The auto-merge workflow triggered on `pull_request: [labeled, opened]`.
When github-actions[bot] opened the regen PR, GitHub's recursion guard
refused to run a workflow triggered by another workflow's GITHUB_TOKEN,
so the run landed as action_required with zero jobs executed. Regen PRs
piled up unmerged and sdk_publish never fired (PyPI stuck at 0.10.0).
Port the TypeScript SDK's architecture: make auto-merge a workflow_call
reusable workflow chained inside the Generate run (generate ->
resolve-branch -> auto-merge). No separate pull_request-triggered run
exists, so there is nothing for GitHub to gate.
- auto-merge-speakeasy-pr.yaml: workflow_call inputs (run_started_at,
branch_name) + App-token secrets; resolve PR via branch/timestamp;
.author.is_bot check; wait_for_checks before direct merge; step
summaries. Keeps the SHA-pinned create-github-app-token.
- sdk_generation.yaml / sdk_generation_for_spec_change.yaml: add
concurrency group, resolve-branch + auto-merge jobs.
Pin actions/create-github-app-token to v3.2.0 commit SHA (bcd2ba49...) instead of mutable @v3 tag to prevent supply chain attacks where a compromised account could force-push malicious code to the tag. This eliminates the risk of secret leakage and malicious code execution in CI workflows.
Generate GitHub App token using GH_DOCS_SYNC_APP_ID and GH_DOCS_SYNC_APP_PRIVATE_KEY secrets. Use the app token instead of GITHUB_TOKEN for both close-superseded and auto-merge steps to ensure downstream workflow triggers (sdk_publish.yaml) after merge. This aligns token usage with typescript-sdk and go-sdk implementations.
- Add 'opened' trigger to catch PRs when bot immediately applies label
- Fix bot username to github-actions[bot] (verified via API and commit history)
- Restructure condition to handle both 'labeled' and 'opened' events
* 'labeled': uses github.event.label.name
* 'opened': uses github.event.pull_request.labels.*.name
* Prevents 'opened' event from failing due to missing github.event.label
This enables the auto-merge workflow to work with Speakeasy SDK generation PRs.
- Add 'opened' trigger to catch PRs when bot immediately applies label
- Fix bot username from github-actions[bot] to app/github-actions
This enables the auto-merge workflow to work with Speakeasy SDK generation PRs.
Add a workflow that merges Speakeasy codegen PRs when the bot applies a
semver label, closing superseded regen PRs first. This unblocks
sdk_publish.yaml after mode:pr generation without manual intervention.
Switch sdk_generation_for_spec_change.yaml from direct to pr mode so
Speakeasy opens a PR instead of pushing to main. This avoids branch
protection failures and routes publishing through sdk_publish.yaml.
Automatically notifies openrouter-web monorepo when changes are pushed to main.
This triggers the subtree sync workflow to create a PR with updates.
Requires MONOREPO_SYNC_TOKEN secret to be configured.
Christine Chen