Repository navigation
build(deps): bump Maven Publish to 0.34.0 - #910
Conversation
Bumps [com.vanniktech:gradle-maven-publish-plugin](https://github.com/vanniktech/gradle-maven-publish-plugin) in `/` from 0.28.0 to 0.37.0. Updates `com.vanniktech:gradle-maven-publish-plugin` from 0.28.0 to 0.37.0 - [Release notes](https://github.com/vanniktech/gradle-maven-publish-plugin/releases) - [Changelog](https://github.com/vanniktech/gradle-maven-publish-plugin/blob/main/CHANGELOG.md) - [Commits](vanniktech/gradle-maven-publish-plugin@0.28.0...0.37.0) --- updated-dependencies: - dependency-name: com.vanniktech:gradle-maven-publish-plugin dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9918710d41
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
jbeckwith-oai
left a comment
jbeckwith-oai
left a comment
There was a problem hiding this comment.
Overview
This updates both buildSrc references to the Vanniktech Maven Publish plugin from 0.28.0 to 0.37.0. The plugin is foundational build logic used by every published SDK module.
Confirmed Findings
- [High] Version 0.37.0 is incompatible with both the current Gradle and Kotlin toolchains
- Location: buildSrc/build.gradle.kts:4,14
- Why: Upstream declares Gradle 9.0+ and Kotlin Gradle Plugin 2.2+ minima, while this head uses Gradle 8.12 and KGP 1.9.20. Exact-head CI fails while applying
MavenPublishBasePlugin, before any build, test, compatibility, or release task can run. Failed CI - Suggested fix: Retain 0.28.0 or separately review a release whose declared minima fit Gradle 8.12/KGP 1.9.20. Treat 0.37.0 as a coordinated Gradle/Kotlin/Dokka publishing migration.
Rejected Findings
None.
Residual Risks
None beyond the confirmed configuration blocker. Requesting changes; this PR must not merge in its current form.
dpiet-oai
changed the title
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Castiron custom code✅ No new custom-code files detected. 87 mixed files remain; 0 existing customizations changed. Compared 87 existing customizations unchanged
47 more in the full report. A changed generated baseline means this report cannot reliably identify which handwritten lines changed. Inspect the custom-code diffDownload the exact patch produced by this run (requires repository access): gh run download 36028261169 --repo openai/openai-java \
--name castiron-custom-code-36028261169-1 --dir /tmp/castiron-custom-code-36028261169-1
git apply --stat /tmp/castiron-custom-code-36028261169-1/custom-code.patch
cat /tmp/castiron-custom-code-36028261169-1/custom-code.patchOr reproduce it from an SDK checkout containing the vendored reporter: git fetch --no-tags origin 3f00bce4be75ba0791f926c13231b499704f9a95 6971c4da7aba9e90424b234c46a6b8892a966e3f
python3 scripts/castiron/custom_code_report.py report \
--base 3f00bce4be75ba0791f926c13231b499704f9a95 \
--head 6971c4da7aba9e90424b234c46a6b8892a966e3f --fetch --require-head-hash --public \
--out /tmp/castiron-custom-code-6971c4da7aba
cat /tmp/castiron-custom-code-6971c4da7aba/custom-code.patchThis is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 899e7cc871
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| useInMemoryPgpKeys( | ||
| System.getenv("GPG_SIGNING_KEY_ID"), | ||
| System.getenv("GPG_SIGNING_KEY"), | ||
| System.getenv("GPG_SIGNING_PASSWORD"), | ||
| ) |
There was a problem hiding this comment.
This replaces the credential-loading and Maven Central publication path, but the commit adds no Gradle or shell regression coverage that executes signing with a synthetic key and verifies the resulting local publication. The manual disposable-key validation is not repeatable in CI, so a future plugin or credential-wiring change could leave the protected release workflow unable to sign or publish artifacts without any pull-request check detecting it.
AGENTS.md reference: AGENTS.md:L41-L45
Useful? React with 👍 / 👎.
|
Follow-up CI fix pushed in 5415ada (current head 6971c4d): Maven Publish now uses Gradle's sourcesJar, so the core verifier now follows that published task instead of kotlinSourcesJar. Removed the redundant manual source aggregation and preserved main/ paths for Kotlin sources. The exact CI build command now passes locally, including verifyCoreCompilationArtifact. All 2,224 core Kotlin sources are present exactly once; all four modules' source inventories and refreshed publication metadata checksums were verified. Two fresh consecutive adversarial-review rounds found no blockers on this final diff. Monitoring the new CI run. |
jbeckwith-oai
left a comment
jbeckwith-oai
left a comment
There was a problem hiding this comment.
Reviewed 6971c4da7aba9e90424b234c46a6b8892a966e3f. No actionable correctness or security blocker found; the toolchain incompatibility from my earlier review is fixed.
Both declarations now use Maven Publish 0.34.0. Its declared requirements and pinned plugin source support the existing Gradle 8.12 / Kotlin 1.9.20 toolchain and the retained Dokka V1 task. I checked the Central Portal task wiring, direct in-memory key/key-ID/password mapping, required signing outside publishLocal, protected release environment, and unchanged coordinates/POM and SDK compatibility policy. The verifier now inspects the actual published sourcesJar; Kotlin main/ paths, full canonical core source inventory, and duplicate rejection are preserved.
