graphn-sdk-python/.github/workflows/spec-sync.yml at main · voltagepark/graphn-sdk-python · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
name: spec-sync

on:
  schedule:
    # Daily at 09:00 UTC. Spec changes from voltagepark/takao land
    # within ~24h of merge.
    - cron: "0 9 * * *"
  workflow_dispatch:
    inputs:
      spec_url:
        description: "Override spec URL (defaults to https://cp.graphn.ai/openapi.yaml)"
        required: false
        default: "https://cp.graphn.ai/openapi.yaml"

permissions:
  contents: read

# Auth model: this workflow uses a fine-grained PAT (`secrets.GH_PAT`)
# instead of `GITHUB_TOKEN` so the bot can open pull requests. The
# voltagepark org policy ("Allow GitHub Actions to create and approve
# pull requests" = off) means `GITHUB_TOKEN` cannot create PRs no
# matter what the per-repo toggle says, and we don't want to weaken
# that policy org-wide for this single workflow. The PAT is
# fine-grained, scoped to this repo only, and only needs:
#   - Contents: Read and write   (push the spec-sync/auto branch)
#   - Pull requests: Read and write   (create / update the PR)
# Both `actions/checkout` and `peter-evans/create-pull-request` are
# given the PAT explicitly so the push and the create-PR call land
# under the same identity.

jobs:
  regenerate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          token: ${{ secrets.GH_PAT }}

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Install regen tooling
        run: |
          python -m pip install --upgrade pip
          pip install -e '.[dev]'

      - name: Regenerate _generated/
        env:
          GRAPHN_OPENAPI_SPEC: ${{ inputs.spec_url || 'https://cp.graphn.ai/openapi.yaml' }}
        run: ./scripts/regenerate.sh --spec "${GRAPHN_OPENAPI_SPEC}"

      - name: Run tests against regenerated client
        run: pytest -ra

      - name: Open PR if anything changed
        uses: peter-evans/create-pull-request@v8
        with:
          token: ${{ secrets.GH_PAT }}
          add-paths: src/graphn/_generated
          branch: spec-sync/auto
          delete-branch: true
          title: "chore(spec): sync generated client from upstream openapi.yaml"
          commit-message: "chore(spec): regenerate _generated/ from upstream openapi.yaml"
          body: |
            Automated nightly spec sync.

            - Regenerated `src/graphn/_generated/` from `${{ inputs.spec_url || 'https://cp.graphn.ai/openapi.yaml' }}`.
            - All tests passed against the regenerated client.

            Review the diff for any breaking field renames before merging.
          labels: |
            spec-sync
            automated