[dpiet-oai]

Maven Central visibility checks currently keep the protected publishing runner occupied after upload and artifact verification; the 4.91.0 release spent 10m15s in that step. Move the read-only polling to a standard GitHub-hosted worker with no permissions or publishing environment.

The new job checks all five artifacts and four required suffixes, polls only missing files with at most 10 concurrent requests, and performs a complete final sweep before success. release_outcome still fails closed, including for unexpected skips. The original attempt shares the publisher's 90-minute deadline; rerunning the visibility job starts a fresh bounded window without republishing. Maven propagation and total workflow time may remain unchanged, and runner handoff can add queue time.

Validation: actionlint passed for both workflows; the offline CI contract passed (1.52s locally); trusted-main Castiron verification passed strict ownership and measured +0/-0 custom lines. A local HTTP fixture with 20 ready files, 80ms per response, and three alternating trials measured median probe time of 2.016s at 0ce5f3f versus 0.890s at 9cbe131; every trial checked the same 20 distinct URLs, with observed peak concurrency 1 versus 8. No release or live Maven propagation test was run.

Requires security-focused review of the release workflow.

[github-actions]

Castiron custom code

Evaluated main: 0ce5f3f17518fb2390d31ec9a4de0a9dda6d9946.

Trusted main policy: 0ce5f3f17518fb2390d31ec9a4de0a9dda6d9946.

✅ No new custom-code files detected.

0 mixed files remain; 0 existing customizations changed.

Compared 0ce5f3f17518 → 9cbe1316b9fc. Generated baselines verified.

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 40029232077 --repo openai/openai-java \
  --name castiron-custom-code-40029232077-1 --dir /tmp/castiron-custom-code-40029232077-1
git apply --stat /tmp/castiron-custom-code-40029232077-1/custom-code.patch
cat /tmp/castiron-custom-code-40029232077-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 0ce5f3f17518fb2390d31ec9a4de0a9dda6d9946 9cbe1316b9fcc8371ce5291fa5357738977212d7
python3 scripts/castiron/custom_code_report.py report \
  --base 0ce5f3f17518fb2390d31ec9a4de0a9dda6d9946 \
  --head 9cbe1316b9fcc8371ce5291fa5357738977212d7 --target-branch main --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-9cbe1316b9fc
cat /tmp/castiron-custom-code-9cbe1316b9fc/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

[marcuswood-oai]

LGTM 👍 No changes requested.

The visibility job keeps publishing credentials isolated and release status fails closed. Offline contract and failure-path checks passed; no live release or Maven propagation test was run.

---

Reviewed: 9cbe131 · Base: 0ce5f3f · sdk-pr-review

[markstuart-oai]

Reviewed 9cbe1316b9fcc8371ce5291fa5357738977212d7. No blocking findings. Maven visibility checks move to a job without publishing credentials. The shared deadline, all 20 artifact checks, final sweep, and failure handling remain enforced. The security review and exact-commit diff scan found no issues. No live release or Maven propagation test was run.

Source-only review; I did not run candidate code or tests. Hosted checks: 3 skipped, 18 success.