gitupdates · pull · Aug 3, 2026 · Aug 3, 2026 · Aug 3, 2026 · Aug 3, 2026
diff --git a/.castiron.stats.yml b/.castiron.stats.yml
@@ -0,0 +1,6 @@
+schema_version: 1
+generation_id: 42c8861d-adc3-4c8a-81b3-3b7f497f41eb
+openapi_spec_hash: d342651bd77c6cd6ea10a9d889b35bb8
+openapi_transformed_spec_hash: 259f19fd2d38c6e784bbb40bf2f9a971
+config_hash: fce3820c4f95b555e486349bc7d297d8
+codegen_sha: acf1dbb5db99bd14d6dae73da59f59fb17e95381
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -3,6 +3,7 @@ on:
   push:
     branches:
       - '**'
+      - '!gh-readonly-queue/**'
       - '!integrated/**'
       - '!stl-preview-head/**'
       - '!stl-preview-base/**'
@@ -13,18 +14,30 @@ on:
     branches-ignore:
       - 'stl-preview-head/**'
       - 'stl-preview-base/**'
+  merge_group:
+    types:
+      - checks_requested
   workflow_dispatch:
+    inputs:
+      release_pr:
+        description: Run required CI for a Release Please branch
+        required: false
+        default: false
+        type: boolean
   # Exercise the complete supported matrix and the next CPython prerelease
   # even when the repository has not changed.
   schedule:
     - cron: '47 9 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     timeout-minutes: 10
     name: lint
     runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
-    if: (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
+    if: (github.event_name == 'push' || github.event_name == 'merge_group' || (github.event_name == 'workflow_dispatch' && inputs.release_pr && github.ref == 'refs/heads/release-please--branches--main') || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
@@ -41,15 +54,16 @@ jobs:
         run: ./scripts/lint
 
   build:
-    if: (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
+    if: (github.event_name == 'push' || github.event_name == 'merge_group' || (github.event_name == 'workflow_dispatch' && inputs.release_pr && github.ref == 'refs/heads/release-please--branches--main') || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
     timeout-minutes: 10
     name: build
     permissions:
       contents: read
-      id-token: write
     runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Set up Rye
         uses: eifinger/setup-rye@c694239a43768373e87d0103d7f547027a23f3c8
@@ -88,19 +102,44 @@ jobs:
       - name: Validate HTTPX2 wheel on Python 3.14
         run: python scripts/utils/validate-httpx2-wheel.py
 
-      - name: Get GitHub OIDC Token
+      - name: Stage tarball for Stainless upload
         if: |-
           github.repository == 'stainless-sdks/openai-python' &&
           !startsWith(github.ref, 'refs/heads/stl/')
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: stainless-package-tarball
+          path: dist/
+          if-no-files-found: error
+          retention-days: 1
+
+  stainless-upload:
+    name: upload tarball to Stainless
+    needs: build
+    if: github.repository == 'stainless-sdks/openai-python' && !startsWith(github.ref, 'refs/heads/stl/')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - name: Download tarball
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: stainless-package-tarball
+          path: dist/
+
+      - name: Get GitHub OIDC Token
         id: github-oidc
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: core.setOutput('github_token', await core.getIDToken());
 
       - name: Upload tarball
-        if: |-
-          github.repository == 'stainless-sdks/openai-python' &&
-          !startsWith(github.ref, 'refs/heads/stl/')
         env:
           URL: https://pkg.stainless.com/s
           AUTH: ${{ steps.github-oidc.outputs.github_token }}
@@ -111,7 +150,7 @@ jobs:
     timeout-minutes: 15
     name: test (Python ${{ matrix.python-version }})
     runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
-    if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
+    if: github.event_name == 'push' || github.event_name == 'merge_group' || (github.event_name == 'workflow_dispatch' && inputs.release_pr && github.ref == 'refs/heads/release-please--branches--main') || github.event.pull_request.head.repo.fork
     strategy:
       fail-fast: false
       matrix:
@@ -132,6 +171,12 @@ jobs:
           version: '0.44.0'
           enable-cache: false
 