Validation: 17 independent static base/head and wiring checks passed. Exact-head CI #36028176937 is green; its build log confirms :buildSrc:test, all four sourcesJar tasks, and :openai-java-core:verifyCoreCompilationArtifact executed. API compatibility, Jackson compatibility, Java 8/25 consumers, lint, and custom-code checks also passed.
I did not run local Gradle, real publication, or a synthetic-key signing smoke test. The reported local four-module publication/GPG verification remains author-provided; checked-in CI does not yet exercise that end-to-end signing path. Keeping that smoke test as repeatable offline regression coverage would be a useful follow-up.
markstuart-oai
left a comment
markstuart-oai
left a comment
There was a problem hiding this comment.
Reviewed 6971c4da7aba9e90424b234c46a6b8892a966e3f. The 0.34.0 pin addresses the Gradle/Kotlin and Dokka V1 compatibility feedback. The explicit in-memory key configuration retains required signing, and the Central Portal release task remains wired correctly. The source-JAR change now verifies the archive actually published, without the old extra source overlay.
One remaining P2 coverage gap on the signing migration, consistent with the existing unresolved signing-check comment. I found no current unsigned-publication or credential-boundary defect, but the repository-required regression check is still missing; details inline.
Validation: inspected the complete immutable diff, surrounding Gradle/release code, existing buildSrc tests, repository security model, and pinned upstream plugin/Gradle signing implementation. Exact-head CI is green, and its build log shows sourcesJar for all four SDK modules and :openai-java-core:verifyCoreCompilationArtifact executing successfully. The disposable-key signing/local-publication checks remain author-reported. I did not run local builds, tests, signing, or publication.
| System.getenv("GPG_SIGNING_KEY_ID"), | ||
| System.getenv("GPG_SIGNING_KEY"), | ||
| System.getenv("GPG_SIGNING_PASSWORD"), | ||
| ) |
There was a problem hiding this comment.
[P2] Commit a regression check for the new signing wiring
Please turn the reported disposable-key smoke check into repeatable Gradle or shell coverage for this change. AGENTS.md requires focused regression coverage for signing/publication logic. The existing publication test in GradleCacheTrustPolicyTest starts after key-ID export and substitutes a fake gradlew, so it never exercises this provider configuration or verifies a signature; normal build CI does not establish those properties either.
A small fixture should apply the production publication convention with a synthetic key, exercise the non-publishLocal signing branch against local artifacts, verify the resulting signatures, and assert that a non-SNAPSHOT signing task fails when the key is absent. It should need no production credentials or Central upload. This is the same remaining coverage concern as the existing unresolved thread, not evidence of a current unsigned-release bug.
Automated Release PR --- ## [4.69.3](openai/openai-java@v4.69.2...v4.69.3) (2026-09-25) ### Chores * **api:** document files and uploads error responses ([openai#1081](openai#1081)) ([69a4e21](openai@69a4e21)) * **api:** document Responses not-found errors ([openai#1080](openai#1080)) ([e8cbf5d](openai@e8cbf5d)) ### Build System * **deps:** bump Maven Publish to 0.34.0 ([openai#910](openai#910)) ([2cbf22c](openai@2cbf22c)) * **deps:** bump Shadow to 9.2.2 ([openai#904](openai#904)) ([09b8c60](openai@09b8c60)) * **deps:** upgrade Kotlin declarations together to 2.2.21 ([openai#1079](openai#1079)) ([465742d](openai@465742d)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: openai-sdks[bot] <284451331+openai-sdks[bot]@users.noreply.github.com>
3 participants
Reviewed upgrade
Updates Maven Publish from 0.28.0 to 0.34.0. This supersedes the original Dependabot 0.37.0 target: 0.34.0 supports the existing Gradle 8.12 / Kotlin 1.9.20 toolchain and Dokka V1.
sourcesJartask, use its complete source inventory, and preserve the existingmain/paths for Kotlin sources.Validation: exact CI build command, including the core binary/source artifact verifier; buildSrc tests and Kotlin lint; all four SDK modules published to a local filesystem repository with JAR/source/Javadoc/POM/module artifacts verified; disposable-key signing through the existing environment contract with GPG signature verification. No real Maven Central publication performed.
Original Dependabot proposal (superseded target)
Rebasing might not happen immediately, so don't worry if this takes some time.
Note: if you make any changes to this PR yourself, they will take precedence over the rebase.
Bumps com.vanniktech:gradle-maven-publish-plugin in
/from 0.28.0 to 0.37.0.Updates
com.vanniktech:gradle-maven-publish-pluginfrom 0.28.0 to 0.37.0Release notes
Sourced from com.vanniktech:gradle-maven-publish-plugin's releases.
... (truncated)
Changelog
Sourced from com.vanniktech:gradle-maven-publish-plugin's changelog.
... (truncated)
Commits
7017e3denable feature preview (#1381)05f6b6euse 0.37.0-rc1 (#1380)0167c9cChangelog for 0.37.0 (#1379)b652eb3Update dependency java to v26 (#1353)a9f70b3Update dependency com.freeletics.gradle:scripts-formatting-jvm to v0.37.0 (#1...541cf8fLog deployment id and publishing type after Central Portal upload (#1354)d4873e5Update slf4j monorepo to v2 (#1365)42baf9dUpdate android.gradle (#1335)2de1978Update Gradle (#1362)6f03e46Update kotlin monorepo to v2.4.0 (#1352)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions