Use local Universe spec for CLI generation

[hectorcast-db]

Changes

Update generate-clijson to:

• Build Genkit from //deco/genkit in the local Universe checkout.
• Read the CLI’s pinned Universe SHA from .codegen/_openapi_sha.
• Ask Genkit to build the OpenAPI specification locally at that exact SHA.
• Pass the locally built specification through the existing CLI generation flow.

Why

The CLI generation flow currently downloads its pinned OpenAPI specification from S3. The corresponding Genkit change can now build that specification directly from Universe while preserving the exact SHA as generation provenance.

This removes the CLI’s dependency on published OpenAPI specifications without changing the generated output.

Tests

• Ran task generate-clijson end to end against the corresponding Universe change.
• Confirmed Genkit checked out the CLI’s pinned historical SHA and built //openapi:all-internal.json locally.
• Confirmed no S3 lookup occurred.
• Confirmed generated artifacts were byte-identical and the CLI worktree remained clean.

[eng-dev-ecosystem-bot]

Integration test report

Commit: 4ea8e79

Run: 35114334835

	Env	🔄​flaky	✅​pass	🙈​skip	Time
🔄​	aws linux	1	275	15	13:57
🔄​	aws windows	2	276	13	10:51
✅​	azure linux		275	15	13:07
🔄​	azure windows	1	276	13	10:29
🔄​	gcp linux	1	275	15	11:35
✅​	gcp windows		278	13	7:44

	Test Name	aws linux	aws windows	azure windows	gcp linux
🔄​	TestSyncFullFileSync	✅​p	🔄​f	🔄​f	✅​p
🔄​	TestSyncIncrementalFileSync	✅​p	✅​p	✅​p	🔄​f
🔄​	TestSyncIncrementalSyncFileToPythonNotebook	🔄​f	✅​p	✅​p	✅​p
🔄​	TestSyncIncrementalSyncPythonNotebookToFile	✅​p	🔄​f	✅​p	✅​p

Top 18 slowest tests (at least 2 minutes):

duration	env	testname
4:20	azure linux	TestImportDirWithOverwriteFlag
4:05	aws windows	TestAccept
3:37	azure linux	TestFilerReadDir/workspace_files
3:25	gcp windows	TestFilerWorkspaceFilesExtensionsDelete
3:14	gcp windows	TestAccept
3:11	azure windows	TestAccept
2:52	azure windows	TestExport
2:50	aws windows	TestFilerWorkspaceFilesExtensionsReadDir
2:41	azure windows	TestFilerRecursiveDelete/workspace_files
2:28	aws linux	TestFilerRecursiveDelete/workspace_files
2:25	gcp windows	TestFilerWorkspaceFilesExtensionsStat
2:17	azure linux	TestFilerReadWrite/workspace_files
2:15	gcp linux	TestFilerWorkspaceNotebook/sqlNb.sql
2:15	azure linux	TestWorkspaceFilesExtensions_ExportFormatIsPreserved/source_r
2:14	azure windows	TestFilerWorkspaceFilesExtensionsStat
2:12	azure windows	TestImportDirDoesNotOverwrite
2:10	gcp linux	TestFilerWorkspaceFilesExtensionsRead
2:05	azure linux	TestImportDir

[janniklasrose]

Confirmed no S3 lookup occurred.

nice, no more AWS auth needed?