From 3edece8f77935179276ef8e7c9a7436d4815f461 Mon Sep 17 00:00:00 2001 From: mcollinscodat Date: Tue, 4 Aug 2026 10:56:51 +0100 Subject: [PATCH 1/4] feat/CONN-1273-release-stubs: Replace Speakeasy generate/release workflows with thin stubs pointing at the central pipeline - bank_feeds_generate.yaml - generation moved to Codat SDK Codegen; stub warns and exits 0 - bank_feeds_release.yaml - forwards the release trigger to the central publish pipeline - lending_generate.yaml - generation moved to Codat SDK Codegen; stub warns and exits 0 - lending_release.yaml - forwards the release trigger to the central publish pipeline - platform_generate.yaml - generation moved to Codat SDK Codegen; stub warns and exits 0 - platform_release.yaml - forwards the release trigger to the central publish pipeline - sync_for_expenses_generate.yaml - generation moved to Codat SDK Codegen; stub warns and exits 0 - sync_for_expenses_release.yaml - forwards the release trigger to the central publish pipeline - sync_for_payables_generate.yaml - generation moved to Codat SDK Codegen; stub warns and exits 0 - sync_for_payables_release.yaml - forwards the release trigger to the central publish pipeline --- .github/workflows/bank_feeds_generate.yaml | 25 ++++++++--------- .github/workflows/bank_feeds_release.yaml | 27 ++++++++++++++----- .github/workflows/lending_generate.yaml | 25 ++++++++--------- .github/workflows/lending_release.yaml | 27 ++++++++++++++----- .github/workflows/platform_generate.yaml | 25 ++++++++--------- .github/workflows/platform_release.yaml | 27 ++++++++++++++----- .../workflows/sync_for_expenses_generate.yaml | 25 ++++++++--------- .../workflows/sync_for_expenses_release.yaml | 27 ++++++++++++++----- .../workflows/sync_for_payables_generate.yaml | 25 ++++++++--------- .../workflows/sync_for_payables_release.yaml | 27 ++++++++++++++----- 10 files changed, 170 insertions(+), 90 deletions(-) diff --git a/.github/workflows/bank_feeds_generate.yaml b/.github/workflows/bank_feeds_generate.yaml index d6e221d18..642f7ac2f 100644 --- a/.github/workflows/bank_feeds_generate.yaml +++ b/.github/workflows/bank_feeds_generate.yaml @@ -1,3 +1,7 @@ +# Written by sdk-codegen (cutover/emit_workflow_stubs.py); do not edit by hand. +# Generation no longer runs in this repo: generate-and-pr.yml in Codat SDK +# Codegen generates this SDK and opens a versioned PR here, dispatched by the +# oas pipeline. This stub only says so. name: Generate Bank Feeds library 'on': workflow_dispatch: @@ -11,15 +15,12 @@ name: Generate Bank Feeds library type: string jobs: generate: - uses: speakeasy-api/sdk-generation-action/.github/workflows/workflow-executor.yaml@v15 - with: - mode: pr - speakeasy_version: latest - force: ${{ github.event.inputs.force }} - set_version: ${{ github.event.inputs.set_version }} - target: bank-feeds-library - secrets: - github_access_token: ${{ secrets.GITHUB_TOKEN }} - speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }} - slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }} - pypi_token: ${{ secrets.PYPI_TOKEN }} + runs-on: ubuntu-latest + steps: + - name: Generation moved to Codat SDK Codegen + run: | + echo "::warning::This workflow no longer generates anything. bank-feeds is generated by generate-and-pr.yml in Codat SDK Codegen, dispatched by the oas pipeline, which opens a versioned PR on this repo." + # Exits 0 because the oas pipeline still runs this workflow on every OAS + # merge; flip to exit 1 in the same change that switches the oas trigger + # to the repository dispatch, so stray runs become loud. + exit 0 diff --git a/.github/workflows/bank_feeds_release.yaml b/.github/workflows/bank_feeds_release.yaml index af107b330..868038996 100644 --- a/.github/workflows/bank_feeds_release.yaml +++ b/.github/workflows/bank_feeds_release.yaml @@ -1,3 +1,8 @@ +# Written by sdk-codegen (cutover/emit_workflow_stubs.py); do not edit by hand. +# Publishing no longer runs in this repo. The packaging checks, the PyPI upload, +# the tag and the GitHub release all run centrally in publish-python.yml in +# Codat SDK Codegen - no check has been dropped, they just moved. This stub +# only forwards the release trigger there. name: Release Bank Feeds library 'on': push: @@ -5,11 +10,21 @@ name: Release Bank Feeds library - bank-feeds/RELEASES.md branches: - main + workflow_dispatch: {} +concurrency: publish-bank-feeds-python jobs: publish: - uses: speakeasy-api/sdk-generation-action/.github/workflows/sdk-publish.yaml@v15 - secrets: - github_access_token: ${{ secrets.GITHUB_TOKEN }} - speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }} - slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }} - pypi_token: ${{ secrets.PYPI_TOKEN }} + runs-on: ubuntu-latest + steps: + - name: Hand the release to the central publish pipeline + run: | + if [ -z "${{ secrets.PUBLISH_TRIGGER_TOKEN }}" ]; then + echo "::error::PUBLISH_TRIGGER_TOKEN secret is not set - needed to send the publish-python repository dispatch to codat-internal/sdk-codegen" + exit 1 + fi + curl --fail-with-body --silent --show-error -X POST \ + -H "Accept: application/vnd.github+json" \ + -H "Authorization: Bearer ${{ secrets.PUBLISH_TRIGGER_TOKEN }}" \ + https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \ + -d '{"event_type": "publish-python", "client_payload": {"product": "bank-feeds", "sha": "${{ github.sha }}"}}' + echo "publish-python dispatch sent to codat-internal/sdk-codegen for bank-feeds @ ${{ github.sha }}" diff --git a/.github/workflows/lending_generate.yaml b/.github/workflows/lending_generate.yaml index 87ded0070..370a0b71b 