ci: Consolidate and harden CI workflows

.github/workflows/ci.yml

@@ -1,28 +1,29 @@
 name: CI
+
 on:
   push:
     branches:
-      - '**'
-      - '!integrated/**'
-      - '!stl-preview-head/**'
-      - '!stl-preview-base/**'
-      - '!generated'
-      - '!codegen/**'
+      - main
+      - next
+      - 'stl/**'
       - 'codegen/stl/**'
   pull_request:
-    branches-ignore:
-      - 'stl-preview-head/**'
-      - 'stl-preview-base/**'
+    branches:
+      - main
+      - next
 
 permissions:
   contents: read
 
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   lint:
+    name: CI / lint
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
-    name: lint
-    runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
-    if: (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -36,60 +37,21 @@ jobs:
           java-version: |
             8
             21
-          cache: gradle
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@0b6dd653ba04f4f93bf581ec31e66cbd7dcb644d # v4
+        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
 
       - name: Run lints
         run: ./scripts/lint
 
   build:
-    timeout-minutes: 30
-    name: build
-    runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
-    if: |-
-      (github.event_name == 'push' || github.event.pull_request.head.repo.fork) &&
-      (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata') &&
+    name: CI / build + Jackson compatibility
+    if: >-
       !(github.repository == 'stainless-sdks/openai-java' &&
         github.event_name == 'push' &&
         !startsWith(github.ref, 'refs/heads/stl/'))
-
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          persist-credentials: false
-
-      - name: Set up Java
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-        with:
-          distribution: temurin
-          java-version: |
-            8
-            21
-          cache: gradle
-
-      - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@0b6dd653ba04f4f93bf581ec31e66cbd7dcb644d # v4
-
-      - name: Build SDK
-        # disable gradle daemon in CI because it is flakey
-        env:
-          GRADLE_OPTS: "-Dkotlin.compiler.execution.strategy=in-process"
-        run: ./scripts/build
-
-  upload-maven-artifacts:
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
-    name: build-and-upload-maven-artifacts
-    permissions:
-      contents: read
-      id-token: write
-    runs-on: depot-ubuntu-24.04
-    if: |-
-      github.repository == 'stainless-sdks/openai-java' &&
-      github.event_name == 'push' &&
-      github.event.head_commit.message != 'codegen metadata' &&
-      !startsWith(github.ref, 'refs/heads/stl/')
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -103,64 +65,20 @@ jobs:
           java-version: |
             8
             21
-          cache: gradle
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@0b6dd653ba04f4f93bf581ec31e66cbd7dcb644d # v4
+        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
 
-      - name: Build SDK
-        # disable gradle daemon in CI because it is flakey
+      - name: Build SDK and run compatibility tests
         env:
-          GRADLE_OPTS: "-Dkotlin.compiler.execution.strategy=in-process"
+          GRADLE_OPTS: -Dkotlin.compiler.execution.strategy=in-process
         run: ./scripts/build
 
-      - name: Upload Maven artifacts
-        env:
-          URL: https://pkg.stainless.com/s
-          SHA: ${{ github.sha }}
-          PROJECT: openai-java
-        run: |
-          set -euo pipefail
-
-          max_retries=5
-          attempt=1
-
-          while true; do
-            echo "Maven artifact upload attempt ${attempt}/${max_retries}"
-
-            oidc_response="$(curl -sSf \
-              -H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
-              "${ACTIONS_ID_TOKEN_REQUEST_URL}")"
-            github_token="$(printf '%s' "$oidc_response" | jq -er '.value')"
-
-            upload_log="$(mktemp)"
-            set +e
-            AUTH="$github_token" ./scripts/upload-artifacts 2>&1 | tee "$upload_log"
-            upload_status=${PIPESTATUS[0]}
-            set -e
-
-            if [ "$upload_status" -eq 0 ]; then
-              break
-            fi
-
-            if [ "$attempt" -lt "$max_retries" ] && \
-              grep -q "Failed to get valid signed URL" "$upload_log" && \
-              grep -q "GitHub JWT is missing or invalid\\." "$upload_log"; then
-              sleep_seconds=$((3 * (1 << (attempt - 1))))
-              echo "Retrying after fresh OIDC token due to transient GitHub JWT validation failure"
-              echo "Sleeping ${sleep_seconds}s before retry"
-              sleep "$sleep_seconds"
-              attempt=$((attempt + 1))
-              continue
-            fi
-
-            exit "$upload_status"
-          done
   test:
+    name: CI / tests
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
-    name: test
-    runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
-    if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
+
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
@@ -173,23 +91,23 @@ jobs:
           java-version: |
             8
             21
-          cache: gradle
 
