release: 2.52.1 - #3562
Merged
Merged
Conversation
jbeckwith-oai
approved these changes
Aug 3, 2026
jbeckwith-oai
left a comment
jbeckwith-oai
left a comment
Contributor
There was a problem hiding this comment.
Reviewed the generated 2.52.1 version and changelog updates; all required checks are green. Approving so the pending Stainless release completes before the Release Please migration.
Contributor
Author
|
🤖 Release is at https://github.com/openai/openai-python/releases/tag/v2.52.1 🌻 |
jbeckwith-oai
added a commit
that referenced
this pull request
Aug 3, 2026
## Summary - replace `stainless-api/trigger-release-please` with the upstream `googleapis/release-please-action`, pinned to verified v5.0.0 commit `45996ed` - run release-please explicitly against `main` with the repository's manifest configuration - use the built-in `GITHUB_TOKEN` explicitly and remove the `STAINLESS_API_KEY` action input - switch the config schema to upstream release-please and remove Stainless's prerelease/beta settings - explicitly dispatch required checks for the generated `release-please--branches--main` PR - keep the `publish` environment scoped to the PyPI publish job ## Impact Release PRs and GitHub releases are now managed entirely by the open-source release-please action. Stable release versions continue to update `CHANGELOG.md`, `.release-please-manifest.json`, `pyproject.toml`, and `src/openai/_version.py`; successful GitHub release creation still gates the existing build and trusted PyPI publish jobs. Release Please deliberately uses `GITHUB_TOKEN`. Because GitHub suppresses ordinary push and pull-request events created by that token, a separate least-privilege job explicitly dispatches CI, breaking-change detection, and CodeQL against the generated release PR. It fetches the PR's live base SHA immediately before dispatch and restricts this path to the exact `release-please--branches--main` ref. ## Permission audit - release: `contents: write` for the release branch, tags, and GitHub releases; `pull-requests: write` for release PRs; `issues: write` for PR labels - release PR checks: `actions: write` only to dispatch workflows and `pull-requests: read` only to obtain the current base SHA and verify the generated head branch - CI and breaking-change workflows: default `contents: read`; the secret-bearing examples job is not dispatched for release PRs - CI build: `contents: read` only, with checkout credential persistence disabled; the Stainless mirror's OIDC upload is isolated in a separate Stainless-only job - CodeQL: `contents: read` and `security-events: write` in its existing dedicated workflow - package build: `contents: read` only, with checkout credential persistence disabled - publish: `id-token: write` only for PyPI Trusted Publishing - no App private key, Stainless credential, or PyPI credential is exposed to the release workflow ## Validation - release-please v17.6.0 `debug-config --dry-run`: loaded the Python strategy with stable/default versioning and target branch `main` - release-please v17.6.0 `release-pr --dry-run`: generated the expected stable branch and version-file changes - release-please config validated against the exact v17.6.0 upstream JSON schema; current manifest baseline is `2.52.1` - pinned action interface, outputs, branch naming, and documented permissions verified against upstream source - actionlint and YAML/JSON parsing - `git diff --check` - thermo-nuclear code-quality review: no findings ## Cutover prerequisites completed - existing Stainless release PR #3562 was reviewed, merged, and released successfully as [v2.52.1](https://github.com/openai/openai-python/releases/tag/v2.52.1); the current release workflow completed GitHub release creation, build, and PyPI publishing in [run 30835897995](https://github.com/openai/openai-python/actions/runs/30835897995) - GitHub rejected its built-in Actions integration as a ruleset bypass actor, so active legacy ruleset `15951502` now excludes only `refs/heads/release-please--branches--main`; all other `release-please--*` branches and the two original bypass actors remain unchanged - the migration branch includes the published `2.52.1` manifest/version baseline ## After merge - remove the now-unused `STAINLESS_API_KEY` secret from the repository/environment - any future migration to the `openai-sdks` App should be handled separately; this PR intentionally uses only `GITHUB_TOKEN`
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated Release PR
2.52.1 (2026-07-31)
Full Changelog: v2.52.0...v2.52.1
Chores
This pull request is managed by Stainless's GitHub App.
The semver version number is based on included commit messages. Alternatively, you can manually set the version number in the title of this pull request.
For a better experience, it is recommended to use either rebase-merge or squash-merge when merging this pull request.
🔗 Stainless website
📚 Read the docs
🙋 Reach out for help or questions