hanzoai/openapi
2
0
Fork 0
Code Issues Pull Requests Actions Releases Activity

ci(regen): dispatch via repo-level SDK_DISPATCH_TOKEN (org GH_PAT not injected on self-hosted runner)

Browse Source
This commit is contained in:
zeekay
2026-07-18 12:16:10 -07:00
parent 9dd99f5ebf
commit 68ae2a7534
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/regenerate-sdks.yml
+7 -4
View File
@@ -66,12 +66,15 @@ jobs:
steps:
- name: Fire spec-update to hanzoai/${{ matrix.repo }}
# Each SDK repo's generate.yml regenerates from this hanzo.yaml with
# openapi-generator and opens a PR. No Stainless, no API key. GH_PAT is
# the org's canonical cross-repo automation PAT (repo scope on the SDK
# repos); the default GITHUB_TOKEN cannot dispatch to a sibling repo.
# openapi-generator and opens a PR. No Stainless, no API key.
# SDK_DISPATCH_TOKEN is a repo-level secret on hanzoai/openapi holding a
# PAT with `repo` scope on the three SDK repos (the org-level GH_PAT does
# not propagate to this self-hosted runner). The default GITHUB_TOKEN
# cannot dispatch to a sibling repo. Rotate to a KMS-synced long-lived
# PAT; repo-level so it is unambiguously injected here.
uses: peter-evans/repository-dispatch@v3
with:
token: ${{ secrets.GH_PAT }}
token: ${{ secrets.SDK_DISPATCH_TOKEN }}
repository: hanzoai/${{ matrix.repo }}
event-type: spec-update