Skip to content

ci: fail fork PRs when generated OpenAPI/SDK are stale #268

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
bhaveshpatel640 wants to merge 5 commits into from
Closed

ci: fail fork PRs when generated OpenAPI/SDK are stale #268

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a8672c8
ci: fail fork PRs when generated OpenAPI/SDK are stale
bhaveshpatel640 Aug 14, 2026
7412a20
Merge branch 'main' into AGE-1753
bhaveshpatel640 Aug 14, 2026
241cff4
simplify
bhaveshpatel640 Aug 14, 2026
6b5da13
Merge branch 'main' into AGE-1753
bhaveshpatel640 Aug 16, 2026
a34b126
Merge branch 'main' into AGE-1753
bhaveshpatel640 Aug 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 21 additions & 4 deletions .github/workflows/generate-sdk.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ jobs:
github.actor != 'github-actions[bot]' &&
github.actor != 'trueforge-dev-bot[bot]'
permissions:
contents: write
contents: read
Comment thread
bhaveshpatel640 marked this conversation as resolved.

steps:
- name: Create GitHub App token
Expand Down Expand Up @@ -109,7 +109,7 @@ jobs:
if: steps.decide.outputs.needed == 'true'
run: pnpm sdk:generate

# Forks get a read-only token, so only the commit is skipped. TODO: an approval flow that can push to the fork.
# Same-repo only: App token can push. Forks have no secrets / cannot write the fork head.
- name: Commit generated output
if: steps.decide.outputs.needed == 'true' && steps.app-token.outcome == 'success'
# Passed as env, never interpolated into the script, so it cannot inject shell.
Expand Down Expand Up @@ -141,7 +141,24 @@ jobs:
git commit -m "Regenerate OpenAPI document and TypeScript SDK"
git push origin "HEAD:refs/heads/$BRANCH"

- name: Report skipped commit on fork
# Forks cannot receive the App push (no secrets; App is not installed on the fork).
# Hard-fail if generated output is stale; ask for the changeset in the same message
# (no merge-base/changeset heuristics — those false-positive on unsynced forks).
- name: Fail if generated output is missing on fork
if: steps.decide.outputs.needed == 'true' && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
run: |
echo "::notice::Generation succeeded. The commit was skipped because pull requests from forks cannot push; a maintainer will regenerate after merge."
set -euo pipefail

# After CI ran sdk:generate, the tree must match what a same-repo commit would
# have pushed. Dirty → fork head is stale (we cannot push to the fork).
dirty="$(git status --porcelain -- .github/fern/openapi docs/openapi.json packages/sdk pnpm-lock.yaml)"
if [ -n "$dirty" ]; then
echo "::error::OpenAPI/SDK out of date on this fork PR. Run and commit:"
echo " pnpm sdk:generate"
echo " pnpm changeset:sdk-regen # if packages/sdk changed (not only .fern)"
echo "Then push to your fork."
echo "$dirty"
exit 1
fi

echo "::notice::Fork PR generated output matches. If this PR changed packages/sdk (not only .fern), ensure you also committed: pnpm changeset:sdk-regen"
Loading