Skip to content

ci(repo): run this repository on the one-repo topology #58

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
arbianst merged 1 commit into from
Oct 30, 2026
Merged

ci(repo): run this repository on the one-repo topology #58

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 20 additions & 8 deletions .github/workflows/seal-dispatch.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,20 +5,21 @@ name: Seal custom code (dispatch)
# When genuine out-of-band custom code is merged to this SDK repo's `main`
# (a direct staging commit, or a contribution pulled back from production),
# notify the config repo to reseal so the custom-code tracking JSON absorbs it
# promptly instead of waiting for the config repo's poll. stlc-authored commits
# promptly instead of waiting for the config repo's poll. generator-authored commits
# are skipped by the loop guards below, so the bot's own pushes (the "Build SDK"
# squash commit and any regen commit) cannot trigger a reseal loop.
#
# This workflow is itself custom code on the SDK repo: seal it once with
# `stlc build --commit` to bootstrap, after which scaffold preservation keeps it
# the generator's commit step to bootstrap, after which scaffold preservation keeps it
# across regenerations. If you would rather keep things simple, drop this file
# and rely on the config repo's scheduled `stlc-sync-tracking.yml` poll alone.
# and rely on the config repo's scheduled tracking-sync poll alone.
#
# Lives in the STAGING repo. Requires CONFIG_DISPATCH_TOKEN — a token that can
# Requires the GitHub App secrets (SDK_APP_ID, SDK_APP_PRIVATE_KEY) or, as a
# fallback, CONFIG_DISPATCH_TOKEN — a token that can
# send a repository_dispatch to the config repo.
on:
push:
# main only. stlc preview/integrated/codegen branches never push to main.
# main only. the generator's preview, integrated and codegen branches never push to main.
branches: [main]

concurrency:
Expand All @@ -31,21 +32,32 @@ permissions:
jobs:
dispatch:
runs-on: ubuntu-latest
if: github.repository == 'sentdm/sent-dm-java-staging'
if: github.repository == 'sentdm/sent-dm-java'

@claude claude Bot Oct 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Per this repo's own ownership rules, the next generated commit may conflict with or restore these workflow changes. The commit deletes four sync workflows and edits seal-dispatch.yml without a Stainless-Generated-From trailer. CLAUDE.md treats "the publish, release and sync workflows" as generator-owned. Its only listed custom code is "the buildSrc publishing marker". Fix: make this change in the SDK configuration so it arrives as a generated commit. If the workflows really are custom code, update CLAUDE.md's ownership list in the same PR. [also at: .github/workflows/stlc-sync-from-production.yml:1 - This hand-written commit deletes workflows that the repo rules call generator-owned, so the next generated commit may recreate them or conflict.]

Why this was flagged

The commit is hand-written, with no Stainless-Generated-From trailer. It deletes the sync workflows stlc-promote.yml, stlc-sync-from-production.yml, trigger-back-sync-on-release.yml and trunk-sync-lock.yml. It also changes generator-written lines in seal-dispatch.yml, including the guard at :35, the env block at :37-38 and the comments. CLAUDE.md says to change only files it lists as custom code; it lists "the buildSrc publishing marker" and names "the publish, release and sync workflows" as generator-owned. It also warns that changed generated lines conflict on regeneration and "a conflict blocks every SDK's release". REVIEW.md says to report a change to a generator-owned file outside a generated commit as Important. The PR says the files are sealed custom code, but nothing in the repo records that, so the documented ownership rules and this change contradict each other.

Verification: Trigger: the next generated commit, unless the out-of-repo pipeline change the PR says to merge first stops emitting these files. CLAUDE.md lists "the publish, release and sync workflows" as generator-owned. All four deleted workflows were added in commit 43e3bcd, which carries a generator trailer. The PR commit 8a18f5f has no trailer, and its diff deletes those four files.

@claude claude Bot Oct 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 (optional) If this repo has neither the App secrets nor CONFIG_DISPATCH_TOKEN, every release merge and human PR merge to main now gets a failed workflow run. This holds unless those secrets were added here. Line 35 now runs the job on sentdm/sent-dm-java, and the guard at line 71 exits 1 with "CONFIG_DISPATCH_TOKEN not set". Fix: provision SDK_APP_ID/SDK_APP_PRIVATE_KEY or CONFIG_DISPATCH_TOKEN on this repo before merging. Alternatively, have the job skip with a warning when no credential exists, and name both secret sources in the message.

