From 5ba17f4a38a83320d3b89749fa21bc89465ec9d3 Mon Sep 17 00:00:00 2001 From: Cristiano Betta Date: Wed, 4 Nov 2026 16:41:32 +0000 Subject: [PATCH 1/3] ci: CI check for hand-started publish, Slack out of the release-key job From the CLI's security review: a hand-started Publish SDK now needs a green CI run on main for that commit, and Merge SDK's Slack step (a container action) runs in its own job instead of the one holding the release App key. Pins sdk-release to c8db692. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/sdk_merge.yaml | 15 ++++++++++++--- .github/workflows/sdk_publish.yaml | 15 ++++++++++++++- 2 files changed, 26 insertions(+), 4 deletions(-) diff --git a/.github/workflows/sdk_merge.yaml b/.github/workflows/sdk_merge.yaml index dc47b294..b8cecfe8 100644 --- a/.github/workflows/sdk_merge.yaml +++ b/.github/workflows/sdk_merge.yaml @@ -17,17 +17,26 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 environment: sdk-release + outputs: + notify: ${{ steps.bot.outputs.notify }} + pr: ${{ steps.bot.outputs.pr }} steps: - id: bot - uses: gr4vy/sdk-release/release-bot@f956131fcbeaa05d2afcd763f7f8e8122ed823e2 + uses: gr4vy/sdk-release/release-bot@c8db692714898b3bed56d5a7df32f44db9b2055c with: sdk: python run-id: ${{ github.event.workflow_run.id }} client-id: ${{ secrets.SDK_RELEASE_APP_CLIENT_ID }} private-key: ${{ secrets.SDK_RELEASE_APP_PRIVATE_KEY }} + # Kept out of `decide`, which holds the release App key: the Slack action + # runs a container image. + notify: + needs: decide + if: needs.decide.outputs.notify == 'true' + runs-on: ubuntu-latest + steps: - name: Slack Notification - if: steps.bot.outputs.notify == 'true' uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2 env: SLACK_USERNAME: Python SDK @@ -37,5 +46,5 @@ jobs: SLACK_MSG_AUTHOR: gr4vy SLACK_ICON_EMOJI: ":gr4vy-sdk:" SLACK_COLOR: "warning" - SLACK_MESSAGE: "Speakeasy PR needs a human: ${{ github.server_url }}/${{ github.repository }}/pull/${{ steps.bot.outputs.pr }}" + SLACK_MESSAGE: "Speakeasy PR needs a human: ${{ github.server_url }}/${{ github.repository }}/pull/${{ needs.decide.outputs.pr }}" SLACK_FOOTER: "" diff --git a/.github/workflows/sdk_publish.yaml b/.github/workflows/sdk_publish.yaml index 4bac4474..0c24baf0 100644 --- a/.github/workflows/sdk_publish.yaml +++ b/.github/workflows/sdk_publish.yaml @@ -25,6 +25,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 permissions: + actions: read contents: read pull-requests: read outputs: @@ -32,8 +33,20 @@ jobs: mode: ${{ github.event_name == 'workflow_dispatch' && 'manual' || steps.gate.outputs.mode }} version: ${{ steps.gate.outputs.version }} steps: + - name: Require a green CI run on this commit + if: github.event_name == 'workflow_dispatch' + env: + GH_TOKEN: ${{ github.token }} + SHA: ${{ github.sha }} + run: | + passed=$(gh api "repos/$GITHUB_REPOSITORY/actions/workflows/ci.yaml/runs?head_sha=$SHA&branch=main&event=push&status=success" --jq '.total_count') + if [ "$passed" = "0" ]; then + echo "::error::CI hasn't