Repository navigation
ci(repo): run this repository on the one-repo topology - #58
Conversation
The generator will push here directly, so the four workflows that moved commits between a staging repository and this one have nothing left to move: promote, back-sync, the trunk lock and the release trigger go. The seal-dispatch now routes on this repository's name and mints its token from the GitHub App, with the old dispatch token as fallback. CI, release-please and the publish workflow stay. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Beyond the inline findings, I checked two more things. Nothing left in the checkout references the four deleted workflows or STAGING_DISPATCH_TOKEN, so removing them leaves no dangling caller. Reading secrets in the job-level HAS_APP env and testing env.HAS_APP in the step if are both contexts Actions allows there.
Extended reasoning...
I searched the repo for the deleted workflow names and the staging token and found no matches. I also checked that the expression contexts used by the new App-token gating in seal-dispatch.yml are valid where they appear.
Findings marked 🟡 are optional suggestions and need no follow-up push.
| dispatch: | ||
| runs-on: ubuntu-latest | ||
| if: github.repository == 'sentdm/sent-dm-java-staging' | ||
| if: github.repository == 'sentdm/sent-dm-java' |
There was a problem hiding this comment.
🔴 Per this repo's own ownership rules, the next generated commit may conflict with or restore these workflow changes. The commit deletes four sync workflows and edits seal-dispatch.yml without a Stainless-Generated-From trailer. CLAUDE.md treats "the publish, release and sync workflows" as generator-owned. Its only listed custom code is "the buildSrc publishing marker". Fix: make this change in the SDK configuration so it arrives as a generated commit. If the workflows really are custom code, update CLAUDE.md's ownership list in the same PR. [also at: .github/workflows/stlc-sync-from-production.yml:1 - This hand-written commit deletes workflows that the repo rules call generator-owned, so the next generated commit may recreate them or conflict.]
Why this was flagged
The commit is hand-written, with no Stainless-Generated-From trailer. It deletes the sync workflows stlc-promote.yml, stlc-sync-from-production.yml, trigger-back-sync-on-release.yml and trunk-sync-lock.yml. It also changes generator-written lines in seal-dispatch.yml, including the guard at :35, the env block at :37-38 and the comments. CLAUDE.md says to change only files it lists as custom code; it lists "the buildSrc publishing marker" and names "the publish, release and sync workflows" as generator-owned. It also warns that changed generated lines conflict on regeneration and "a conflict blocks every SDK's release". REVIEW.md says to report a change to a generator-owned file outside a generated commit as Important. The PR says the files are sealed custom code, but nothing in the repo records that, so the documented ownership rules and this change contradict each other.
Verification: Trigger: the next generated commit, unless the out-of-repo pipeline change the PR says to merge first stops emitting these files. CLAUDE.md lists "the publish, release and sync workflows" as generator-owned. All four deleted workflows were added in commit 43e3bcd, which carries a generator trailer. The PR commit 8a18f5f has no trailer, and its diff deletes those four files.
| CONFIG_REPO: sentdm/sent-dm-sdk-pipeline | ||
| HAS_APP: ${{ secrets.SDK_APP_ID != '' && secrets.SDK_APP_PRIVATE_KEY != '' }} | ||
| steps: | ||
| - name: Mint a pipeline token from the GitHub App | ||
| id: app | ||
| if: env.HAS_APP == 'true' | ||
| uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v3.3.0 | ||
| with: | ||
| app-id: ${{ secrets.SDK_APP_ID }} | ||
| private-key: ${{ secrets.SDK_APP_PRIVATE_KEY }} | ||
| owner: sentdm | ||
| repositories: sent-dm-sdk-pipeline |
There was a problem hiding this comment.
🔴 Anyone reading this public repository can see the name of Sent's private pipeline repository. This change adds another mention and switches the workflow to run here. Line 48 adds repositories: sent-dm-sdk-pipeline, line 37 keeps CONFIG_REPO: sentdm/sent-dm-sdk-pipeline, and the comments still describe a "config repo". Fix: remove every private repository name from this public repo. Read the target from a repository variable or secret (for example vars.CONFIG_REPO) and pass it to both the app-token repositories: input and the dispatch URL.
Why this was flagged
The repository is public (CLAUDE.md: "This repository is public. Nothing in it ... links to or names Sent's private repositories, internal systems or providers"). REVIEW.md says to report as Important "A link to, or the name of, a private Sent repository ... anywhere in the diff." The diff adds repositories: sent-dm-sdk-pipeline at seal-dispatch.yml:48 and changes the guard at :35 so the job runs on the public sentdm/sent-dm-java. CONFIG_REPO: sentdm/sent-dm-sdk-pipeline at :37 is still hardcoded. Merging publishes the private pipeline repo's name in a new line, and the workflow now runs against it from the public repo. A repository variable would keep the name out of the tree.
