fix(ci): include ogx-open-client in unified release piepine

.github/CODEOWNERS

@@ -7,4 +7,3 @@
 # OpenAPI SDK generation and publishing
 /client-sdks/openapi/ @ashwinb @leseb @bbrowning
 /.github/workflows/openapi-generator-validation.yml @ashwinb @leseb @bbrowning
-/.github/workflows/publish-openapi-sdk.yml @ashwinb @leseb @bbrowning

.github/workflows/README.md

@@ -28,7 +28,6 @@ OGX uses GitHub Actions for Continuous Integration (CI). Below is a table detail
 | Pre-commit | [pre-commit.yml](pre-commit.yml) | Run pre-commit checks |
 | Prepare release | [prepare-release.yml](prepare-release.yml) | Prepare release |
 | Test OGX Build | [providers-build.yml](providers-build.yml) | Test ogx build and list-deps |
-| Publish OpenAPI SDK to PyPI | [publish-openapi-sdk.yml](publish-openapi-sdk.yml) | Publish ogx-open-client to PyPI |
 | Build, test, and publish packages | [pypi.yml](pypi.yml) | Build, test, and publish packages |
 | Integration Tests (Record) | [record-integration-tests.yml](record-integration-tests.yml) | Auto-record missing test recordings for PR |
 | vLLM GPU Recording | [record-vllm-gpu-tests.yml](record-vllm-gpu-tests.yml) | GPU recording for gpt-oss:20b (${{ inputs.suite }} suite) |

.github/workflows/backward-compat.yml

@@ -36,7 +36,7 @@ jobs:
           fetch-depth: 0  # Need full history to access main branch
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.12'
 
@@ -446,7 +446,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.12'
 

.github/workflows/build-distributions.yml

@@ -154,7 +154,7 @@ jobs:
           output: 'trivy-container-${{ matrix.distro }}.sarif'
 
       - name: Upload container scan results to GitHub Security
-        uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v3
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3
         if: always()
         with:
           sarif_file: 'trivy-container-${{ matrix.distro }}.sarif'

.github/workflows/ci-status.yml

@@ -22,6 +22,7 @@ jobs:
     timeout-minutes: 180
     permissions:
       checks: read
+      pull-requests: read
     steps:
       - name: Wait for CI checks to complete
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -43,19 +44,47 @@ jobs:
             const excludedApps = new Set(['mergify']);
 
             const terminalStatuses = new Set(['completed']);
-            const successConclusions = new Set(['success', 'skipped', 'neutral', 'cancelled']);
-            const failureConclusions = new Set(['failure', 'timed_out']);
+            const successConclusions = new Set(['success', 'skipped', 'neutral']);
+            const failureConclusions = new Set(['failure', 'timed_out', 'cancelled', 'action_required', 'startup_failure', 'stale']);
+            const replayCheckPrefix = 'Integration Tests (';
+            const recordCheckPrefix = 'record-providers (';
+
+            function pathTriggersReplay(path) {
+              if (path.startsWith('src/ogx_ui/')) return false;
+              return path.startsWith('src/ogx/') ||
+                path.startsWith('tests/') ||
+                path === 'uv.lock' ||
+                path === 'pyproject.toml' ||
+                path === '.github/workflows/integration-tests.yml' ||
+                path === '.github/actions/setup-ollama/action.yml' ||
+                path === '.github/actions/setup-test-environment/action.yml' ||
+                path === '.github/actions/run-and-record-tests/action.yml' ||
+                path === 'scripts/integration-tests.sh' ||
+                path === 'scripts/generate_ci_matrix.py';
+            }
+
+            let replayRequired = context.eventName === 'merge_group';
+            if (context.payload.pull_request) {
+              const changedFiles = await github.paginate(github.rest.pulls.listFiles, {
+                owner,
+                repo,
+                pull_number: context.payload.pull_request.number,
+                per_page: 100,
+              });
+              replayRequired = changedFiles.some(file => pathTriggersReplay(file.filename));
+              core.info(`Replay required: ${replayRequired} (${changedFiles.length} changed file(s) checked)`);
+            }
 
             while (true) {
-              const { data: checkRuns } = await github.rest.checks.listForRef({
+              const checkRuns = await github.paginate(github.rest.checks.listForRef, {
                 owner,
                 repo,
                 ref: sha,
                 per_page: 100,
               });
 
               // Filter to only GitHub Actions checks, excluding ourselves and bots
-              const relevant = checkRuns.check_runs.filter(cr => {
+              const relevant = checkRuns.filter(cr => {
                 if (excludedChecks.has(cr.name)) return false;
                 if (cr.app && excludedApps.has(cr.app.slug)) return false;
                 // Only include GitHub Actions checks
@@ -71,8 +100,11 @@ jobs:
 
               const pending = relevant.filter(cr => !terminalStatuses.has(cr.status));
               const completed = relevant.filter(cr => terminalStatuses.has(cr.status));
+              const replayChecks = relevant.filter(cr => cr.name.startsWith(replayCheckPrefix));
+              const recordChecks = relevant.filter(cr => cr.name.startsWith(recordCheckPrefix));
 
               core.info(`Checks: ${completed.length} completed, ${pending.length} pending out of ${relevant.length} total`);
+              core.info(`Replay checks: ${replayChecks.length}; record checks: ${recordChecks.length}`);
 
               for (const cr of completed) {
                 core.info(`  ✓ ${cr.name}: ${cr.conclusion}`);
@@ -87,6 +119,15 @@ jobs:
                 continue;
               }
 
+              if (replayRequired && replayChecks.length === 0) {
+                if (recordChecks.length > 0) {
+                  core.warning('Record checks are present, but no replay matrix checks were found for this SHA.');
+                }
+                core.info('Replay checks are required for this change. Waiting 30s for the replay workflow to appear...');
+                await new Promise(r => setTimeout(r, 30000));
+                continue;
+              }
+
               // All checks completed — evaluate conclusions
               const failed = completed.filter(cr => failureConclusions.has(cr.conclusion));
 

.github/workflows/dependabot-constraints.yml

@@ -39,7 +39,7 @@ jobs:
           fetch-depth: 2
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.12'
 

.github/workflows/docs-build.yml

@@ -34,7 +34,7 @@ jobs:
           cache-dependency-path: 'docs/package-lock.json'
 
       - name: Cache node_modules
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: cache-node-modules
         with:
           path: docs/node_modules

.github/workflows/integration-tests.yml

@@ -150,7 +150,9 @@ jobs:
         client: ${{ github.event_name == 'pull_request' && fromJSON('["server"]') || fromJSON('["library", "server"]') }}
         # Use Python 3.13 only on nightly schedule (daily latest client test), otherwise use 3.12
         python-version: ${{ github.event.schedule == '0 0 * * *' && fromJSON('["3.12", "3.13"]') || fromJSON('["3.12"]') }}
-        node-version: [22]
+        # Pinned to 22.22 due to node-fetch v2 "Premature close" regression in 22.23.0
+        # (nodejs/node#63989). Unpin once a patched 22.x ships with nodejs/node#64004.
+        node-version: ['22.22']
         client-version: ${{ (github.event.schedule == '0 0 * * *' || github.event.inputs.test-all-client-versions == 'true' || inputs.test-all-client-versions == true) && fromJSON('["published", "latest"]') || fromJSON('["latest"]') }}
         # Test configurations: Either from matrix_json input or generated from ci_matrix.json
         config: ${{ fromJSON(inputs.matrix_json || needs.generate-matrix.outputs.matrix).include }}

.github/workflows/integration-vector-io-tests.yml

@@ -196,7 +196,7 @@ jobs:
           exit 1
 
       - name: Cache Hugging Face models
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/huggingface
           key: hf-${{ runner.os }}-${{ matrix.python-version }}-nomic-embed-text-v1.5

.github/workflows/openapi-generator-validation.yml

@@ -117,7 +117,7 @@ jobs:
           python-version: '3.12'
 
       - name: Set up Java
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
         with:
           distribution: 'temurin'
           java-version: '11'
@@ -187,7 +187,7 @@ jobs:
 
       - name: Generate Python SDK
         working-directory: client-sdks/openapi
-        run: make sdk OPEN=1
+        run: make sdk OPEN=0
 
       - name: Validate generated SDK
         working-directory: client-sdks/openapi
@@ -217,14 +217,14 @@ jobs:
 
       - name: Install generated SDK
         run: |
-          echo "Reinstalling OpenAPI-generated SDK (ogx_open_client)..."
-          uv pip uninstall ogx-open-client || true
+          echo "Reinstalling OpenAPI-generated SDK (ogx_client)..."
+          uv pip uninstall ogx-client || true
 
           # Install SDK using uv pip
           uv pip install -e client-sdks/openapi/sdks/python
 
           echo "Verifying installation..."
-          uv run python -c "import ogx_open_client; print(f'Installed: {ogx_open_client.__name__}')"
+          uv run python -c "import ogx_client; print(f'Installed: {ogx_client.__name__}')"
 
       - name: Setup Ollama (for integration tests)
         if: runner.os == 'Linux'
@@ -242,7 +242,7 @@ jobs:
             || echo "::warning::Some integration tests failed - this may indicate SDK compatibility issues"
 
           # Show which SDK is actually being used
-          uv run python -c "import ogx_open_client; import inspect; print(f'SDK location: {inspect.getfile(ogx_open_client)}')"
+          uv run python -c "import ogx_client; import inspect; print(f'SDK location: {inspect.getfile(ogx_client)}')"
 
       - name: Summary
         if: runner.os == 'Linux'
@@ -255,5 +255,5 @@ jobs:
             echo "✅ Integration tests executed (check logs for results)"
             echo ""
             echo "**Platform**: ${{ matrix.os }}"
-            echo "**Package**: ogx_open_client (OpenAPI-generated)"
+            echo "**Package**: ogx_client (OpenAPI-generated)"
           } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/pre-commit.yml

@@ -36,7 +36,7 @@ jobs:
           fetch-depth: ${{ github.actor == 'dependabot[bot]' && 0 || 2 }}
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.12'
           cache: pip
@@ -62,7 +62,7 @@ jobs:
         run: python -m pip install 'pre-commit>=4.4.0'
 
       - name: Cache pre-commit
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
         with:
           path: ~/.cache/pre-commit
           key: pre-commit-3|${{ env.pythonLocation }}|${{ hashFiles('.pre-commit-config.yaml') }}