ci.yml

# Runs the repository's normal lint, build, test, benchmark, example, and ecosystem checks.
# These checks catch generated-code, packaging, runtime, and integration
# regressions; policy-document alignment lives in node-version-policy.yml.
# SDK_GHA_RUNNER is trusted configuration for ephemeral GitHub-hosted capacity.
# See docs/architecture/security-model.md#ci-runner-configuration.
name: CI
on:
  push:
    branches:
      - '**'
      - '!gh-readonly-queue/**'
      - '!integrated/**'
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review, edited]
  merge_group:
    types:
      - checks_requested

jobs:
  lint:
    timeout-minutes: 10
    name: lint
    runs-on: ${{ vars.SDK_GHA_RUNNER || 'ubuntu-latest' }}
    if: github.event_name == 'push' || github.event_name == 'merge_group' || github.event.pull_request.head.repo.fork || github.event.action == 'ready_for_review'
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Set up pnpm
        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      - name: Set up Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version-file: '.nvmrc'
          cache: pnpm

      - name: Bootstrap
        run: ./scripts/bootstrap

      - name: Check formatting and lint rules
        run: ./scripts/lint

      - name: Check types
        run: pnpm exec tsc

  build:
    timeout-minutes: 5
    name: build
    runs-on: ${{ vars.SDK_GHA_RUNNER || 'ubuntu-latest' }}
    if: github.event_name == 'push' || github.event_name == 'merge_group' || github.event.pull_request.head.repo.fork || github.event.action == 'ready_for_review'
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Set up pnpm
        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      - name: Set up Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version-file: '.nvmrc'
          cache: pnpm

      - name: Bootstrap
        run: ./scripts/bootstrap

      - name: Check build
        run: ./scripts/build

      - name: Check published source types with TypeScript 4.9
        run: ./node_modules/typescript-4-9/bin/tsc --project dist/src/tsconfig.json --noEmit

      - name: Check published source types with TypeScript 6
        run: ./node_modules/typescript/bin/tsc --project dist/src/tsconfig.json --noEmit

      - name: Check package types
        run: |
          pnpm exec attw --pack dist -f json > .attw.json || true
          node scripts/utils/attw-report.cjs

      - name: Check published package
        run: pnpm exec publint dist

  build_windows:
    timeout-minutes: 15
    name: build (Windows)
    runs-on: windows-latest
    if: github.event_name == 'push' || github.event_name == 'merge_group' || github.event.pull_request.head.repo.fork || github.event.action == 'ready_for_review'
    permissions:
      contents: read
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Set up pnpm
        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      - name: Set up Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version-file: '.nvmrc'
          cache: pnpm

      - name: Bootstrap
        run: ./scripts/bootstrap

      - name: Check build
        run: pnpm build

      - name: Check mock launcher fixture cleanup
        run: ./scripts/test tests/mock-launcher.test.ts

  node_matrix:
    name: Read Node.js test matrix
    runs-on: ${{ vars.SDK_GHA_RUNNER || 'ubuntu-latest' }}
    if: github.event_name == 'push' || github.event_name == 'merge_group' || github.event.pull_request.head.repo.fork || github.event.action == 'ready_for_review'
    permissions:
      contents: read
    outputs:
      matrix: ${{ steps.policy.outputs.matrix }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version-file: '.nvmrc'

      - name: Read policy matrix
        id: policy
        run: |
          matrix="$(node --experimental-strip-types scripts/check-node-version-policy.ts --matrix)"
          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"

  test:
    name: test (${{ matrix.node-version }})
    needs: node_matrix
    timeout-minutes: 15
    runs-on: ${{ vars.SDK_GHA_RUNNER || 'ubuntu-latest' }}
    if: github.event_name == 'push' || github.event_name == 'merge_group' || github.event.pull_request.head.repo.fork || github.event.action == 'ready_for_review'
    continue-on-error: ${{ matrix.experimental }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.node_matrix.outputs.matrix) }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Set up pnpm
        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      # pnpm 11 requires Node >=22.13, so install dependencies with the current
      # LTS before switching to the runtime version under test.
      - name: Set up Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version-file: '.nvmrc'
          cache: pnpm

