Release SDK updates

.github/workflows/stlc-promote.yml

@@ -0,0 +1,83 @@
+name: Promote SDKs
+
+# Production requires pull requests, so staging is promoted through a merge-
+# commit PR. Never squash or rebase this cross-repo PR: preserving the incoming
+# commits keeps production and staging on one ancestry chain.
+on:
+ push:
+ branches: [main]
+ workflow_dispatch: {}
+
+permissions:
+ contents: read
+
+jobs:
+ promote:
+ if: github.repository == 'kernel/kernel-python-sdk-staging'
+ runs-on: ${{ vars.STLC_RUNNER || 'ubuntu-latest' }}
+ concurrency:
+ group: stlc-promote
+ cancel-in-progress: true
+ steps:
+ - name: Check out staging
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ fetch-depth: 0
+ persist-credentials: false
+
+ - name: Mint production token
+ id: production-token
+ uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
+ with:
+ app-id: ${{ secrets.ADMIN_APP_ID }}
+ private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
+ owner: kernel
+ repositories: kernel-python-sdk
+ permission-contents: write
+ permission-workflows: write
+ permission-pull-requests: write
+
+ - name: Fetch production main
+ env:
+ GH_TOKEN: ${{ steps.production-token.outputs.token }}
+ PRODUCTION_REPO: kernel/kernel-python-sdk
+ run: |
+ git remote add production "https://x-access-token:${GH_TOKEN}@github.com/${PRODUCTION_REPO}.git"
+ git fetch production main
+
+ - name: Check whether production already has staging's content
+ id: diff
+ run: |
+ MERGED=$(git merge-tree --write-tree production/main origin/main) || MERGED=conflict
+ PRODUCTION_TREE=$(git rev-parse 'production/main^{tree}')
+ if [ "$MERGED" = "$PRODUCTION_TREE" ]; then
+ echo "Production already contains staging's content. Nothing to promote."
+ echo "synced=true" >> "$GITHUB_OUTPUT"
+ else
+ echo "synced=false" >> "$GITHUB_OUTPUT"
+ fi
+
+ - name: Push the production release branch
+ if: steps.diff.outputs.synced == 'false'
+ env:
+ GH_TOKEN: ${{ steps.production-token.outputs.token }}
+ PRODUCTION_REPO: kernel/kernel-python-sdk
+ run: git push production origin/main:refs/heads/stainless/release --force
+
+ - name: Open or update the promote PR
+ if: steps.diff.outputs.synced == 'false'
+ env:
+ GH_TOKEN: ${{ steps.production-token.outputs.token }}
+ PRODUCTION_REPO: kernel/kernel-python-sdk
+ run: |
+ body=$(mktemp)
+ git log --oneline production/main..origin/main > "$body"
+ existing=$(gh pr list --repo "$PRODUCTION_REPO" --head stainless/release --state open --json number --jq 'if length == 0 then "" else .[0].number end')
+ if [ -z "$existing" ]; then
+ gh pr create --repo "$PRODUCTION_REPO" --base main --head stainless/release --title "Release SDK updates" --body-file "$body"
+ else
+ gh pr edit "$existing" --repo "$PRODUCTION_REPO" --title "Release SDK updates" --body-file "$body"
+ fi
+ if ! gh pr merge stainless/release --repo "$PRODUCTION_REPO" --merge --auto; then
+ echo "::warning title=Manual promotion required::Merge the promote PR with a merge commit."
+ fi

