocking/WebhookService.kt
  • openai-java-core/src/main/kotlin/com/openai/services/blocking/WebhookServiceImpl.kt
  • openai-java-core/src/main/kotlin/com/openai/services/blocking/audio/TranscriptionServiceImpl.kt
  • openai-java-core/src/main/kotlin/com/openai/services/blocking/chat/ChatCompletionService.kt
  • openai-java-core/src/main/kotlin/com/openai/services/blocking/finetuning/checkpoints/PermissionServiceImpl.kt
  • openai-java-core/src/test/kotlin/com/openai/models/beta/responses/BetaResponsesServerEventTest.kt
  • openai-java-core/src/test/kotlin/com/openai/models/responses/ResponsesServerEventTest.kt
  • openai-java-core/src/test/kotlin/com/openai/services/async/CompletionServiceAsyncTest.kt
  • openai-java-core/src/test/kotlin/com/openai/services/async/ImageServiceAsyncTest.kt
  • openai-java-core/src/test/kotlin/com/openai/services/async/ResponseServiceAsyncTest.kt
  • openai-java-core/src/test/kotlin/com/openai/services/async/WebhookServiceAsyncTest.kt
  • openai-java-core/src/test/kotlin/com/openai/services/async/audio/TranscriptionServiceAsyncTest.kt
  • openai-java-core/src/test/kotlin/com/openai/services/async/beta/ResponseServiceAsyncTest.kt
  • openai-java-core/src/test/kotlin/com/openai/services/async/beta/ThreadServiceAsyncTest.kt
  • openai-java-core/src/test/kotlin/com/openai/services/async/beta/threads/RunServiceAsyncTest.kt

13 more in the full report.

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 33218883863 --repo openai/openai-java \
  --name castiron-custom-code-33218883863-1 --dir /tmp/castiron-custom-code-33218883863-1
git apply --stat /tmp/castiron-custom-code-33218883863-1/custom-code.patch
cat /tmp/castiron-custom-code-33218883863-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 5f3ab4a3e839b30f0d22d4b036223c4f6f6fce4e 65ccb009a89a57481f9dc7817d2d801f03ca75e0
python3 scripts/castiron/custom_code_report.py report \
  --base 5f3ab4a3e839b30f0d22d4b036223c4f6f6fce4e \
  --head 65ccb009a89a57481f9dc7817d2d801f03ca75e0 --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-65ccb009a89a
cat /tmp/castiron-custom-code-65ccb009a89a/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

@HAYDEN-OAI HAYDEN-OAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed 65ccb009a89a57481f9dc7817d2d801f03ca75e0; no substantive issues found. The daemon stop precedes the JVM switch, and serialization is scoped to the final publication invocation. The isolated Gradle home, verified release source, attestation/JAR digest continuity, and publish-step-only signing credentials remain intact.

@jbeckwith-oai
jbeckwith-oai added this pull request to the merge queue Aug 28, 2026
Merged via the queue into main with commit 02b2d0d Aug 28, 2026
13 checks passed
@openai-sdks openai-sdks Bot mentioned this pull request Aug 28, 2026
pietdaniel pushed a commit to pietdaniel/openai-java that referenced this pull request Aug 31, 2026
Automated Release PR
---


##
[4.55.0](openai/openai-java@v4.54.0...v4.55.0)
(2026-08-31)


### Features

* **api:** add compute_units to Responses and Chat Completions usage
([openai#944](openai#944))
([3e45ffb](openai@3e45ffb))
* **auth:** add X.509 token exchange
([openai#940](openai#940))
([df0c88d](openai@df0c88d))
* integrate X.509 workload identity with OkHttp clients
([openai#948](openai#948))
([9684d52](openai@9684d52))


### Bug Fixes

* **auth:** bind X.509 bearer attachment to its mTLS transport
([openai#949](openai#949))
([5f3ab4a](openai@5f3ab4a))
* bind X.509 transport clients to trusted origins
([openai#946](openai#946))
([bccb100](openai@bccb100))
* **ci:** preserve release source in Maven provenance
([openai#951](openai#951))
([0382c7c](openai@0382c7c)),
closes [openai#950](openai#950)
* **ci:** reduce Maven publish runner pressure
([openai#953](openai#953))
([02b2d0d](openai@02b2d0d))
* fail closed when protected X.509 verification cannot run
([openai#945](openai#945))
([24089bd](openai@24089bd))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: openai-sdks[bot] <284451331+openai-sdks[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants