fix(auth): secure first-class X.509 workload credentials - #2479
fix(auth): secure first-class X.509 workload credentials#2479jbeckwith-oai wants to merge 2 commits into
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Castiron custom code✅ No new custom-code files detected. 32 mixed files remain; 1 existing customization changed. Compared
31 existing customizations unchanged
A changed generated baseline means this report cannot reliably identify which handwritten lines changed. Inspect the custom-code diffDownload the exact patch produced by this run (requires repository access): gh run download 32934529417 --repo openai/openai-node \
--name castiron-custom-code-32934529417-1 --dir /tmp/castiron-custom-code-32934529417-1
git apply --stat /tmp/castiron-custom-code-32934529417-1/custom-code.patch
cat /tmp/castiron-custom-code-32934529417-1/custom-code.patchOr reproduce it from an SDK checkout containing the vendored reporter: git fetch --no-tags origin 6992683aaf2014d5e625e8eeebb3906bd8651ff0 5bab25987279cbfa3a5ec73b3e66d83ac41a017d
python3 scripts/castiron/custom_code_report.py report \
--base 6992683aaf2014d5e625e8eeebb3906bd8651ff0 \
--head 5bab25987279cbfa3a5ec73b3e66d83ac41a017d --fetch --require-head-hash --public \
--out /tmp/castiron-custom-code-5bab25987279
cat /tmp/castiron-custom-code-5bab25987279/custom-code.patchThis is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: efde41142d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
1 participant
Summary
workloadIdentity.fromX509(...)credentials accepted bynew OpenAI({ credential }), with explicit credential ownership, independently scoped target/proxy TLS trust, certificate/key validation, and fail-closed legacy transport verification.openai/authCommonJS and ESM entrypoints while preserving optional Undici isolation and blocking private credential-state package subpaths.refreshBufferSeconds, retain the deprecatedrefreshBufferMscompatibility alias, and reject conflicting or malformed refresh settings.Verification
./scripts/test: 6,573 handwritten + 556 generated tests passing.pnpm lint,pnpm exec tsc --noEmit,pnpm build, and TypeScript 4.9 declaration checking passing.Compatibility and rollout
createX509Transport(...)integrations remain supported; SDK-owned first-class credentials are the recommended secure path.refreshBufferMsremains a deprecated compatibility alias; simultaneous seconds/milliseconds options fail clearly.