Skip to content

ci: add automated SDK definition sync workflow #315

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Joffref merged 7 commits into from
May 28, 2026
Merged

ci: add automated SDK definition sync workflow #315

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
4aa8c83
ci: add automated SDK definition sync workflow
Joffref May 28, 2026
8326df9
ci: use GITHUB_TOKEN for PR creation instead of cross-repo PAT
Joffref May 28, 2026
59cf132
Update .github/workflows/update-sdk-definitions.yaml
Joffref May 28, 2026
0784571
Apply suggestions from code review
Joffref May 28, 2026
43c8ab6
ci: fix duplicate YAML lines and use git status --porcelain
Joffref May 28, 2026
4925f72
ci: use GITHUB_TOKEN for cross-repo reads (same org)
Joffref May 28, 2026
0b9dd4f
ci: use public endpoints for spec downloads
Joffref May 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
100 changes: 100 additions & 0 deletions .github/workflows/update-sdk-definitions.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,100 @@
name: Update SDK definitions

on:
schedule:
- cron: "0 8 * * *" # daily at 08:00 UTC
workflow_dispatch:
repository_dispatch:
types: [update-sdk-definitions]

permissions:
contents: write
pull-requests: write

jobs:
update-definitions:
name: Regenerate SDK clients from upstream OpenAPI specs
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: main

- name: Setup Bun
uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
Comment thread
mendral-app[bot] marked this conversation as resolved.

- name: Setup Node.js
uses: actions/setup-node@49933ea5288caeca8642195f2b846f73898f2e17 # v4.4.0
with:
Comment thread
mendral-app[bot] marked this conversation as resolved.
Comment thread
mendral-app[bot] marked this conversation as resolved.
node-version: "22"

- name: Install dependencies
run: bun install

- name: Regenerate sandbox SDK client
run: |
echo "Downloading sandbox definition from blaxel-ai/sandbox"
curl -sf -o ./definition.yml \
"https://raw.githubusercontent.com/blaxel-ai/sandbox/refs/heads/main/sandbox-api/docs/openapi.yml"

@mendral-app mendral-app Bot May 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security (P3): OpenAPI spec is fetched over HTTPS without checksum verification. A compromised upstream could inject malicious type definitions into generated SDK code. Consider pinning to a specific commit SHA in the raw URL.

Suggested change
Suggested change
"https://raw.githubusercontent.com/blaxel-ai/sandbox/refs/heads/main/sandbox-api/docs/openapi.yml"
curl -sf -o ./definition.yml \
"https://raw.githubusercontent.com/blaxel-ai/sandbox/<COMMIT_SHA>/sandbox-api/docs/openapi.yml"
Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/update-sdk-definitions.yaml, line 39:

<issue>
OpenAPI spec is fetched over HTTPS without checksum verification. A compromised upstream could inject malicious type definitions into generated SDK code. Consider pinning to a specific commit SHA in the raw URL.
</issue>


rm -rf @blaxel/core/src/sandbox/client/types.gen.ts @blaxel/core/src/sandbox/client/sdk.gen.ts
npx @hey-api/openapi-ts@0.66.0 -i ./definition.yml -o ./tmp/ -c @hey-api/client-fetch
Comment thread
mendral-app[bot] marked this conversation as resolved.

@mendral-app mendral-app Bot May 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maintainability (P2): Running npx @hey-api/openapi-ts@0.66.0 downloads and executes the package at runtime without integrity verification. Consider adding this as a devDependency in the project lockfile and invoking it from there, or verifying the package checksum after download.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/update-sdk-definitions.yaml, line 42:

<issue>
Running `npx @hey-api/openapi-ts@0.66.0` downloads and executes the package at runtime without integrity verification. Consider adding this as a devDependency in the project lockfile and invoking it from there, or verifying the package checksum after download.
</issue>

@cursor cursor Bot May 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Agentic Security Review
Severity: MEDIUM
This workflow executes npx @hey-api/openapi-ts@0.66.0 directly in CI for scheduled runs while the job has contents: write and pull-requests: write. Even with a pinned top-level version, runtime package resolution is not lockfile-bound and introduces an external code-execution path in a privileged automation context.
Impact: A compromise in the package supply chain (or one of its resolved dependencies) could execute attacker-controlled code in this job and use repository-write privileges to push malicious generated changes or manipulate automated update PRs.

