chore: merge main into next preserving next CI coverage

.castiron.stats.yml

@@ -1,8 +1,8 @@
 schema_version: 1
-generation_id: dcbb1592-447d-41a4-acb3-90850aee414e
-openapi_spec_hash: d342651bd77c6cd6ea10a9d889b35bb8
-openapi_transformed_spec_hash: 259f19fd2d38c6e784bbb40bf2f9a971
-config_hash: fce3820c4f95b555e486349bc7d297d8
-codegen_sha: d082ff25f7a8d79c8b37bd111b6c3c73ed75b287
-codegen_hash: 321c8e18084913bcf2ab5c7f4fcc2275399a412df08e3288c4e94a8f0970df4e
-public_codegen_sha: 57bc540656cae6646589d514646a8b2c33c5895a
+generation_id: 491e58ee-627a-4a57-91d7-2d5261cecfe9
+openapi_spec_hash: 1f2d498f08bdd6dacffeb41cee8f44e5
+openapi_transformed_spec_hash: 77075630a8655ccbb8d1f790f19f5731
+config_hash: d356dda7ff9ca3fbc614107eb546de9f
+codegen_sha: eeef8c0a76fd3885ff1da6b83ed2ba0ef6531414
+codegen_hash: ccac0bcc0ccfd20617a6e93498d22157f63843c1288cf775b7f3d5d393e49358
+public_codegen_sha: 40b2e7c300353a5cc5c8f8992e6616e999f4ecad

.devcontainer/Dockerfile

@@ -1,9 +1,11 @@
-ARG VARIANT="3.9"
+ARG VARIANT="3.10"
 FROM mcr.microsoft.com/vscode/devcontainers/python:0-${VARIANT}
 
 USER vscode
 
-RUN curl -sSf https://rye.astral.sh/get | RYE_VERSION="0.44.0" RYE_INSTALL_OPTION="--yes" bash
-ENV PATH=/home/vscode/.rye/shims:$PATH
+ADD --chmod=644 --checksum=sha256:504511fbbbd811aeaba6738abc79408956b6c7da0ca35437b3dcc24a41efc111 \
+    https://github.com/astral-sh/uv/releases/download/0.12.5/uv-installer.sh /tmp/uv-installer.sh
+RUN UV_NO_MODIFY_PATH=1 sh /tmp/uv-installer.sh
+ENV PATH=/home/vscode/.local/bin:$PATH
 
 RUN echo "[[ -d .venv ]] && source .venv/bin/activate || export PATH=\$PATH" >> /home/vscode/.bashrc

.devcontainer/devcontainer.json

@@ -7,7 +7,7 @@
     "context": ".."
   },
 
-  "postStartCommand": "rye sync --all-features",
+  "postStartCommand": "./scripts/bootstrap",
 
   "customizations": {
     "vscode": {
@@ -20,13 +20,16 @@
         "python.defaultInterpreterPath": ".venv/bin/python",
         "python.typeChecking": "basic",
         "terminal.integrated.env.linux": {
-          "PATH": "/home/vscode/.rye/shims:${env:PATH}"
+          "PATH": "/home/vscode/.local/bin:${env:PATH}"
         }
       }
     }
   },
   "features": {
-    "ghcr.io/devcontainers/features/node:1": {}
+    "ghcr.io/devcontainers/features/node:1": {
+      "version": "22.22.3",
+      "pnpmVersion": "11.19.0"
+    }
   }
 
   // Features to add to the dev container. More info: https://containers.dev/features.