Why this was flagged

The condition can't be checked from this checkout: CONFIG_DISPATCH_TOKEN was a secret on the staging repo, which the old guard 'sentdm/sent-dm-java-staging' targeted. The PR text lists only STAGING_DISPATCH_TOKEN as present on this repo. It does not say SDK_APP_ID, SDK_APP_PRIVATE_KEY or CONFIG_DISPATCH_TOKEN exist here. When none is set, HAS_APP is false, the mint step is skipped, DISPATCH_TOKEN is empty, and seal-dispatch.yml:71 exits 1. Every push to main whose head commit lacks the Stainless-Generated-From trailer and was not authored by stlc-bot reaches that line, e.g. the release-please merge commits authored by arbianst in git log. Each one gets a red run, where the base branch ran nothing on this repo. The error text names only CONFIG_DISPATCH_TOKEN, so it does not mention the App secrets.

Verification: Line 35 now runs the job on sentdm/sent-dm-java; before this change it was 'sentdm/sent-dm-java-staging', so it was always skipped here. Without the App secrets, line 52 falls back to CONFIG_DISPATCH_TOKEN, and line 73 exits 1 if that is empty. The exit-1 guard is at line 73, not line 71.

env:
CONFIG_REPO: sentdm/sent-dm-sdk-pipeline
HAS_APP: ${{ secrets.SDK_APP_ID != '' && secrets.SDK_APP_PRIVATE_KEY != '' }}
steps:
- name: Mint a pipeline token from the GitHub App
id: app
if: env.HAS_APP == 'true'
uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v3.3.0
with:
app-id: ${{ secrets.SDK_APP_ID }}
private-key: ${{ secrets.SDK_APP_PRIVATE_KEY }}
owner: sentdm
repositories: sent-dm-sdk-pipeline
Comment on lines 37 to +48

@claude claude Bot Oct 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Anyone reading this public repository can see the name of Sent's private pipeline repository. This change adds another mention and switches the workflow to run here. Line 48 adds repositories: sent-dm-sdk-pipeline, line 37 keeps CONFIG_REPO: sentdm/sent-dm-sdk-pipeline, and the comments still describe a "config repo". Fix: remove every private repository name from this public repo. Read the target from a repository variable or secret (for example vars.CONFIG_REPO) and pass it to both the app-token repositories: input and the dispatch URL.

Why this was flagged

The repository is public (CLAUDE.md: "This repository is public. Nothing in it ... links to or names Sent's private repositories, internal systems or providers"). REVIEW.md says to report as Important "A link to, or the name of, a private Sent repository ... anywhere in the diff." The diff adds repositories: sent-dm-sdk-pipeline at seal-dispatch.yml:48 and changes the guard at :35 so the job runs on the public sentdm/sent-dm-java. CONFIG_REPO: sentdm/sent-dm-sdk-pipeline at :37 is still hardcoded. Merging publishes the private pipeline repo's name in a new line, and the workflow now runs against it from the public repo. A repository variable would keep the name out of the tree.

Verification: The diff adds a new line at .github/workflows/seal-dispatch.yml:48, repositories: sent-dm-sdk-pipeline. That is a second mention of the pipeline repository, next to the existing CONFIG_REPO: sentdm/sent-dm-sdk-pipeline at :37 (base :36). The guard at :35 changes from sentdm/sent-dm-java-staging to sentdm/sent-dm-java, so the dispatch now runs from the public repo.


- name: Loop-guard and send reseal dispatch
env:
DISPATCH_TOKEN: ${{ secrets.CONFIG_DISPATCH_TOKEN }}
DISPATCH_TOKEN: ${{ steps.app.outputs.token || secrets.CONFIG_DISPATCH_TOKEN }}
HEAD_MSG: ${{ github.event.head_commit.message }}
Comment on lines +40 to 53

@claude claude Bot Oct 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 (optional) Maintainers whose GitHub App token cannot be minted or used get a failed seal-dispatch run on every non-generator push to main, with no fallback. steps.app.outputs.token || secrets.CONFIG_DISPATCH_TOKEN falls back only when the mint step is skipped. A failing mint step fails the job, and a minted token without dispatch rights is used anyway. Fix: make the fallback cover mint failure, e.g. continue-on-error: true on the app step, and retry the dispatch with CONFIG_DISPATCH_TOKEN on a non-204, or drop the fallback claim from the PR.

