ci: add Castiron promotion workflow

[HAYDEN-OAI]

Summary

• add a default-off workflow_dispatch entrypoint for promoting approved Ruby Castiron candidates into a public main draft PR
• hardcode the target to openai-ruby and pin the shared writer to the merged Castiron orchestration commit from openai/openai#1160100
• mint separate GitHub App tokens for the read-only openai/openai checkout and the narrowly scoped openai-ruby plus openai-ruby-internal promotion
• serialize promotions per repository and require the repository guard, main, the protected castiron-promotion environment, and CASTIRON_PROMOTION_ENABLED=true

Promotion remains disabled. Before enabling:

• create the protected castiron-promotion environment, restrict it to main, require sdks-team, and prevent self-review
• configure the environment variables CASTIRON_CONTAINER_URI, CASTIRON_AZURE_CLIENT_ID, and CASTIRON_AZURE_TENANT_ID
• store OPENAI_SDKS_APP_PRIVATE_KEY in the protected environment
• set the repository- or organization-level CASTIRON_PROMOTION_ENABLED=true only for the controlled first promotion

Validation

• actionlint v1.7.7 .github/workflows/castiron-promote.yml

[Copilot]

Pull request overview

Adds a manually triggered GitHub Actions workflow to promote previously approved Castiron candidates by invoking a pinned writer from openai/openai, gated behind repository/branch checks, a protected environment, and an explicit enable flag.

Changes:

• Introduces a default-off workflow_dispatch promotion workflow with repository + main branch guards and per-repo concurrency.
• Checks out a pinned openai/openai commit and runs the Castiron public PR writer via Bazel.
• Mints separate GitHub App tokens for monorepo checkout (read-only) and SDK promotion (write-scoped), and logs into Azure via OIDC.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 9.229s for Ruby SDK PR #313.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	201ms
tests/chat-completions-create.test.ts	✅ Passed	239ms
tests/chat-completions-stream.test.ts	✅ Passed	156ms
tests/files-content-binary.test.ts	✅ Passed	232ms
tests/files-create-multipart.test.ts	✅ Passed	247ms
tests/files-list-pagination.test.ts	✅ Passed	204ms
tests/initialize-config.test.ts	✅ Passed	189ms
tests/instance-isolation.test.ts	✅ Passed	229ms
tests/models-list.test.ts	✅ Passed	251ms
tests/responses-background-lifecycle.test.ts	✅ Passed	258ms
tests/responses-body-method-errors.test.ts	✅ Passed	478ms
tests/responses-cancel-timeout.test.ts	✅ Passed	253ms
tests/responses-cancel.test.ts	✅ Passed	259ms
tests/responses-compact-retries.test.ts	✅ Passed	286ms
tests/responses-compact.test.ts	✅ Passed	296ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	154ms
tests/responses-create-advanced.test.ts	✅ Passed	242ms
tests/responses-create-disconnect.test.ts	✅ Passed	160ms
tests/responses-create-errors.test.ts	✅ Passed	263ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	149ms
tests/responses-create-retries.test.ts	✅ Passed	294ms
tests/responses-create-stream-failures.test.ts	✅ Passed	144ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	227ms
tests/responses-create-stream-wire.test.ts	✅ Passed	2.034s
tests/responses-create-stream.test.ts	✅ Passed	105ms
tests/responses-create-terminal-states.test.ts	✅ Passed	294ms
tests/responses-create-timeout.test.ts	✅ Passed	257ms
tests/responses-create.test.ts	✅ Passed	357ms
tests/responses-delete.test.ts	✅ Passed	286ms
tests/responses-input-items-errors.test.ts	✅ Passed	231ms
tests/responses-input-items-list.test.ts	✅ Passed	187ms
tests/responses-input-items-options.test.ts	✅ Passed	221ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	298ms
tests/responses-input-tokens-count.test.ts	✅ Passed	280ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.265s
tests/responses-not-found-errors.test.ts	✅ Passed	408ms
tests/responses-parse.test.ts	✅ Passed	183ms
tests/responses-retrieve-retries.test.ts	✅ Passed	282ms
tests/responses-retrieve.test.ts	✅ Passed	261ms
tests/responses-stored-method-errors.test.ts	✅ Passed	666ms
tests/retry-behavior.test.ts	✅ Passed	2.095s
tests/sdk-error-shape.test.ts	✅ Passed	398ms

View OkTest run #30037453884

_{SDK merge (26dcaf238bc2) · head (2573e5b2dc06) · base (7f0fb8f34a3a) · OkTest (d2b5921fc22a)}