100644 --- a/.github/workflows/lending_generate.yaml +++ b/.github/workflows/lending_generate.yaml @@ -1,3 +1,7 @@ +# Written by sdk-codegen (cutover/emit_workflow_stubs.py); do not edit by hand. +# Generation no longer runs in this repo: generate-and-pr.yml in Codat SDK +# Codegen generates this SDK and opens a versioned PR here, dispatched by the +# oas pipeline. This stub only says so. name: Generate Lending library 'on': workflow_dispatch: @@ -11,15 +15,12 @@ name: Generate Lending library type: string jobs: generate: - uses: speakeasy-api/sdk-generation-action/.github/workflows/workflow-executor.yaml@v15 - with: - mode: pr - speakeasy_version: latest - force: ${{ github.event.inputs.force }} - set_version: ${{ github.event.inputs.set_version }} - target: lending-library - secrets: - github_access_token: ${{ secrets.GITHUB_TOKEN }} - speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }} - slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }} - pypi_token: ${{ secrets.PYPI_TOKEN }} \ No newline at end of file + runs-on: ubuntu-latest + steps: + - name: Generation moved to Codat SDK Codegen + run: | + echo "::warning::This workflow no longer generates anything. lending is generated by generate-and-pr.yml in Codat SDK Codegen, dispatched by the oas pipeline, which opens a versioned PR on this repo." + # Exits 0 because the oas pipeline still runs this workflow on every OAS + # merge; flip to exit 1 in the same change that switches the oas trigger + # to the repository dispatch, so stray runs become loud. + exit 0 diff --git a/.github/workflows/lending_release.yaml b/.github/workflows/lending_release.yaml index 85ab3d43c..c8ee5d5d3 100644 --- a/.github/workflows/lending_release.yaml +++ b/.github/workflows/lending_release.yaml @@ -1,3 +1,8 @@ +# Written by sdk-codegen (cutover/emit_workflow_stubs.py); do not edit by hand. +# Publishing no longer runs in this repo. The packaging checks, the PyPI upload, +# the tag and the GitHub release all run centrally in publish-python.yml in +# Codat SDK Codegen - no check has been dropped, they just moved. This stub +# only forwards the release trigger there. name: Release Lending library 'on': push: @@ -5,11 +10,21 @@ name: Release Lending library - lending/RELEASES.md branches: - main + workflow_dispatch: {} +concurrency: publish-lending-python jobs: publish: - uses: speakeasy-api/sdk-generation-action/.github/workflows/sdk-publish.yaml@v15 - secrets: - github_access_token: ${{ secrets.GITHUB_TOKEN }} - speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }} - slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }} - pypi_token: ${{ secrets.PYPI_TOKEN }} + runs-on: ubuntu-latest + steps: + - name: Hand the release to the central publish pipeline + run: | + if [ -z "${{ secrets.PUBLISH_TRIGGER_TOKEN }}" ]; then + echo "::error::PUBLISH_TRIGGER_TOKEN secret is not set - needed to send the publish-python repository dispatch to codat-internal/sdk-codegen" + exit 1 + fi + curl --fail-with-body --silent --show-error -X POST \ + -H "Accept: application/vnd.github+json" \ + -H "Authorization: Bearer ${{ secrets.PUBLISH_TRIGGER_TOKEN }}" \ + https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \ + -d '{"event_type": "publish-python", "client_payload": {"product": "lending", "sha": "${{ github.sha }}"}}' + echo "publish-python dispatch sent to codat-internal/sdk-codegen for lending @ ${{ github.sha }}" diff --git a/.github/workflows/platform_generate.yaml b/.github/workflows/platform_generate.yaml index 969f1e2f0..8b8936e35 100644 --- a/.github/workflows/platform_generate.yaml +++ b/.github/workflows/platform_generate.yaml @@ -1,3 +1,7 @@ +# Written by sdk-codegen (cutover/emit_workflow_stubs.py); do not edit by hand. +# Generation no longer runs in this repo: generate-and-pr.yml in Codat SDK +# Codegen generates this SDK and opens a versioned PR here, dispatched by the +# oas pipeline. This stub only says so. name: Generate Platform library 'on': workflow_dispatch: @@ -11,15 +15,12 @@ name: Generate Platform library type: string jobs: generate: - uses: speakeasy-api/sdk-generation-action/.github/workflows/workflow-executor.yaml@v15 - with: - mode: pr - speakeasy_version: latest - force: ${{ github.event.inputs.force }} - set_version: ${{ github.event.inputs.set_version }} - target: platform-library - secrets: - github_access_token: ${{ secrets.GITHUB_TOKEN }} - speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }} - slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }} - pypi_token: ${{ secrets.PYPI_TOKEN }} + runs-on: ubuntu-latest + steps: + - name: Generation moved to Codat SDK Codegen + run: | + echo "::warning::This workflow no longer generates anything. platform is generated by generate-and-pr.yml in Codat SDK Codegen, dispatched by the oas pipeline, which opens a versioned PR on this repo." + # Exits 0 because the oas pipeline still runs this workflow on every OAS + # merge; flip to exit 1 in the same change that switches the oas trigger + # to the repository dispatch, so stray runs become loud. + exit 0 diff --git a/.github/workflows/platform_release.yaml b/.github/workflows/platform_release.yaml index 348fb5c19..294792d79 100644 --- a/.github/workflows/platform_release.yaml +++ b/.github/workflows/platform_release.yaml @@ -1,3 +1,8 @@ +# Written by sdk-codegen (cutover/emit_workflow_stubs.py); do not edit by hand. +# Publishing no longer runs in this repo. The packaging checks, the PyPI upload, +# the tag and the GitHub release all run centrally in publish-python.yml in +# Codat SDK Codegen - no check has been dropped, they