.github/actions/setup-node-tooling/action.yml

@@ -0,0 +1,15 @@
+name: Set up repository Node tooling
+description: Install the pinned contributor toolchain and frozen dependencies
+runs:
+  using: composite
+  steps:
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      with:
+        node-version-file: .node-version
+    - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      with:
+        run_install: false
+    - shell: bash
+      run: ./scripts/bootstrap-node
+    - shell: bash
+      run: node --test tests/node-tooling.test.cjs tests/node-release-age.test.cjs

.github/dependabot.yml

@@ -0,0 +1,48 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 8
+  - package-ecosystem: uv
+    directory: /
+    versioning-strategy: increase-if-necessary
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Etc/UTC
+    # Version updates wait; Dependabot security updates are exempt.
+    cooldown:
+      default-days: 8
+    open-pull-requests-limit: 3
+    groups:
+      python-maintenance:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+      python-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:30"
+      timezone: Etc/UTC
+    cooldown:
+      default-days: 8
+    open-pull-requests-limit: 5
+    groups:
+      # CodeQL init/analyze share versioned state and must change together.
+      codeql:
+        patterns:
+          - "github/codeql-action"

.github/pull_request_template.md

@@ -1,9 +1,8 @@
-<!-- Thank you for contributing to this project! -->
-<!-- The code in this repository is all auto-generated, and is not meant to be edited manually. -->
-<!-- We recommend opening an Issue instead, but you are still welcome to open a PR to share for -->
-<!-- an improvement if you wish, just note that we are unlikely to merge it as-is. -->
-
-- [ ] I understand that this repository is auto-generated and my pull request may not be merged
+<!-- Pull requests are limited to repository collaborators. -->
+<!-- For community bug reports and feature requests, open an issue: -->
+<!-- https://github.com/openai/openai-python/issues -->
+<!-- Read the contribution policy and development guide: -->
+<!-- https://github.com/openai/openai-python/blob/main/CONTRIBUTING.md -->
 
 ## Changes being requested
 

.github/scripts/setup-playwright-sandbox.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Ubuntu restricts user namespaces for downloaded Chromium. Keep Chromium's
+# sandbox enabled and allow only the two executables installed for this CI job.
+: "${RUNNER_TEMP:?RUNNER_TEMP is required}"
+: "${PLAYWRIGHT_BROWSERS_PATH:?PLAYWRIGHT_BROWSERS_PATH is required}"
+expected_root="$RUNNER_TEMP/openai-python-playwright"
+if [[ "$PLAYWRIGHT_BROWSERS_PATH" != "$expected_root" || ! -d "$expected_root" ]]; then
+  echo "Playwright must be installed inside this job's RUNNER_TEMP." >&2
+  exit 1
+fi
+runner_root="$(realpath "$RUNNER_TEMP")"
+install_root="$(realpath "$expected_root")"
+# AppArmor uses these paths in its policy syntax, without globs or expansions.
+if [[ "$install_root" != "$runner_root/openai-python-playwright" || ! "$install_root" =~ ^/[a-zA-Z0-9_./-]+$ ]]; then
+  echo "Playwright installation escaped RUNNER_TEMP or contains unexpected path characters." >&2
+  exit 1
+fi
+shopt -s nullglob
+chromiums=("$install_root"/chromium-*/chrome-linux64/chrome)
+headless_shells=("$install_root"/chromium_headless_shell-*/chrome-headless-shell-linux64/chrome-headless-shell)
+if [[ "${#chromiums[@]}" -ne 1 || "${#headless_shells[@]}" -ne 1 ]]; then
+  echo "Expected one installed Chromium and one installed headless shell." >&2
+  exit 1
+fi
+binaries=("${chromiums[0]}" "${headless_shells[0]}")
+for index in "${!binaries[@]}"; do
+  binary="$(realpath "${binaries[index]}")"
+  if [[ ! -x "$binary" || "$binary" != "$install_root/"* || ! "$binary" =~ ^/[a-zA-Z0-9_./-]+$ ]]; then
+    echo "Chromium executable is absent or outside this job's installation." >&2
+    exit 1
+  fi
+  binaries[index]="$binary"
+done
+{
+  printf 'abi <abi/4.0>,\ninclude <tunables/global>\n'
+  for index in "${!binaries[@]}"; do
+    printf 'profile openai-python-playwright-%s "%s" flags=(unconfined) {\n  userns,\n}\n' "$index" "${binaries[index]}"
+  done
+} | sudo tee /etc/apparmor.d/openai-python-playwright >/dev/null
+sudo apparmor_parser -r /etc/apparmor.d/openai-python-playwright