ci: use GitHub App for Release Please

[jbeckwith-oai]

Summary

• mint a repository-scoped installation token for the openai-sdks GitHub App from the release environment
• pass that token to Release Please and disable the release job's built-in GITHUB_TOKEN permissions
• remove the manual release-PR CI dispatch workaround now that app-authored branch pushes and pull-request events trigger Actions normally
• simplify API compatibility CI back to normal pull-request events

Java equivalent of openai/openai-python#3577.

Validation

• git diff --check
• actionlint v1.7.7 on .github/workflows/ci.yml and .github/workflows/create-releases.yml
• YAML parse of both changed workflows
• ./scripts/lint attempted, but local execution is blocked because this machine only has JDK 25 installed (Gradle fails during configuration with 25.0.2); CI runs with JDK 21

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 17.723s for Java SDK PR #845.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	855ms
tests/chat-completions-create.test.ts	✅ Passed	639ms
tests/chat-completions-stream.test.ts	✅ Passed	409ms
tests/files-content-binary.test.ts	✅ Passed	239ms
tests/files-create-multipart.test.ts	✅ Passed	283ms
tests/files-list-pagination.test.ts	✅ Passed	299ms
tests/initialize-config.test.ts	✅ Passed	189ms
tests/instance-isolation.test.ts	✅ Passed	318ms
tests/models-list.test.ts	✅ Passed	181ms
tests/responses-background-lifecycle.test.ts	✅ Passed	649ms
tests/responses-body-method-errors.test.ts	✅ Passed	569ms
tests/responses-cancel-timeout.test.ts	✅ Passed	210ms
tests/responses-cancel.test.ts	✅ Passed	449ms
tests/responses-compact-retries.test.ts	✅ Passed	490ms
tests/responses-compact.test.ts	✅ Passed	404ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	403ms
tests/responses-create-advanced.test.ts	✅ Passed	1.683s
tests/responses-create-disconnect.test.ts	✅ Passed	1.003s
tests/responses-create-errors.test.ts	✅ Passed	389ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	306ms
tests/responses-create-retries.test.ts	✅ Passed	331ms
tests/responses-create-stream-failures.test.ts	✅ Passed	356ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	239ms
tests/responses-create-stream-wire.test.ts	✅ Passed	6.602s
tests/responses-create-stream.test.ts	✅ Passed	106ms
tests/responses-create-terminal-states.test.ts	✅ Passed	488ms
tests/responses-create-timeout.test.ts	✅ Passed	235ms
tests/responses-create.test.ts	✅ Passed	336ms
tests/responses-delete.test.ts	✅ Passed	254ms
tests/responses-input-items-errors.test.ts	✅ Passed	292ms
tests/responses-input-items-list.test.ts	✅ Passed	350ms
tests/responses-input-items-options.test.ts	✅ Passed	623ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	226ms
tests/responses-input-tokens-count.test.ts	✅ Passed	397ms
tests/responses-malformed-inputs.test.ts	✅ Passed	5.397s
tests/responses-not-found-errors.test.ts	✅ Passed	539ms
tests/responses-parse.test.ts	✅ Passed	701ms
tests/responses-retrieve-retries.test.ts	✅ Passed	350ms
tests/responses-retrieve.test.ts	✅ Passed	312ms
tests/responses-stored-method-errors.test.ts	✅ Passed	1.011s
tests/retry-behavior.test.ts	✅ Passed	3.473s
tests/sdk-error-shape.test.ts	✅ Passed	504ms

View OkTest run #30953631412

_{SDK merge (8749221ca359) · head (d031482ba5f7) · base (33c6b57709af) · OkTest (91635c6a2723)}

[Copilot]

Pull request overview

Updates the repository’s GitHub Actions release automation to authenticate Release Please using a GitHub App installation token (scoped via the castiron-promotion environment), removing the prior manual workflow-dispatch workaround for release PR CI and simplifying API compatibility CI back to standard pull request triggering.

Changes:

• Generate a repo-scoped GitHub App installation token and pass it to Release Please, while disabling the release job’s default GITHUB_TOKEN permissions.
• Remove the “dispatch CI for release PR” workaround now that App-authored events trigger workflows normally.
• Restrict API compatibility CI back to running only for pull_request events and remove the dispatch-specific validation/base-SHA logic.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/create-releases.yml	Switch Release Please auth to a GitHub App token (environment-scoped), drop the release-PR workflow-dispatch CI job, and simplify outcome verification accordingly.
.github/workflows/ci.yml	Remove workflow_dispatch handling from the API compatibility job and associated logic, returning it to PR-only execution.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[HAYDEN-OAI]

Independent SDK review found one high-priority release-automation blocker; see the inline comment.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[HAYDEN-OAI]

Re-reviewed the complete workflow changes at d031482. The prior release-authentication blocker is resolved: the dedicated release environment is main-only, has no approval gate, and contains the matching GitHub App client ID and private-key secret. The requested contents, issues, and pull-request write scopes match the App, and normal release-PR CI plus manual release retries remain intact. No substantive findings.