passed on main for $SHA, so it can't be released" + exit 1 + fi + - id: gate - uses: gr4vy/sdk-release/publish-gate@f956131fcbeaa05d2afcd763f7f8e8122ed823e2 + uses: gr4vy/sdk-release/publish-gate@c8db692714898b3bed56d5a7df32f44db9b2055c with: head-sha: ${{ github.event.workflow_run.head_sha || github.sha }} bot-login: gr4vy-sdk-release[bot] From e8a4272a69ec6cf9b974daab77a1e4fb871e1c65 Mon Sep 17 00:00:00 2001 From: Cristiano Betta Date: Wed, 4 Nov 2026 16:59:13 +0000 Subject: [PATCH 2/3] ci: pin sdk-release to f65897b (#15: dependency downgrades go to a person) Co-Authored-By: Claude Opus 5.5 --- .github/workflows/sdk_merge.yaml | 2 +- .github/workflows/sdk_publish.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/sdk_merge.yaml b/.github/workflows/sdk_merge.yaml index b8cecfe8..f5b19304 100644 --- a/.github/workflows/sdk_merge.yaml +++ b/.github/workflows/sdk_merge.yaml @@ -22,7 +22,7 @@ jobs: pr: ${{ steps.bot.outputs.pr }} steps: - id: bot - uses: gr4vy/sdk-release/release-bot@c8db692714898b3bed56d5a7df32f44db9b2055c + uses: gr4vy/sdk-release/release-bot@f65897be6ab124cb925f1f1fbabbbe81d191ce23 with: sdk: python run-id: ${{ github.event.workflow_run.id }} diff --git a/.github/workflows/sdk_publish.yaml b/.github/workflows/sdk_publish.yaml index 0c24baf0..43857a09 100644 --- a/.github/workflows/sdk_publish.yaml +++ b/.github/workflows/sdk_publish.yaml @@ -46,7 +46,7 @@ jobs: fi - id: gate - uses: gr4vy/sdk-release/publish-gate@c8db692714898b3bed56d5a7df32f44db9b2055c + uses: gr4vy/sdk-release/publish-gate@f65897be6ab124cb925f1f1fbabbbe81d191ce23 with: head-sha: ${{ github.event.workflow_run.head_sha || github.sha }} bot-login: gr4vy-sdk-release[bot] From f01f71d8ab6e59981c1427b516f0d02c5de5a393 Mon Sep 17 00:00:00 2001 From: Cristiano Betta Date: Wed, 4 Nov 2026 17:48:07 +0000 Subject: [PATCH 3/3] ci: pin sdk-release to 4d17bbf (#16, #17: tighter dependency checks) Co-Authored-By: Claude Opus 5.5 --- .github/workflows/sdk_merge.yaml | 2 +- .github/workflows/sdk_publish.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/sdk_merge.yaml b/.github/workflows/sdk_merge.yaml index f5b19304..07acab82 100644 --- a/.github/workflows/sdk_merge.yaml +++ b/.github/workflows/sdk_merge.yaml @@ -22,7 +22,7 @@ jobs: pr: ${{ steps.bot.outputs.pr }} steps: - id: bot - uses: gr4vy/sdk-release/release-bot@f65897be6ab124cb925f1f1fbabbbe81d191ce23 + uses: gr4vy/sdk-release/release-bot@4d17bbfa966f12d70db408bb1d0acc30576e0647 with: sdk: python run-id: ${{ github.event.workflow_run.id }} diff --git a/.github/workflows/sdk_publish.yaml b/.github/workflows/sdk_publish.yaml index 43857a09..858c496e 100644 --- a/.github/workflows/sdk_publish.yaml +++ b/.github/workflows/sdk_publish.yaml @@ -46,7 +46,7 @@ jobs: fi - id: gate - uses: gr4vy/sdk-release/publish-gate@f65897be6ab124cb925f1f1fbabbbe81d191ce23 + uses: gr4vy/sdk-release/publish-gate@4d17bbfa966f12d70db408bb1d0acc30576e0647 with: head-sha: ${{ github.event.workflow_run.head_sha || github.sha }} bot-login: gr4vy-sdk-release[bot]