      - name: Bootstrap
        run: ./scripts/bootstrap

      - name: Set up test Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: '${{ matrix.node-version }}'

      - name: Check Steady downloads and cache lifecycle
        run: |
          node scripts/steady/download.test.cjs
          node scripts/steady/publication.test.cjs
          node scripts/steady/cache.test.cjs

      - name: Run tests
        # Reuse V8 compilation within this job only; never restore it across runs.
        env:
          NODE_COMPILE_CACHE: ${{ runner.temp }}/node-compile-cache
        run: ./scripts/test

      - name: Test packed npm package
        if: matrix.experimental == false
        env:
          NODE_COMPILE_CACHE: ${{ runner.temp }}/node-compile-cache
        run: |
          ./scripts/build
          node --experimental-strip-types scripts/test-packed-package.ts

      - name: Prepare isolated minimum-runtime package and synthetic certificate
        if: matrix.node-version == 22
        run: |
          package_tarball="$(npm pack "$GITHUB_WORKSPACE/dist" --ignore-scripts --silent --pack-destination "$RUNNER_TEMP")"
          echo "X509_FLOOR_PACKAGE=${RUNNER_TEMP}/${package_tarball}" >> "$GITHUB_ENV"
          node -r ts-node/register/transpile-only --eval '
            const { writeFileSync } = require("node:fs");
            const { join } = require("node:path");
            const { createX509TestLab } = require("./tests/utils/x509-test-lab.ts");
            const { firstClient } = createX509TestLab();
            writeFileSync(join(process.env.RUNNER_TEMP, "openai-x509-minimum-fixture.json"), JSON.stringify({ certificateChain: firstClient.certificate.toString(), privateKey: firstClient.privateKey.toString() }));
          '

      - name: Set up exact minimum supported Node.js runtime
        if: matrix.node-version == 22
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: '22.0.0'

      - name: Verify first-class X.509 authentication on the exact Node.js floor
        if: matrix.node-version == 22
        run: |
          floor_consumer="${RUNNER_TEMP}/openai-node-minimum-runtime"
          npm install --ignore-scripts --no-audit --no-fund --prefix "$floor_consumer" "$X509_FLOOR_PACKAGE" 'undici@^7'
          cd "$floor_consumer"
          node --input-type=module --eval '
            import { readFileSync } from "node:fs";
            import { join } from "node:path";
            import OpenAI from "openai";
            import { Agent, ProxyAgent } from "undici";
            import { createX509Transport, fromX509, workloadIdentity } from "openai/auth/x509-transport";
            if (process.version !== "v22.0.0" || workloadIdentity.fromX509 !== fromX509) throw new Error("Invalid minimum-runtime X.509 exports");
            const material = JSON.parse(readFileSync(join(process.env.RUNNER_TEMP, "openai-x509-minimum-fixture.json"), "utf8"));
            const credential = fromX509({ ...material, identityProviderId: "synthetic-provider", serviceAccountId: "synthetic-account" });
            new OpenAI({ credential });
            await credential.close();
            for (const [proxy, dispatcher] of [["direct", new Agent()], ["http-connect", new ProxyAgent({ uri: "http://127.0.0.1:1" })], ["https-connect", new ProxyAgent({ uri: "https://127.0.0.1:1" })]]) {
              const x509Transport = createX509Transport({ runtime: "node", dispatcher, certificateIdentity: "static", proxy });
              new OpenAI({ apiKey: null, workloadIdentity: { type: "x509", identityProviderId: "synthetic-provider", serviceAccountId: "synthetic-account" }, x509Transport });
              await dispatcher.close();
            }
          '

