chore: sync current main into next before major development

.castiron.stats.yml

@@ -1,6 +1,8 @@
 schema_version: 1
-generation_id: 42c8861d-adc3-4c8a-81b3-3b7f497f41eb
-openapi_spec_hash: d342651bd77c6cd6ea10a9d889b35bb8
-openapi_transformed_spec_hash: 259f19fd2d38c6e784bbb40bf2f9a971
-config_hash: fce3820c4f95b555e486349bc7d297d8
-codegen_sha: acf1dbb5db99bd14d6dae73da59f59fb17e95381
+generation_id: bb452d19-8d5f-4013-bfd3-3edecb25c37e
+openapi_spec_hash: 72d34e76f62e434dc0b71e0b4ac0ce8a
+openapi_transformed_spec_hash: bca4c6179df519f310841c4730b72c18
+config_hash: 8a49d8603252fe24c2dc96f50eb0d05b
+codegen_sha: 016ee2b2da744118cf209752f57c8616ad20b842
+codegen_hash: 82cc4b7aca374db5d389b1ac06369a1ffa5946795a9ab86c87f57a5f5ec00390
+public_codegen_sha: e23db4894b46c4da1d4d9625eb0876d0ab512e78

.devcontainer/Dockerfile

@@ -1,9 +1,11 @@
-ARG VARIANT="3.9"
+ARG VARIANT="3.10"
 FROM mcr.microsoft.com/vscode/devcontainers/python:0-${VARIANT}
 
 USER vscode
 
-RUN curl -sSf https://rye.astral.sh/get | RYE_VERSION="0.44.0" RYE_INSTALL_OPTION="--yes" bash
-ENV PATH=/home/vscode/.rye/shims:$PATH
+ADD --chmod=644 --checksum=sha256:504511fbbbd811aeaba6738abc79408956b6c7da0ca35437b3dcc24a41efc111 \
+    https://github.com/astral-sh/uv/releases/download/0.12.5/uv-installer.sh /tmp/uv-installer.sh
+RUN UV_NO_MODIFY_PATH=1 sh /tmp/uv-installer.sh
+ENV PATH=/home/vscode/.local/bin:$PATH
 
 RUN echo "[[ -d .venv ]] && source .venv/bin/activate || export PATH=\$PATH" >> /home/vscode/.bashrc

.devcontainer/devcontainer.json

@@ -7,7 +7,7 @@
     "context": ".."
   },
 
-  "postStartCommand": "rye sync --all-features",
+  "postStartCommand": "./scripts/bootstrap",
 
   "customizations": {
     "vscode": {
@@ -20,13 +20,16 @@
         "python.defaultInterpreterPath": ".venv/bin/python",
         "python.typeChecking": "basic",
         "terminal.integrated.env.linux": {
-          "PATH": "/home/vscode/.rye/shims:${env:PATH}"
+          "PATH": "/home/vscode/.local/bin:${env:PATH}"
         }
       }
     }
   },
   "features": {
-    "ghcr.io/devcontainers/features/node:1": {}
+    "ghcr.io/devcontainers/features/node:1": {
+      "version": "22.22.3",
+      "pnpmVersion": "11.19.0"
+    }
   }
 
   // Features to add to the dev container. More info: https://containers.dev/features.

.github/actions/setup-node-tooling/action.yml

@@ -0,0 +1,15 @@
+name: Set up repository Node tooling
+description: Install the pinned contributor toolchain and frozen dependencies
+runs:
+  using: composite
+  steps:
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      with:
+        node-version-file: .node-version
+    - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      with:
+        run_install: false
+    - shell: bash
+      run: ./scripts/bootstrap-node
+    - shell: bash
+      run: node --test tests/node-tooling.test.cjs tests/node-release-age.test.cjs

