ci: attest Maven release artifact provenance

[HAYDEN-OAI]

Summary

• Generate GitHub OIDC/Sigstore build-provenance attestations for the exact four published Maven binary JARs: openai-java, openai-java-core, openai-java-client-okhttp, and openai-java-bedrock.
• Build and attest those JARs before exposing Maven Central or PGP credentials, then verify their SHA-256 digests again after publication.
• Pin GitHub's first-party actions/attest action to its immutable v4.2.2 commit and scope id-token: write / attestations: write to the existing protected publishing job.
• Preserve the main-only publishing environment, existing Sonatype authentication and PGP signatures, isolated Gradle cache, and current release behavior.
• Document downstream verification using gh attestation verify.

Verification

• All 22 GradleCacheTrustPolicyTest JUnit cases pass, including new regressions for exact artifact coverage, least-privilege permissions, SHA-pinned action inputs, pre-secret attestation ordering, and post-publication digest verification.
• Executed the workflow's artifact-preparation and digest-verification scripts against four fixture JARs; confirmed modified artifacts and symbolic links are rejected.
• actionlint .github/workflows/create-releases.yml passes.
• Repository-pinned ktfmt 0.61 formatting check passes.
• Duplicate-safe YAML parsing and git diff --check pass.
• Full project CI will exercise the normal Gradle dependency set; local root Gradle execution cannot resolve the uncached Dokka 2.1.0 plugin offline.

Rollout

• Provenance becomes verifiable after the first release generated with this workflow.
• Maven Central still requires its existing publisher token and PGP signatures; no new secrets or registry configuration are introduced.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 13.482s for Java SDK PR #903.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	108ms
tests/chat-completions-create.test.ts	✅ Passed	567ms
tests/chat-completions-stream.test.ts	✅ Passed	322ms
tests/files-content-binary.test.ts	✅ Passed	256ms
tests/files-create-multipart.test.ts	✅ Passed	368ms
tests/files-list-pagination.test.ts	✅ Passed	210ms
tests/initialize-config.test.ts	✅ Passed	159ms
tests/instance-isolation.test.ts	✅ Passed	96ms
tests/models-list.test.ts	✅ Passed	218ms
tests/responses-background-lifecycle.test.ts	✅ Passed	175ms
tests/responses-body-method-errors.test.ts	✅ Passed	463ms
tests/responses-cancel-timeout.test.ts	✅ Passed	180ms
tests/responses-cancel.test.ts	✅ Passed	216ms
tests/responses-compact-retries.test.ts	✅ Passed	243ms
tests/responses-compact.test.ts	✅ Passed	160ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	184ms
tests/responses-create-advanced.test.ts	✅ Passed	825ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.018s
tests/responses-create-errors.test.ts	✅ Passed	266ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	156ms
tests/responses-create-retries.test.ts	✅ Passed	238ms
tests/responses-create-stream-failures.test.ts	✅ Passed	149ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	201ms
tests/responses-create-stream-wire.test.ts	✅ Passed	4.607s
tests/responses-create-stream.test.ts	✅ Passed	319ms
tests/responses-create-terminal-states.test.ts	✅ Passed	222ms
tests/responses-create-timeout.test.ts	✅ Passed	190ms
tests/responses-create.test.ts	✅ Passed	274ms
tests/responses-delete.test.ts	✅ Passed	204ms
tests/responses-input-items-errors.test.ts	✅ Passed	241ms
tests/responses-input-items-list.test.ts	✅ Passed	212ms
tests/responses-input-items-options.test.ts	✅ Passed	355ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	203ms
tests/responses-input-tokens-count.test.ts	✅ Passed	392ms
tests/responses-malformed-inputs.test.ts	✅ Passed	4.155s
tests/responses-not-found-errors.test.ts	✅ Passed	288ms
tests/responses-parse.test.ts	✅ Passed	650ms
tests/responses-retrieve-retries.test.ts	✅ Passed	596ms
tests/responses-retrieve.test.ts	✅ Passed	209ms
tests/responses-stored-method-errors.test.ts	✅ Passed	873ms
tests/retry-behavior.test.ts	✅ Passed	3.182s
tests/sdk-error-shape.test.ts	✅ Passed	438ms

View OkTest run #32308711613

_{SDK merge (3a2e8ff1c5f6) · head (83203039841e) · base (217d163402fd) · OkTest (2b1bdfd25e98)}

[jbeckwith-oai]

Independent two-pass release-security review identified one Medium issue: the provenance digest check occurs only after Maven Central publication/release, so it cannot prevent an attestation mismatch if the separate publishing Gradle invocation regenerates an artifact.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 49efc88371

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jbeckwith-oai]

Independent two-pass release-security re-review confirms the prior provenance issue is fixed: all four JAR digests are verified before irreversible Maven publication, producer tasks are excluded to prevent rebuilding, and attestation identity is bound to the actual protected release commit. CI is green.