just moved. This stub +# only forwards the release trigger there. name: Release Platform library 'on': push: @@ -5,11 +10,21 @@ name: Release Platform library - platform/RELEASES.md branches: - main + workflow_dispatch: {} +concurrency: publish-platform-python jobs: publish: - uses: speakeasy-api/sdk-generation-action/.github/workflows/sdk-publish.yaml@v15 - secrets: - github_access_token: ${{ secrets.GITHUB_TOKEN }} - speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }} - slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }} - pypi_token: ${{ secrets.PYPI_TOKEN }} + runs-on: ubuntu-latest + steps: + - name: Hand the release to the central publish pipeline + run: | + if [ -z "${{ secrets.PUBLISH_TRIGGER_TOKEN }}" ]; then + echo "::error::PUBLISH_TRIGGER_TOKEN secret is not set - needed to send the publish-python repository dispatch to codat-internal/sdk-codegen" + exit 1 + fi + curl --fail-with-body --silent --show-error -X POST \ + -H "Accept: application/vnd.github+json" \ + -H "Authorization: Bearer ${{ secrets.PUBLISH_TRIGGER_TOKEN }}" \ + https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \ + -d '{"event_type": "publish-python", "client_payload": {"product": "platform", "sha": "${{ github.sha }}"}}' + echo "publish-python dispatch sent to codat-internal/sdk-codegen for platform @ ${{ github.sha }}" diff --git a/.github/workflows/sync_for_expenses_generate.yaml b/.github/workflows/sync_for_expenses_generate.yaml index 39ea556f9..cc7e6a8af 100644 --- a/.github/workflows/sync_for_expenses_generate.yaml +++ b/.github/workflows/sync_for_expenses_generate.yaml @@ -1,3 +1,7 @@ +# Written by sdk-codegen (cutover/emit_workflow_stubs.py); do not edit by hand. +# Generation no longer runs in this repo: generate-and-pr.yml in Codat SDK +# Codegen generates this SDK and opens a versioned PR here, dispatched by the +# oas pipeline. This stub only says so. name: Generate Sync for Expenses library 'on': workflow_dispatch: @@ -11,15 +15,12 @@ name: Generate Sync for Expenses library type: string jobs: generate: - uses: speakeasy-api/sdk-generation-action/.github/workflows/workflow-executor.yaml@v15 - with: - mode: pr - speakeasy_version: latest - force: ${{ github.event.inputs.force }} - set_version: ${{ github.event.inputs.set_version }} - target: sync-for-expenses-library - secrets: - github_access_token: ${{ secrets.GITHUB_TOKEN }} - speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }} - slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }} - pypi_token: ${{ secrets.PYPI_TOKEN }} + runs-on: ubuntu-latest + steps: + - name: Generation moved to Codat SDK Codegen + run: | + echo "::warning::This workflow no longer generates anything. sync-for-expenses is generated by generate-and-pr.yml in Codat SDK Codegen, dispatched by the oas pipeline, which opens a versioned PR on this repo." + # Exits 0 because the oas pipeline still runs this workflow on every OAS + # merge; flip to exit 1 in the same change that switches the oas trigger + # to the repository dispatch, so stray runs become loud. + exit 0 diff --git a/.github/workflows/sync_for_expenses_release.yaml b/.github/workflows/sync_for_expenses_release.yaml index 47f008208..f0715f788 100644 --- a/.github/workflows/sync_for_expenses_release.yaml +++ b/.github/workflows/sync_for_expenses_release.yaml @@ -1,3 +1,8 @@ +# Written by sdk-codegen (cutover/emit_workflow_stubs.py); do not edit by hand. +# Publishing no longer runs in this repo. The packaging checks, the PyPI upload, +# the tag and the GitHub release all run centrally in publish-python.yml in +# Codat SDK Codegen - no check has been dropped, they just moved. This stub +# only forwards the release trigger there. name: Release Sync for Expenses library 'on': push: @@ -5,11 +10,21 @@ name: Release Sync for Expenses library - sync-for-expenses/RELEASES.md branches: - main + workflow_dispatch: {} +concurrency: publish-sync-for-expenses-python jobs: publish: - uses: speakeasy-api/sdk-generation-action/.github/workflows/sdk-publish.yaml@v15 - secrets: - github_access_token: ${{ secrets.GITHUB_TOKEN }} - speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }} - slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }} - pypi_token: ${{ secrets.PYPI_TOKEN }} + runs-on: ubuntu-latest + steps: + - name: Hand the release to the central publish pipeline + run: | + if [ -z "${{ secrets.PUBLISH_TRIGGER_TOKEN }}" ]; then + echo "::error::PUBLISH_TRIGGER_TOKEN secret is not set - needed to send the publish-python repository dispatch to codat-internal/sdk-codegen" + exit 1 + fi + curl --fail-with-body --silent --show-error -X POST \ + -H "Accept: application/vnd.github+json" \ + -H "Authorization: Bearer ${{ secrets.PUBLISH_TRIGGER_TOKEN }}" \ + https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \ + -d '{"event_type": "publish-python", "client_payload": {"product": "sync-for-expenses", "sha": "${{ github.sha }}"}}' + echo "publish-python dispatch sent to codat-internal/sdk-codegen for sync-for-expenses @ ${{ github.sha }}" diff --git a/.github/workflows/sync_for_payables_generate.yaml b/.github/workflows/sync_for_payables_generate.yaml index 81a3e48e0..114079a5e 100644 --- a/.github/workflows/sync_for_payables_generate.yaml +++ b/.github/workflows/sync_for_payables_generate.yaml @@ -1,3 +1,7 @@ +# Written by sdk-codegen (cutover/emit_workflow_stubs.py); do not edit by hand. +# Generation no longer runs in this repo: generate-and-pr.yml in Codat SDK +# Codegen generates this SDK and opens a versioned PR here, dispatched by the +# oas pipeline. This stub only says so. name: Generate