Merge pull request #2 from stainless-api/dgellow/add-stainless-workflows

chore(ci): setup automated stainless builds

Author: dgellow

.github/workflows/README.md

@@ -16,6 +16,7 @@ Llama Stack uses GitHub Actions for Continuous Integration (CI). Below is a tabl
 | Python Package Build Test | [python-build-test.yml](python-build-test.yml) | Test building the llama-stack PyPI project |
 | Integration Tests (Record) | [record-integration-tests.yml](record-integration-tests.yml) | Run the integration test suite from tests/integration |
 | Check semantic PR titles | [semantic-pr.yml](semantic-pr.yml) | Ensure that PR titles follow the conventional commit spec |
+| Stainless SDK Builds | [stainless-builds.yml](stainless-builds.yml) | Build Stainless SDKs |
 | Close stale issues and PRs | [stale_bot.yml](stale_bot.yml) | Run the Stale Bot action |
 | Test External Providers Installed via Module | [test-external-provider-module.yml](test-external-provider-module.yml) | Test External Provider installation via Python module |
 | Test External API and Providers | [test-external.yml](test-external.yml) | Test the External API and Provider mechanisms |

.github/workflows/pre-commit.yml

@@ -112,21 +112,19 @@ jobs:
 
       # Trigger the stainless-builds workflow after pre-commit passes.
       # This is required because pre-commit generates the OpenAPI spec file that
-      # stainless-builds needs to build the SDKs. Using repository_dispatch allows
-      # to trigger the workflow with custom payload data.
+      # stainless-builds needs to build the SDKs.
       - name: Trigger Stainless builds
         if: github.event_name == 'pull_request' && success()
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
-            await github.rest.repos.createDispatchEvent({
+            await github.rest.actions.createWorkflowDispatch({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              event_type: 'stainless-build-trigger',
-              client_payload: {
-                pr_number: context.payload.pull_request.number,
-                pr_action: context.payload.action,
-                ref: context.payload.pull_request.head.ref,
-                sha: context.payload.pull_request.head.sha
+              workflow_id: 'stainless-builds.yml',
+              ref: context.payload.pull_request.head.ref,
+              inputs: {
+                pr_number: String(context.payload.pull_request.number),
+                pr_action: context.payload.action
               }
             })

.github/workflows/stainless-builds.yml

@@ -1,14 +1,26 @@
-name: Build SDKs for pull request
+name: Stainless SDK Builds
+
+run-name: Build Stainless SDKs
 
 on:
-  repository_dispatch:
-    types: [stainless-build-trigger]
+  # Triggered by the pre-commit workflow after it successfully completes.
+  # This ensures the OpenAPI spec file is generated before attempting to build SDKs.
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'Pull request number'
+        required: true
+        type: string
+      pr_action:
+        description: 'Pull request action'
+        required: true
+        type: string
   pull_request:
     types:
       - closed
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.client_payload.pr_number || github.event.pull_request.number }}
+  group: ${{ github.workflow }}-${{ inputs.pr_number || github.event.pull_request.number }}
   cancel-in-progress: true
 
 env:
@@ -31,19 +43,19 @@ env:
 
 jobs:
   preview:
-    if: github.event_name == 'repository_dispatch' && github.event.client_payload.pr_action != 'closed'
+    if: github.event_name == 'workflow_dispatch' && inputs.pr_action != 'closed'
     runs-on: ubuntu-latest
     permissions:
       contents: read
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 2
 
       - name: Run preview builds
-        uses: stainless-api/upload-openapi-spec-action/preview@v1
+        uses: stainless-api/upload-openapi-spec-action/preview@b741c27bc604e5c130b92ed4056b07aee783aa04 # v1.5.4
         with:
           stainless_api_key: ${{ secrets.STAINLESS_API_KEY }}
           org: ${{ env.STAINLESS_ORG }}
@@ -60,7 +72,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 2
 
@@ -71,7 +83,7 @@ jobs:
       # against preview/${{ github.head_ref }} to complete, but assuming that
       # the preview-sdk job happens before the PR merge, it should be fine.
       - name: Run merge build
-        uses: stainless-api/upload-openapi-spec-action/merge@v1
+        uses: stainless-api/upload-openapi-spec-action/merge@b741c27bc604e5c130b92ed4056b07aee783aa04 # v1.5.4
         with:
           stainless_api_key: ${{ secrets.STAINLESS_API_KEY }}
           org: ${{ env.STAINLESS_ORG }}