ci: auto-bump @openrouter/sdk and dispatch monorepo on release

[mattapperson]

Auto-bump @openrouter/sdk + dispatch monorepo on release (HOPs 2 & 3)

Receives the openrouter-sdk-published dispatch from typescript-sdk, opens a
PR bumping @openrouter/sdk in packages/agent, drives it through Perry + CI,
and auto-merges on green. When that release publishes a new @openrouter/agent,
it dispatches the monorepo to bump its server-tools pin.

What this adds / changes

• .github/workflows/bump-openrouter-sdk.yaml (new): receiver +
  self-gating auto-merge.
  • bump job: opens the PR with SUBTREE_PUSH_PAT (a PAT, so Perry + CI
    run — GITHUB_TOKEN would suppress them), bumps the dependency to the caret
    floor ^<version>, runs a full pnpm install relock, writes a changeset,
    and closes prior bot bump PRs.
  • gate job: polls perry/review + CI to a terminal state and squash-merges
    on green; on failure/blocker/timeout it alerts Slack and leaves the PR red
    (never merges red). Branch protection is off, so the gate — not GitHub-native
    auto-merge — does the gating.
• .github/scripts/bump-sdk.sh, .github/scripts/pr-gate.sh (new): the
  bump and wait-gate logic (locally runnable).
• .github/workflows/publish.yaml (extended): on a real @openrouter/agent
  publish (changesets published output, or an npm version diff on a manual
  publish), dispatch openrouter-agent-published to openrouter-web using
  SUBTREE_PUSH_PAT.

Secrets — reuses existing, nothing new to create

• SUBTREE_PUSH_PAT — org's cross-repo PAT, used here to open + merge the
  bump PR and to dispatch the monorepo. ⚠️ Confirm its scope includes
  contents: write + pull_requests: write on this repo and
  contents: write on OpenRouterTeam/openrouter-web.
• CI_RELEASE_ALERT_SLACK_BOT_TOKEN + CI_RELEASE_ALERT_SLACK_CHANNEL_ID —
  org-level (already used by the monorepo's release workflows); the gate posts
  pass/fail here. No setup needed.
• NPM_TOKEN / OPENROUTER_API_KEY — already resolve org-level (the Release
  • CI workflows use them today). e2e coverage on bump PRs works out of the box.
• Perry is installed on this repo, so perry/review posts on the bump PR.

How to test

1. Merge to main.
2. Actions → Bump @openrouter/sdk → Run workflow → version=0.12.79,
   dry_run=true. Confirm the PR opens, Perry + CI run on it, and the gate
   reports without merging.
3. Re-run with dry_run=false on a green PR to confirm squash-merge.

[sdk-bot]

[perry-the-pr-reviewer]

⚠️ APPROVE unavailable on this installation — the maintainer GitHub App is not
configured, so the verdict below is posted as COMMENT. Event-level approval
(for branch-protection / review requirements) must be added out-of-band.

Perry's Review

Simplifies the SDK release chain by reusing the org's existing SUBTREE_PUSH_PAT instead of introducing two new GitHub App secrets and a separate WEB_DISPATCH_PAT.

Verdict: ✅ LGTM

Details

CI: all passing ✅ (typecheck, lint, unit-tests, structural-gate, e2e-tests)

Findings: none (no new issues in the 11 new lines)

Codex (HEAVY_SECONDARY_MODEL): skipped (medium tier)

Research: skipped (medium tier)

Security: Category 7 (auth/credential) touched — consolidating from 3 separate secrets to 1 is a net reduction in secret surface area. The PAT still needs contents:write on openrouter-web for the dispatch step (documented inline). No concerns.

Test coverage: no tests needed for workflow infrastructure changes

Unresolved threads: 1 open nit from prior review (double date call in bump-sdk.sh) — not addressed by this PR, which is fine as this PR's scope is credential consolidation only.

Scope: incremental — 11 new lines since prior review

Tier: medium (448 LoC)

[perry-the-pr-reviewer]

[nit] The bump job passes token: SUBTREE_PUSH_PAT at checkout so that the subsequent git push in bump-sdk.sh is authenticated as the PAT rather than GITHUB_TOKEN; the gate job omits the token (correct — it only needs read access, and the merge-step GH_TOKEN env var handles authentication separately). Consider a brief comment here to explain the asymmetry for the next reader.

Reviewed at 8917615