ci: resolve fork PRs missing Castiron run associations

[marcuswood-oai]

Summary

When GitHub omits a fork PR from both the workflow-run association and the base repository's commit-to-PR endpoint, Castiron cannot resolve the PR and leaves the required budget statuses missing.

Port the focused fix from openai/openai-python#3831: fall back to listing open PRs by the source run's fork owner and branch, then retain the existing exact-head, target, freshness, and ambiguity checks. Cover report computation, budget evaluation, and publication; update the reporter integrity digest.

Validation

• Both evaluator and status-publisher regressions reproduce on unpatched main.
• Castiron reporter/budget suite: 53 tests, OK (1 optional compiler-contract test skipped), including JavaScript publishers, pagination, stale heads, wrong targets, and ambiguous matches.
• Ruff and Pyright for scripts/castiron; git diff --check.
• Patched lookup verified against https://github.com/openai/openai-[go/pull/901](https://www.golinks.io/pull/901?trackSource=github) with read-only GitHub requests.

The trusted handler runs from main. After merging, rerun affected Castiron custom-code workflows so the required statuses can be published.

SDK CODEOWNER review is required. The repository-requested Codex Security diff scan remains outstanding because the plugin is not installed in this session.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-09T23:46:34.429715Z	6843aeb	PR opened
🔒 Security Review	✅ Completed 2026-09-09T23:47:08.722329Z	6843aeb	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[openai-sdks]

OkTest Summary

✅ 236/236 SDK tests passed in 8.804s for Go SDK PR #910.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	149ms
tests/chat-completions-create.test.ts	✅ Passed	245ms
tests/chat-completions-stream.test.ts	✅ Passed	120ms
tests/files-content-binary.test.ts	✅ Passed	129ms
tests/files-create-multipart.test.ts	✅ Passed	140ms
tests/files-list-pagination.test.ts	✅ Passed	159ms
tests/initialize-config.test.ts	✅ Passed	162ms
tests/instance-isolation.test.ts	✅ Passed	155ms
tests/models-list.test.ts	✅ Passed	147ms
tests/responses-background-lifecycle.test.ts	✅ Passed	199ms
tests/responses-body-method-errors.test.ts	✅ Passed	301ms
tests/responses-cancel-timeout.test.ts	✅ Passed	192ms
tests/responses-cancel.test.ts	✅ Passed	242ms
tests/responses-compact-retries.test.ts	✅ Passed	174ms
tests/responses-compact.test.ts	✅ Passed	204ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	138ms
tests/responses-create-advanced.test.ts	✅ Passed	195ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.058s
tests/responses-create-errors.test.ts	✅ Passed	184ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	116ms
tests/responses-create-retries.test.ts	✅ Passed	220ms
tests/responses-create-stream-failures.test.ts	✅ Passed	120ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	203ms
tests/responses-create-stream-wire.test.ts	✅ Passed	2.267s
tests/responses-create-stream.test.ts	✅ Passed	95ms
tests/responses-create-terminal-states.test.ts	✅ Passed	206ms
tests/responses-create-timeout.test.ts	✅ Passed	235ms
tests/responses-create.test.ts	✅ Passed	171ms
tests/responses-delete.test.ts	✅ Passed	197ms
tests/responses-input-items-errors.test.ts	✅ Passed	145ms
tests/responses-input-items-list.test.ts	✅ Passed	155ms
tests/responses-input-items-options.test.ts	✅ Passed	116ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	240ms
tests/responses-input-tokens-count.test.ts	✅ Passed	232ms
tests/responses-malformed-inputs.test.ts	✅ Passed	1.983s
tests/responses-not-found-errors.test.ts	✅ Passed	240ms
tests/responses-parse.test.ts	✅ Passed	179ms
tests/responses-retrieve-retries.test.ts	✅ Passed	227ms
tests/responses-retrieve.test.ts	✅ Passed	180ms
tests/responses-stored-method-errors.test.ts	✅ Passed	455ms
tests/retry-behavior.test.ts	✅ Passed	3.188s
tests/sdk-error-shape.test.ts	✅ Passed	263ms

View OkTest run #34418217200

_{SDK merge (9a45b5a9cb0a) · head (6843aeb0b976) · base (a57d34cb7c58) · OkTest (08ec4299e769)}

[github-actions]

Castiron custom code

✅ No new custom-code files detected.

16 mixed files remain; 2 existing customizations changed.

Compared a57d34cb7c58 → 6843aeb0b976. Generated baselines verified.

File	Result	Current custom patch
scripts/castiron/custom_code_report.py	Existing customization changed	+142 / −31
scripts/castiron/test_custom_code_report.py	Existing customization changed	+341 / −31

14 existing customizations unchanged

• api.md
• betaresponse.go
• betathreadmessage.go
• chatcompletion.go
• client.go
• finetuningcheckpointpermission.go
• responses/response.go
• scripts/castiron/README.md
• shared/shared.go
• vectorstorefile.go
• vectorstorefile_test.go
• vectorstorefilebatch.go
• video.go
• webhooks/webhook.go

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 34418261527 --repo openai/openai-go \
  --name castiron-custom-code-34418261527-1 --dir /tmp/castiron-custom-code-34418261527-1
git apply --stat /tmp/castiron-custom-code-34418261527-1/custom-code.patch
cat /tmp/castiron-custom-code-34418261527-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin a57d34cb7c5839cfd5790d3d77d9c579c837b192 6843aeb0b9760b707e9b45057f435523a34a063c
python3 scripts/castiron/custom_code_report.py report \
  --base a57d34cb7c5839cfd5790d3d77d9c579c837b192 \
  --head 6843aeb0b9760b707e9b45057f435523a34a063c --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-6843aeb0b976
cat /tmp/castiron-custom-code-6843aeb0b976/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch