ci: add Castiron promotion workflow

[HAYDEN-OAI]

Summary

• add a default-off workflow_dispatch entrypoint for promoting approved Python Castiron candidates into a public main draft PR
• keep the repository workflow thin: it accepts only candidate ID and preflight-contract digest, hardcodes target openai-python, and invokes the pinned shared writer from openai/openai#1160100
• temporarily reuse openai-sdks for a separate checkout token scoped only to openai/openai with Contents read; the later SDK write token remains separately minted and scoped only to openai-python plus openai-python-internal
• serialize promotions per repository and require main/repo guards, a protected castiron-promotion environment, and a repository/org-level CASTIRON_PROMOTION_ENABLED=true gate

This remains intentionally inert: the writer is pinned to merged Castiron orchestration commit d2dbbaefab9ec4c7513abe593015a9f97597c18c. The repository already has CASTIRON_PROMOTION_ENABLED=false plus a castiron-promotion environment restricted to main, requiring sdks-team, and preventing self-review.

Before enabling:

• set protected-environment variables CASTIRON_CONTAINER_URI, CASTIRON_AZURE_CLIENT_ID, and CASTIRON_AZURE_TENANT_ID after openai/openai#1143332 is applied
• keep OPENAI_SDKS_APP_PRIVATE_KEY in the protected environment and set repository/org variable CASTIRON_PROMOTION_ENABLED=true only for the controlled first promotion

Validation

• actionlint v1.7.7 .github/workflows/castiron-promote.yml

[Copilot]

Pull request overview

Adds a default-off, manually triggered GitHub Actions workflow to promote an already-approved Castiron candidate into a draft PR against this repo’s main, delegating most logic to a pinned writer in openai/openai and relying on a protected environment plus an explicit repo/org enablement gate.

Changes:

• Introduces a workflow_dispatch-only promotion workflow guarded by CASTIRON_PROMOTION_ENABLED, main branch, and repository checks.
• Uses a protected castiron-promotion environment plus Azure OIDC login and two separately minted GitHub App tokens (read-only for monorepo checkout; write-scoped for PR creation).
• Pins all third-party actions and pins the external writer to a specific openai/openai commit.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 11.967s for Python SDK PR #3509.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	215ms
tests/chat-completions-create.test.ts	✅ Passed	304ms
tests/chat-completions-stream.test.ts	✅ Passed	135ms
tests/files-content-binary.test.ts	✅ Passed	255ms
tests/files-create-multipart.test.ts	✅ Passed	228ms
tests/files-list-pagination.test.ts	✅ Passed	165ms
tests/initialize-config.test.ts	✅ Passed	242ms
tests/instance-isolation.test.ts	✅ Passed	251ms
tests/models-list.test.ts	✅ Passed	241ms
tests/responses-background-lifecycle.test.ts	✅ Passed	238ms
tests/responses-body-method-errors.test.ts	✅ Passed	365ms
tests/responses-cancel-timeout.test.ts	✅ Passed	259ms
tests/responses-cancel.test.ts	✅ Passed	251ms
tests/responses-compact-retries.test.ts	✅ Passed	350ms
tests/responses-compact.test.ts	✅ Passed	326ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	150ms
tests/responses-create-advanced.test.ts	✅ Passed	242ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.312s
tests/responses-create-errors.test.ts	✅ Passed	223ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	299ms
tests/responses-create-retries.test.ts	✅ Passed	370ms
tests/responses-create-stream-failures.test.ts	✅ Passed	137ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	237ms
tests/responses-create-stream-wire.test.ts	✅ Passed	3.737s
tests/responses-create-stream.test.ts	✅ Passed	351ms
tests/responses-create-terminal-states.test.ts	✅ Passed	273ms
tests/responses-create-timeout.test.ts	✅ Passed	243ms
tests/responses-create.test.ts	✅ Passed	252ms
tests/responses-delete.test.ts	✅ Passed	243ms
tests/responses-input-items-errors.test.ts	✅ Passed	357ms
tests/responses-input-items-list.test.ts	✅ Passed	323ms
tests/responses-input-items-options.test.ts	✅ Passed	332ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	244ms
tests/responses-input-tokens-count.test.ts	✅ Passed	247ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.934s
tests/responses-not-found-errors.test.ts	✅ Passed	293ms
tests/responses-parse.test.ts	✅ Passed	378ms
tests/responses-retrieve-retries.test.ts	✅ Passed	244ms
tests/responses-retrieve.test.ts	✅ Passed	276ms
tests/responses-stored-method-errors.test.ts	✅ Passed	784ms
tests/retry-behavior.test.ts	✅ Passed	3.285s
tests/sdk-error-shape.test.ts	✅ Passed	352ms

View OkTest run #30037456976

_{SDK merge (e49f0c0d749b) · head (930b3185aeea) · base (e67afa88433d) · OkTest (d2b5921fc22a)}