The Python SDK had no pull_request-triggered checks, so regen PRs
(speakeasy-sdk-regen-*) carried an empty status-check rollup and the
auto-merge flow would merge them with zero validation. The TypeScript
SDK validates every regen PR via pr-validation.yaml; Python had no
equivalent.
Add a single-file PR Validation workflow that builds the package and
runs the SDK's existing quality gates (mypy, pyright, pylint) via uv.
No tests exist in this repo yet, so no API-key secret is needed, which
also lets the workflow run on fork PRs. paths-ignore on
.speakeasy/in.openapi.yaml mirrors TS so pure spec-bump PRs don't
double-trigger.
This registers a `validate` check that the auto-merge wait_for_checks
step will gate on once both land.
Speakeasy regen PRs are opened with the workflow GITHUB_TOKEN, which by
design does not trigger downstream on: pull_request runs, so they carry
zero status checks. main has no required checks either, so gh pr merge
--auto no-ops and the direct-merge fallback calls wait_for_checks.
The empty-rollup arm only `continue`d, so TOTAL stayed 0 until the 600s
timeout and the function exit 1'd — failing auto-merge on every regen PR.
Add a 60s grace window for checks to register, then treat a persistently
empty rollup as "no checks to wait for" and return 0 so the direct squash
merge proceeds. Matches the fix already shipped in go-sdk #318.
The auto-merge workflow triggered on `pull_request: [labeled, opened]`.
When github-actions[bot] opened the regen PR, GitHub's recursion guard
refused to run a workflow triggered by another workflow's GITHUB_TOKEN,
so the run landed as action_required with zero jobs executed. Regen PRs
piled up unmerged and sdk_publish never fired (PyPI stuck at 0.10.0).
Port the TypeScript SDK's architecture: make auto-merge a workflow_call
reusable workflow chained inside the Generate run (generate ->
resolve-branch -> auto-merge). No separate pull_request-triggered run
exists, so there is nothing for GitHub to gate.
- auto-merge-speakeasy-pr.yaml: workflow_call inputs (run_started_at,
branch_name) + App-token secrets; resolve PR via branch/timestamp;
.author.is_bot check; wait_for_checks before direct merge; step
summaries. Keeps the SHA-pinned create-github-app-token.
- sdk_generation.yaml / sdk_generation_for_spec_change.yaml: add
concurrency group, resolve-branch + auto-merge jobs.
Pin actions/create-github-app-token to v3.2.0 commit SHA (bcd2ba49...) instead of mutable @v3 tag to prevent supply chain attacks where a compromised account could force-push malicious code to the tag. This eliminates the risk of secret leakage and malicious code execution in CI workflows.
Generate GitHub App token using GH_DOCS_SYNC_APP_ID and GH_DOCS_SYNC_APP_PRIVATE_KEY secrets. Use the app token instead of GITHUB_TOKEN for both close-superseded and auto-merge steps to ensure downstream workflow triggers (sdk_publish.yaml) after merge. This aligns token usage with typescript-sdk and go-sdk implementations.
- Add 'opened' trigger to catch PRs when bot immediately applies label
- Fix bot username to github-actions[bot] (verified via API and commit history)
- Restructure condition to handle both 'labeled' and 'opened' events
* 'labeled': uses github.event.label.name
* 'opened': uses github.event.pull_request.labels.*.name
* Prevents 'opened' event from failing due to missing github.event.label
This enables the auto-merge workflow to work with Speakeasy SDK generation PRs.
- Add 'opened' trigger to catch PRs when bot immediately applies label
- Fix bot username from github-actions[bot] to app/github-actions
This enables the auto-merge workflow to work with Speakeasy SDK generation PRs.
Add a workflow that merges Speakeasy codegen PRs when the bot applies a
semver label, closing superseded regen PRs first. This unblocks
sdk_publish.yaml after mode:pr generation without manual intervention.
