fix(release): use Azure for contract evals

.github/workflows/publish.yml

@@ -100,14 +100,15 @@ jobs:
         run: bun install --frozen-lockfile
 
       # Finalize/stable releases promote to latest, so block before any version
-      # bump/tag if the live contract eval fails. The gate uses a Models-capable
-      # PAT secret and does not override the workflow GITHUB_TOKEN.
+      # bump/tag if the live contract eval fails. The gate uses the configured
+      # Azure OpenAI deployment and does not override the workflow GITHUB_TOKEN.
       - name: Contract eval gate
         if: inputs.channel == 'finalize' || inputs.channel == 'stable'
         run: bun run contract-eval
         env:
-          GH_MODELS_TOKEN: ${{ secrets.GH_MODELS_TOKEN }}
-          GH_MODELS_MODEL: ${{ vars.GH_MODELS_MODEL || 'gpt-5-mini' }}
+          AZURE_OPENAI_API_KEY: ${{ secrets.AZURE_OPENAI_API_KEY }}
+          AZURE_OPENAI_ENDPOINT: ${{ vars.AZURE_OPENAI_ENDPOINT }}
+          AZURE_DEPLOYMENT_NAME: ${{ vars.AZURE_DEPLOYMENT_NAME }}
 
       - name: Bump version, commit, and tag
         if: inputs.channel != 'existing'
@@ -228,8 +229,9 @@ jobs:
         if: needs.prepare.outputs.publish_action == 'publish-latest' && inputs.channel == 'existing'
         run: bun run contract-eval
         env:
-          GH_MODELS_TOKEN: ${{ secrets.GH_MODELS_TOKEN }}
-          GH_MODELS_MODEL: ${{ vars.GH_MODELS_MODEL || 'gpt-5-mini' }}
+          AZURE_OPENAI_API_KEY: ${{ secrets.AZURE_OPENAI_API_KEY }}
+          AZURE_OPENAI_ENDPOINT: ${{ vars.AZURE_OPENAI_ENDPOINT }}
+          AZURE_DEPLOYMENT_NAME: ${{ vars.AZURE_DEPLOYMENT_NAME }}
 
       - name: Publish to npm
         run: |

examples/contract/evals/release-gate.eval.yaml

@@ -4,7 +4,7 @@ environment:
   type: host
   workdir: ../workspace-template
 providers:
-  - gh-models
+  - azure
 prompts:
   - "{{ input }}"
 tests:

examples/contract/evals/repo-materialization.eval.yaml

@@ -13,7 +13,7 @@ environment:
       - 21a34daed7ebcfe36cbed053607622a55e5e94cb
     cwd: "."
 providers:
-  - gh-models
+  - azure
 prompts:
   - "{{ input }}"
 tests:

examples/contract/evals/script-grader-contract.eval.yaml

@@ -1,7 +1,7 @@
 name: script-grader-contract
 description: Release gate verifying the script-grader stdin payload contract.
 providers:
-  - gh-models
+  - azure
 prompts:
   - "{{ input }}"
 tests:

scripts/run-contract-eval.ts

@@ -7,11 +7,10 @@
  * invoking this file directly.
  *
  * Local usage:
- * GH_MODELS_TOKEN=$(gh auth token) bun run contract-eval
+ * Set AZURE_OPENAI_API_KEY, AZURE_OPENAI_ENDPOINT, and AZURE_DEPLOYMENT_NAME,
+ * then run `bun run contract-eval`.
  */
 
-process.env.GH_MODELS_MODEL ||= 'gpt-5-mini';
-
 const evalFiles = [
   'examples/contract/evals/release-gate.eval.yaml',
   'examples/contract/evals/repo-materialization.eval.yaml',
@@ -27,9 +26,9 @@ for (const evalFile of evalFiles) {
       'eval',
       evalFile,
       '--provider',
-      'gh-models',
+      'azure',
       '--grader-provider',
-      'gh-models',
+      'azure',
       '--threshold',
       '1',
     ],