ci: fail fork PRs when generated OpenAPI/SDK are stale

[bhaveshpatel640]

Summary

Fail Generate SDK on fork PRs when OpenAPI/SDK output is stale, so public-repo contributors must commit pnpm sdk:generate locally (the App bot cannot push to forks). Also set contents: read since pushes use the App token.

Closes AGE-1753

Changes

• Replace fork “notice + skip” with a hard fail when generated paths differ after regen
• Point contributors at pnpm sdk:generate and print the dirty paths
• Drop contents: write on GITHUB_TOKEN (contents: read)

How was this tested?

• Same-repo PR: bot still regenerates and pushes
• Fork PR with stale SDK: Generate SDK fails with the new error
• Fork PR after pnpm sdk:generate + commit of listed paths: Generate SDK passes

Checklist

• pnpm build, pnpm test, pnpm typecheck, pnpm lint:ci, and pnpm format:check pass locally
• Tests added/updated where it makes sense — N/A (workflow-only)
• No hand-edits to generated code (packages/sdk, .github/fern/openapi/openapi.json, docs/openapi.json)
• Docs / .env.example updated if configuration or behavior changed — N/A

---

Note

Low Risk
Workflow-only CI behavior for fork PRs and token permissions; no runtime application code changes.

Overview
Generate SDK no longer treats fork PRs as “generate succeeded, commit skipped.” When regen is required, fork PRs fail if .github/fern/openapi, docs/openapi.json, packages/sdk, or pnpm-lock.yaml still differ after pnpm sdk:generate, with ::error:: instructions to run pnpm sdk:generate, optionally pnpm changeset:sdk-regen, and push to the fork. A passing fork run emits a notice reminding contributors to commit a changeset when SDK output changed.

Job permissions drop contents: write on the default token and use contents: read, since same-repo pushes go through the GitHub App token on the commit step.

^{Reviewed by Cursor Bugbot for commit 241cff4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a8672c8. Configure here.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: a34b126

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR