Pin actions/create-github-app-token to v3.2.0 commit SHA (bcd2ba49...) instead of mutable @v3 tag to prevent supply chain attacks where a compromised account could force-push malicious code to the tag. This eliminates the risk of secret leakage and malicious code execution in CI workflows.
Generate GitHub App token using GH_DOCS_SYNC_APP_ID and GH_DOCS_SYNC_APP_PRIVATE_KEY secrets. Use the app token instead of GITHUB_TOKEN for both close-superseded and auto-merge steps to ensure downstream workflow triggers (sdk_publish.yaml) after merge. This aligns token usage with typescript-sdk and go-sdk implementations.
- Add 'opened' trigger to catch PRs when bot immediately applies label
- Fix bot username to github-actions[bot] (verified via API and commit history)
- Restructure condition to handle both 'labeled' and 'opened' events
* 'labeled': uses github.event.label.name
* 'opened': uses github.event.pull_request.labels.*.name
* Prevents 'opened' event from failing due to missing github.event.label
This enables the auto-merge workflow to work with Speakeasy SDK generation PRs.
- Add 'opened' trigger to catch PRs when bot immediately applies label
- Fix bot username from github-actions[bot] to app/github-actions
This enables the auto-merge workflow to work with Speakeasy SDK generation PRs.
Add a workflow that merges Speakeasy codegen PRs when the bot applies a
semver label, closing superseded regen PRs first. This unblocks
sdk_publish.yaml after mode:pr generation without manual intervention.
Switch sdk_generation_for_spec_change.yaml from direct to pr mode so
Speakeasy opens a PR instead of pushing to main. This avoids branch
protection failures and routes publishing through sdk_publish.yaml.
Automatically notifies openrouter-web monorepo when changes are pushed to main.
This triggers the subtree sync workflow to create a PR with updates.
Requires MONOREPO_SYNC_TOKEN secret to be configured.
Christine Chen