Skip to content

chore: add GitHub Actions workflow to automate OpenAPI types generation #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
karamouche wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore: add GitHub Actions workflow to automate OpenAPI types generation #44

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 57 additions & 0 deletions .github/workflows/update-openapi-types.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,57 @@
name: Update OpenAPI types

on:
schedule:
- cron: '0 6 * * *'
workflow_dispatch:

concurrency:
group: '${{ github.workflow }}'
cancel-in-progress: false

permissions:
contents: write
pull-requests: write

jobs:
update-openapi-types:
name: Regenerate OpenAPI types
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7

- uses: oven-sh/setup-bun@v2
with:
bun-version: latest
- uses: actions/setup-node@v6
with:
node-version: 22
package-manager-cache: false
- run: bun install

- name: Install uv
uses: astral-sh/setup-uv@v7
with:
enable-cache: true
- name: Install Python deps
run: bun nx run-many -t sync

- name: Generate OpenAPI types
run: bun nx run generator:generate
Comment on lines +21 to +40

@coderabbitai coderabbitai Bot Jul 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== workflow ==\n'
git ls-files '.github/workflows/update-openapi-types.yml'
wc -l .github/workflows/update-openapi-types.yml
sed -n '1,120p' .github/workflows/update-openapi-types.yml

printf '\n== checkout usage in repo ==\n'
rg -n "actions/checkout@v[0-9]+|persist-credentials" .github/workflows .github -S

printf '\n== nearby permissions/context ==\n'
rg -n "contents:\s*write|pull_request|workflow_dispatch|permissions:" .github/workflows/update-openapi-types.yml .github/workflows -n -S

Repository: gladiaio/sdk

Length of output: 1947

Disable persisted checkout credentials. Add persist-credentials: false to actions/checkout; this job runs repository code with contents: write, so the default token should not be left available to scripts or dependencies.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 21-21: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/update-openapi-types.yml around lines 21 - 40, Add
persist-credentials: false to the actions/checkout@v7 step so the checkout token
is not retained for subsequent repository scripts or dependencies. Leave the
remaining workflow steps unchanged.

Source: Linters/SAST tools


- name: Create Pull Request
uses: peter-evans/create-pull-request@v8
with:
token: ${{ secrets.GITHUB_TOKEN }}
commit-message: 'chore: auto-update OpenAPI generated types'
title: 'chore: auto-update OpenAPI generated types'
body: |
Automated regeneration of SDK types from the remote OpenAPI schema:

https://api.gladia.io/openapi.json

Please review the generated type changes before merging.
branch: chore/update-openapi-types
base: main
delete-branch: true
reviewers: egenthon-cmd
Loading