fix(security): restrict live CI credentials to protected main

[HAYDEN-OAI]

• I understand that this repository is auto-generated and my pull request may not be merged

Changes being requested

• Restrict the only CI job using the ci environment and OPENAI_API_KEY to non-Dependabot push events on the exact protected openai/openai-node main branch.
• Keep live example and ecosystem coverage together in that trusted job, with the existing SHA-pinned Deno/Bun setup and a fail-closed missing-key check.
• Run the existing ecosystem tests job without an environment, secret, or --live flag for ordinary pull requests, forks, feature-branch pushes, and merge groups.
• Preserve existing required check names, merge-queue triggers, frozen installs, read-only workflow permissions, release workflows, and ordinary example type coverage.
• Replace the existing insecure trust assumptions with focused workflow and event-matrix regressions.

Required administrator follow-up after merge

Configure the existing ci environment's Deployment branches and tags to Selected branches and tags, allowing only main. Do not allow pull-request refs, merge-queue refs, alpha, or other branches. Apply this only after the updated workflow lands on main.

This repository setting is not changed by the PR. It is required for complete enforcement because workflow-level guards cannot stop a separately defined branch workflow from referencing an environment that remains unrestricted.

Validation

• Regression-first: the updated security test fails on unchanged main and passes with this workflow.
• CI=1 ./node_modules/.bin/vitest run --config vitest.config.mts --no-cache tests/ecosystem-cli.test.ts — 17 passed.
• Broader handwritten suite excluding two unrelated local-infrastructure-dependent files — 109 files / 3,344 tests passed.
• ./scripts/lint — passed across 656 files.
• ./node_modules/.bin/tsc --ignoreConfig --noEmit --strict --skipLibCheck --target ES2020 --module NodeNext --moduleResolution NodeNext --types jest,node tests/ecosystem-cli.test.ts — passed.
• Actionlint v1.7.12, exact pinned Oxfmt 0.62.0, YAML parsing, and git diff --check — passed.
• Nine event cases verify only a human protected-main push can reach the API-key job; same-repository PR, fork PR, feature push, merge group, Dependabot, manual dispatch, other repository, and main-lookalike refs cannot.
• An unfiltered run with reused local dependencies reports three unrelated failures in two unchanged suites: one pnpm workspace-verification fixture and two /proc-dependent Cloudflare fixtures. Current-main GitHub CI is green; PR CI will provide the authoritative complete run.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 10.378s for Node SDK PR #2405.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	150ms
tests/chat-completions-create.test.ts	✅ Passed	181ms
tests/chat-completions-stream.test.ts	✅ Passed	114ms
tests/files-content-binary.test.ts	✅ Passed	114ms
tests/files-create-multipart.test.ts	✅ Passed	199ms
tests/files-list-pagination.test.ts	✅ Passed	145ms
tests/initialize-config.test.ts	✅ Passed	195ms
tests/instance-isolation.test.ts	✅ Passed	103ms
tests/models-list.test.ts	✅ Passed	124ms
tests/responses-background-lifecycle.test.ts	✅ Passed	199ms
tests/responses-body-method-errors.test.ts	✅ Passed	338ms
tests/responses-cancel-timeout.test.ts	✅ Passed	206ms
tests/responses-cancel.test.ts	✅ Passed	215ms
tests/responses-compact-retries.test.ts	✅ Passed	213ms
tests/responses-compact.test.ts	✅ Passed	210ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	132ms
tests/responses-create-advanced.test.ts	✅ Passed	172ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.033s
tests/responses-create-errors.test.ts	✅ Passed	208ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	132ms
tests/responses-create-retries.test.ts	✅ Passed	291ms
tests/responses-create-stream-failures.test.ts	✅ Passed	204ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	2.167s
tests/responses-create-stream-wire.test.ts	✅ Passed	2.635s
tests/responses-create-stream.test.ts	✅ Passed	89ms
tests/responses-create-terminal-states.test.ts	✅ Passed	203ms
tests/responses-create-timeout.test.ts	✅ Passed	218ms
tests/responses-create.test.ts	✅ Passed	237ms
tests/responses-delete.test.ts	✅ Passed	201ms
tests/responses-input-items-errors.test.ts	✅ Passed	180ms
tests/responses-input-items-list.test.ts	✅ Passed	194ms
tests/responses-input-items-options.test.ts	✅ Passed	113ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	261ms
tests/responses-input-tokens-count.test.ts	✅ Passed	262ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.324s
tests/responses-not-found-errors.test.ts	✅ Passed	231ms
tests/responses-parse.test.ts	✅ Passed	163ms
tests/responses-retrieve-retries.test.ts	✅ Passed	210ms
tests/responses-retrieve.test.ts	✅ Passed	183ms
tests/responses-stored-method-errors.test.ts	✅ Passed	502ms
tests/retry-behavior.test.ts	✅ Passed	3.155s
tests/sdk-error-shape.test.ts	✅ Passed	302ms

View OkTest run #32190532900

_{SDK merge (e85aadb92025) · head (bd31bcfd8317) · base (4f4b45d59f3d) · OkTest (7e7850017529)}

[jbeckwith-oai]

Independent two-pass review confirms this change materially reduces existing API-key exposure: pull requests, forks, feature branches, and merge groups run credential-free CI while protected-main live tests retain coverage. Critical documented rollout prerequisite: an administrator must restrict the ci environment to the selected main branch; it currently has no environment branch policy, so branch-editable workflow conditions alone cannot establish the promised hard boundary. This environment weakness predates the PR and is not a newly introduced code defect. Approving the improvement with that operational requirement explicitly noted.