chore(ci): change CI to use ogx_open_client (#6016)

# What does this PR do?

Fixes multiple integration test failures when running with the
OpenAPI-generated SDK (`ogx_open_client`) instead of the Stainless SDK
(`ogx_client`). This PR switches the integration test suite to use the
new SDK and resolves all compatibility issues discovered during the
transition.

**Changes by commit:**

1. **fix(ci):** Fix the OpenAPI SDK publish workflow to use OIDC trusted
publishing instead of unconfigured secret-based auth.

2. **chore(client-sdks):** Switch all integration tests and the library
client from `ogx_client` to `ogx_open_client`. Add fallback import
chains for backward compatibility. Update model class references in
`test_rerank.py` and adapt
`test_openai_vector_store_file_contents_with_extra_query` for the new
SDK's direct query parameter convention (vs. the OpenAI SDK's
`extra_query`).

3. **fix(client-sdks):** Fix dict serialization in multipart form
requests. The generated SDK was sending dicts as JSON strings, but the
OGX server expects bracket-notation (`key[subkey]=value`). Affects
`expires_after` and similar nested fields on file upload.

4. **fix(client-sdks):** Add a `ChoiceDeltaToolCall` streaming delta
variant in the OpenAPI spec. The spec previously used the same
`ChatCompletionMessageToolCall` schema (all fields required, no `index`)
for both complete responses and streaming deltas, but streaming deltas
on the wire include `index` and omit `id`/`type`/`function` on
continuation chunks. This formalizes the de-facto protocol without
changing anything on the wire.

5. **fix(client-sdks):** Fix enum deserialization in anyOf validators.
The generated `actual_instance_must_validate_anyof` used `isinstance()`
to check variant types, which failed for `str,Enum` types (e.g.,
`OpenAIResponseInputToolChoiceMode`) because a bare string like `"auto"`
is not an `isinstance` of the enum class. Add a fallback that tries
constructing the type from `str`/`int` values.

6. **fix(tests):** Fix four bugs in vision inference integration tests:
guard against `None` in streaming `delta.content`, fix
`multi_image_data` fixture reference (was using the function instead of
the resolved value), fix wrong streaming API call
(`chunk.event.delta.text` → `chunk.choices[0].delta.content`), and
update stale GitHub image URL.

## Test Plan

Integration tests were run against a live OpenAI backend with the
`ci-tests` distribution:

```bash
# Ensure the generated SDK is installed with all template fixes
cp -r client-sdks/openapi/sdks/python/ogx_open_client/* \
  .venv/lib64/python3.12/site-packages/ogx_open_client/

# Run the full base test suite
uv run --no-sync ./scripts/integration-tests.sh \
  --stack-config server:ci-tests --setup gpt --suite base --inference-mode live
```

**Results: 22 failures (down from 29 baseline), 0 regressions.**

All 22 remaining failures are pre-existing and unrelated:
- 16x ranker/hybrid search returning empty results (keyword indexing
issue across backends)
- 6x legacy `/v1/completions` endpoint 404 (not served by the `ci-tests`
distribution with `gpt` setup — not a real CI configuration)

**Tests fixed by this PR (7 resolved):**

| Test | Root cause | Fix |
|------|-----------|-----|
|
`test_openai_vector_store_file_contents_with_extra_query[client_with_models-*]`
(x6 backends) | Generated SDK rejects `extra_query` kwarg |
`_get_file_content` helper adapts params per client type |
| `test_inference_store_tool_calls[client_with_models-True]` | Streaming
tool call chunks deserialized as raw dicts | `ChoiceDeltaToolCall`
schema with relaxed fields |
| `test_list_response_input_items[client_with_models]` | `tool_choice:
"auto"` fails anyOf enum validation | Try enum construction for str/int
in validator |
| `test_image_chat_completion_multiple_images[True]` | `None`
delta.content on streaming chunks | `or ""` guard |
| `test_image_chat_completion_multiple_images[False]` |
`multi_image_data` fixture function used as value | Changed to
`multi_image_url` |
| `test_image_chat_completion_streaming` | `.lower()` called on `None`
delta.content | `if delta_content:` guard |
| `test_openai_chat_completion_image_url` | Stale GitHub URL
(`meta-llama/ogx`) | Updated to `ogx-ai/ogx` |