       - name: Set up Gradle
-        uses: gradle/gradle-build-action@fe583dc97e032f41ccc310ea5176f2d7306abbc4 # v2
+        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
 
       - name: Run tests
         run: ./scripts/test
-  examples:
+
+  api_compatibility:
+    name: CI / API compatibility
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
-    name: examples
-    environment: CI
-    runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
-    if: github.repository == 'openai/openai-java' && github.event_name == 'push' && github.ref == 'refs/heads/main' && github.event.head_commit.message != 'codegen metadata'
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Set up Java
@@ -199,11 +117,71 @@ jobs:
           java-version: |
             8
             21
-          cache: gradle
+
       - name: Set up Gradle
-        uses: gradle/gradle-build-action@fe583dc97e032f41ccc310ea5176f2d7306abbc4 # v2
+        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
 
-      - env: 
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      - name: Compile previous tests against the proposed SDK
+        env:
+          BASE_COMMIT: ${{ github.event.pull_request.base.sha }}
+          GRADLE_OPTS: -Dkotlin.compiler.execution.strategy=in-process
         run: |
-            ./gradlew :openai-java-example:run
+          set -euo pipefail
+
+          # The proposed detector verifies the current compatibility policy. Running the baseline
+          # detector as well prevents a PR from weakening that policy to hide an SDK break.
+          ./scripts/detect-breaking-changes "$BASE_COMMIT"
+
+          BASE_DETECTOR="$(mktemp ./scripts/detect-breaking-changes.baseline.XXXXXX)"
+          trap 'rm -f "$BASE_DETECTOR"' EXIT
+          git show "${BASE_COMMIT}:scripts/detect-breaking-changes" > "$BASE_DETECTOR"
+          chmod +x "$BASE_DETECTOR"
+          "$BASE_DETECTOR" "$BASE_COMMIT"
+
+  required:
+    name: CI / required
+    if: always()
+    needs:
+      - lint
+      - build
+      - test
+      - api_compatibility
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+
+    steps:
+      - name: Verify required jobs succeeded
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          REPOSITORY: ${{ github.repository }}
+          REF: ${{ github.ref }}
+          LINT_RESULT: ${{ needs.lint.result }}
+          BUILD_RESULT: ${{ needs.build.result }}
+          TEST_RESULT: ${{ needs.test.result }}
+          API_COMPATIBILITY_RESULT: ${{ needs.api_compatibility.result }}
+        run: |
+          set -euo pipefail
+
+          failed_jobs=()
+          [[ "$LINT_RESULT" == "success" ]] || failed_jobs+=("lint: $LINT_RESULT")
+          [[ "$TEST_RESULT" == "success" ]] || failed_jobs+=("test: $TEST_RESULT")
+
+          if [[ "$EVENT_NAME" == "push" &&
+                "$REPOSITORY" == "stainless-sdks/openai-java" &&
+                "$REF" != refs/heads/stl/* ]]; then
+            [[ "$BUILD_RESULT" == "skipped" ]] ||
+              failed_jobs+=("build: expected skipped, got $BUILD_RESULT")
+          else
+            [[ "$BUILD_RESULT" == "success" ]] || failed_jobs+=("build: $BUILD_RESULT")
+          fi
+
+          if [[ "$EVENT_NAME" == "pull_request" && "$API_COMPATIBILITY_RESULT" != "success" ]]; then
+            failed_jobs+=("API compatibility: $API_COMPATIBILITY_RESULT")
+          fi
+
+          if (( ${#failed_jobs[@]} > 0 )); then
+            printf 'Required CI job did not succeed: %s\n' "${failed_jobs[@]}"
+            exit 1
+          fi
+
+          echo "All required CI jobs succeeded."

