ci: migrate release-please to upstream action

[jbeckwith-oai]

Summary

• replace stainless-api/trigger-release-please with the upstream googleapis/release-please-action, pinned to verified v5.0.0 commit 45996ed
• run release-please explicitly against main with the repository's manifest configuration
• use the built-in GITHUB_TOKEN explicitly and remove the STAINLESS_API_KEY action input
• switch the config schema to upstream release-please and remove Stainless's prerelease/beta settings
• explicitly dispatch required checks for the generated release-please--branches--main PR
• keep the publish environment scoped to the PyPI publish job

Impact

Release PRs and GitHub releases are now managed entirely by the open-source release-please action. Stable release versions continue to update CHANGELOG.md, .release-please-manifest.json, pyproject.toml, and src/openai/_version.py; successful GitHub release creation still gates the existing build and trusted PyPI publish jobs.

Release Please deliberately uses GITHUB_TOKEN. Because GitHub suppresses ordinary push and pull-request events created by that token, a separate least-privilege job explicitly dispatches CI, breaking-change detection, and CodeQL against the generated release PR. It fetches the PR's live base SHA immediately before dispatch and restricts this path to the exact release-please--branches--main ref.

Permission audit

• release: contents: write for the release branch, tags, and GitHub releases; pull-requests: write for release PRs; issues: write for PR labels
• release PR checks: actions: write only to dispatch workflows and pull-requests: read only to obtain the current base SHA and verify the generated head branch
• CI and breaking-change workflows: default contents: read; the secret-bearing examples job is not dispatched for release PRs
• CI build: contents: read only, with checkout credential persistence disabled; the Stainless mirror's OIDC upload is isolated in a separate Stainless-only job
• CodeQL: contents: read and security-events: write in its existing dedicated workflow
• package build: contents: read only, with checkout credential persistence disabled
• publish: id-token: write only for PyPI Trusted Publishing
• no App private key, Stainless credential, or PyPI credential is exposed to the release workflow

Validation

• release-please v17.6.0 debug-config --dry-run: loaded the Python strategy with stable/default versioning and target branch main
• release-please v17.6.0 release-pr --dry-run: generated the expected stable branch and version-file changes
• release-please config validated against the exact v17.6.0 upstream JSON schema; current manifest baseline is 2.52.1
• pinned action interface, outputs, branch naming, and documented permissions verified against upstream source
• actionlint and YAML/JSON parsing
• git diff --check
• thermo-nuclear code-quality review: no findings

Cutover prerequisites completed

• existing Stainless release PR release: 2.52.1 #3562 was reviewed, merged, and released successfully as v2.52.1; the current release workflow completed GitHub release creation, build, and PyPI publishing in run 30835897995
• GitHub rejected its built-in Actions integration as a ruleset bypass actor, so active legacy ruleset 15951502 now excludes only refs/heads/release-please--branches--main; all other release-please--* branches and the two original bypass actors remain unchanged
• the migration branch includes the published 2.52.1 manifest/version baseline

After merge

• remove the now-unused STAINLESS_API_KEY secret from the repository/environment
• any future migration to the openai-sdks App should be handled separately; this PR intentionally uses only GITHUB_TOKEN