---------

Signed-off-by: E Geiger <egeiger@redhat.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Charlie Doern <cdoern@redhat.com>

Author: 3 people

.github/actions/install-ogx-client/action.yml

@@ -30,7 +30,7 @@ runs:
       id: configure
       shell: bash
       run: |
-        # If sdk_install_url is provided (e.g., from Stainless preview), use it directly
+        # If sdk_install_url is provided, use it directly
         if [ -n "${{ inputs.sdk_install_url }}" ]; then
           echo "Using provided sdk_install_url: ${{ inputs.sdk_install_url }}"
           echo "install-after-sync=true" >> $GITHUB_OUTPUT

.github/workflows/README.md

@@ -33,7 +33,6 @@ OGX uses GitHub Actions for Continuous Integration (CI). Below is a table detail
 | Integration Tests (Record) | [record-integration-tests.yml](record-integration-tests.yml) | Auto-record missing test recordings for PR |
 | Release Branch Scheduled CI | [release-branch-scheduled-ci.yml](release-branch-scheduled-ci.yml) | Scheduled CI checks for active release branches |
 | Check semantic PR titles | [semantic-pr.yml](semantic-pr.yml) | Ensure that PR titles follow the conventional commit spec |
-| Stainless SDK Builds | [stainless-builds.yml](stainless-builds.yml) | Build Stainless SDK from OpenAPI spec changes |
 | Close stale issues and PRs | [stale_bot.yml](stale_bot.yml) | Run the Stale Bot action |
 | Test External Providers Installed via Module | [test-external-provider-module.yml](test-external-provider-module.yml) | Test External Provider installation via Python module |
 | Test External API and Providers | [test-external.yml](test-external.yml) | Test the External API and Provider mechanisms |

.github/workflows/integration-tests.yml

@@ -51,7 +51,7 @@ on:
         required: false
         type: string
         default: 'default'
-        description: 'Matrix configuration key from ci_matrix.json (e.g., "default", "stainless")'
+        description: 'Matrix configuration key from ci_matrix.json (e.g., "default")'
       matrix_json:
         required: false
         type: string
@@ -87,8 +87,7 @@ concurrency:
 
 # Limit permissions of the GITHUB_TOKEN to the minimum required.
 # Default mode is 'replay' which only needs read access.
-# When called via workflow_call (e.g., from stainless-builds.yml with record-if-missing),
-# the caller's permissions apply.
+# When called via workflow_call, the caller's permissions apply.
 permissions:
   contents: read
 
@@ -204,7 +203,7 @@ jobs:
           WATSONX_PROJECT_ID: replay-mode-dummy-project
           VERTEX_AI_PROJECT: ${{ matrix.config.setup == 'vertexai' && 'replay-mode-dummy-project' || '' }}
           VERTEX_AI_LOCATION: ${{ matrix.config.setup == 'vertexai' && 'global' || '' }}
-          AWS_BEARER_TOKEN_BEDROCK: replay-mode-dummy-key
+          AWS_BEDROCK_BEARER_TOKEN: replay-mode-dummy-key
           AWS_DEFAULT_REGION: us-west-2
           GEMINI_API_KEY: replay-mode-dummy-key
           TAVILY_SEARCH_API_KEY: ${{ secrets.TAVILY_SEARCH_API_KEY || 'replay-mode-dummy-key' }}

.github/workflows/openapi-generator-validation.yml

@@ -185,9 +185,9 @@ jobs:
           echo "OpenAPI spec generated successfully"
           ls -lh openapi.yml
 
-      - name: Generate Python SDK (for CI testing with ogx_client name)
+      - name: Generate Python SDK
         working-directory: client-sdks/openapi
-        run: make sdk OPEN=0
+        run: make sdk OPEN=1
 