.github/workflows/stlc-sync.yml

@@ -0,0 +1,107 @@
+name: Sync SDK repos
+
+# Keeps production and staging on one fast-forward-only history. Optional
+# dispatch tokens make the polling loop eager; the scheduled back-sync is the
+# safety backstop when those secrets are absent.
+on:
+ schedule:
+ - cron: '7,37 * * * *'
+ workflow_dispatch: {}
+ repository_dispatch:
+ types: [prod-released]
+ release:
+ types: [published]
+ push:
+ branches: [main]
+
+jobs:
+ back-sync:
+ if: >-
+ github.repository == 'kernel/kernel-python-sdk-staging' &&
+ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch')
+ runs-on: ${{ vars.STLC_RUNNER || 'ubuntu-latest' }}
+ permissions:
+ contents: write
+ concurrency:
+ group: stlc-back-sync
+ cancel-in-progress: true
+ steps:
+ - name: Check out staging
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ fetch-depth: 0
+
+ - name: Fetch production main
+ run: |
+ git remote add production "https://github.com/kernel/kernel-python-sdk.git"
+ git -c "http.https://github.com/.extraheader=" fetch production main
+
+ - name: Check whether production has content staging lacks
+ id: diff
+ run: |
+ MERGED=$(git merge-tree --write-tree origin/main production/main) || MERGED=conflict
+ STAGING_TREE=$(git rev-parse 'origin/main^{tree}')
+ if [ "$MERGED" = "$STAGING_TREE" ]; then
+ echo "Staging already has production's content. Nothing to pull back."
+ echo "behind=false" >> "$GITHUB_OUTPUT"
+ else
+ echo "behind=true" >> "$GITHUB_OUTPUT"
+ fi
+
+ - name: Sync production to staging
+ if: steps.diff.outputs.behind == 'true'
+ run: |
+ if ! git merge-base --is-ancestor origin/main production/main; then
+ echo "::error title=Back-sync blocked::staging main is not an ancestor of production/main."
+ exit 1
+ fi
+ git push origin production/main:refs/heads/main
+
+ notify-back-sync:
+ if: >-
+ github.repository == 'kernel/kernel-python-sdk' &&
+ (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
+ runs-on: ${{ vars.STLC_RUNNER || 'ubuntu-latest' }}
+ permissions:
+ contents: read
+ steps:
+ - name: Dispatch back-sync to staging
+ env:
+ DISPATCH_TOKEN: ${{ secrets.STAGING_DISPATCH_TOKEN }}
+ REF_NAME: ${{ github.ref_name }}
+ run: |
+ set -euo pipefail
+ if [ -z "${DISPATCH_TOKEN:-}" ]; then
+ echo "::notice::STAGING_DISPATCH_TOKEN not configured; the scheduled back-sync remains active."
+ exit 0
+ fi
+ payload=$(jq -n --arg ref "$REF_NAME" '{event_type:"prod-released",client_payload:{ref:$ref}}')
+ curl --fail-with-body -sS -X POST -H "Authorization: Bearer $DISPATCH_TOKEN" -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" "https://api.github.com/repos/kernel/kernel-python-sdk-staging/dispatches" -d "$payload"
+
+ seal-dispatch:
+ if: github.repository == 'kernel/kernel-python-sdk-staging' && github.event_name == 'push'
+ runs-on: ${{ vars.STLC_RUNNER || 'ubuntu-latest' }}
+ permissions:
+ contents: read
+ concurrency:
+ group: seal-dispatch-${{ github.ref }}
+ cancel-in-progress: false
+ steps:
+ - name: Dispatch tracking sync
+ env:
+ DISPATCH_TOKEN: ${{ secrets.CONFIG_DISPATCH_TOKEN }}
+ HEAD_MSG: ${{ github.event.head_commit.message }}
+ HEAD_AUTHOR_NAME: ${{ github.event.head_commit.author.name }}
+ SHA: ${{ github.sha }}
+ run: |
+ set -euo pipefail
+ if printf '%s' "$HEAD_MSG" | grep -q 'Stainless-Generated-From' || [ "$HEAD_AUTHOR_NAME" = "stlc-bot" ]; then
+ echo "Generated commit; skipping tracking dispatch."
+ exit 0
+ fi
+ if [ -z "${DISPATCH_TOKEN:-}" ]; then
+ echo "::notice::CONFIG_DISPATCH_TOKEN not configured; the config repo's scheduled sync remains active."
+ exit 0
+ fi
+ payload=$(jq -n --arg sha "$SHA" --arg repo "${{ github.repository }}" '{event_type:"seal-custom-code",client_payload:{target:"all",sha:$sha,repo:$repo}}')
+ curl --fail-with-body -sS -X POST -H "Authorization: Bearer $DISPATCH_TOKEN" -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" "https://api.github.com/repos/kernel/kernel/dispatches" -d "$payload"