From 8eccb2b7feea594b2bd89ae906f6f7bffa47af2b Mon Sep 17 00:00:00 2001 From: Cristiano Betta Date: Wed, 4 Nov 2026 16:41:45 +0000 Subject: [PATCH 1/3] ci: CI check for hand-started publish, Slack out of the release-key job From the CLI's security review: a hand-started Publish SDK now needs a green CI run on main for that commit, and Merge SDK's Slack step (a container action) runs in its own job instead of the one holding the release App key. Pins sdk-release to c8db692. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/sdk_merge.yaml | 15 ++++++++++++--- .github/workflows/sdk_publish.yaml | 15 ++++++++++++++- 2 files changed, 26 insertions(+), 4 deletions(-) diff --git a/.github/workflows/sdk_merge.yaml b/.github/workflows/sdk_merge.yaml index 8b68fbcc..7cc7992b 100644 --- a/.github/workflows/sdk_merge.yaml +++ b/.github/workflows/sdk_merge.yaml @@ -17,17 +17,26 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 environment: sdk-release + outputs: + notify: ${{ steps.bot.outputs.notify }} + pr: ${{ steps.bot.outputs.pr }} steps: - id: bot - uses: gr4vy/sdk-release/release-bot@f956131fcbeaa05d2afcd763f7f8e8122ed823e2 + uses: gr4vy/sdk-release/release-bot@c8db692714898b3bed56d5a7df32f44db9b2055c with: sdk: java run-id: ${{ github.event.workflow_run.id }} client-id: ${{ secrets.SDK_RELEASE_APP_CLIENT_ID }} private-key: ${{ secrets.SDK_RELEASE_APP_PRIVATE_KEY }} + # Kept out of `decide`, which holds the release App key: the Slack action + # runs a container image. + notify: + needs: decide + if: needs.decide.outputs.notify == 'true' + runs-on: ubuntu-latest + steps: - name: Slack Notification - if: steps.bot.outputs.notify == 'true' uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2 env: SLACK_USERNAME: Java SDK @@ -37,5 +46,5 @@ jobs: SLACK_MSG_AUTHOR: gr4vy SLACK_ICON_EMOJI: ":gr4vy-sdk:" SLACK_COLOR: "warning" - SLACK_MESSAGE: "Speakeasy PR needs a human: ${{ github.server_url }}/${{ github.repository }}/pull/${{ steps.bot.outputs.pr }}" + SLACK_MESSAGE: "Speakeasy PR needs a human: ${{ github.server_url }}/${{ github.repository }}/pull/${{ needs.decide.outputs.pr }}" SLACK_FOOTER: "" diff --git a/.github/workflows/sdk_publish.yaml b/.github/workflows/sdk_publish.yaml index 92622f01..559b020f 100644 --- a/.github/workflows/sdk_publish.yaml +++ b/.github/workflows/sdk_publish.yaml @@ -25,6 +25,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 permissions: + actions: read contents: read pull-requests: read outputs: @@ -32,8 +33,20 @@ jobs: mode: ${{ github.event_name == 'workflow_dispatch' && 'manual' || steps.gate.outputs.mode }} version: ${{ steps.gate.outputs.version }} steps: + - name: Require a green CI run on this commit + if: github.event_name == 'workflow_dispatch' + env: + GH_TOKEN: ${{ github.token }} + SHA: ${{ github.sha }} + run: | + passed=$(gh api "repos/$GITHUB_REPOSITORY/actions/workflows/ci.yaml/runs?head_sha=$SHA&branch=main&event=push&status=success" --jq '.total_count') + if [ "$passed" = "0" ]; then + echo "::error::CI hasn't