Sync for Payables library 'on': workflow_dispatch: @@ -11,15 +15,12 @@ name: Generate Sync for Payables library type: string jobs: generate: - uses: speakeasy-api/sdk-generation-action/.github/workflows/workflow-executor.yaml@v15 - with: - mode: pr - speakeasy_version: latest - force: ${{ github.event.inputs.force }} - set_version: ${{ github.event.inputs.set_version }} - target: sync-for-payables-library - secrets: - github_access_token: ${{ secrets.GITHUB_TOKEN }} - speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }} - slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }} - pypi_token: ${{ secrets.PYPI_TOKEN }} + runs-on: ubuntu-latest + steps: + - name: Generation moved to Codat SDK Codegen + run: | + echo "::warning::This workflow no longer generates anything. sync-for-payables is generated by generate-and-pr.yml in Codat SDK Codegen, dispatched by the oas pipeline, which opens a versioned PR on this repo." + # Exits 0 because the oas pipeline still runs this workflow on every OAS + # merge; flip to exit 1 in the same change that switches the oas trigger + # to the repository dispatch, so stray runs become loud. + exit 0 diff --git a/.github/workflows/sync_for_payables_release.yaml b/.github/workflows/sync_for_payables_release.yaml index 66e306b02..6a649d215 100644 --- a/.github/workflows/sync_for_payables_release.yaml +++ b/.github/workflows/sync_for_payables_release.yaml @@ -1,3 +1,8 @@ +# Written by sdk-codegen (cutover/emit_workflow_stubs.py); do not edit by hand. +# Publishing no longer runs in this repo. The packaging checks, the PyPI upload, +# the tag and the GitHub release all run centrally in publish-python.yml in +# Codat SDK Codegen - no check has been dropped, they just moved. This stub +# only forwards the release trigger there. name: Release Sync for Payables library 'on': push: @@ -5,11 +10,21 @@ name: Release Sync for Payables library - sync-for-payables/RELEASES.md branches: - main + workflow_dispatch: {} +concurrency: publish-sync-for-payables-python jobs: publish: - uses: speakeasy-api/sdk-generation-action/.github/workflows/sdk-publish.yaml@v15 - secrets: - github_access_token: ${{ secrets.GITHUB_TOKEN }} - speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }} - slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }} - pypi_token: ${{ secrets.PYPI_TOKEN }} + runs-on: ubuntu-latest + steps: + - name: Hand the release to the central publish pipeline + run: | + if [ -z "${{ secrets.PUBLISH_TRIGGER_TOKEN }}" ]; then + echo "::error::PUBLISH_TRIGGER_TOKEN secret is not set - needed to send the publish-python repository dispatch to codat-internal/sdk-codegen" + exit 1 + fi + curl --fail-with-body --silent --show-error -X POST \ + -H "Accept: application/vnd.github+json" \ + -H "Authorization: Bearer ${{ secrets.PUBLISH_TRIGGER_TOKEN }}" \ + https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \ + -d '{"event_type": "publish-python", "client_payload": {"product": "sync-for-payables", "sha": "${{ github.sha }}"}}' + echo "publish-python dispatch sent to codat-internal/sdk-codegen for sync-for-payables @ ${{ github.sha }}" From be9ebace2f11f97449459f560fd25e7df59db25e Mon Sep 17 00:00:00 2001 From: mcollinscodat Date: Tue, 4 Aug 2026 13:19:59 +0100 Subject: [PATCH 2/4] feat/CONN-1273-release-stubs: release stubs mint their dispatch token from the GitHub App - bank_feeds_release.yaml - guard + App token mint (scoped to the codegen repo) before the dispatch - lending_release.yaml - guard + App token mint (scoped to the codegen repo) before the dispatch - platform_release.yaml - guard + App token mint (scoped to the codegen repo) before the dispatch - sync_for_expenses_release.yaml - guard + App token mint (scoped to the codegen repo) before the dispatch - sync_for_payables_release.yaml - guard + App token mint (scoped to the codegen repo) before the dispatch --- .github/workflows/bank_feeds_release.yaml | 24 +++++++++++++++---- .github/workflows/lending_release.yaml | 24 +++++++++++++++---- .github/workflows/platform_release.yaml | 24 +++++++++++++++---- .../workflows/sync_for_expenses_release.yaml | 24 +++++++++++++++---- .../workflows/sync_for_payables_release.yaml | 24 +++++++++++++++---- 5 files changed, 95 insertions(+), 25 deletions(-) diff --git a/.github/workflows/bank_feeds_release.yaml b/.github/workflows/bank_feeds_release.yaml index 868038996..f34b95178 100644 --- a/.github/workflows/bank_feeds_release.yaml +++ b/.github/workflows/bank_feeds_release.yaml @@ -2,7 +2,8 @@ # Publishing no longer runs in this repo. The packaging checks, the PyPI upload, # the tag and the GitHub release all run centrally in publish-python.yml in # Codat SDK Codegen - no check has been dropped, they just moved. This stub -# only forwards the release trigger there. +# only forwards the release trigger there, authenticated with a short-lived +# token minted from the GitHub App in the PUBLISH_TRIGGER_APP_* secrets. name: Release Bank Feeds library 'on': push: @@ -16,15 +17,28 @@ jobs: publish: runs-on: ubuntu-latest steps: - - name: Hand the release to the central publish pipeline + - name: Check the App secrets are set + env: + APP_ID_SET: ${{ secrets.PUBLISH_TRIGGER_APP_ID != '' }} + APP_KEY_SET: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY != '' }} run: | - if [ -z "${{ secrets.PUBLISH_TRIGGER_TOKEN }}" ]; then - echo "::error::PUBLISH_TRIGGER_TOKEN secret is not set - needed to send the publish-python repository dispatch to codat-internal/sdk-codegen" + if [ "$APP_ID_SET" != "true" ] || [ "$APP_KEY_SET" != "true" ]; then + echo "::error::PUBLISH_TRIGGER_APP_ID / PUBLISH_TRIGGER_APP_PRIVATE_KEY secrets are not set - needed to mint the token that sends the publish-python repository dispatch to codat-internal/sdk-codegen" exit 1 fi + - name: Mint a token from the GitHub App + id: app_token + uses: actions/create-github-app-token@v2 + with: + app-id: ${{ secrets.PUBLISH_TRIGGER_APP_ID }} + private-key: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY }} + owner: codat-internal + repositories: sdk-codegen + - name: Hand the release to the central publish pipeline + run: | curl --fail-with-body --silent --show-error -X POST \ -H "Accept: application/vnd.github+json" \ - -H "Authorization: Bearer ${{ secrets.PUBLISH_TRIGGER_TOKEN }}" \ + -H "Authorization: Bearer ${{ steps.app_token.outputs.token }}" \ https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \ -d '{"event_type": "publish-python", "client_payload": {"product": "bank-feeds", "sha": "${{ github.sha }}"}}' echo "publish-python dispatch sent to codat-internal/sdk-codegen for bank-feeds @ ${{ github.sha }}" diff --git a/.github/workflows/lending_release.yaml b/.github/workflows/lending_release.yaml index c8ee5d5d3..7d4f30866 100644 --- a/.github/workflows/lending_release.yaml +++ b/.github/workflows/lending_release.yaml @@ -2,7 +2,8 @@ # Publishing no longer runs in this repo. The packaging checks, the PyPI upload, # the tag and the GitHub release all run centrally in publish-python.yml in # Codat SDK Codegen - no check has been dropped, they just moved. This stub -# only forwards the release trigger there. +# only forwards the release trigger there, authenticated with a short-lived +# token minted from the GitHub App in the PUBLISH_TRIGGER_APP_* secrets. name: Release Lending library 'on': push: @@ -16,15 +17,28 @@ jobs: publish: runs-on: ubuntu-latest steps: - - name: Hand the release to the central publish pipeline + - name: Check the App secrets are set + env: + APP_ID_SET: ${{ secrets.PUBLISH_TRIGGER_APP_ID != '' }} + APP_KEY_SET: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY != '' }} run: | - if [ -z "${{ secrets.PUBLISH_TRIGGER_TOKEN }}" ]; then - echo "::error::PUBLISH_TRIGGER_TOKEN secret is not set - needed to send the publish-python repository dispatch to codat-internal/sdk-codegen" + if [ "$APP_ID_SET" != "true" ] || [ "$APP_KEY_SET" != "true" ]; then + echo "::error::PUBLISH_TRIGGER_APP_ID / PUBLISH_TRIGGER_APP_PRIVATE_KEY secrets are not set - needed to mint the token that sends the publish-python repository dispatch to codat-internal/sdk-codegen" exit 1 fi + - name: Mint a token from the GitHub App + id: app_token + uses: actions/create-github-app-token@v2 + with: + app-id: ${{ secrets.PUBLISH_TRIGGER_APP_ID }} + private-key: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY }} + owner: codat-internal + repositories: sdk-codegen + - name: Hand the release to the central publish pipeline + run: | curl --fail-with-body --silent --show-error -X POST \ -H "Accept: application/vnd.github+json" \ - -H "Authorization: Bearer ${{ secrets.PUBLISH_TRIGGER_TOKEN }}" \ + -H "Authorization: Bearer ${{ steps.app_token.outputs.token }}" \ https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \ -d '{"event_type": "publish-python", "client_payload": {"product": "lending", "sha": "${{ github.sha }}"}}' echo "publish-python dispatch sent to codat-internal/sdk-codegen for lending @ ${{ github.sha }}" diff --git a/.github/workflows/platform_release.yaml b/.github/workflows/platform_release.yaml index 294792d79..5bfa854a1 100644 --- a/.github/workflows/platform_release.yaml +++ b/.github/workflows/platform_release.yaml @@ -2,7 +2,8 @@ # Publishing no longer runs in this repo. The packaging checks, the PyPI upload, # the tag and the GitHub release all run centrally in publish-python.yml in # Codat SDK Codegen - no check has been dropped, they just moved. This stub -# only forwards the release trigger there. +# only forwards the release trigger there, authenticated with a short-lived +# token minted from the GitHub App in the PUBLISH_TRIGGER_APP_* secrets. name: Release Platform library 'on': push: @@ -16,15 +17,28 @@ jobs: publish: runs-on: ubuntu-latest steps: - - name: Hand the release to the central publish pipeline + - name: Check the App secrets are set + env: + APP_ID_SET: ${{ secrets.PUBLISH_TRIGGER_APP_ID != '' }} + APP_KEY_SET: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY != '' }} run: | - if [ -z "${{ secrets.PUBLISH_TRIGGER_TOKEN }}" ]; then - echo "::error::PUBLISH_TRIGGER_TOKEN secret is not set - needed to send the publish-python repository dispatch to codat-internal/sdk-codegen" + if [ "$APP_ID_SET" != "true" ] || [ "$APP_KEY_SET" != "true" ]; then + echo "::error::PUBLISH_TRIGGER_APP_ID / PUBLISH_TRIGGER_APP_PRIVATE_KEY secrets are not set - needed to mint the token that sends the publish-python repository dispatch to codat-internal/sdk-codegen" exit 1 fi + - name: Mint a token from the GitHub App + id: app_token + uses: actions/create-github-app-token@v2 + with: + app-id: ${{ secrets.PUBLISH_TRIGGER_APP_ID }} + private-key: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY }} + owner: codat-internal + repositories: sdk-codegen + - name: Hand the release to the central publish pipeline + run: | curl --fail-with-body --silent --show-error -X POST \ -H "Accept: application/vnd.github+json" \ - -H "Authorization: Bearer ${{ secrets.PUBLISH_TRIGGER_TOKEN }}" \ + -H "Authorization: Bearer ${{ steps.app_token.outputs.token }}" \ https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \ -d '{"event_type": "publish-python", "client_payload": {"product": "platform", "sha": "${{ github.sha }}"}}' echo "publish-python dispatch sent to codat-internal/sdk-codegen for platform @ ${{ github.sha }}" diff --git a/.github/workflows/sync_for_expenses_release.yaml b/.github/workflows/sync_for_expenses_release.yaml index f0715f788..1b9774a24 100644 --- a/.github/workflows/sync_for_expenses_release.yaml +++ b/.github/workflows/sync_for_expenses_release.yaml @@ -2,7 +2,8 @@ # Publishing no longer runs in this repo. The packaging checks, the PyPI upload, # the tag and the GitHub release all run centrally in publish-python.yml in # Codat SDK Codegen - no check has been dropped, they just moved. This stub -# only forwards the release trigger there. +# only forwards the release trigger there, authenticated with a short-lived +# token minted from the GitHub App in the PUBLISH_TRIGGER_APP_* secrets. name: Release Sync for Expenses library 'on': push: @@ -16,15 +17,28 @@ jobs: publish: runs-on: ubuntu-latest steps: - - name: Hand the release to the central publish pipeline + - name: Check the App secrets are set + env: + APP_ID_SET: ${{ secrets.PUBLISH_TRIGGER_APP_ID != '' }} + APP_KEY_SET: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY != '' }} run: | - if [ -z "${{ secrets.PUBLISH_TRIGGER_TOKEN }}" ]; then - echo "::error::PUBLISH_TRIGGER_TOKEN secret is not set - needed to send the publish-python repository dispatch to codat-internal/sdk-codegen" + if [ "$APP_ID_SET" != "true" ] || [ "$APP_KEY_SET" != "true" ]; then + echo "::error::PUBLISH_TRIGGER_APP_ID / PUBLISH_TRIGGER_APP_PRIVATE_KEY secrets are not set - needed to mint the token that sends the publish-python repository dispatch to codat-internal/sdk-codegen" exit 1 fi + - name: Mint a token from the GitHub App + id: app_token + uses: actions/create-github-app-token@v2 + with: + app-id: ${{ secrets.PUBLISH_TRIGGER_APP_ID }} + private-key: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY }} + owner: codat-internal + repositories: sdk-codegen + - name: Hand the release to the central publish pipeline + run: | curl --fail-with-body --silent --show-error -X POST \ -H "Accept: application/vnd.github+json" \ - -H "Authorization: Bearer ${{ secrets.PUBLISH_TRIGGER_TOKEN }}" \ + -H "Authorization: Bearer ${{ steps.app_token.outputs.token }}" \ https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \ -d '{"event_type": "publish-python", "client_payload": {"product": "sync-for-expenses", "sha": "${{ github.sha }}"}}' echo "publish-python dispatch sent to codat-internal/sdk-codegen for sync-for-expenses @ ${{ github.sha }}" diff --git a/.github/workflows/sync_for_payables_release.yaml b/.github/workflows/sync_for_payables_release.yaml index 6a649d215..290e439a2 100644 --- a/.github/workflows/sync_for_payables_release.yaml +++ b/.github/workflows/sync_for_payables_release.yaml @@ -2,7 +2,8 @@ # Publishing no longer runs in this repo. The packaging checks, the PyPI upload, # the tag and the GitHub release all run centrally in publish-python.yml in # Codat SDK Codegen - no check has been dropped, they just moved. This stub -# only forwards the release trigger there. +# only forwards the release trigger there, authenticated with a short-lived +# token minted from the GitHub App in the PUBLISH_TRIGGER_APP_* secrets. name: Release Sync for Payables library 'on': push: @@ -16,15 +17,28 @@ jobs: publish: runs-on: ubuntu-latest steps: - - name: Hand the release to the central publish pipeline + - name: Check the App secrets are set + env: + APP_ID_SET: ${{ secrets.PUBLISH_TRIGGER_APP_ID != '' }} + APP_KEY_SET: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY != '' }} run: | - if [ -z "${{ secrets.PUBLISH_TRIGGER_TOKEN }}" ]; then - echo "::error::PUBLISH_TRIGGER_TOKEN secret is not set - needed to send the publish-python repository dispatch to codat-internal/sdk-codegen" + if [ "$APP_ID_SET" != "true" ] || [ "$APP_KEY_SET" != "true" ]; then + echo "::error::PUBLISH_TRIGGER_APP_ID / PUBLISH_TRIGGER_APP_PRIVATE_KEY secrets are not set - needed to mint the token that sends the publish-python repository dispatch to codat-internal/sdk-codegen" exit 1 fi + - name: Mint a token from the GitHub App + id: app_token + uses: actions/create-github-app-token@v2 + with: + app-id: ${{ secrets.PUBLISH_TRIGGER_APP_ID }} + private-key: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY }} + owner: codat-internal + repositories: sdk-codegen + - name: Hand the release to the central publish pipeline + run: | curl --fail-with-body --silent --show-error -X POST \ -H "Accept: application/vnd.github+json" \ - -H "Authorization: Bearer ${{ secrets.PUBLISH_TRIGGER_TOKEN }}" \ + -H "Authorization: Bearer ${{ steps.app_token.outputs.token }}" \ https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \ -d '{"event_type": "publish-python", "client_payload": {"product": "sync-for-payables", "sha": "${{ github.sha }}"}}' echo "publish-python dispatch sent to codat-internal/sdk-codegen for sync-for-payables @ ${{ github.sha }}" From ed6f533b979722ea53f134ac58cb8dded6679142 Mon Sep 17 00:00:00 2001 From: mcollinscodat Date: Tue, 4 Aug 2026 15:35:16 +0100 Subject: [PATCH 3/4] feat/CONN-1273-release-stubs: the stub headers name just the emitter file .github/workflows - all ten stubs: drop the cutover/ prefix from the written-by line so it matches the TypeScript repo's stubs and pipeline file --- .github/workflows/bank_feeds_generate.yaml | 2 +- .github/workflows/bank_feeds_release.yaml | 2 +- .github/workflows/lending_generate.yaml | 2 +- .github/workflows/lending_release.yaml | 2 +- .github/workflows/platform_generate.yaml | 2 +- .github/workflows/platform_release.yaml | 2 +- .github/workflows/sync_for_expenses_generate.yaml | 2 +- .github/workflows/sync_for_expenses_release.yaml | 2 +- .github/workflows/sync_for_payables_generate.yaml | 2 +- .github/workflows/sync_for_payables_release.yaml | 2 +- 10 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/bank_feeds_generate.yaml b/.github/workflows/bank_feeds_generate.yaml index 642f7ac2f..2fd103af1 100644 --- a/.github/workflows/bank_feeds_generate.yaml +++ b/.github/workflows/bank_feeds_generate.yaml @@ -1,4 +1,4 @@ -# Written by sdk-codegen (cutover/emit_workflow_stubs.py); do not edit by hand. +# Written by sdk-codegen (emit_workflow_stubs.py); do not edit by hand. # Generation no longer runs in this repo: generate-and-pr.yml in Codat SDK # Codegen generates this SDK and opens a versioned PR here, dispatched by the # oas pipeline. This stub only says so. diff --git a/.github/workflows/bank_feeds_release.yaml b/.github/workflows/bank_feeds_release.yaml index f34b95178..f229ff6ae 100644 --- a/.github/workflows/bank_feeds_release.yaml +++ b/.github/workflows/bank_feeds_release.yaml @@ -1,4 +1,4 @@ -# Written by sdk-codegen (cutover/emit_workflow_stubs.py); do not edit by hand. +# Written by sdk-codegen (emit_workflow_stubs.py); do not edit by hand. # Publishing no longer runs in this repo. The packaging checks, the PyPI upload, # the tag and the GitHub release all run centrally in publish-python.yml in # Codat SDK Codegen - no check has been dropped, they just moved. This stub diff --git a/.github/workflows/lending_generate.yaml b/.github/workflows/lending_generate.yaml index 370a0b71b..93bcaab3b 100644 --- a/.github/workflows/lending_generate.yaml +++ b/.github/workflows/lending_generate.yaml @@ -1,4 +1,4 @@ -# Written by sdk-codegen (cutover/emit_workflow_stubs.py); do not edit by hand. +# Written by sdk-codegen (emit_workflow_stubs.py); do not edit by hand. # Generation no longer runs in this repo: generate-and-pr.yml in Codat SDK # Codegen generates this SDK and opens a versioned PR here, dispatched by the # oas pipeline. This stub only says so. diff --git a/.github/workflows/lending_release.yaml b/.github/workflows/lending_release.yaml index 7d4f30866..f4227d420 100644 --- a/.github/workflows/lending_release.yaml +++ b/.github/workflows/lending_release.yaml @@ -1,4 +1,4 @@ -# Written by sdk-codegen (cutover/emit_workflow_stubs.py); do not edit by hand. +# Written by sdk-codegen (emit_workflow_stubs.py); do not edit by hand. # Publishing no longer runs in this repo. The packaging checks, the PyPI upload, # the tag and the GitHub release all run centrally in publish-python.yml in # Codat SDK Codegen - no check has been dropped, they just moved. This stub diff --git a/.github/workflows/platform_generate.yaml b/.github/workflows/platform_generate.yaml index 8b8936e35..a0dc2273e 100644 --- a/.github/workflows/platform_generate.yaml +++ b/.github/workflows/platform_generate.yaml @@ -1,4 +1,4 @@ -# Written by sdk-codegen (cutover/emit_workflow_stubs.py); do not edit by hand. +# Written by sdk-codegen (emit_workflow_stubs.py); do not edit by hand. # Generation no longer runs in this repo: generate-and-pr.yml in Codat SDK # Codegen generates this SDK and opens a versioned PR here, dispatched by the # oas pipeline. This stub only says so. diff --git a/.github/workflows/platform_release.yaml b/.github/workflows/platform_release.yaml index 5bfa854a1..a84ed6577 100644 --- a/.github/workflows/platform_release.yaml +++ b/.github/workflows/platform_release.yaml @@ -1,4 +1,4 @@ -# Written by sdk-codegen (cutover/emit_workflow_stubs.py); do not edit by hand. +# Written by sdk-codegen (emit_workflow_stubs.py); do not edit by hand. # Publishing no longer runs in this repo. The packaging checks, the PyPI upload, # the tag and the GitHub release all run centrally in publish-python.yml in # Codat SDK Codegen - no check has been dropped, they just moved. This stub diff --git a/.github/workflows/sync_for_expenses_generate.yaml b/.github/workflows/sync_for_expenses_generate.yaml index cc7e6a8af..fafe61375 100644 --- a/.github/workflows/sync_for_expenses_generate.yaml +++ b/.github/workflows/sync_for_expenses_generate.yaml @@ -1,4 +1,4 @@ -# Written by sdk-codegen (cutover/emit_workflow_stubs.py); do not edit by hand. +# Written by sdk-codegen (emit_workflow_stubs.py); do not edit by hand. # Generation no longer runs in this repo: generate-and-pr.yml in Codat SDK # Codegen generates this SDK and opens a versioned PR here, dispatched by the # oas pipeline. This stub only says so. diff --git a/.github/workflows/sync_for_expenses_release.yaml b/.github/workflows/sync_for_expenses_release.yaml index 1b9774a24..c15bd3fef 100644 --- a/.github/workflows/sync_for_expenses_release.yaml +++ b/.github/workflows/sync_for_expenses_release.yaml @@ -1,4 +1,4 @@ -# Written by sdk-codegen (cutover/emit_workflow_stubs.py); do not edit by hand. +# Written by sdk-codegen (emit_workflow_stubs.py); do not edit by hand. # Publishing no longer runs in this repo. The packaging checks, the PyPI upload, # the tag and the GitHub release all run centrally in publish-python.yml in # Codat SDK Codegen - no check has been dropped, they just moved. This stub diff --git a/.github/workflows/sync_for_payables_generate.yaml b/.github/workflows/sync_for_payables_generate.yaml index 114079a5e..fb56617ce 100644 --- a/.github/workflows/sync_for_payables_generate.yaml +++ b/.github/workflows/sync_for_payables_generate.yaml @@ -1,4 +1,4 @@ -# Written by sdk-codegen (cutover/emit_workflow_stubs.py); do not edit by hand. +# Written