Verification: The diff adds a new line at .github/workflows/seal-dispatch.yml:48, repositories: sent-dm-sdk-pipeline. That is a second mention of the pipeline repository, next to the existing CONFIG_REPO: sentdm/sent-dm-sdk-pipeline at :37 (base :36). The guard at :35 changes from sentdm/sent-dm-java-staging to sentdm/sent-dm-java, so the dispatch now runs from the public repo.
| jobs: | ||
| dispatch: | ||
| runs-on: ubuntu-latest | ||
| if: github.repository == 'sentdm/sent-dm-java-staging' | ||
| if: github.repository == 'sentdm/sent-dm-java' | ||
| env: | ||
| CONFIG_REPO: sentdm/sent-dm-sdk-pipeline | ||
| HAS_APP: ${{ secrets.SDK_APP_ID != '' && secrets.SDK_APP_PRIVATE_KEY != '' }} | ||
| steps: | ||
| - name: Mint a pipeline token from the GitHub App | ||
| id: app | ||
| if: env.HAS_APP == 'true' | ||
| uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v3.3.0 | ||
| with: | ||
| app-id: ${{ secrets.SDK_APP_ID }} | ||
| private-key: ${{ secrets.SDK_APP_PRIVATE_KEY }} | ||
| owner: sentdm | ||
| repositories: sent-dm-sdk-pipeline | ||
|
|
||
| - name: Loop-guard and send reseal dispatch | ||
| env: | ||
| DISPATCH_TOKEN: ${{ secrets.CONFIG_DISPATCH_TOKEN }} | ||
| DISPATCH_TOKEN: ${{ steps.app.outputs.token || secrets.CONFIG_DISPATCH_TOKEN }} | ||
| HEAD_MSG: ${{ github.event.head_commit.message }} | ||
| HEAD_AUTHOR_NAME: ${{ github.event.head_commit.author.name }} | ||
| SHA: ${{ github.sha }} | ||
| REPO: ${{ github.repository }} | ||
| run: | | ||
| set -euo pipefail | ||
|
|
||
| # Loop guard 1: skip the stlc "Build SDK" squash commit (it carries | ||
| # Loop guard 1: skip the generator's "Build SDK" squash commit (it carries | ||
| # the Stainless-Generated-From trailer in its message). | ||
| if printf '%s' "$HEAD_MSG" | grep -q 'Stainless-Generated-From'; then | ||
| echo "Head commit is an stlc build — skipping reseal dispatch." |
There was a problem hiding this comment.
🔴 The comments in this workflow still name the generator, which this repo's rules forbid. A stale stlc echo message is also left behind. CLAUDE.md says: "Don't add a comment that marks code as hand-written or names the generator, and remove one from a block you are already editing." The diff changes stlc to "the generator" in comments but keeps the provenance wording. Fix: remove or neutralise every generator-naming comment and message in blocks this diff edits. Same pattern at 5 sites (seal-dispatch.yml:8, :13, :22, :60, :63).
Why this was flagged
The diff edits the comment blocks at seal-dispatch.yml:8 ("generator-authored commits"), :13 ("the generator's commit step"), :22 ("the generator's preview, integrated and codegen branches") and :60 ("skip the generator's "Build SDK" squash commit"). Each rewrite still names the generator. CLAUDE.md's "No provenance comments" rule and REVIEW.md ("A comment that ... names the generator") both flag this as Important. The echo at :63 still prints "Head commit is an stlc build", and the guard at :66-67 still says stlc-bot. These leave internal tool names in a block this diff rewrote. The rename did not remove the provenance; it only changed which word is used.
Verification: Trigger: merging this hand-written commit as it stands. The diff rewrites comment lines in .github/workflows/seal-dispatch.yml at :8, :13, :22 and :60, and each new version still names the generator. In the same run block, the unchanged echo at :63 still prints "Head commit is an stlc build — skipping reseal dispatch.".
| - name: Mint a pipeline token from the GitHub App | ||
| id: app | ||
| if: env.HAS_APP == 'true' | ||
| uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v3.3.0 | ||
| with: | ||
| app-id: ${{ secrets.SDK_APP_ID }} | ||
| private-key: ${{ secrets.SDK_APP_PRIVATE_KEY }} | ||
| owner: sentdm | ||
| repositories: sent-dm-sdk-pipeline | ||
|
|
||
| - name: Loop-guard and send reseal dispatch | ||
| env: | ||
| DISPATCH_TOKEN: ${{ secrets.CONFIG_DISPATCH_TOKEN }} | ||
| DISPATCH_TOKEN: ${{ steps.app.outputs.token || secrets.CONFIG_DISPATCH_TOKEN }} | ||
| HEAD_MSG: ${{ github.event.head_commit.message }} |
There was a problem hiding this comment.
