From b7f966fb83e936ae1b1ee96edc5e798cfd6f7b90 Mon Sep 17 00:00:00 2001 From: Chai Landau Date: Thu, 20 Aug 2026 13:34:19 -0400 Subject: [PATCH 1/3] Dispatch internal version sync after releases Co-authored-by: Goose Ai-assisted: true --- .github/workflows/release.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 73064207..e5e80cbb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -23,6 +23,7 @@ jobs: # `secrets` context can't be used in step-level `if:`, so surface a # presence flag here. Skips the tap bump on forks / unconfigured repos. HAS_TAP_APP: ${{ secrets.BLOCK_HOMEBREW_TAP_APP_ID != '' && secrets.BLOCK_HOMEBREW_TAP_PRIVATE_KEY != '' }} + HAS_GHOST_SYNC_APP: ${{ vars.GHOST_SYNC_VERSION_APP_ID != '' && secrets.GHOST_SYNC_VERSION_PRIVATE_KEY != '' }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: @@ -120,3 +121,28 @@ jobs: -f "tag=$TAG" \ -f "artifact_url=$ARTIFACT_URL" \ -f "sha256=$SHA256" + + # Notify the internal sync workflow after the release tarball exists. The + # app is installed only on squareup/agents; this public repo holds its + # credentials solely to mint a repository-scoped installation token. + # repository_dispatch avoids granting the app Actions permission. + - name: Generate token for internal version sync + id: generate_sync_token + if: ${{ steps.changesets.outputs.published == 'true' && env.HAS_GHOST_SYNC_APP == 'true' }} + uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1 + with: + app-id: ${{ vars.GHOST_SYNC_VERSION_APP_ID }} + private-key: ${{ secrets.GHOST_SYNC_VERSION_PRIVATE_KEY }} + owner: squareup + repositories: agents + + - name: Trigger internal version sync + if: ${{ steps.changesets.outputs.published == 'true' && env.HAS_GHOST_SYNC_APP == 'true' }} + env: + GH_TOKEN: ${{ steps.generate_sync_token.outputs.token }} + TAG: ${{ steps.tarball.outputs.tag }} + run: | + VERSION="${TAG#design-intelligence-ghost@}" + gh api repos/squareup/agents/dispatches \ + -f event_type=bump_ghost \ + -F "client_payload[version]=$VERSION" From 3645773e1cb64639e134e008bac07f202ee826b8 Mon Sep 17 00:00:00 2001 From: Chai Landau Date: Thu, 20 Aug 2026 13:35:23 -0400 Subject: [PATCH 2/3] Remove redundant sync workflow comments Co-authored-by: Goose Ai-assisted: true --- .github/workflows/release.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e5e80cbb..f1067bdb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -122,10 +122,6 @@ jobs: -f "artifact_url=$ARTIFACT_URL" \ -f "sha256=$SHA256" - # Notify the internal sync workflow after the release tarball exists. The - # app is installed only on squareup/agents; this public repo holds its - # credentials solely to mint a repository-scoped installation token. - # repository_dispatch avoids granting the app Actions permission. - name: Generate token for internal version sync id: generate_sync_token if: ${{ steps.changesets.outputs.published == 'true' && env.HAS_GHOST_SYNC_APP == 'true' }} From 67dcb7e02cf7423e1e6e1b58e6df1ea52ccb415b Mon Sep 17 00:00:00 2001 From: Chai Landau Date: Thu, 20 Aug 2026 13:36:18 -0400 Subject: [PATCH 3/3] Configure sync destination with variables Co-authored-by: Goose Ai-assisted: true --- .github/workflows/release.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f1067bdb..641c5a40 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -23,7 +23,7 @@ jobs: # `secrets` context can't be used in step-level `if:`, so surface a # presence flag here. Skips the tap bump on forks / unconfigured repos. HAS_TAP_APP: ${{ secrets.BLOCK_HOMEBREW_TAP_APP_ID != '' && secrets.BLOCK_HOMEBREW_TAP_PRIVATE_KEY != '' }} - HAS_GHOST_SYNC_APP: ${{ vars.GHOST_SYNC_VERSION_APP_ID != '' && secrets.GHOST_SYNC_VERSION_PRIVATE_KEY != '' }} + HAS_GHOST_SYNC_APP: ${{ vars.GHOST_SYNC_VERSION_APP_ID != '' && secrets.GHOST_SYNC_VERSION_PRIVATE_KEY != '' && vars.GHOST_SYNC_VERSION_OWNER != '' && vars.GHOST_SYNC_VERSION_REPOSITORY != '' }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: @@ -129,8 +129,8 @@ jobs: with: app-id: ${{ vars.GHOST_SYNC_VERSION_APP_ID }} private-key: ${{ secrets.GHOST_SYNC_VERSION_PRIVATE_KEY }} - owner: squareup - repositories: agents + owner: ${{ vars.GHOST_SYNC_VERSION_OWNER }} + repositories: ${{ vars.GHOST_SYNC_VERSION_REPOSITORY }} - name: Trigger internal version sync if: ${{ steps.changesets.outputs.published == 'true' && env.HAS_GHOST_SYNC_APP == 'true' }} @@ -139,6 +139,6 @@ jobs: TAG: ${{ steps.tarball.outputs.tag }} run: | VERSION="${TAG#design-intelligence-ghost@}" - gh api repos/squareup/agents/dispatches \ + gh api "repos/${{ vars.GHOST_SYNC_VERSION_OWNER }}/${{ vars.GHOST_SYNC_VERSION_REPOSITORY }}/dispatches" \ -f event_type=bump_ghost \ -F "client_payload[version]=$VERSION"