Clean up CI triggers and required checks

[jbeckwith-oai]

Summary

• route the shared CI workflow by repository and event so each commit gets one authoritative check set
• keep OpenAI feature branches PR-authoritative while preserving Stainless feature-branch push validation
• retain Stainless Depot runners and OIDC-backed installable gem artifact uploads
• move the common lint, package, and Ruby 3.2–4.0 test matrix into a reusable workflow
• add a stable, fail-closed ci / ci-required branch-protection gate
• scan main pull requests with CodeQL and cancel stale runs

Why

This workflow is shared byte-for-byte with stainless-sdks/openai-ruby. The previous shape launched both push and pull_request workflows for same-repository PRs, producing an ambiguous pile of successful and skipped checks. Simply limiting pushes to main/next would break Stainless: it validates generated feature branches on push, uses Depot, and publishes installable artifacts for those commits.

The router preserves both operating modes. On this repository, a feature-branch push collapses to one skipped ci router and the PR event runs the real checks. In Stainless, feature-branch pushes run the real checks and artifact publishing, while same-repository PR events collapse to the router. The production PR also shows ci / stainless artifact as explicitly skipped because that least-privilege OIDC job exists only for Stainless.

Validation

• actionlint v1.7.12
• zizmor --pedantic (no findings)
• ./scripts/lint
• ./scripts/test (467 runs, 1,512 assertions)
• bundle exec rake build:gem
• live PR run: package, lint, Ruby 3.2–4.0, CodeQL security, Code Quality, and ci / ci-required all green

Branch protection

Require the single ci / ci-required check. Keep the repository’s separate code-scanning rule for CodeQL rather than requiring individual matrix check names.

[Copilot]

Pull request overview

This PR refines the repository’s GitHub Actions setup to reduce duplicate CI runs, remove unreachable/obsolete CI paths, and provide a single stable required-check context for branch protection.

Changes:

• Restricts CI push runs to main/next and relies on pull_request runs for PR validation, with concurrency cancellation for stale runs.
• Adds a gem packaging validation job (bundle exec rake build:gem) to CI.
• Introduces a fail-closed ci-required aggregator job intended to be the single branch-protection required check, and enables CodeQL scanning for PRs targeting main.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/codeql.yml	Adds pull_request trigger and concurrency cancellation for CodeQL runs; adjusts job permissions comments.
.github/workflows/ci.yml	Simplifies triggers, adds concurrency cancellation, adds gem packaging job, and adds a stable ci-required gate job.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 9.151s for Ruby SDK PR #314.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	182ms
tests/chat-completions-create.test.ts	✅ Passed	232ms
tests/chat-completions-stream.test.ts	✅ Passed	131ms
tests/files-content-binary.test.ts	✅ Passed	292ms
tests/files-create-multipart.test.ts	✅ Passed	251ms
tests/files-list-pagination.test.ts	✅ Passed	221ms
tests/initialize-config.test.ts	✅ Passed	175ms
tests/instance-isolation.test.ts	✅ Passed	283ms
tests/models-list.test.ts	✅ Passed	261ms
tests/responses-background-lifecycle.test.ts	✅ Passed	263ms
tests/responses-body-method-errors.test.ts	✅ Passed	387ms
tests/responses-cancel-timeout.test.ts	✅ Passed	218ms
tests/responses-cancel.test.ts	✅ Passed	241ms
tests/responses-compact-retries.test.ts	✅ Passed	261ms
tests/responses-compact.test.ts	✅ Passed	270ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	134ms
tests/responses-create-advanced.test.ts	✅ Passed	235ms
tests/responses-create-disconnect.test.ts	✅ Passed	161ms
tests/responses-create-errors.test.ts	✅ Passed	276ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	130ms
tests/responses-create-retries.test.ts	✅ Passed	277ms
tests/responses-create-stream-failures.test.ts	✅ Passed	144ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	215ms
tests/responses-create-stream-wire.test.ts	✅ Passed	2.021s
tests/responses-create-stream.test.ts	✅ Passed	140ms
tests/responses-create-terminal-states.test.ts	✅ Passed	335ms
tests/responses-create-timeout.test.ts	✅ Passed	230ms
tests/responses-create.test.ts	✅ Passed	329ms
tests/responses-delete.test.ts	✅ Passed	274ms
tests/responses-input-items-errors.test.ts	✅ Passed	211ms
tests/responses-input-items-list.test.ts	✅ Passed	171ms
tests/responses-input-items-options.test.ts	✅ Passed	334ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	251ms
tests/responses-input-tokens-count.test.ts	✅ Passed	217ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.301s
tests/responses-not-found-errors.test.ts	✅ Passed	352ms
tests/responses-parse.test.ts	✅ Passed	201ms
tests/responses-retrieve-retries.test.ts	✅ Passed	278ms
tests/responses-retrieve.test.ts	✅ Passed	231ms
tests/responses-stored-method-errors.test.ts	✅ Passed	849ms
tests/retry-behavior.test.ts	✅ Passed	2.025s
tests/sdk-error-shape.test.ts	✅ Passed	402ms

View OkTest run #30121824587

_{SDK merge (e44489362e0b) · head (b93cded45fd8) · base (2ce399946f4b) · OkTest (91635c6a2723)}

[HAYDEN-OAI]

Reviewed the full diff and workflow routing at b135f41. The reusable workflow centralizes the shared checks, preserves the OpenAI/Stainless event split, scopes permissions appropriately, and the live PR run plus independent actionlint validation are clean. No substantive issues found; before merge, coordinate the ruleset change from lint to ci / ci-required noted in the PR body.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.