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 12.647s for Python SDK PR #3568.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	199ms
tests/chat-completions-create.test.ts	✅ Passed	270ms
tests/chat-completions-stream.test.ts	✅ Passed	159ms
tests/files-content-binary.test.ts	✅ Passed	261ms
tests/files-create-multipart.test.ts	✅ Passed	279ms
tests/files-list-pagination.test.ts	✅ Passed	196ms
tests/initialize-config.test.ts	✅ Passed	222ms
tests/instance-isolation.test.ts	✅ Passed	240ms
tests/models-list.test.ts	✅ Passed	204ms
tests/responses-background-lifecycle.test.ts	✅ Passed	256ms
tests/responses-body-method-errors.test.ts	✅ Passed	414ms
tests/responses-cancel-timeout.test.ts	✅ Passed	248ms
tests/responses-cancel.test.ts	✅ Passed	268ms
tests/responses-compact-retries.test.ts	✅ Passed	367ms
tests/responses-compact.test.ts	✅ Passed	353ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	178ms
tests/responses-create-advanced.test.ts	✅ Passed	262ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.318s
tests/responses-create-errors.test.ts	✅ Passed	277ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	265ms
tests/responses-create-retries.test.ts	✅ Passed	324ms
tests/responses-create-stream-failures.test.ts	✅ Passed	161ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	242ms
tests/responses-create-stream-wire.test.ts	✅ Passed	4.062s
tests/responses-create-stream.test.ts	✅ Passed	406ms
tests/responses-create-terminal-states.test.ts	✅ Passed	281ms
tests/responses-create-timeout.test.ts	✅ Passed	265ms
tests/responses-create.test.ts	✅ Passed	346ms
tests/responses-delete.test.ts	✅ Passed	244ms
tests/responses-input-items-errors.test.ts	✅ Passed	367ms
tests/responses-input-items-list.test.ts	✅ Passed	346ms
tests/responses-input-items-options.test.ts	✅ Passed	309ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	272ms
tests/responses-input-tokens-count.test.ts	✅ Passed	305ms
tests/responses-malformed-inputs.test.ts	✅ Passed	3.161s
tests/responses-not-found-errors.test.ts	✅ Passed	328ms
tests/responses-parse.test.ts	✅ Passed	468ms
tests/responses-retrieve-retries.test.ts	✅ Passed	343ms
tests/responses-retrieve.test.ts	✅ Passed	325ms
tests/responses-stored-method-errors.test.ts	✅ Passed	801ms
tests/retry-behavior.test.ts	✅ Passed	3.33s
tests/sdk-error-shape.test.ts	✅ Passed	369ms

View OkTest run #30836154009

_{SDK merge (1d723424f2da) · head (8b3bc1ccfc80) · base (f83b1f4cce7f) · OkTest (91635c6a2723)}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 77f69f23f4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[HAYDEN-OAI]

Two independent P1 release blockers make this migration unsafe to merge as written:

1. The existing unresolved review thread correctly identifies that GITHUB_TOKEN suppresses branch/PR workflow events. The main ruleset requires seven GitHub Actions checks, so generated release PRs cannot merge. Provision the short-lived openai-sdks installation token before cutover; deferring it to a follow-up halts releases.
2. The newly added inline comment identifies a separate protected-release-branch ruleset that neither GitHub Actions nor the proposed SDK App can bypass.

Additionally, the second inline comment documents why still-open release PR #3562 must be merged and released, or closed, before takeover. After the successful cutover, revoke/delete the still-configured STAINLESS_API_KEY from the publish environment.

The stable-release configuration, action pin, per-job permissions, checkout credential handling, and isolated PyPI OIDC publishing boundary otherwise look appropriate.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3cca60b70b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[HAYDEN-OAI]

Re-reviewed the full current diff at exact head 8b3bc1ccfc80ad7bcffc7b96270dd4121c3678d1 (newer than the previously reported 770f79fc) against the live rulesets, release state, pinned upstream action, and GitHub Actions event/token semantics.

• The least-privileged dispatch job fetches the live release PR/base SHA, verifies the exact release-please--branches--main head, and dispatches ci.yml, detect-breaking-changes.yml, and codeql.yml; the resulting jobs cover all seven status checks actually required by the active main ruleset. GitHub Code Quality also runs its separate dynamic analysis for GitHub-Actions-authored PRs.
• Active ruleset 15951502 now excludes only refs/heads/release-please--branches--main; existing release PR #3562 was merged and v2.52.1 was successfully released/published, with the migration branch carrying the matching manifest and version baseline.
• The release/build jobs have no OIDC access; Stainless OIDC is isolated to the Stainless-only upload job, and PyPI Trusted Publishing OIDC remains confined to the protected publish environment job. The upstream action pin resolves to v5.0.0, and the configuration validates against its bundled release-please v17.6.0 schema.
• All five prior review conversations are resolved.

No substantive findings. After merge, revoke/delete the still-present legacy STAINLESS_API_KEY from the publish environment as already planned.