.github/dependabot.yml

@@ -0,0 +1,48 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 8
+  - package-ecosystem: uv
+    directory: /
+    versioning-strategy: increase-if-necessary
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Etc/UTC
+    # Version updates wait; Dependabot security updates are exempt.
+    cooldown:
+      default-days: 8
+    open-pull-requests-limit: 3
+    groups:
+      python-maintenance:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+      python-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:30"
+      timezone: Etc/UTC
+    cooldown:
+      default-days: 8
+    open-pull-requests-limit: 5
+    groups:
+      # CodeQL init/analyze share versioned state and must change together.
+      codeql:
+        patterns:
+          - "github/codeql-action"

.github/pull_request_template.md

@@ -1,9 +1,8 @@
-<!-- Thank you for contributing to this project! -->
-<!-- The code in this repository is all auto-generated, and is not meant to be edited manually. -->
-<!-- We recommend opening an Issue instead, but you are still welcome to open a PR to share for -->
-<!-- an improvement if you wish, just note that we are unlikely to merge it as-is. -->
-
-- [ ] I understand that this repository is auto-generated and my pull request may not be merged
+<!-- Pull requests are limited to repository collaborators. -->
+<!-- For community bug reports and feature requests, open an issue: -->
+<!-- https://github.com/openai/openai-python/issues -->
+<!-- Read the contribution policy and development guide: -->
+<!-- https://github.com/openai/openai-python/blob/main/CONTRIBUTING.md -->
 
 ## Changes being requested
 

.github/scripts/setup-playwright-sandbox.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Ubuntu restricts user namespaces for downloaded Chromium. Keep Chromium's
+# sandbox enabled and allow only the two executables installed for this CI job.
+: "${RUNNER_TEMP:?RUNNER_TEMP is required}"
+: "${PLAYWRIGHT_BROWSERS_PATH:?PLAYWRIGHT_BROWSERS_PATH is required}"
+expected_root="$RUNNER_TEMP/openai-python-playwright"
+if [[ "$PLAYWRIGHT_BROWSERS_PATH" != "$expected_root" || ! -d "$expected_root" ]]; then
+  echo "Playwright must be installed inside this job's RUNNER_TEMP." >&2
+  exit 1
+fi
+runner_root="$(realpath "$RUNNER_TEMP")"
+install_root="$(realpath "$expected_root")"
+# AppArmor uses these paths in its policy syntax, without globs or expansions.
+if [[ "$install_root" != "$runner_root/openai-python-playwright" || ! "$install_root" =~ ^/[a-zA-Z0-9_./-]+$ ]]; then
+  echo "Playwright installation escaped RUNNER_TEMP or contains unexpected path characters." >&2
+  exit 1
+fi
+shopt -s nullglob
+chromiums=("$install_root"/chromium-*/chrome-linux64/chrome)
+headless_shells=("$install_root"/chromium_headless_shell-*/chrome-headless-shell-linux64/chrome-headless-shell)
+if [[ "${#chromiums[@]}" -ne 1 || "${#headless_shells[@]}" -ne 1 ]]; then
+  echo "Expected one installed Chromium and one installed headless shell." >&2
+  exit 1
+fi
+binaries=("${chromiums[0]}" "${headless_shells[0]}")
+for index in "${!binaries[@]}"; do
+  binary="$(realpath "${binaries[index]}")"
+  if [[ ! -x "$binary" || "$binary" != "$install_root/"* || ! "$binary" =~ ^/[a-zA-Z0-9_./-]+$ ]]; then
+    echo "Chromium executable is absent or outside this job's installation." >&2
+    exit 1
+  fi
+  binaries[index]="$binary"
+done
+{
+  printf 'abi <abi/4.0>,\ninclude <tunables/global>\n'
+  for index in "${!binaries[@]}"; do
+    printf 'profile openai-python-playwright-%s "%s" flags=(unconfined) {\n  userns,\n}\n' "$index" "${binaries[index]}"
+  done
+} | sudo tee /etc/apparmor.d/openai-python-playwright >/dev/null
+sudo apparmor_parser -r /etc/apparmor.d/openai-python-playwright