fix(ci): reuse SDK compilation outputs across Java builds

[dpiet-oai]

The Gradle basic cache uses an immutable key derived from build files. On main, the version-matrix job saved the key before CI / build compiled the SDK; later builds restored only dependency/buildSrc outputs. The observed 8m35s PR build executed all SDK compilation tasks again.

Give CI / build a separate, commit-keyed SDK compilation cache, overlaid after the existing dependency cache. Only successful pushes to the default branch can publish it. PRs and merge groups read it and continue to share their current immutable, digest-verified build artifact downstream. All current tests, runtime, Jackson and API compatibility gates remain required. The new SHA-pinned GitHub cache actions store only Gradle's content-addressed build-cache-1.

Validation:

• Full Gradle build-logic tests including cache trust/fail-closed policy: pass.
• Java and Kotlin project lint: pass.
• Actual scripts/build with CI compiler flags and a dependency-only Gradle home, cleaning between runs: 135.14s with 0/20 Kotlin compilation cache hits, then 17.18s with 20/20 hits. This measures clean, unchanged local builds; changed modules will recompile, and the GitHub speedup will be measurable after the first successful main build seeds the cache.
• Security review: default-branch push only writer, read-only restore elsewhere, pinned actions, contents:read permissions unchanged, no release workflow/cache changes.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-06T22:33:13.748114Z	18c64c8	PR opened
🔒 Security Review	✅ Completed 2026-10-06T22:33:41.862785Z	18c64c8	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[openai-sdks]

OkTest Summary

✅ 236/236 SDK tests passed in 17.707s for Java SDK PR #1149.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	599ms
tests/chat-completions-create.test.ts	✅ Passed	809ms
tests/chat-completions-stream.test.ts	✅ Passed	617ms
tests/files-content-binary.test.ts	✅ Passed	351ms
tests/files-create-multipart.test.ts	✅ Passed	366ms
tests/files-list-pagination.test.ts	✅ Passed	271ms
tests/initialize-config.test.ts	✅ Passed	147ms
tests/instance-isolation.test.ts	✅ Passed	312ms
tests/models-list.test.ts	✅ Passed	321ms
tests/responses-background-lifecycle.test.ts	✅ Passed	216ms
tests/responses-body-method-errors.test.ts	✅ Passed	472ms
tests/responses-cancel-timeout.test.ts	✅ Passed	240ms
tests/responses-cancel.test.ts	✅ Passed	274ms
tests/responses-compact-retries.test.ts	✅ Passed	500ms
tests/responses-compact.test.ts	✅ Passed	233ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	341ms
tests/responses-create-advanced.test.ts	✅ Passed	1.377s
tests/responses-create-disconnect.test.ts	✅ Passed	1.074s
tests/responses-create-errors.test.ts	✅ Passed	320ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	217ms
tests/responses-create-retries.test.ts	✅ Passed	250ms
tests/responses-create-stream-failures.test.ts	✅ Passed	1.604s
tests/responses-create-stream-timeout.test.ts	✅ Passed	229ms
tests/responses-create-stream-wire.test.ts	✅ Passed	6.617s
tests/responses-create-stream.test.ts	✅ Passed	281ms
tests/responses-create-terminal-states.test.ts	✅ Passed	935ms
tests/responses-create-timeout.test.ts	✅ Passed	203ms
tests/responses-create.test.ts	✅ Passed	245ms
tests/responses-delete.test.ts	✅ Passed	236ms
tests/responses-input-items-errors.test.ts	✅ Passed	273ms
tests/responses-input-items-list.test.ts	✅ Passed	381ms
tests/responses-input-items-options.test.ts	✅ Passed	197ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	214ms
tests/responses-input-tokens-count.test.ts	✅ Passed	343ms
tests/responses-malformed-inputs.test.ts	✅ Passed	5.258s
tests/responses-not-found-errors.test.ts	✅ Passed	458ms
tests/responses-parse.test.ts	✅ Passed	567ms
tests/responses-retrieve-retries.test.ts	✅ Passed	424ms
tests/responses-retrieve.test.ts	✅ Passed	406ms
tests/responses-stored-method-errors.test.ts	✅ Passed	954ms
tests/retry-behavior.test.ts	✅ Passed	3.521s
tests/sdk-error-shape.test.ts	✅ Passed	486ms

View OkTest run #37541148759

_{SDK merge (1056ecc055e9) · head (18c64c877dae) · base (7648554b5e6a) · OkTest (505ac0e34283)}

[github-actions]

Castiron custom code

Evaluated main: 7648554b5e6a250a233cc11e211f436b756ef03b.

✅ No new custom-code files detected.

93 mixed files remain; 0 existing customizations changed.

Compared 7648554b5e6a → 18c64c877dae. Generated baselines verified.