.github/workflows/codeql.yml

@@ -31,7 +31,7 @@ jobs:
           java-version: 21
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@0b6dd653ba04f4f93bf581ec31e66cbd7dcb644d # v4
+        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4

.github/workflows/create-releases.yml

@@ -1,4 +1,5 @@
 name: Create releases
+
 on:
   schedule:
     - cron: '0 5 * * *' # every day at 5am UTC
@@ -9,11 +10,16 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: create-releases
+  cancel-in-progress: false
+
 jobs:
   release:
-    name: release
+    name: Release / create
     if: github.ref == 'refs/heads/main' && github.repository == 'openai/openai-java'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
     environment: publish
     outputs:
       releases_created: ${{ steps.release.outputs.releases_created }}
@@ -23,75 +29,14 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: stainless-api/trigger-release-please@bb6677c5a04578eec1ccfd9e1913b5b78ed64c61 # v1.4.0
+      - name: Create release
         id: release
+        uses: stainless-api/trigger-release-please@bb6677c5a04578eec1ccfd9e1913b5b78ed64c61 # v1.4.0
         with:
           repo: ${{ github.event.repository.full_name }}
           stainless-api-key: ${{ secrets.STAINLESS_API_KEY }}
 
   publish:
-    name: publish
     needs: release
-    if: ${{ needs.release.outputs.releases_created == 'true' }}
-    runs-on: ubuntu-latest
-    environment: publish
-
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          persist-credentials: false
-
-      - name: Set up Java
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-        with:
-          distribution: temurin
-          java-version: |
-            8
-            21
-          cache: gradle
-
-      - name: Set up Gradle
-        uses: gradle/gradle-build-action@fe583dc97e032f41ccc310ea5176f2d7306abbc4 # v2
-
-      - name: Compile the openai-java-core project
-        run: |
-          ./gradlew :openai-java-core:compileJava :openai-java-core:compileTestJava -x test
-
-      - name: Run the mock server
-        run: |
-          ./scripts/mock --daemon
-
-      - name: Setup GraalVM
-        uses: graalvm/setup-graalvm@03e8abf916fd0e281b2efe7b2da3378bb0a1d085 # v1
-        with:
-          java-version: 21
-          distribution: 'graalvm-community'
-          cache: gradle
-
-      - name: Run tests on the openai-java-core project with the GraalVM native-image agent
-        run: |
-          ./gradlew :openai-java-core:test -x compileJava -x compileTestJava -x compileKotlin -x compileTestKotlin -PgraalvmAgent
-
-      - name: Check generated GraalVM file
-        run: |
-          echo "Checking for GraalVM agent metadata files..."
-          DIRECTORY=openai-java-core/src/main/resources/META-INF/native-image
-          if [ -d "$DIRECTORY" ] && [ "$(ls -A $DIRECTORY)" ]; then
-            echo "Files found in $DIRECTORY:"
-            ls -l $DIRECTORY
-          else
-            echo "No files found in $DIRECTORY"
-            exit 1
-          fi
-
-      - name: Publish to Sonatype
-        run: |-
-          export -- GPG_SIGNING_KEY_ID
-          printenv -- GPG_SIGNING_KEY | gpg --batch --passphrase-fd 3 --import 3<<< "$GPG_SIGNING_PASSWORD"
-          GPG_SIGNING_KEY_ID="$(gpg --with-colons --list-keys | awk -F : -- '/^pub:/ { getline; print "0x" substr($10, length($10) - 7) }')"
-          ./gradlew publishAndReleaseToMavenCentral --stacktrace -PmavenCentralUsername="$SONATYPE_USERNAME" -PmavenCentralPassword="$SONATYPE_PASSWORD" --no-configuration-cache
-        env:
-          SONATYPE_USERNAME: ${{ secrets.OPENAI_SONATYPE_USERNAME }}
-          SONATYPE_PASSWORD: ${{ secrets.OPENAI_SONATYPE_PASSWORD }}
-          GPG_SIGNING_KEY: ${{ secrets.OPENAI_SONATYPE_GPG_SIGNING_KEY }}
-          GPG_SIGNING_PASSWORD: ${{ secrets.OPENAI_SONATYPE_GPG_SIGNING_PASSWORD }}
+    if: needs.release.outputs.releases_created == 'true'
+    uses: ./.github/workflows/publish-sonatype-reusable.yml