[codex] Add AWS Bedrock provider authentication

[HAYDEN-OAI]

Summary

• add an OpenAI::Providers.bedrock provider for Amazon Bedrock's OpenAI-compatible API
• support bearer credentials, static AWS credentials, refreshable credential providers, named profiles, and the standard AWS credential chain, including ~/.aws/credentials
• sign each request attempt with SigV4 and prevent signed requests from following redirects or authenticating a different origin
• isolate provider routing and authentication from ambient OpenAI client configuration
• add RBI/RBS types, setup documentation, a runnable example, a shared SigV4 fixture, and focused regression tests

Why

The Ruby SDK did not have a supported provider-authentication path for AWS Bedrock, so applications could not use their normal AWS credentials file or runtime credential chain with the standard OpenAI client. This brings Ruby in line with the provider architecture used by the Node and Python SDKs.

Linear: SDK-78

User impact

Ruby users can now construct the normal client with OpenAI::Providers.bedrock(...) and use AWS environment credentials, shared credentials/config files, named profiles, SSO or assume-role profiles, workload identities, explicit static credentials, or refreshable providers. AWS authentication loads aws-sdk-core as an optional dependency; bearer authentication does not require it.

Provider authentication is applied immediately before every transport attempt, so retries receive fresh credentials and a fresh signature over the exact serialized body and retry headers.

Validation

• focused Bedrock, client, and workload-identity suites: 60 runs, 226 assertions, 0 failures, 0 errors
• Bedrock implementation coverage: 98.7% lines, 96.5% branches, 100% methods
• provider registry coverage: 100% lines, branches, and methods
• RuboCop and type checks pass
• git diff --check passes
• gem package isolation check passes

The full generated resource suite requires the local Prism mock server on localhost:4010; without it, those tests stop on expected connection errors. CI provisions that dependency.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4af7fdf180

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jliccini]

Inline review of the default Bedrock endpoint.

[jliccini]

Approving but noting that the URL thing Codex found might be important. I am not a Bedrock expert but the Ruby lgtm

[jliccini]

Ruby truthiness and optional-value validation review.

[jliccini]

Ruby exception-boundary review.

[jliccini]

Ruby public-type and exception-contract review.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 9.224s for Ruby SDK PR #289.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	241ms
tests/chat-completions-create.test.ts	✅ Passed	317ms
tests/chat-completions-stream.test.ts	✅ Passed	133ms
tests/files-content-binary.test.ts	✅ Passed	262ms
tests/files-create-multipart.test.ts	✅ Passed	170ms
tests/files-list-pagination.test.ts	✅ Passed	155ms
tests/initialize-config.test.ts	✅ Passed	145ms
tests/instance-isolation.test.ts	✅ Passed	194ms
tests/models-list.test.ts	✅ Passed	151ms
tests/responses-background-lifecycle.test.ts	✅ Passed	261ms
tests/responses-body-method-errors.test.ts	✅ Passed	535ms
tests/responses-cancel-timeout.test.ts	✅ Passed	282ms
tests/responses-cancel.test.ts	✅ Passed	335ms
tests/responses-compact-retries.test.ts	✅ Passed	268ms
tests/responses-compact.test.ts	✅ Passed	324ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	145ms
tests/responses-create-advanced.test.ts	✅ Passed	205ms
tests/responses-create-disconnect.test.ts	✅ Passed	166ms
tests/responses-create-errors.test.ts	✅ Passed	344ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	125ms
tests/responses-create-retries.test.ts	✅ Passed	241ms
tests/responses-create-stream-failures.test.ts	✅ Passed	131ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	226ms
tests/responses-create-stream-wire.test.ts	✅ Passed	1.853s
tests/responses-create-stream.test.ts	✅ Passed	175ms
tests/responses-create-terminal-states.test.ts	✅ Passed	343ms
tests/responses-create-timeout.test.ts	✅ Passed	339ms
tests/responses-create.test.ts	✅ Passed	256ms
tests/responses-delete.test.ts	✅ Passed	234ms
tests/responses-input-items-errors.test.ts	✅ Passed	180ms
tests/responses-input-items-list.test.ts	✅ Passed	160ms
tests/responses-input-items-options.test.ts	✅ Passed	264ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	406ms
tests/responses-input-tokens-count.test.ts	✅ Passed	282ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.01s
tests/responses-not-found-errors.test.ts	✅ Passed	439ms
tests/responses-parse.test.ts	✅ Passed	227ms
tests/responses-retrieve-retries.test.ts	✅ Passed	338ms
tests/responses-retrieve.test.ts	✅ Passed	344ms
tests/responses-stored-method-errors.test.ts	✅ Passed	890ms
tests/retry-behavior.test.ts	✅ Passed	1.896s
tests/sdk-error-shape.test.ts	✅ Passed	431ms

View OkTest run #29368550187

_{SDK merge (46f7c5d31451) · head (737c4f3ff5fa) · base (92dad5763384) · OkTest (cb7f0514ccd2)}