chore: promote staging 73ea73e to production

[agentex-sdk-sync]

Automated promote from the staging trunk, opened by stlc-promote.yml.

Approve this pull request - do not click Merge. Squash and rebase both rewrite SHAs, which forks the production trunk away from staging and blocks all codegen until someone reconciles them by hand. Merge commits are disabled on this repo.

Once CI is green here and this has one approval, re-run stlc-promote.yml in the config repo. It fast-forwards main onto these exact commits, GitHub closes this pull request as merged, and the trunks stay byte-identical.

Confidence Score: 3/5

This PR is not safe to merge. Fix the client test mismatch and the Bandit fork checkout first.

Findings

1.  Production URL breaks client test ▶
2.  Fork PRs fail Bandit checkout ▶

Fix with agent prompt

### Issue 1
src/agentex/_client.py:74-75
`ENVIRONMENTS["production"]` now points at the remote host, but `test_base_url_env` still requires `http://localhost:5003`. The normal test suite will fail. Update the generated source and its test together. The repository also requires generated edits to be backed by generator config or an upstream schema change.

### Issue 2
.github/workflows/bandit-ci.yml:30-31
This fetch reads `$GITHUB_HEAD_REF` from the base repository's `origin`. For a fork PR, that branch exists only in the fork, so the job stops before Bandit runs. Check out the pull request head SHA or fetch from `github.event.pull_request.head.repo` instead.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

This promotion adds production-only workflow guards, release automation, and shared security scans while keeping staging workflows inactive where production secrets are required. It also points the SDK at the production API and updates staging artifact install instructions.

• Production-only jobs now check the repository name.
• Release Please uses an App token and runs release commands from a workflow.
• Bandit, OpenGrep, and TruffleHog workflows are added.
• The production SDK endpoint and staging artifact path are updated.

Diagram

sequenceDiagram
    participant Author
    participant GitHub
    participant Bandit
    participant OpenGrep
    participant Main
    participant Release
    participant Client
    participant AgentEx

    Author->>GitHub: Open pull request
    par PR checks
        GitHub->>Bandit: Run on pull_request
        Bandit->>GitHub: Fetch head branch from origin
        GitHub->>OpenGrep: Call reusable workflow with inherited secrets
    end
    GitHub->>Main: Fast-forward approved promotion
    Main->>Release: Trigger release-please job
    Release->>GitHub: Mint App token and update release state
    Client->>Client: Default environment to production
    Client->>AgentEx: Send API request to agentex.sgp.scale.com

Loading

_{Reviews (1) · Last reviewed commit: "fix(stlc): restore the custom-code tree ..."}

[greptile-apps]

ENVIRONMENTS["production"] now points at the remote host, but test_base_url_env still requires http://localhost:5003. The normal test suite will fail. Update the generated source and its test together. The repository also requires generated edits to be backed by generator config or an upstream schema change.

Context Used: Keep manual code separate from generated SDK code (source)

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/agentex/_client.py
Line: 74-75

Comment:
`ENVIRONMENTS["production"]` now points at the remote host, but `test_base_url_env` still requires `http://localhost:5003`. The normal test suite will fail. Update the generated source and its test together. The repository also requires generated edits to be backed by generator config or an upstream schema change.

**Context Used:** Keep manual code separate from generated SDK code ([source](https://github.com/scaleapi/scale-agentex-python/blob/main/.cursor/rules/20_codegen_boundaries.mdc))

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

This fetch reads $GITHUB_HEAD_REF from the base repository's origin. For a fork PR, that branch exists only in the fork, so the job stops before Bandit runs. Check out the pull request head SHA or fetch from github.event.pull_request.head.repo instead.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/bandit-ci.yml
Line: 30-31

Comment:
This fetch reads `$GITHUB_HEAD_REF` from the base repository's `origin`. For a fork PR, that branch exists only in the fork, so the job stops before Bandit runs. Check out the pull request head SHA or fetch from `github.event.pull_request.head.repo` instead.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[agentex-sdk-sync]

Superseded: the staging trunk advanced to bc1a463 while this was open. Closing rather than force-pushing, because an approval here would otherwise carry over to commits nobody reviewed.