[codex] Harden GitHub Actions permissions

[jbeckwith-oai]

Summary

• Add explicit read-only contents: read defaults to all GitHub Actions workflows.
• Stop persisting GITHUB_TOKEN credentials in checkout steps.
• Keep OIDC isolated to a trusted Stainless push-only build-and-upload job.
• Restrict the secret-backed examples job to trusted main pushes.
• Suppress Mockito/Byte Buddy dynamic-agent warnings in test JVMs so stderr-sensitive logging tests are stable on Java 21.

Why

The repository currently has write-capable default workflow permissions, so jobs without explicit permissions: blocks inherit broader GITHUB_TOKEN access than they need. The previous CI build job also granted OIDC to the whole job while running pull request code, even though only the artifact upload path needed it.

The prior PR run also failed in LoggingHttpClientTest.debugLevel_logsRequestBody(false) because JVM dynamic-agent warnings from Mockito/Byte Buddy were written to stderr and polluted exact log assertions. Enabling dynamic agent loading for test JVMs removes that warning at the source while preserving the assertion behavior.

Validation

• Fetched latest origin/main and rebased this branch cleanly on 2935d47e753fcbef81a6a0d720eedb3ac559ac73.
• Parsed all four workflow YAML files with Ruby YAML.load_file.
• Ran git diff --check.
• Re-scanned workflows for tag-pinned actions, broad write permissions, persisted checkout credentials, pull_request_target, workflow_run, and secrets: inherit.
• Inspected the failed GitHub Actions test log and confirmed the failure was stderr pollution from Byte Buddy dynamic-agent warnings.

Local Gradle execution is blocked on this machine because the default JDK is Java 25.0.2, which this Gradle/Kotlin stack cannot parse during build-script compilation. GitHub Actions uses Java 21 and is the authoritative validation for the test fix.

Follow-up outside this PR

The repo-level Actions setting should still be flipped from default workflow permission write to read, and "Allow GitHub Actions to create and approve pull requests" should be disabled in repository settings. Those are admin settings rather than repository files.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 16.053s for Java SDK PR #762.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	475ms
tests/chat-completions-create.test.ts	✅ Passed	759ms
tests/chat-completions-stream.test.ts	✅ Passed	361ms
tests/files-content-binary.test.ts	✅ Passed	271ms
tests/files-create-multipart.test.ts	✅ Passed	272ms
tests/files-list-pagination.test.ts	✅ Passed	284ms
tests/initialize-config.test.ts	✅ Passed	185ms
tests/instance-isolation.test.ts	✅ Passed	341ms
tests/models-list.test.ts	✅ Passed	177ms
tests/responses-background-lifecycle.test.ts	✅ Passed	255ms
tests/responses-body-method-errors.test.ts	✅ Passed	498ms
tests/responses-cancel-timeout.test.ts	✅ Passed	239ms
tests/responses-cancel.test.ts	✅ Passed	268ms
tests/responses-compact-retries.test.ts	✅ Passed	439ms
tests/responses-compact.test.ts	✅ Passed	273ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	437ms
tests/responses-create-advanced.test.ts	✅ Passed	1.191s
tests/responses-create-disconnect.test.ts	✅ Passed	1.074s
tests/responses-create-errors.test.ts	✅ Passed	398ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	295ms
tests/responses-create-retries.test.ts	✅ Passed	391ms
tests/responses-create-stream-failures.test.ts	✅ Passed	275ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	219ms
tests/responses-create-stream-wire.test.ts	✅ Passed	5.874s
tests/responses-create-stream.test.ts	✅ Passed	129ms
tests/responses-create-terminal-states.test.ts	✅ Passed	401ms
tests/responses-create-timeout.test.ts	✅ Passed	264ms
tests/responses-create.test.ts	✅ Passed	892ms
tests/responses-delete.test.ts	✅ Passed	280ms
tests/responses-input-items-errors.test.ts	✅ Passed	266ms
tests/responses-input-items-list.test.ts	✅ Passed	310ms
tests/responses-input-items-options.test.ts	✅ Passed	478ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	206ms
tests/responses-input-tokens-count.test.ts	✅ Passed	340ms
tests/responses-malformed-inputs.test.ts	✅ Passed	4.8s
tests/responses-not-found-errors.test.ts	✅ Passed	403ms
tests/responses-parse.test.ts	✅ Passed	666ms
tests/responses-retrieve-retries.test.ts	✅ Passed	262ms
tests/responses-retrieve.test.ts	✅ Passed	258ms
tests/responses-stored-method-errors.test.ts	✅ Passed	967ms
tests/retry-behavior.test.ts	✅ Passed	3.437s
tests/sdk-error-shape.test.ts	✅ Passed	372ms

View OkTest run #29383238671

_{SDK merge (6cd4184fc47a) · head (28597ee85259) · base (2935d47e753f) · OkTest (fd7a761c81c1)}