fix: address code scanning findings

[jbeckwith-oai]

Summary

• restrict the affected GitHub Actions jobs to explicit read-only repository permissions
• stop Cloudflare Worker, Vercel Edge, and Vercel Node test endpoints from returning stack traces in HTTP 500 responses while retaining server-side error logging
• add focused regressions for each error boundary and a Cloudflare health-check control

Root cause

Six jobs inherited the repository's default GITHUB_TOKEN permissions instead of declaring the minimum required scope. Three ecosystem-test endpoints also reused their server-side stack-trace diagnostics as public error-response bodies.

Validation

• ./scripts/lint on Node 24: Prettier, ESLint, build, TypeScript, ATTW, publint, and JSR dry-run all passed
• ./scripts/test on Node 24: 117 suites and 1,193 tests passed; one test intentionally skipped
• pnpm tsn ecosystem-tests/cli.ts cloudflare-worker vercel-edge --jobs=1 --verbose: both packages passed against the locally built openai-6.48.0 tarball
• focused Cloudflare regression/control tests: 2 passed
• focused Vercel Edge/Node regression tests: 2 passed
• actionlint on both changed workflows: passed

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 10.281s for Node SDK PR #2007.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	164ms
tests/chat-completions-create.test.ts	✅ Passed	248ms
tests/chat-completions-stream.test.ts	✅ Passed	210ms
tests/files-content-binary.test.ts	✅ Passed	151ms
tests/files-create-multipart.test.ts	✅ Passed	140ms
tests/files-list-pagination.test.ts	✅ Passed	152ms
tests/initialize-config.test.ts	✅ Passed	159ms
tests/instance-isolation.test.ts	✅ Passed	119ms
tests/models-list.test.ts	✅ Passed	136ms
tests/responses-background-lifecycle.test.ts	✅ Passed	222ms
tests/responses-body-method-errors.test.ts	✅ Passed	299ms
tests/responses-cancel-timeout.test.ts	✅ Passed	207ms
tests/responses-cancel.test.ts	✅ Passed	231ms
tests/responses-compact-retries.test.ts	✅ Passed	262ms
tests/responses-compact.test.ts	✅ Passed	210ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	119ms
tests/responses-create-advanced.test.ts	✅ Passed	175ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.031s
tests/responses-create-errors.test.ts	✅ Passed	179ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	174ms
tests/responses-create-retries.test.ts	✅ Passed	214ms
tests/responses-create-stream-failures.test.ts	✅ Passed	238ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	2.185s
tests/responses-create-stream-wire.test.ts	✅ Passed	2.563s
tests/responses-create-stream.test.ts	✅ Passed	69ms
tests/responses-create-terminal-states.test.ts	✅ Passed	210ms
tests/responses-create-timeout.test.ts	✅ Passed	235ms
tests/responses-create.test.ts	✅ Passed	128ms
tests/responses-delete.test.ts	✅ Passed	179ms
tests/responses-input-items-errors.test.ts	✅ Passed	180ms
tests/responses-input-items-list.test.ts	✅ Passed	146ms
tests/responses-input-items-options.test.ts	✅ Passed	179ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	241ms
tests/responses-input-tokens-count.test.ts	✅ Passed	227ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.202s
tests/responses-not-found-errors.test.ts	✅ Passed	267ms
tests/responses-parse.test.ts	✅ Passed	191ms
tests/responses-retrieve-retries.test.ts	✅ Passed	254ms
tests/responses-retrieve.test.ts	✅ Passed	352ms
tests/responses-stored-method-errors.test.ts	✅ Passed	517ms
tests/retry-behavior.test.ts	✅ Passed	3.042s
tests/sdk-error-shape.test.ts	✅ Passed	245ms

View OkTest run #29605086951

_{SDK merge (d28966d11294) · head (ae091b493875) · base (9bec3332133c) · OkTest (fd7a761c81c1)}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 747111806e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[HAYDEN-OAI]

re-reviewed the latest changes. the earlier credential-isolation and inner error-response issues are both addressed, and i did not find any remaining blockers. looks good to me, thanks!