passed on main for $SHA, so it can't be released" + exit 1 + fi + - id: gate - uses: gr4vy/sdk-release/publish-gate@f956131fcbeaa05d2afcd763f7f8e8122ed823e2 + uses: gr4vy/sdk-release/publish-gate@c8db692714898b3bed56d5a7df32f44db9b2055c with: head-sha: ${{ github.event.workflow_run.head_sha || github.sha }} bot-login: gr4vy-sdk-release[bot] From ea1f1043690fe82515b6bca26efe28a38e055ad8 Mon Sep 17 00:00:00 2001 From: Cristiano Betta Date: Wed, 4 Nov 2026 16:59:20 +0000 Subject: [PATCH 2/3] ci: pin sdk-release to f65897b (#15: dependency downgrades go to a person) Co-Authored-By: Claude Opus 5.5 --- .github/workflows/sdk_merge.yaml | 2 +- .github/workflows/sdk_publish.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/sdk_merge.yaml b/.github/workflows/sdk_merge.yaml index 7cc7992b..d309c44b 100644 --- a/.github/workflows/sdk_merge.yaml +++ b/.github/workflows/sdk_merge.yaml @@ -22,7 +22,7 @@ jobs: pr: ${{ steps.bot.outputs.pr }} steps: - id: bot - uses: gr4vy/sdk-release/release-bot@c8db692714898b3bed56d5a7df32f44db9b2055c + uses: gr4vy/sdk-release/release-bot@f65897be6ab124cb925f1f1fbabbbe81d191ce23 with: sdk: java run-id: ${{ github.event.workflow_run.id }} diff --git a/.github/workflows/sdk_publish.yaml b/.github/workflows/sdk_publish.yaml index 559b020f..9a96af85 100644 --- a/.github/workflows/sdk_publish.yaml +++ b/.github/workflows/sdk_publish.yaml @@ -46,7 +46,7 @@ jobs: fi - id: gate - uses: gr4vy/sdk-release/publish-gate@c8db692714898b3bed56d5a7df32f44db9b2055c + uses: gr4vy/sdk-release/publish-gate@f65897be6ab124cb925f1f1fbabbbe81d191ce23 with: head-sha: ${{ github.event.workflow_run.head_sha || github.sha }} bot-login: gr4vy-sdk-release[bot] From 41e5a1491e3c5a22790238728b150eecacdf43b0 Mon Sep 17 00:00:00 2001 From: Cristiano Betta Date: Wed, 4 Nov 2026 17:48:16 +0000 Subject: [PATCH 3/3] ci: pin sdk-release to 4d17bbf (#16, #17: tighter dependency checks) Co-Authored-By: Claude Opus 5.5 --- .github/workflows/sdk_merge.yaml | 2 +- .github/workflows/sdk_publish.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/sdk_merge.yaml b/.github/workflows/sdk_merge.yaml index d309c44b..3764f851 100644 --- a/.github/workflows/sdk_merge.yaml +++ b/.github/workflows/sdk_merge.yaml @@ -22,7 +22,7 @@ jobs: pr: ${{ steps.bot.outputs.pr }} steps: - id: bot - uses: gr4vy/sdk-release/release-bot@f65897be6ab124cb925f1f1fbabbbe81d191ce23 + uses: gr4vy/sdk-release/release-bot@4d17bbfa966f12d70db408bb1d0acc30576e0647 with: sdk: java run-id: ${{ github.event.workflow_run.id }} diff --git a/.github/workflows/sdk_publish.yaml b/.github/workflows/sdk_publish.yaml index 9a96af85..bd371093 100644 --- a/.github/workflows/sdk_publish.yaml +++ b/.github/workflows/sdk_publish.yaml @@ -46,7 +46,7 @@ jobs: fi - id: gate - uses: gr4vy/sdk-release/publish-gate@f65897be6ab124cb925f1f1fbabbbe81d191ce23 + uses: gr4vy/sdk-release/publish-gate@4d17bbfa966f12d70db408bb1d0acc30576e0647 with: head-sha: ${{ github.event.workflow_run.head_sha || github.sha }} bot-login: gr4vy-sdk-release[bot]