ci: regenerate SDK directly when merged spec changes land#315
ci: regenerate SDK directly when merged spec changes land#315robert-j-y wants to merge 1 commit into
Conversation
![perry-the-pr-reviewer[bot]](https://avatars.githubusercontent.com/in/3222961?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
robert-j-y
force-pushed
the
ci/regenerate-on-spec-merge
branch
from
cf631ac to
d7a796b
Compare
Spec updates land on main automatically, but the only generation trigger is the nightly cron in PR mode, whose rolling PRs require a manual merge (#205 sat open Apr 24 - Jun 11). Mirror typescript-sdk's spec-change workflow: when a PR touching .speakeasy/in.openapi.yaml merges to main, run Speakeasy in direct mode so the regenerated SDK lands on main and the publish workflow fires.
robert-j-y
force-pushed
the
ci/regenerate-on-spec-merge
branch
from
7f191d3 to
d20db80
Compare
There was a problem hiding this comment.
⚠️ APPROVE unavailable on this installation — the maintainer GitHub App does not havepull_requests: writepermission on OpenRouterTeam, so the verdict below is posted as COMMENT. Event-level approval (for branch-protection / review requirements) must be added out-of-band.
Perry's Review
Adds a new GitHub Actions workflow to automatically regenerate the Python SDK in mode: direct whenever a merged PR touches .speakeasy/in.openapi.yaml, replacing the stale rolling-PR pattern that required manual merges.
Verdict: ✅ LGTM
Details
Risk: 🟡 Medium — new CI automation that commits directly to main via a PAT, but no production SDK code paths are changed and the pattern mirrors the existing typescript-sdk and go-sdk workflows.
CI: no checks — new workflow file not yet triggered.
Findings: none.
Security: Category 7 (auth — PAT usage for github_access_token) was touched. The prior review flagged that secrets.GH_TOKEN lacked push access; the author ran a scope-check workflow, confirmed GH_TOKEN has permissions.push=false, and switched to secrets.SDK_MERGE_PAT (same secret name go-sdk uses for this exact purpose). The SDK_MERGE_PAT secret is not yet added to this repo — the PR description and test plan document this as a required pre-merge step. Safeguard is intact once the secret is provisioned.
Research: skipped (small tier).
Codex: skipped (small tier).
Test coverage: no unit tests applicable — this is a CI workflow file. The test plan documents a manual integration test (trigger via workflow_dispatch with force: true post-merge and verify a regeneration commit lands on main and the Publish workflow fires).
Unresolved threads: 1 outdated thread (PAT scope concern, raised in prior review at cf631ac, addressed by author on this push — switched from GH_TOKEN to SDK_MERGE_PAT with confirmed push access).
Scope: first review (full)
Review: tier=small · model=claude-sonnet-latest · score=0.4
1 participant
Summary
OpenAPI spec updates land on
mainautomatically (thechore: update OpenAPI spec from monorepoPRs), but nothing regenerates the SDK when they do. The only generation trigger is the nightly cron insdk_generation.yaml, which runs Speakeasy inmode: prand produces a rolling PR that requires a manual merge — #205 accumulated changes from Apr 24 to Jun 11 before it was merged by hand, and #127/#169 went stale the same way.This adds the same workflow
typescript-sdkuses: when a merged PR touches.speakeasy/in.openapi.yaml, run the Speakeasy generator inmode: directso the regenerated SDK commits straight tomain, where the existing Publish workflow (.speakeasy/gen.lockpath filter) picks it up and releases to PyPI.Important
This uses
secrets.SDK_MERGE_PAT(not the defaultGITHUB_TOKEN) forgithub_access_token, because commits pushed withGITHUB_TOKENdo not trigger other workflows — the Publish workflow would silently never fire. go-sdk already uses a secret with this name for the same purpose, but it does not exist in this repo yet and must be added before merging. (GH_TOKENwas considered, but a scope check showed it has no push access to this repo.)Test plan
SDK_MERGE_PATsecret (PAT with push access to this repo, same as go-sdk's)workflow_dispatchwithforce: true)mainand the Publish workflow fires and releases to PyPI