Why this was flagged

The trigger is deploy-side and not visible here: SDK_APP_ID and SDK_APP_PRIVATE_KEY are set but the App is not installed on sentdm/sent-dm-sdk-pipeline, or it lacks contents: write there, which repository_dispatch needs. The mint step at seal-dispatch.yml:40-48 has no continue-on-error, so a mint error fails the job before the dispatch step runs. If minting succeeds but the token lacks rights, line 53 still picks it over CONFIG_DISPATCH_TOKEN, and the curl gets a 403/404 and exits 1 at the Dispatch failed (HTTP $code) branch. This repo's main gets non-generator pushes, such as the Merge pull request #56 from sentdm/release-please--branches--main release merges by a human. Each of those runs fails and no reseal reaches the pipeline. On the base branch the job was guarded to 'sentdm/sent-dm-java-staging' and never ran here. The PR text promises a fallback to the old token, but HAS_APP only checks that the secrets are non-empty.

Verification: The app step (seal-dispatch.yml:40-48) has no continue-on-error, so a failed mint fails the job. Line 52 falls back to CONFIG_DISPATCH_TOKEN only when the mint step was skipped, so a token that cannot dispatch is still used and line 85 runs exit 1. On the base branch this job never ran in this repo, because line 35 used to check 'sentdm/sent-dm-java-staging'.

HEAD_AUTHOR_NAME: ${{ github.event.head_commit.author.name }}
SHA: ${{ github.sha }}
REPO: ${{ github.repository }}
run: |
set -euo pipefail

# Loop guard 1: skip the stlc "Build SDK" squash commit (it carries
# Loop guard 1: skip the generator's "Build SDK" squash commit (it carries
# the Stainless-Generated-From trailer in its message).
if printf '%s' "$HEAD_MSG" | grep -q 'Stainless-Generated-From'; then
echo "Head commit is an stlc build — skipping reseal dispatch."
Comment on lines 32 to 63

@claude claude Bot Oct 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 The comments in this workflow still name the generator, which this repo's rules forbid. A stale stlc echo message is also left behind. CLAUDE.md says: "Don't add a comment that marks code as hand-written or names the generator, and remove one from a block you are already editing." The diff changes stlc to "the generator" in comments but keeps the provenance wording. Fix: remove or neutralise every generator-naming comment and message in blocks this diff edits. Same pattern at 5 sites (seal-dispatch.yml:8, :13, :22, :60, :63).

Why this was flagged

The diff edits the comment blocks at seal-dispatch.yml:8 ("generator-authored commits"), :13 ("the generator's commit step"), :22 ("the generator's preview, integrated and codegen branches") and :60 ("skip the generator's "Build SDK" squash commit"). Each rewrite still names the generator. CLAUDE.md's "No provenance comments" rule and REVIEW.md ("A comment that ... names the generator") both flag this as Important. The echo at :63 still prints "Head commit is an stlc build", and the guard at :66-67 still says stlc-bot. These leave internal tool names in a block this diff rewrote. The rename did not remove the provenance; it only changed which word is used.

Verification: Trigger: merging this hand-written commit as it stands. The diff rewrites comment lines in .github/workflows/seal-dispatch.yml at :8, :13, :22 and :60, and each new version still names the generator. In the same run block, the unchanged echo at :63 still prints "Head commit is an stlc build — skipping reseal dispatch.".

Expand Down
70 changes: 0 additions & 70 deletions .github/workflows/stlc-promote.yml
View file
Open in desktop

This file was deleted.

74 changes: 0 additions & 74 deletions .github/workflows/stlc-sync-from-production.yml
View file
Open in desktop

This file was deleted.

38 changes: 0 additions & 38 deletions .github/workflows/trigger-back-sync-on-release.yml
View file
Open in desktop

This file was deleted.

69 changes: 0 additions & 69 deletions .github/workflows/trunk-sync-lock.yml
View file
Open in desktop

This file was deleted.

Loading