Add publish-v1-specs workflow - #195
Open
zacchua-stripe wants to merge 4 commits into
Open
Conversation
Adds a workflow_dispatch workflow that publishes v1 private-preview specs for a given API version and cuts a release, mirroring the private-preview (beta) path of pay-server's api-codegen/tools/publish.sh. It pulls the specs from the Statics Commander CDN (instead of a local build dir), commits them to master, generates per-language diffs against the private-preview spec, and tags the release. Triggered by the zoolander LockAndReleasePrivatePreviewSpecs workflow. A dry_run input (default true) fetches, builds, and diffs without pushing, uploading the would-be output as an artifact for inspection. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Committed-By-Agent: claude
- Diff the GA spec (openapi/spec3.sdk.yaml), old-tag vs. working tree, exactly as publish.sh's beta path does, instead of the private-preview spec. - In dry-run, force-push local commits to a disposable dry-run/private-preview branch for inspection instead of uploading an artifact; never create or push a tag (a stray vN would corrupt the next real run's describe increment). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Committed-By-Agent: claude
zacchua-stripe
commented
Aug 21, 2026
zacchua-stripe
commented
Aug 21, 2026
Adds a `mode` choice input (private-preview / public-preview / GA / all). Only private-preview is implemented; the other channels fail fast at a new "Resolve mode configuration" step until the zoolander dispatcher and CDN keys for them are wired up. Mode-specific values (CDN subpath, spec/fixture filenames, commit and tag messages, dry-run branch) are resolved into env vars so the download and release steps stay mode-agnostic. Dry-run branch is now dry-run/<mode>. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Committed-By-Agent: claude
zacchua-stripe
marked this pull request as ready for review
August 21, 2026 18:28
zacchua-stripe
changed the title
xavdid
requested changes
Aug 27, 2026
xavdid
left a comment
xavdid
left a comment
Member
There was a problem hiding this comment.
had a couple of nits, but the big blocker is to use the more secure Github actions (and figuring out why that didn't get flagged here in the first place)
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Fetch app installation token | ||
| uses: tibdex/github-app-token@v1.5.2 |
Member
There was a problem hiding this comment.
This (and all other actions) should be using the new action and pinned hashes from #194
I'm actually surprised there wasn't a new CI job that failed on this branch because you're not pinning a version. so maybe double check why it didn't yell at you 😅
| options: | ||
| - private-preview | ||
| - public-preview | ||
| - GA |
Member
There was a problem hiding this comment.
this is uppercase but the rest are lowercase
| - public-preview | ||
| - GA | ||
| - all | ||
| dry_run: |
Member
There was a problem hiding this comment.
this is fine, but should we invert it? Like, push_changes or something? dry_run: false is sort of a double negative, so it's a pet peeve of mine (especially if true is the default)
| export PATH="${PWD}/node_modules/.bin:${PATH}" | ||
|
|
||
| # `rest.md` is the language-agnostic diff (no --lang), matching publish.sh. | ||
| node ./dist/main.js diff --old-path "$OLD_SPEC" --new-path "$NEW_SPEC" --output-path "$DIFF_DIR/rest.md" |
Member
There was a problem hiding this comment.
nit: I would use just --no-deps diff ... instead of reaching into main.js directly
| uses: actions/checkout@v4 | ||
| with: | ||
| repository: stripe/sdk-codegen | ||
| ref: v17.0.0 |
Member
There was a problem hiding this comment.
does this need to pin a specific codegen version?
Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
Contributor
Author
|
Thanks for the comments @xavdid! Do you mind taking a second pass? Thank you! 🙏 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Follow up to https://docs.google.com/document/d/1RH_6VhWlPGnBX17bwu1WWXCaBjDO3CtKqg7nfRdLS8o/edit?tab=t.0. This PR adds
.github/workflows/publish-v1-specs.yaml, a private-preview-only workflow that sits downstream ofLockAndReleasePrivatePreviewSpecs, pulls the v1 specs from the CDN, and publishes them tostripe/openapifor a given API version.It is functionally equivalent to the private-preview (
beta) path of pay-server'sapi-codegen/tools/publish.sh. The difference is that specs are pulled from the CDN instead of a local build directory.How it works
openapiwith full history and tags.stripe/sdk-codegen@v17.0.0commit and installsjustand Node 24 to provide thediffCLI.openapi/.rest.mdand seven per-language diffs, commitsupcoming-changes/, tagsvN, and pushes atomically.publish_release
The
publish_releaseinput defaults tofalse. By default, the workflow fetches, builds, and diffs without touchingmasteror tags, then force-pushes the local commits to the disposabledry-run/private-previewbranch for inspection. Tags are never created or pushed in this mode.Setting
publish_releasetotruepublishes the commits tomasterand creates the release tag. The follow-up Mint wiring must set this input explicitly for production releases.Context
Triggered by the Zoolander
LockAndReleasePrivatePreviewSpecsworkflow, which currently dispatchesstripe/openapiunder aPLACEHOLDER_WORKFLOW_NAME. Replacing that placeholder with this workflow's filename and passingpublish_release: trueis a separate, follow-up Mint PR.Note: a full end-to-end test requires a dry-run Zoolander run to first publish a version to the CDN.