+      - name: Cache Rye virtual environment
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .venv
+          key: rye-${{ runner.os }}-${{ runner.arch }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('requirements.lock', 'requirements-dev.lock') }}
+
       - name: Select Python ${{ matrix.python-version }}
         run: |
           rye toolchain register "${{ steps.setup-python.outputs.python-path }}"
@@ -147,7 +192,7 @@ jobs:
     timeout-minutes: 20
     name: test (HTTPX2)
     runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
-    if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
+    if: github.event_name == 'push' || github.event_name == 'merge_group' || (github.event_name == 'workflow_dispatch' && inputs.release_pr && github.ref == 'refs/heads/release-please--branches--main') || github.event.pull_request.head.repo.fork
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
@@ -163,17 +208,18 @@ jobs:
           version: '0.44.0'
           enable-cache: false
 
+      - name: Cache Rye virtual environment
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .venv
+          key: rye-${{ runner.os }}-${{ runner.arch }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('requirements.lock', 'requirements-dev.lock') }}
+
       - name: Install HTTPX2 test dependencies
         run: |
           rye toolchain register "${{ steps.setup-python.outputs.python-path }}"
           rye pin --relaxed --no-update-requires-python 3.14
           rye sync --all-features
 
-      - name: Run tests with HTTPX and HTTPX2 installed
-        env:
-          OPENAI_TEST_HTTP_CLIENT: httpx
-        run: ./scripts/test
-
       - name: Run tests with HTTPX2
         env:
           OPENAI_TEST_HTTP_CLIENT: httpx2
@@ -224,7 +270,7 @@ jobs:
     timeout-minutes: 20
     name: compatibility (Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
-    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && !inputs.release_pr)
     continue-on-error: ${{ matrix.experimental }}
     strategy:
       fail-fast: false
@@ -260,6 +306,12 @@ jobs:
           version: '0.44.0'
           enable-cache: false
 
+      - name: Cache Rye virtual environment
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .venv
+          key: rye-${{ runner.os }}-${{ runner.arch }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('requirements.lock', 'requirements-dev.lock') }}
+
       - name: Select Python ${{ matrix.python-version }}
         run: |
           rye toolchain register "${{ steps.setup-python.outputs.python-path }}"

diff --git a/.github/workflows/create-releases.yml b/.github/workflows/create-releases.yml
@@ -9,20 +9,98 @@ jobs:
     name: release
     if: github.ref == 'refs/heads/main' && github.repository == 'openai/openai-python'
     runs-on: ubuntu-latest
-    environment: publish
     outputs:
       releases_created: ${{ steps.release.outputs.releases_created }}
+      release_pr_branch: ${{ steps.release_pr.outputs.branch }}
+      release_pr_number: ${{ steps.release_pr.outputs.number }}
+    # Release Please writes its PR branch, tags/releases, PR, and PR labels.
     permissions:
       contents: write
+      issues: write
+      pull-requests: write
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-
-      - uses: stainless-api/trigger-release-please@bb6677c5a04578eec1ccfd9e1913b5b78ed64c61 # v1.4.0
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         id: release
         with:
-          repo: ${{ github.event.repository.full_name }}
-          stainless-api-key: ${{ secrets.STAINLESS_API_KEY }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          target-branch: main
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+      - name: Capture release PR
+        if: steps.release.outputs.prs_created == 'true'
+        id: release_pr
+        env:
+          RELEASE_PR: ${{ steps.release.outputs.pr }}
+        run: |
+          branch="$(jq -er '.headBranchName | select(. == "release-please--branches--main")' <<<"$RELEASE_PR")"
+          number="$(jq -er '.number | select(type == "number")' <<<"$RELEASE_PR")"
+          echo "branch=$branch" >> "$GITHUB_OUTPUT"
+          echo "number=$number" >> "$GITHUB_OUTPUT"
+
+  release-pr-ci:
+    name: release PR CI
+    needs: release
+    if: ${{ needs.release.outputs.release_pr_branch != '' }}
+    runs-on: ubuntu-latest
+    # Read the release PR's current base SHA, then dispatch its required
+    # workflows. Keeping this separate prevents Release Please from receiving
+    # Actions write access.
+    permissions:
+      actions: write
+      pull-requests: read
+
+    steps:
+      - name: Run required checks for release PR
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        env:
+          RELEASE_PR_BRANCH: ${{ needs.release.outputs.release_pr_branch }}
+          RELEASE_PR_NUMBER: ${{ needs.release.outputs.release_pr_number }}
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const expectedRef = process.env.RELEASE_PR_BRANCH;
+            const pullNumber = Number(process.env.RELEASE_PR_NUMBER);
+            if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+              throw new Error('Release Please returned an invalid PR number');
+            }
+
+            const { data: pull } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: pullNumber,
+            });
+            if (pull.head.ref !== expectedRef) {
+              throw new Error(`Release PR branch changed: expected ${expectedRef}, got ${pull.head.ref}`);
+            }
+
+            const ref = pull.head.ref;
+            await Promise.all([
+              github.rest.actions.createWorkflowDispatch({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: 'ci.yml',
+                ref,
+                inputs: { release_pr: 'true' },
+              }),
+              github.rest.actions.createWorkflowDispatch({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: 'detect-breaking-changes.yml',
+                ref,
+                inputs: {
+                  release_pr: 'true',
+                  base_sha: pull.base.sha,
+                },
+              }),
+              github.rest.actions.createWorkflowDispatch({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: 'codeql.yml',
+                ref,
+              }),
+            ]);
 