🟡 (optional) Maintainers whose GitHub App token cannot be minted or used get a failed seal-dispatch run on every non-generator push to main, with no fallback. steps.app.outputs.token || secrets.CONFIG_DISPATCH_TOKEN falls back only when the mint step is skipped. A failing mint step fails the job, and a minted token without dispatch rights is used anyway. Fix: make the fallback cover mint failure, e.g. continue-on-error: true on the app step, and retry the dispatch with CONFIG_DISPATCH_TOKEN on a non-204, or drop the fallback claim from the PR.
Why this was flagged
The trigger is deploy-side and not visible here: SDK_APP_ID and SDK_APP_PRIVATE_KEY are set but the App is not installed on sentdm/sent-dm-sdk-pipeline, or it lacks contents: write there, which repository_dispatch needs. The mint step at seal-dispatch.yml:40-48 has no continue-on-error, so a mint error fails the job before the dispatch step runs. If minting succeeds but the token lacks rights, line 53 still picks it over CONFIG_DISPATCH_TOKEN, and the curl gets a 403/404 and exits 1 at the Dispatch failed (HTTP $code) branch. This repo's main gets non-generator pushes, such as the Merge pull request #56 from sentdm/release-please--branches--main release merges by a human. Each of those runs fails and no reseal reaches the pipeline. On the base branch the job was guarded to 'sentdm/sent-dm-java-staging' and never ran here. The PR text promises a fallback to the old token, but HAS_APP only checks that the secrets are non-empty.
Verification: The app step (seal-dispatch.yml:40-48) has no continue-on-error, so a failed mint fails the job. Line 52 falls back to CONFIG_DISPATCH_TOKEN only when the mint step was skipped, so a token that cannot dispatch is still used and line 85 runs exit 1. On the base branch this job never ran in this repo, because line 35 used to check 'sentdm/sent-dm-java-staging'.
| dispatch: | ||
| runs-on: ubuntu-latest | ||
| if: github.repository == 'sentdm/sent-dm-java-staging' | ||
| if: github.repository == 'sentdm/sent-dm-java' |
There was a problem hiding this comment.
🟡 (optional) If this repo has neither the App secrets nor CONFIG_DISPATCH_TOKEN, every release merge and human PR merge to main now gets a failed workflow run. This holds unless those secrets were added here. Line 35 now runs the job on sentdm/sent-dm-java, and the guard at line 71 exits 1 with "CONFIG_DISPATCH_TOKEN not set". Fix: provision SDK_APP_ID/SDK_APP_PRIVATE_KEY or CONFIG_DISPATCH_TOKEN on this repo before merging. Alternatively, have the job skip with a warning when no credential exists, and name both secret sources in the message.
Why this was flagged
The condition can't be checked from this checkout: CONFIG_DISPATCH_TOKEN was a secret on the staging repo, which the old guard 'sentdm/sent-dm-java-staging' targeted. The PR text lists only STAGING_DISPATCH_TOKEN as present on this repo. It does not say SDK_APP_ID, SDK_APP_PRIVATE_KEY or CONFIG_DISPATCH_TOKEN exist here. When none is set, HAS_APP is false, the mint step is skipped, DISPATCH_TOKEN is empty, and seal-dispatch.yml:71 exits 1. Every push to main whose head commit lacks the Stainless-Generated-From trailer and was not authored by stlc-bot reaches that line, e.g. the release-please merge commits authored by arbianst in git log. Each one gets a red run, where the base branch ran nothing on this repo. The error text names only CONFIG_DISPATCH_TOKEN, so it does not mention the App secrets.
Verification: Line 35 now runs the job on sentdm/sent-dm-java; before this change it was 'sentdm/sent-dm-java-staging', so it was always skipped here. Without the App secrets, line 52 falls back to CONFIG_DISPATCH_TOKEN, and line 73 exits 1 if that is empty. The exit-1 guard is at line 73, not line 71.
This SDK moves to the one-repo topology: the generator pushes into this repository directly, so the four workflows that moved commits between a staging repository and this one are removed (
stlc-promote.yml,stlc-sync-from-production.yml,trigger-back-sync-on-release.yml,trunk-sync-lock.yml).seal-dispatch.ymlroutes on this repository's name and mints its token from the GitHub App, falling back to the old dispatch token. CI, release-please and the publish workflow stay. These four files are sealed custom code, not generator output, as the Go and PHP switches confirmed.Merge after the SDK pipeline PR that switches this language.
STAGING_DISPATCH_TOKENon this repository becomes unused once this merges.🤖 Generated with Claude Code