fix(auth): harden X.509 refresh and diagnostic boundaries - #529
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Castiron custom code✅ No new custom-code files detected. 47 mixed files remain; 1 existing customization changed. Compared
46 existing customizations unchanged
6 more in the full report. A changed generated baseline means this report cannot reliably identify which handwritten lines changed. Inspect the custom-code diffDownload the exact patch produced by this run (requires repository access): gh run download 32876133319 --repo openai/openai-ruby \
--name castiron-custom-code-32876133319-1 --dir /tmp/castiron-custom-code-32876133319-1
git apply --stat /tmp/castiron-custom-code-32876133319-1/custom-code.patch
cat /tmp/castiron-custom-code-32876133319-1/custom-code.patchOr reproduce it from an SDK checkout containing the vendored reporter: git fetch --no-tags origin 712f3c84453006583dae5850008ea18101d01756 b61f8ed17473d0d487ddbb76caf727849da4c5e1
python3 scripts/castiron/custom_code_report.py report \
--base 712f3c84453006583dae5850008ea18101d01756 \
--head b61f8ed17473d0d487ddbb76caf727849da4c5e1 --fetch --require-head-hash --public \
--out /tmp/castiron-custom-code-b61f8ed17473
cat /tmp/castiron-custom-code-b61f8ed17473/custom-code.patchThis is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR. |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 595f66d367
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
apcha-oai
left a comment
apcha-oai
left a comment
There was a problem hiding this comment.
[sdk codex review] Approving b61f8ed17473d0d487ddbb76caf727849da4c5e1 after two independent full reviews of all 13 changed files and the supporting auth/client contracts. No substantiated blocking issue found.
The proactive-refresh fallback preserves token validity, invalidation and deadline boundaries, uses a bounded monotonic cooldown, and retains the original issuer failure across expiry. The existing expiry-boundary feedback is substantively addressed, with deterministic regression coverage; legacy JWT behavior remains unchanged. The diagnostic changes, destination-scoped README setup, signature parity and test isolation are consistent with the implementation. Existing feedback was checked; no duplicate inline comments are needed.
Verified primary hosted CI on merge 0238107d720fd57bba0fb097d9eec226384dd4b5 (this head + current main at 712f3c84453006583dae5850008ea18101d01756): Ruby 3.3.12/3.4.10/4.0.6 each passed 1,372 tests with zero failures, errors or skips. Gem packaging, the Sorbet examples check and RBS validation passed. OkTest passed 237 tests across 42 suites against the same SDK merge.
Head, base, author, open/non-draft status and mergeability rechecked immediately before submission. No new scans, candidate execution or live credential tests were performed for this review.
2 participants
Summary
Follow up on the merged five-PR X.509 workload-identity stack with one focused correctness, security, and documentation hardening change.
X509WorkloadIdentityand nestedX509TokenExchangeinspection while keeping RBI and RBS signatures aligned.The shared cross-language mTLS runbook and dedicated X.509 design were separately updated to document the merged Ruby implementation, the actual public APIs, project setup, and key/secret management:
Verification
bundle exec rake lint: 2,773 files inspected; no offenses; Ruby formatting, Sorbet, and all 1,244 RBS signatures clean.OPENAI_LOG=debug.Review requested from
@openai/sdks-team.