93 existing customizations unchanged

• openai-java-core/src/main/kotlin/com/openai/models/audio/AudioResponseFormat.kt
• openai-java-core/src/main/kotlin/com/openai/models/beta/agents/vaults/credentials/CredentialAuth.kt
• openai-java-core/src/main/kotlin/com/openai/models/beta/agents/vaults/credentials/CredentialAuthCreateParam.kt
• openai-java-core/src/main/kotlin/com/openai/models/beta/agents/vaults/credentials/CredentialAuthRotateParam.kt
• openai-java-core/src/main/kotlin/com/openai/models/beta/responses/BetaResponse.kt
• openai-java-core/src/main/kotlin/com/openai/models/beta/responses/BetaResponseStreamEvent.kt
• openai-java-core/src/main/kotlin/com/openai/models/beta/responses/BetaResponsesServerEvent.kt
• openai-java-core/src/main/kotlin/com/openai/models/chat/completions/ChatCompletionCreateParams.kt
• openai-java-core/src/main/kotlin/com/openai/models/chat/completions/ChatCompletionMessageFunctionToolCall.kt
• openai-java-core/src/main/kotlin/com/openai/models/chat/completions/ChatCompletionToolMessageParam.kt
• openai-java-core/src/main/kotlin/com/openai/models/embeddings/Embedding.kt
• openai-java-core/src/main/kotlin/com/openai/models/embeddings/EmbeddingCreateParams.kt
• openai-java-core/src/main/kotlin/com/openai/models/responses/Response.kt
• openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseCreateParams.kt
• openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseFunctionToolCall.kt
• openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseFunctionWebSearch.kt
• openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseInputItem.kt
• openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseStreamEvent.kt
• openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseTextConfig.kt
• openai-java-core/src/main/kotlin/com/openai/models/responses/ResponsesServerEvent.kt
• openai-java-core/src/main/kotlin/com/openai/models/videos/Video.kt
• openai-java-core/src/main/kotlin/com/openai/models/webhooks/UnwrapWebhookEvent.kt
• openai-java-core/src/main/kotlin/com/openai/models/webhooks/WebhookEndpointWithSecret.kt
• openai-java-core/src/main/kotlin/com/openai/services/async/BetaServiceAsync.kt
• openai-java-core/src/main/kotlin/com/openai/services/async/BetaServiceAsyncImpl.kt
• openai-java-core/src/main/kotlin/com/openai/services/async/ImageServiceAsyncImpl.kt
• openai-java-core/src/main/kotlin/com/openai/services/async/ResponseServiceAsync.kt
• openai-java-core/src/main/kotlin/com/openai/services/async/ResponseServiceAsyncImpl.kt
• openai-java-core/src/main/kotlin/com/openai/services/async/SkillServiceAsyncImpl.kt
• openai-java-core/src/main/kotlin/com/openai/services/async/VideoServiceAsyncImpl.kt
• openai-java-core/src/main/kotlin/com/openai/services/async/WebhookServiceAsync.kt
• openai-java-core/src/main/kotlin/com/openai/services/async/WebhookServiceAsyncImpl.kt
• openai-java-core/src/main/kotlin/com/openai/services/async/audio/TranscriptionServiceAsyncImpl.kt
• openai-java-core/src/main/kotlin/com/openai/services/async/audio/TranslationServiceAsyncImpl.kt
• openai-java-core/src/main/kotlin/com/openai/services/async/audio/VoiceServiceAsyncImpl.kt
• openai-java-core/src/main/kotlin/com/openai/services/async/beta/agents/SessionServiceAsync.kt
• openai-java-core/src/main/kotlin/com/openai/services/async/beta/agents/SessionServiceAsyncImpl.kt
• openai-java-core/src/main/kotlin/com/openai/services/async/beta/agents/sessions/TurnServiceAsync.kt
• openai-java-core/src/main/kotlin/com/openai/services/async/chat/ChatCompletionServiceAsync.kt
• openai-java-core/src/main/kotlin/com/openai/services/async/finetuning/checkpoints/PermissionServiceAsyncImpl.kt

53 more in the full report.

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 37541388915 --repo openai/openai-java \
  --name castiron-custom-code-37541388915-1 --dir /tmp/castiron-custom-code-37541388915-1
git apply --stat /tmp/castiron-custom-code-37541388915-1/custom-code.patch
cat /tmp/castiron-custom-code-37541388915-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 7648554b5e6a250a233cc11e211f436b756ef03b 18c64c877dae832e2bf0a1451ae520da7217f2c5
python3 scripts/castiron/custom_code_report.py report \
  --base 7648554b5e6a250a233cc11e211f436b756ef03b \
  --head 18c64c877dae832e2bf0a1451ae520da7217f2c5 --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-18c64c877dae
cat /tmp/castiron-custom-code-18c64c877dae/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

[jbeckwith-oai]

Reviewed 18c64c877dae832e2bf0a1451ae520da7217f2c5; no actionable findings.

The separate commit-keyed compilation cache fixes the dependency-cache race without weakening the exact-run artifact/digest handoff or required test and compatibility jobs. Restore-only use preserves read-only PR/merge-group behavior; the default-branch push condition also retains GitHub’s implicit success guard.

Independently ran three exact-head Kotlin cache-policy tests plus five additional workflow mutations (writer predicates, commit key, cache path and primary-vs-matched save key): all passed/rejected as expected. This was a standalone invocation with cached test dependencies, not the full Gradle suite; I did not rerun the local performance benchmark. All 13 executed hosted checks/statuses are green; queue-signal is skipped. Temporary test fixtures cleaned up.

[markstuart-oai]

Reviewed 18c64c877dae832e2bf0a1451ae520da7217f2c5: no actionable findings.

The separate compilation cache fixes the race with the faster dependency-cache writer. Restore runs before the SDK build. Save runs after successful build, collect, and upload steps, only on default-branch pushes. PRs and merge groups keep read-only access. The existing artifact ID and digest checks still bind later jobs to this run's build outputs.

The policy tests cover unsafe save conditions and a competing writer in an earlier job. The change uses the existing workflow parser and keeps the cache logic in the build job.

Required hosted CI checks pass at this head: build, lint, tests, API/Jackson compatibility, and Java 8/25 runtime checks. This was a source review; I did not run local tests or a build. The reported speedup is from the author's local runs. Hosted cache reuse still needs a successful main build to seed it. The separate OkTest bot comment still reports Running.