From df48194f068e4da89e2620048580b4e29d5d7512 Mon Sep 17 00:00:00 2001 From: cb-logesh Date: Fri, 21 Aug 2026 16:15:43 +0530 Subject: [PATCH 1/2] ci: notify the Postman collection pipeline when a spec release lands MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The specs in spec/ are updated by cb-sdk-gen's public-sdk-release, which opens a pull request here. Merging it is the moment the specification becomes public, since this repository's main branch is what downstream consumers read — so it is the moment worth announcing. chargebee/cb-openapi-generator regenerates the published Chargebee Postman collections from spec/ and opens a pull request carrying the diff. Until now it discovered a release by polling and could lag a day behind it. A latency optimisation, not a dependency, and written to stay that way: that pipeline still polls hourly and keys on this repository's commit SHA, so if the token is never configured, the dispatch fails, or this file is deleted, the collections still follow — just later. The step fails soft for the same reason. A specification release must not report as broken because a downstream notification could not be sent. Needs one repository secret, POSTMAN_REGEN_DISPATCH_TOKEN: a fine-grained token with Contents write on chargebee/cb-openapi-generator and nothing else. Without it the step logs a notice and exits zero. --- .github/workflows/notify-postman.yml | 60 ++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) create mode 100644 .github/workflows/notify-postman.yml diff --git a/.github/workflows/notify-postman.yml b/.github/workflows/notify-postman.yml new file mode 100644 index 0000000..52f61c1 --- /dev/null +++ b/.github/workflows/notify-postman.yml @@ -0,0 +1,60 @@ +# Tells the Postman collection pipeline that a specification release has landed. +# +# The specs in spec/ are updated by cb-sdk-gen's public-sdk-release, which opens +# a pull request here. Merging that pull request is the moment the specification +# becomes public — this repository's main branch is what downstream consumers +# read — so it is the moment worth announcing. +# +# The consumer, chargebee/cb-openapi-generator, regenerates its published Postman +# collections from spec/ and opens a pull request carrying the diff. Nothing +# auto-merges there; a human reads the semantic change. +# +# This is a latency optimisation, not a dependency. That pipeline also polls +# hourly and keys on this repository's commit SHA, so if the dispatch fails, is +# never configured, or this workflow is deleted, the collections still follow — +# just up to an hour later. Deliberately fails soft for the same reason: a +# specification release must not be reported as broken because a downstream +# notification could not be sent. +name: notify-postman + +on: + push: + branches: [main] + paths: + - 'spec/**' + workflow_dispatch: + +permissions: + contents: read + +jobs: + notify: + runs-on: ubuntu-latest + steps: + - name: Dispatch to cb-openapi-generator + env: + # Fine-grained token with Contents: read and write on + # chargebee/cb-openapi-generator — the permission repository_dispatch + # requires. Nothing else. + TOKEN: ${{ secrets.POSTMAN_REGEN_DISPATCH_TOKEN }} + SHA: ${{ github.sha }} + run: | + if [ -z "$TOKEN" ]; then + echo "::notice::POSTMAN_REGEN_DISPATCH_TOKEN is not set; skipping. The Postman pipeline polls hourly and will pick this up regardless." + exit 0 + fi + + status=$(curl -sS -o /tmp/dispatch.out -w '%{http_code}' \ + -X POST "https://api.github.com/repos/chargebee/cb-openapi-generator/dispatches" \ + -H "Authorization: Bearer $TOKEN" \ + -H "Accept: application/vnd.github+json" \ + -H "X-GitHub-Api-Version: 2022-11-28" \ + -d "{\"event_type\":\"openapi-spec-published\",\"client_payload\":{\"sha\":\"$SHA\"}}") + + if [ "$status" = "204" ]; then + echo "Notified cb-openapi-generator of ${SHA}." + else + # Soft failure on purpose: see the note at the top of this file. + echo "::warning::Dispatch returned HTTP ${status}. The Postman pipeline polls hourly, so this delays regeneration rather than preventing it." + cat /tmp/dispatch.out + fi From f1dcd666656087b362b0d6c44689937b1886a7db Mon Sep 17 00:00:00 2001 From: cb-logesh Date: Thu, 3 Sep 2026 16:44:02 +0530 Subject: [PATCH 2/2] ci: mint the dispatch token from the SDK release app Replaces the POSTMAN_REGEN_DISPATCH_TOKEN fine-grained PAT with an installation token from chargebee-sdk-release-bot, the same app cb-sdk-gen uses in specs-release.yml. The token lives an hour, so nothing needs rotating, and the dispatch is attributed to the bot rather than a person. The token step carries continue-on-error because create-github-app-token hard-fails on a missing or malformed key, which would otherwise defeat the fail-soft contract described at the top of the file; the existing empty-token check then reports the skip and exits 0. repositories: and permission-contents: narrow the token to Contents: write on cb-openapi-generator alone, matching what the PAT was scoped to. Requires CB_SDK_BOT_APP_ID and CB_SDK_BOT_PEM_KEY to be granted to this repository. They are org secrets with a repository access list that does not currently include chargebee/openapi. --- .github/workflows/notify-postman.yml | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/.github/workflows/notify-postman.yml b/.github/workflows/notify-postman.yml index 52f61c1..5c5fa1e 100644 --- a/.github/workflows/notify-postman.yml +++ b/.github/workflows/notify-postman.yml @@ -31,16 +31,37 @@ jobs: notify: runs-on: ubuntu-latest steps: + # Same identity cb-sdk-gen releases specs with (chargebee-sdk-release-bot), + # so no separate personal access token needs minting or rotating: the + # installation token below lives for an hour. + # + # continue-on-error is what keeps this workflow failing soft. Without it + # this step hard-fails when the private key is absent or malformed, before + # the empty-token check in the next step can report the skip and exit 0. + # + # repositories: narrows the token to the one repository being dispatched + # to, rather than every repository in the installation. + - name: Generate GitHub App token + id: app-token + continue-on-error: true + uses: actions/create-github-app-token@v1 + with: + app-id: ${{ secrets.CB_SDK_BOT_APP_ID }} + private-key: ${{ secrets.CB_SDK_BOT_PEM_KEY }} + owner: ${{ github.repository_owner }} + repositories: cb-openapi-generator + permission-contents: write + - name: Dispatch to cb-openapi-generator env: - # Fine-grained token with Contents: read and write on + # Short-lived installation token carrying Contents: write on # chargebee/cb-openapi-generator — the permission repository_dispatch # requires. Nothing else. - TOKEN: ${{ secrets.POSTMAN_REGEN_DISPATCH_TOKEN }} + TOKEN: ${{ steps.app-token.outputs.token }} SHA: ${{ github.sha }} run: | if [ -z "$TOKEN" ]; then - echo "::notice::POSTMAN_REGEN_DISPATCH_TOKEN is not set; skipping. The Postman pipeline polls hourly and will pick this up regardless." + echo "::notice::No app token was minted; skipping. Check that CB_SDK_BOT_APP_ID and CB_SDK_BOT_PEM_KEY are granted to this repository. The Postman pipeline polls hourly and will pick this up regardless." exit 0 fi