ci: Consolidate and harden CI workflows#811
Conversation
There was a problem hiding this comment.
Pull request overview
This PR consolidates and hardens the repository’s GitHub Actions setup to reduce duplicate CI runs, create a single stable required gate, move live-API examples to a post-merge smoke test, and unify Sonatype publishing via a reusable workflow. It also makes test execution more deterministic and more stable under parallel JDK 21 execution.
Changes:
- Restructures CI triggers and job layout, adding a single
CI / requiredgate and moving API-compatibility checks into the main CI workflow. - Introduces a reusable Sonatype publishing workflow and updates manual/automatic publication workflows to call it.
- Improves test determinism/stability (Steady seeding; SLF4J/Mockito adjustments for parallel tests).
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| scripts/mock | Adds a fixed Steady generator seed for deterministic mock server behavior. |
| scripts/detect-breaking-changes | Hardens CLI usage and switches API-compat detection to compile prior tests via Gradle testClasses. |
| openai-java-core/build.gradle.kts | Adds Mockito javaagent wiring and SLF4J nop binding for more stable parallel tests. |
| .github/workflows/publish-sonatype.yml | Converts manual Sonatype recovery workflow to call the reusable publish workflow. |
| .github/workflows/publish-sonatype-reusable.yml | Adds a reusable workflow encapsulating the Sonatype publish pipeline. |
| .github/workflows/examples.yml | Adds a post-merge live API “examples smoke test” workflow on main. |
| .github/workflows/detect-breaking-changes.yml | Removes the standalone breaking-changes workflow (folded into CI). |
| .github/workflows/create-releases.yml | Tightens runner/timeout/concurrency and reuses Sonatype publish workflow when releases are created. |
| .github/workflows/codeql.yml | Renames and hardens CodeQL workflow (permissions/concurrency/runner/action pins). |
| .github/workflows/ci.yml | Consolidates lint/build/test/API-compat behind CI / required, and narrows push/PR triggers to main/next. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
bc0ce28 to
0497669
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (4)
openai-java-core/build.gradle.kts:88
- Using
mockitoAgent.asPathinside string interpolation forces the configuration to resolve during configuration time, which can break configuration cache and slow builds. It also implicitly allows multiple files, but-javaagent:expects a single jar path.
tasks.withType<Test>().configureEach {
jvmArgs("-javaagent:${mockitoAgent.asPath}")
}
.github/workflows/publish-sonatype-reusable.yml:5
- This reusable workflow consumes Sonatype/GPG secrets, but
workflow_calldoesn’t declare any accepted secrets. Reusable workflows only receive secrets that are explicitly passed/declared, so the publish step may run with empty credentials. Declare the required secrets in the reusable workflow interface (and have callers pass them, e.g. viasecrets: inherit).
on:
workflow_call:
.github/workflows/publish-sonatype.yml:13
- When calling a reusable workflow, secrets are not passed by default. This job needs the Sonatype/GPG secrets used inside
publish-sonatype-reusable.yml, so it should pass them (e.g.secrets: inherit) to avoid publishing failures due to missing credentials.
jobs:
publish:
uses: ./.github/workflows/publish-sonatype-reusable.yml
.github/workflows/create-releases.yml:43
- The reusable Sonatype publish workflow relies on secrets, but reusable workflows don’t receive secrets unless the caller passes them. Add
secrets: inherithere so the publish job has access to the required Sonatype/GPG credentials.
publish:
needs: release
if: needs.release.outputs.releases_created == 'true'
uses: ./.github/workflows/publish-sonatype-reusable.yml
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
openai-java-core/build.gradle.kts:88
jvmArgs("-javaagent:${mockitoAgent.singleFile.absolutePath}")resolves themockitoAgentconfiguration during Gradle configuration time, which can break/disable the configuration cache (org.gradle.configuration-cache=true) and may cause premature dependency resolution. Prefer wiring this viajvmArgumentProviders(or adoFirst) so the configuration is resolved only at task execution time.
tasks.withType<Test>().configureEach {
jvmArgs("-javaagent:${mockitoAgent.singleFile.absolutePath}")
}
de38a25 to
db881cc
Compare
jbeckwith-oai
changed the title
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: db881cca1f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 05bed58477
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
HAYDEN-OAI
left a comment
HAYDEN-OAI
left a comment
There was a problem hiding this comment.
Re-reviewed commit 3e998e51ae00690f3246727a7b0f8dec7ef87be0, including the resolved prior threads, all changed files, the passing CI/security analyses, the effective branch rules, and the archived baseline compatibility tests. Two substantive findings remain: the new CI gate is not enforced by the live main ruleset, and the replacement fixtures do not preserve the excluded structured-output API surface. See the inline comments.
3e998e5 to
0803a69
Compare
HAYDEN-OAI
left a comment
HAYDEN-OAI
left a comment
There was a problem hiding this comment.
Re-reviewed 0803a6926fca9d2090919c8ba971f2d63c9adde8, including the full PR, the rebased delta, and all previous discussion threads. Verified that the effective main ruleset strictly requires the actually emitted CI / required check while preserving real CodeQL code-scanning enforcement. Independently audited the structured-output policy against the source: all 638 unique public JVM method signatures across all 15 wrapper, builder, and nested/visitor types are represented, and CI successfully validates both immutable-baseline and proposed manifests and compilation. Build, lint, tests, API compatibility, the required gate, and security CodeQL all pass on this exact head. The previous findings are addressed; no substantive correctness, security, compatibility, or maintainability issues remain. Approved.
Summary
main/nextand running PR CI for changes targeting those branchesCI / requiredgateSecurity / CodeQLcontextWhy
The previous workflow layout produced duplicate feature-branch runs for the same commit, emitted skipped checks alongside successful equivalents, split API compatibility into another workflow also named
CI, and duplicated the complete Sonatype publication implementation. That made required-check configuration ambiguous and allowed the publication paths to drift.The publication steps removed from the two callers now live verbatim in
.github/workflows/publish-sonatype-reusable.yml; both the release and manual workflows invoke that single implementation with the protectedpublishenvironment and the same Sonatype/GPG secrets.The Sonatype/GPG credentials are environment secrets (not repository secrets). The reusable workflow's
Publish / Sonatypejob bindsenvironment: publish, so callers intentionally do not usesecrets: inherit; the called job receives the protected environment credentials directly.Validation
origin/maingit diff --checkCI / requiredandSecurity / CodeQLa3a50ec7(test: configure Mockito as Java agent #814): repository lint, a cache-disabled Core/Bedrock test run, and real API compatibility passed locally; all 9 hosted checks passed ondb881ccaRequired-check rollout
The active
mainruleset now strictly requires the emittedCI / requiredstatus check. CodeQL remains enforced by the existing code-scanning rule rather than by a duplicate status-check context.The required gate was enabled only after
CI / requiredpassed on this PR. Strict branch freshness remains enabled. The code-owner approval, one-review minimum, CodeQL/code-quality enforcement, linear history, deletion protection, force-push protection, allowed merge methods, and existing bypass actor were preserved byte-for-byte.