   build:
     name: build
@@ -36,6 +114,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Set up Rye
         uses: eifinger/setup-rye@c694239a43768373e87d0103d7f547027a23f3c8
@@ -64,7 +144,6 @@ jobs:
     # PyPI Trusted Publishing requires id-token: write. Keep it scoped to this
     # minimal upload-only job rather than the build job.
     permissions:
-      contents: read
       id-token: write
 
     steps:

diff --git a/.github/workflows/detect-breaking-changes.yml b/.github/workflows/detect-breaking-changes.yml
@@ -4,20 +4,43 @@ on:
     branches:
       - main
       - next
+  merge_group:
+    types:
+      - checks_requested
+  workflow_dispatch:
+    inputs:
+      release_pr:
+        description: Run checks for a Release Please branch
+        required: false
+        default: false
+        type: boolean
+      base_sha:
+        description: Base commit for breaking-change comparison
+        required: false
+        type: string
+
+permissions:
+  contents: read
 
 jobs:
   detect_breaking_changes:
     runs-on: 'ubuntu-latest'
     name: detect-breaking-changes
-    if: github.repository == 'openai/openai-python'
+    if: github.repository == 'openai/openai-python' && (github.event_name == 'pull_request' || github.event_name == 'merge_group' || (inputs.release_pr && github.ref == 'refs/heads/release-please--branches--main'))
+    env:
+      BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event_name == 'merge_group' && github.event.merge_group.base_sha || inputs.base_sha }}
+      FETCH_DEPTH: 0
     steps:
       - name: Calculate fetch-depth
+        if: github.event_name == 'pull_request'
+        env:
+          PR_COMMITS: ${{ github.event.pull_request.commits }}
         run: |
-          echo "FETCH_DEPTH=$(expr ${{ github.event.pull_request.commits }} + 1)" >> $GITHUB_ENV
+          echo "FETCH_DEPTH=$((PR_COMMITS + 1))" >> "$GITHUB_ENV"
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          # Ensure we can check out the pull request base in the script below.
+          # Ensure the comparison base is available to the scripts below.
           fetch-depth: ${{ env.FETCH_DEPTH }}
 
       - name: Set up Rye
@@ -30,17 +53,17 @@ jobs:
           rye sync --all-features
       - name: Detect removed symbols
         run: |
-          rye run python scripts/detect-breaking-changes.py "${{ github.event.pull_request.base.sha }}"
+          rye run python scripts/detect-breaking-changes.py "$BASE_SHA"
 
       - name: Detect breaking changes
         run: |
           test -f ./scripts/detect-breaking-changes || { echo "Missing scripts/detect-breaking-changes"; exit 1; }
-          ./scripts/detect-breaking-changes ${{ github.event.pull_request.base.sha }}
+          ./scripts/detect-breaking-changes "$BASE_SHA"
 
   agents_sdk:
     runs-on: 'ubuntu-latest'
     name: Detect Agents SDK regressions
-    if: github.repository == 'openai/openai-python'
+    if: github.repository == 'openai/openai-python' && (github.event_name == 'pull_request' || (inputs.release_pr && github.ref == 'refs/heads/release-please--branches--main'))
     steps:
       # Setup this sdk
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "2.52.0"
+  ".": "2.53.0"
 }