  test_matrix:
    name: ${{ (github.event_name == 'push' || github.event_name == 'merge_group' || github.event.pull_request.head.repo.fork || github.event.action == 'ready_for_review') && 'test matrix' || 'test matrix (not run)' }}
    if: ${{ always() && (github.event_name == 'push' || github.event_name == 'merge_group' || github.event.pull_request.head.repo.fork || github.event.action == 'ready_for_review') }}
    needs: [test, benchmarks, ecosystem_tests, build_windows]
    runs-on: ${{ vars.SDK_GHA_RUNNER || 'ubuntu-latest' }}
    permissions: {}
    steps:
      - name: Tests (all)
        env:
          TEST_RESULT: ${{ needs.test.result }}
          BENCHMARKS_RESULT: ${{ needs.benchmarks.result }}
          ECOSYSTEM_RESULT: ${{ needs.ecosystem_tests.result }}
          WINDOWS_BUILD_RESULT: ${{ needs.build_windows.result }}
        run: |
          if [ "$TEST_RESULT" != "success" ]; then
            echo "::error::Node.js test matrix result: $TEST_RESULT"
            exit 1
          fi
          if [ "$BENCHMARKS_RESULT" != "success" ]; then
            echo "::error::Performance benchmarks result: $BENCHMARKS_RESULT"
            exit 1
          fi
          if [ "$ECOSYSTEM_RESULT" != "success" ]; then
            echo "::error::Ecosystem tests result: $ECOSYSTEM_RESULT"
            exit 1
          fi
          if [ "$WINDOWS_BUILD_RESULT" != "success" ]; then
            echo "::error::Windows build result: $WINDOWS_BUILD_RESULT"
            exit 1
          fi

  benchmarks:
    timeout-minutes: 20
    name: performance benchmarks
    runs-on: ${{ vars.SDK_GHA_RUNNER || 'ubuntu-latest' }}
    if: github.event_name == 'push' || github.event_name == 'merge_group' || github.event.pull_request.head.repo.fork || github.event.action == 'ready_for_review'
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Set up pnpm
        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      - name: Set up Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version-file: '.nvmrc'
          cache: pnpm

      - name: Bootstrap
        run: ./scripts/bootstrap

      - name: Run Vitest performance benchmarks
        run: pnpm bench:json

      - name: Upload benchmark results
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: vitest-benchmark-results-${{ github.run_id }}-${{ github.run_attempt }}
          path: benchmark-results.json
          if-no-files-found: error
          retention-days: 30

  examples:
    timeout-minutes: 30
    name: examples
    # Keep live credentials independent of the configurable CI runner pool.
    runs-on: ubuntu-latest
    if: >-
      ${{
        github.repository == 'openai/openai-node' &&
        github.event_name == 'push' &&
        github.ref == 'refs/heads/main' &&
        github.actor != 'dependabot[bot]'
      }}
    environment: ci
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      - name: Set up pnpm
        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      - name: Set up Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version-file: '.nvmrc'
          cache: pnpm

      - uses: denoland/setup-deno@11b63cf76cfcafb4e43f97b6cad24d8e8438f62d # v1
        with:
          deno-version: v1.39.0

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.14

      - name: Install dependencies
        run: |
          pnpm install --frozen-lockfile

      - name: Run live examples and ecosystem tests
        run: |
          if [ -z "$OPENAI_API_KEY" ]; then
            echo "OPENAI_API_KEY is required for live CI checks" >&2
            exit 1
          fi
          pnpm tsn examples/chat-completions/demo.ts
          pnpm tsn ecosystem-tests/cli.ts --live --verbose --parallel --jobs=4 --retry=3
        env:
          DISABLE_V8_COMPILE_CACHE: '1'
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          PUPPETEER_EXECUTABLE_PATH: /usr/bin/google-chrome
          PUPPETEER_SKIP_DOWNLOAD: 'true'

  ecosystem_tests:
    name: ecosystem tests
    runs-on: ${{ vars.SDK_GHA_RUNNER || 'ubuntu-latest' }}
    timeout-minutes: 20
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      - name: Set up pnpm
        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      - name: Set up Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version-file: '.nvmrc'
          cache: pnpm

      - uses: denoland/setup-deno@11b63cf76cfcafb4e43f97b6cad24d8e8438f62d # v1
        with:
          deno-version: v1.39.0

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.14

      - name: Bootstrap
        run: ./scripts/bootstrap

      - name: Run ecosystem tests without live credentials
        run: |
          pnpm tsn ecosystem-tests/cli.ts --verbose --parallel --jobs=4 --retry=3
        env:
          DISABLE_V8_COMPILE_CACHE: '1'
          PUPPETEER_EXECUTABLE_PATH: /usr/bin/google-chrome
          PUPPETEER_SKIP_DOWNLOAD: 'true'