Fix in Cursor Fix in Web

Reviewed by Cursor Security Reviewer for commit 0b9dd4f. Configure here.

cp -r ./tmp/* @blaxel/core/src/sandbox/client

sed -i 's/from '\''\.\/sdk\.gen'\''/from '\''\.\/sdk\.gen\.js'\''/g' @blaxel/core/src/sandbox/client/index.ts
sed -i 's/from '\''\.\/types\.gen'\''/from '\''\.\/types\.gen\.js'\''/g' @blaxel/core/src/sandbox/client/index.ts
rm -rf ./tmp definition.yml

- name: Regenerate controlplane SDK client
run: |
echo "Downloading controlplane definition from blaxel-ai/controlplane"
curl -sf -o ./definition.yml \
"https://api.blaxel.ai/v0/openapi/controlplane.yml"

Comment thread
mendral-app[bot] marked this conversation as resolved.
rm -rf @blaxel/core/src/client/types.gen.ts @blaxel/core/src/client/sdk.gen.ts
npx @hey-api/openapi-ts@0.66.0 -i ./definition.yml -o ./tmp/ -c @hey-api/client-fetch
cp -r ./tmp/* @blaxel/core/src/client

sed -i 's/from '\''\.\/sdk\.gen'\''/from '\''\.\/sdk\.gen\.js'\''/g' @blaxel/core/src/client/index.ts
sed -i 's/from '\''\.\/types\.gen'\''/from '\''\.\/types\.gen\.js'\''/g' @blaxel/core/src/client/index.ts
sed -i 's/from '\''\.\/types\.gen'\''/from '\''\.\/types\.gen\.js'\''/g' @blaxel/core/src/client/sdk.gen.ts
perl -i -0777 -pe 's/(\{\s*scheme: .bearer.,\s*type: .http.\s*\}),\s*\{\s*scheme: .bearer.,\s*type: .http.\s*\}/$1/g' @blaxel/core/src/client/sdk.gen.ts
sed -i 's/\([A-Za-z_][A-Za-z0-9_]*\)Readable/\1/g' @blaxel/core/src/client/types.gen.ts
sed -i 's/TimeFieldsWritable/TimeFields/g' @blaxel/core/src/client/types.gen.ts
sed -i 's/OwnerFieldsWritable/OwnerFields/g' @blaxel/core/src/client/types.gen.ts
sed -i 's/export type Function =/export type _Function =/g' @blaxel/core/src/client/types.gen.ts
sed -i 's/: Function;/: _Function;/g' @blaxel/core/src/client/types.gen.ts
sed -i 's/<Function>/<_Function>/g' @blaxel/core/src/client/types.gen.ts
echo '' >> @blaxel/core/src/client/types.gen.ts
echo 'export type DriveStateWritable = DriveState;' >> @blaxel/core/src/client/types.gen.ts
rm -rf ./tmp definition.yml

- name: Check for changes
id: diff
run: |
if [ -z "$(git status --porcelain)" ]; then
echo "changed=false" >> "$GITHUB_OUTPUT"
echo "No definition changes detected"
else
echo "changed=true" >> "$GITHUB_OUTPUT"
echo "Definition changes detected:"
git status --short
fi

- name: Create pull request
if: steps.diff.outputs.changed == 'true'
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
with:
token: ${{ secrets.GITHUB_TOKEN }}
branch: automated/update-sdk-definitions
commit-message: "chore: update SDK definitions from upstream OpenAPI specs"
title: "chore: update SDK definitions from upstream OpenAPI specs"
body: |
Automated PR to sync the generated SDK clients with the latest OpenAPI specs from:
- [`blaxel-ai/sandbox`](https://github.com/blaxel-ai/sandbox) (sandbox client)
- [`blaxel-ai/controlplane`](https://github.com/blaxel-ai/controlplane) (controlplane client)

Generated by the **Update SDK definitions** workflow.
labels: automated
delete-branch: true
Loading