       - name: Validate generated SDK
         working-directory: client-sdks/openapi
@@ -217,16 +217,14 @@ jobs:
 
       - name: Install generated SDK
         run: |
-          echo "Installing OpenAPI-generated SDK (ogx_client)..."
-          # Uninstall existing client (note: uv pip uninstall doesn't support -y flag)
-          uv pip uninstall ogx-client || true
+          echo "Reinstalling OpenAPI-generated SDK (ogx_open_client)..."
+          uv pip uninstall ogx-open-client || true
 
-          # Install SDK using uv pip - this ensures proper editable install
+          # Install SDK using uv pip
           uv pip install -e client-sdks/openapi/sdks/python
 
           echo "Verifying installation..."
-          # Use 'uv run python' to ensure we use the correct Python in the venv
-          uv run python -c "import ogx_client; print(f'Installed: {ogx_client.__name__}')"
+          uv run python -c "import ogx_open_client; print(f'Installed: {ogx_open_client.__name__}')"
 
       - name: Setup Ollama (for integration tests)
         if: runner.os == 'Linux'
@@ -244,7 +242,7 @@ jobs:
             || echo "::warning::Some integration tests failed - this may indicate SDK compatibility issues"
 
           # Show which SDK is actually being used
-          uv run python -c "import ogx_client; import inspect; print(f'SDK location: {inspect.getfile(ogx_client)}')"
+          uv run python -c "import ogx_open_client; import inspect; print(f'SDK location: {inspect.getfile(ogx_open_client)}')"
 
       - name: Summary
         if: runner.os == 'Linux'
@@ -257,5 +255,5 @@ jobs:
             echo "✅ Integration tests executed (check logs for results)"
             echo ""
             echo "**Platform**: ${{ matrix.os }}"
-            echo "**Package**: ogx_client (OpenAPI-generated)"
+            echo "**Package**: ogx_open_client (OpenAPI-generated)"
           } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/publish-openapi-sdk.yml

@@ -27,13 +27,10 @@ concurrency:
 
 permissions:
   contents: read
-  id-token: write  # Required for trusted publishing to PyPI
 
 jobs:
-  publish-sdk:
+  build-sdk:
     runs-on: ubuntu-latest
-    environment:
-      name: ${{ github.event.inputs.publish_to == 'pypi' && 'pypi-production' || 'testpypi' }}
 
     steps:
       - name: Checkout repository
@@ -100,65 +97,80 @@ jobs:
           echo "Built distribution files:"
           ls -lh dist/
 
-      - name: Publish to TestPyPI (dry-run or manual)
-        if: |
-          (github.event_name == 'workflow_dispatch' && inputs.publish_to == 'testpypi' && inputs.dry_run == false) ||
-          (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/openapi-sdk-v') && !contains(github.ref, '-rc') && !contains(github.ref, '-alpha') && !contains(github.ref, '-beta'))
-        working-directory: client-sdks/openapi/sdks/python
-        run: |
-          echo "Publishing to TestPyPI..."
-          uv publish --publish-url https://test.pypi.org/legacy/ dist/*
-        env:
-          UV_PUBLISH_TOKEN: ${{ secrets.TEST_PYPI_API_TOKEN }}
-
-      - name: Publish to PyPI (production)
-        if: |
-          github.event_name == 'workflow_dispatch' &&
-          inputs.publish_to == 'pypi' &&
-          inputs.dry_run == false
-        working-directory: client-sdks/openapi/sdks/python
-        run: |
-          echo "Publishing to PyPI..."
-          uv publish dist/*
-        env:
-          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
-
       - name: Upload build artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: python-sdk-dist
           path: client-sdks/openapi/sdks/python/dist/
           retention-days: 30
 
