ci: use GitHub App for Release Please

[jbeckwith-oai]

Summary

• mint a repository-scoped installation token for the openai-sdks GitHub App from environment configuration
• pass that token to Release Please and disable the release job's built-in GITHUB_TOKEN permissions
• preserve the existing RubyGems publish and retry flow

Why

Release Please currently authenticates with GITHUB_TOKEN. Events created with that token do not normally start downstream workflows. A GitHub App installation token triggers the normal push and pull-request workflows for the generated release branch.

This is the Ruby equivalent of openai/openai-python#3577. Ruby does not have Python's manual release-PR workflow-dispatch workaround, so no CI dispatch cleanup is needed here.

Repository configuration

• verified App: openai-sdks (App ID 3705508, client ID Iv23li2AtcmhLHO07J87)
• environment: release, restricted to main with no required-reviewer gate
• environment variable: OPENAI_SDKS_APP_CLIENT_ID
• environment secret: OPENAI_SDKS_APP_PRIVATE_KEY

Validation

• actionlint v1.7.7 .github/workflows/create-releases.yml
• Ruby YAML parse
• git diff --check
• thermo-nuclear code quality review
• all required GitHub checks pass
• OkTest: 237/237 SDK tests pass

[Copilot]

Pull request overview

Updates the release automation workflow to authenticate Release Please using a GitHub App installation token (minted from the existing release environment) instead of GITHUB_TOKEN, so that release-branch pushes and release PR events can trigger downstream workflows as expected.

Changes:

• Add a step to mint a repository-scoped GitHub App installation token from the release environment.
• Pass the GitHub App token to googleapis/release-please-action and disable default GITHUB_TOKEN permissions for the release job.
• Preserve the existing publish job behavior (RubyGems publish + retry flow unchanged).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 9.872s for Ruby SDK PR #334.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	229ms
tests/chat-completions-create.test.ts	✅ Passed	315ms
tests/chat-completions-stream.test.ts	✅ Passed	151ms
tests/files-content-binary.test.ts	✅ Passed	244ms
tests/files-create-multipart.test.ts	✅ Passed	278ms
tests/files-list-pagination.test.ts	✅ Passed	183ms
tests/initialize-config.test.ts	✅ Passed	206ms
tests/instance-isolation.test.ts	✅ Passed	226ms
tests/models-list.test.ts	✅ Passed	349ms
tests/responses-background-lifecycle.test.ts	✅ Passed	248ms
tests/responses-body-method-errors.test.ts	✅ Passed	452ms
tests/responses-cancel-timeout.test.ts	✅ Passed	231ms
tests/responses-cancel.test.ts	✅ Passed	264ms
tests/responses-compact-retries.test.ts	✅ Passed	299ms
tests/responses-compact.test.ts	✅ Passed	250ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	143ms
tests/responses-create-advanced.test.ts	✅ Passed	226ms
tests/responses-create-disconnect.test.ts	✅ Passed	167ms
tests/responses-create-errors.test.ts	✅ Passed	325ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	197ms
tests/responses-create-retries.test.ts	✅ Passed	381ms
tests/responses-create-stream-failures.test.ts	✅ Passed	154ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	265ms
tests/responses-create-stream-wire.test.ts	✅ Passed	2.264s
tests/responses-create-stream.test.ts	✅ Passed	102ms
tests/responses-create-terminal-states.test.ts	✅ Passed	402ms
tests/responses-create-timeout.test.ts	✅ Passed	225ms
tests/responses-create.test.ts	✅ Passed	289ms
tests/responses-delete.test.ts	✅ Passed	335ms
tests/responses-input-items-errors.test.ts	✅ Passed	220ms
tests/responses-input-items-list.test.ts	✅ Passed	203ms
tests/responses-input-items-options.test.ts	✅ Passed	233ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	293ms
tests/responses-input-tokens-count.test.ts	✅ Passed	337ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.447s
tests/responses-not-found-errors.test.ts	✅ Passed	363ms
tests/responses-parse.test.ts	✅ Passed	194ms
tests/responses-retrieve-retries.test.ts	✅ Passed	347ms
tests/responses-retrieve.test.ts	✅ Passed	321ms
tests/responses-stored-method-errors.test.ts	✅ Passed	952ms
tests/retry-behavior.test.ts	✅ Passed	1.96s
tests/sdk-error-shape.test.ts	✅ Passed	443ms

View OkTest run #30867942862

_{SDK merge (35a763e395aa) · head (4861b42d15cf) · base (e3cbb6833713) · OkTest (91635c6a2723)}

[HAYDEN-OAI]

One release-blocking issue: the GitHub App private key required by the new release workflow is not configured for this repository.

[HAYDEN-OAI]

Re-reviewed the complete release-workflow change at 4861b42. Independently verified that the protected, main-only release environment now contains OPENAI_SDKS_APP_PRIVATE_KEY, that OPENAI_SDKS_APP_CLIENT_ID matches the openai-sdks GitHub App, and that the previous blocking thread is resolved. The App token is repository-scoped with explicit contents, issues, and pull-request write permissions; the publishing and retry flow is unchanged. No substantive findings.