fix(auth): harden X.509 workload identity integration

[jbeckwith-oai]

Summary

• Make X.509 workload identity consistent across synchronous and asynchronous clients, supported data-residency regions, client copies, and explicit authentication configuration.
• Preserve caller-owned HTTP clients, request hooks, custom HTTPS origins and TLS configuration, retry behavior, token refresh, and request replay compatibility.
• Add focused synchronous, asynchronous, concurrent, legacy-HTTPX, and workload-identity regression coverage without changing the public API or custom-code budget policy.

Validation

• Full repository tests: 9,425 passed, 32 skipped.
• Focused X.509 and compatibility tests: 340 passed, 2 skipped.
• Legacy HTTPX compatibility tests: 137 passed.
• Large-payload compatibility regression passed.
• Ruff, whole-repository pyright, and mypy across 1,576 files passed.
• Wheel and source distributions built successfully; package metadata and Bedrock packaging validated.
• Existing custom-code budget passed: 6,574 / 10,000.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-27T04:59:10.370293Z	65f5d41	New commits
🔒 Security Review	✅ Completed 2026-08-27T05:00:45.315081Z	65f5d41	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Castiron custom code

✅ No new custom-code files detected.

34 mixed files remain; 1 existing customization changed.

Compared 555ac487f450 → 65f5d417ddda. Generated baselines verified.

File	Result	Current custom patch
src/openai/_client.py	Existing customization changed	+763 / −60

33 existing customizations unchanged

• api.md
• scripts/castiron/README.md
• scripts/castiron/custom_code_report.py
• scripts/castiron/test_custom_code_report.py
• src/openai/init.py
• src/openai/resources/audio/transcriptions.py
• src/openai/resources/audio/translations.py
• src/openai/resources/beta/beta.py
• src/openai/resources/beta/responses/responses.py
• src/openai/resources/beta/threads/runs/runs.py
• src/openai/resources/beta/threads/threads.py
• src/openai/resources/chat/completions/completions.py
• src/openai/resources/embeddings.py
• src/openai/resources/files.py
• src/openai/resources/realtime/realtime.py
• src/openai/resources/responses/responses.py
• src/openai/resources/uploads/uploads.py
• src/openai/resources/vector_stores/file_batches.py
• src/openai/resources/vector_stores/files.py
• src/openai/resources/videos.py
• src/openai/resources/webhooks/init.py
• src/openai/resources/webhooks/webhooks.py
• src/openai/types/chat/init.py
• src/openai/types/chat/chat_completion_message_tool_call.py
• src/openai/types/fine_tuning/fine_tuning_job_integration.py
• src/openai/types/responses/init.py
• src/openai/types/responses/response.py
• src/openai/types/responses/response_function_web_search.py
• src/openai/types/responses/response_function_web_search_param.py
• src/openai/types/responses/tool.py
• src/openai/types/responses/tool_param.py
• src/openai/types/webhooks/init.py
• tests/api_resources/test_videos.py

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 33041002003 --repo openai/openai-python \
  --name castiron-custom-code-33041002003-1 --dir /tmp/castiron-custom-code-33041002003-1
git apply --stat /tmp/castiron-custom-code-33041002003-1/custom-code.patch
cat /tmp/castiron-custom-code-33041002003-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 79c588bb3a40fb698c65e35c94ad96c0b44c30d4 65f5d417dddab81e120374a17c5e8891f6027529
python3 scripts/castiron/custom_code_report.py report \
  --base 79c588bb3a40fb698c65e35c94ad96c0b44c30d4 \
  --head 65f5d417dddab81e120374a17c5e8891f6027529 --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-65f5d417ddda
cat /tmp/castiron-custom-code-65f5d417ddda/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 11.866s for Python SDK PR #3740.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	211ms
tests/chat-completions-create.test.ts	✅ Passed	301ms
tests/chat-completions-stream.test.ts	✅ Passed	121ms
tests/files-content-binary.test.ts	✅ Passed	256ms
tests/files-create-multipart.test.ts	✅ Passed	235ms
tests/files-list-pagination.test.ts	✅ Passed	139ms
tests/initialize-config.test.ts	✅ Passed	223ms
tests/instance-isolation.test.ts	✅ Passed	161ms
tests/models-list.test.ts	✅ Passed	196ms
tests/responses-background-lifecycle.test.ts	✅ Passed	216ms
tests/responses-body-method-errors.test.ts	✅ Passed	337ms
tests/responses-cancel-timeout.test.ts	✅ Passed	206ms
tests/responses-cancel.test.ts	✅ Passed	201ms
tests/responses-compact-retries.test.ts	✅ Passed	326ms
tests/responses-compact.test.ts	✅ Passed	363ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	151ms
tests/responses-create-advanced.test.ts	✅ Passed	258ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.097s
tests/responses-create-errors.test.ts	✅ Passed	267ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	309ms
tests/responses-create-retries.test.ts	✅ Passed	333ms
tests/responses-create-stream-failures.test.ts	✅ Passed	129ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	209ms
tests/responses-create-stream-wire.test.ts	✅ Passed	3.828s
tests/responses-create-stream.test.ts	✅ Passed	329ms
tests/responses-create-terminal-states.test.ts	✅ Passed	296ms
tests/responses-create-timeout.test.ts	✅ Passed	196ms
tests/responses-create.test.ts	✅ Passed	234ms
tests/responses-delete.test.ts	✅ Passed	249ms
tests/responses-input-items-errors.test.ts	✅ Passed	390ms
tests/responses-input-items-list.test.ts	✅ Passed	318ms
tests/responses-input-items-options.test.ts	✅ Passed	317ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	273ms
tests/responses-input-tokens-count.test.ts	✅ Passed	235ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.935s
tests/responses-not-found-errors.test.ts	✅ Passed	259ms
tests/responses-parse.test.ts	✅ Passed	396ms
tests/responses-retrieve-retries.test.ts	✅ Passed	259ms
tests/responses-retrieve.test.ts	✅ Passed	223ms
tests/responses-stored-method-errors.test.ts	✅ Passed	660ms
tests/retry-behavior.test.ts	✅ Passed	3.225s
tests/sdk-error-shape.test.ts	✅ Passed	499ms

View OkTest run #33040988413

_{SDK merge (52413df1c4a3) · head (65f5d417ddda) · base (79c588bb3a40) · OkTest (2b1bdfd25e98)}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b5ec9be738

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".