+  publish-testpypi:
+    if: |
+      (github.event_name == 'workflow_dispatch' && inputs.publish_to == 'testpypi' && inputs.dry_run == false) ||
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/openapi-sdk-v') && !contains(github.ref, '-rc') && !contains(github.ref, '-alpha') && !contains(github.ref, '-beta'))
+    needs: build-sdk
+    runs-on: ubuntu-latest
+    environment: testpypi
+    permissions:
+      id-token: write
+    steps:
+      - name: Download build artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: python-sdk-dist
+          path: dist
+
+      - name: Publish to TestPyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          packages-dir: dist/
+          verbose: true
+
       - name: Summary
         run: |
           {
             echo "## SDK Publishing Summary"
             echo ""
             echo "- **Event**: ${{ github.event_name }}"
-            echo "- **Dry Run**: ${{ inputs.dry_run || 'false' }}"
-            echo "- **Target**: ${{ inputs.publish_to || 'testpypi (default)' }}"
+            echo "- **Target**: TestPyPI"
             echo "- **Package**: ogx-open-client"
             echo ""
+            echo "✅ Package published to TestPyPI"
+            echo "Install with: \`pip install --index-url https://test.pypi.org/simple/ ogx-open-client\`"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  publish-pypi:
+    if: |
+      github.event_name == 'workflow_dispatch' &&
+      inputs.publish_to == 'pypi' &&
+      inputs.dry_run == false
+    needs: build-sdk
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - name: Download build artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: python-sdk-dist
+          path: dist
 
-            if [ "${{ inputs.dry_run }}" = "true" ]; then
-              echo "✅ Package built successfully (dry-run, not published)"
-            elif [ "${{ inputs.publish_to }}" = "testpypi" ]; then
-              echo "✅ Package published to TestPyPI"
-              echo "Install with: \`pip install --index-url https://test.pypi.org/simple/ ogx-open-client\`"
-            elif [ "${{ github.event_name }}" = "push" ]; then
-              # Check for pre-release tags (same logic as publish step)
-              case "${{ github.ref }}" in
-                *"-rc"*|*"-alpha"*|*"-beta"*)
-                  echo "✅ Package built successfully (pre-release tag, not published)"
-                  ;;
-                *)
-                  echo "✅ Package published to TestPyPI"
-                  echo "Install with: \`pip install --index-url https://test.pypi.org/simple/ ogx-open-client\`"
-                  ;;
-              esac
-            else
-              echo "✅ Package published to PyPI"
-              echo "Install with: \`pip install ogx-open-client\`"
-            fi
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        with:
+          packages-dir: dist/
+          verbose: true
+
+      - name: Summary
+        run: |
+          {
+            echo "## SDK Publishing Summary"
+            echo ""
+            echo "- **Event**: ${{ github.event_name }}"
+            echo "- **Target**: PyPI (production)"
+            echo "- **Package**: ogx-open-client"
+            echo ""
+            echo "✅ Package published to PyPI"
+            echo "Install with: \`pip install ogx-open-client\`"
           } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/record-integration-tests.yml

@@ -273,7 +273,7 @@ jobs:
           GOOGLE_APPLICATION_CREDENTIALS: ${{ matrix.provider.setup == 'vertexai' && secrets.GOOGLE_APPLICATION_CREDENTIALS || '' }}
           GEMINI_API_KEY: ${{ matrix.provider.setup == 'gemini' && secrets.GEMINI_API_KEY || '' }}
           TAVILY_SEARCH_API_KEY: ${{ contains(fromJSON('["gpt","azure","vertexai"]'), matrix.provider.setup) && secrets.TAVILY_SEARCH_API_KEY || '' }}
-          AWS_BEARER_TOKEN_BEDROCK: ${{ matrix.provider.setup == 'bedrock' && secrets.AWS_BEARER_TOKEN_BEDROCK || '' }}
+          AWS_BEDROCK_BEARER_TOKEN: ${{ matrix.provider.setup == 'bedrock' && secrets.AWS_BEARER_TOKEN_BEDROCK || '' }}
           AWS_DEFAULT_REGION: ${{ matrix.provider.setup == 'bedrock' && 'us-west-2' || '' }}
         with:
           stack-config: 'server:ci-tests'