by sdk-codegen (emit_workflow_stubs.py); do not edit by hand. # Generation no longer runs in this repo: generate-and-pr.yml in Codat SDK # Codegen generates this SDK and opens a versioned PR here, dispatched by the # oas pipeline. This stub only says so. diff --git a/.github/workflows/sync_for_payables_release.yaml b/.github/workflows/sync_for_payables_release.yaml index 290e439a2..9852209f4 100644 --- a/.github/workflows/sync_for_payables_release.yaml +++ b/.github/workflows/sync_for_payables_release.yaml @@ -1,4 +1,4 @@ -# Written by sdk-codegen (cutover/emit_workflow_stubs.py); do not edit by hand. +# Written by sdk-codegen (emit_workflow_stubs.py); do not edit by hand. # Publishing no longer runs in this repo. The packaging checks, the PyPI upload, # the tag and the GitHub release all run centrally in publish-python.yml in # Codat SDK Codegen - no check has been dropped, they just moved. This stub From b761e5b208d5fca5da61032777ba4c9167bf6537 Mon Sep 17 00:00:00 2001 From: mcollinscodat Date: Wed, 5 Aug 2026 19:20:38 +0100 Subject: [PATCH 4/4] feat/CONN-1273-release-stubs: the release stubs tell the central pipeline which repo they fired from - .github/workflows/*_release.yaml - all five dispatch payloads add sdk_repo (github.repository), so the central publish clones and tags the repo the release came from and a mirror rehearses against its own tree --- .github/workflows/bank_feeds_release.yaml | 2 +- .github/workflows/lending_release.yaml | 2 +- .github/workflows/platform_release.yaml | 2 +- .github/workflows/sync_for_expenses_release.yaml | 2 +- .github/workflows/sync_for_payables_release.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/bank_feeds_release.yaml b/.github/workflows/bank_feeds_release.yaml index f229ff6ae..929087522 100644 --- a/.github/workflows/bank_feeds_release.yaml +++ b/.github/workflows/bank_feeds_release.yaml @@ -40,5 +40,5 @@ jobs: -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer ${{ steps.app_token.outputs.token }}" \ https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \ - -d '{"event_type": "publish-python", "client_payload": {"product": "bank-feeds", "sha": "${{ github.sha }}"}}' + -d '{"event_type": "publish-python", "client_payload": {"product": "bank-feeds", "sha": "${{ github.sha }}", "sdk_repo": "${{ github.repository }}"}}' echo "publish-python dispatch sent to codat-internal/sdk-codegen for bank-feeds @ ${{ github.sha }}" diff --git a/.github/workflows/lending_release.yaml b/.github/workflows/lending_release.yaml index f4227d420..975c71154 100644 --- a/.github/workflows/lending_release.yaml +++ b/.github/workflows/lending_release.yaml @@ -40,5 +40,5 @@ jobs: -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer ${{ steps.app_token.outputs.token }}" \ https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \ - -d '{"event_type": "publish-python", "client_payload": {"product": "lending", "sha": "${{ github.sha }}"}}' + -d '{"event_type": "publish-python", "client_payload": {"product": "lending", "sha": "${{ github.sha }}", "sdk_repo": "${{ github.repository }}"}}' echo "publish-python dispatch sent to codat-internal/sdk-codegen for lending @ ${{ github.sha }}" diff --git a/.github/workflows/platform_release.yaml b/.github/workflows/platform_release.yaml index a84ed6577..b304d8da4 100644 --- a/.github/workflows/platform_release.yaml +++ b/.github/workflows/platform_release.yaml @@ -40,5 +40,5 @@ jobs: -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer ${{ steps.app_token.outputs.token }}" \ https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \ - -d '{"event_type": "publish-python", "client_payload": {"product": "platform", "sha": "${{ github.sha }}"}}' + -d '{"event_type": "publish-python", "client_payload": {"product": "platform", "sha": "${{ github.sha }}", "sdk_repo": "${{ github.repository }}"}}' echo "publish-python dispatch sent to codat-internal/sdk-codegen for platform @ ${{ github.sha }}" diff --git a/.github/workflows/sync_for_expenses_release.yaml b/.github/workflows/sync_for_expenses_release.yaml index c15bd3fef..ed9320c13 100644 --- a/.github/workflows/sync_for_expenses_release.yaml +++ b/.github/workflows/sync_for_expenses_release.yaml @@ -40,5 +40,5 @@ jobs: -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer ${{ steps.app_token.outputs.token }}" \ https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \ - -d '{"event_type": "publish-python", "client_payload": {"product": "sync-for-expenses", "sha": "${{ github.sha }}"}}' + -d '{"event_type": "publish-python", "client_payload": {"product": "sync-for-expenses", "sha": "${{ github.sha }}", "sdk_repo": "${{ github.repository }}"}}' echo "publish-python dispatch sent to codat-internal/sdk-codegen for sync-for-expenses @ ${{ github.sha }}" diff --git a/.github/workflows/sync_for_payables_release.yaml b/.github/workflows/sync_for_payables_release.yaml index 9852209f4..4e23fb4b2 100644 --- a/.github/workflows/sync_for_payables_release.yaml +++ b/.github/workflows/sync_for_payables_release.yaml @@ -40,5 +40,5 @@ jobs: -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer ${{ steps.app_token.outputs.token }}" \ https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \ - -d '{"event_type": "publish-python", "client_payload": {"product": "sync-for-payables", "sha": "${{ github.sha }}"}}' + -d '{"event_type": "publish-python", "client_payload": {"product": "sync-for-payables", "sha": "${{ github.sha }}", "sdk_repo": "${{ github.repository }}"}}' echo "publish-python dispatch sent to codat-internal/sdk-codegen for sync-for-payables @ ${{ github.sha }}"