[arosasg]

Problem

Alex (2026-11-07): the SDKs must publish automatically whenever the public API of service-didit-verification changes.
Today every API change needs a person three times: approving CI on the bot's spec sync pull request (its pull_request run sits at action_required, because a pull request opened with GITHUB_TOKEN in a public repository needs a maintainer's approval), merging the spec sync pull request, and merging the release-please pull request.
main has no branch protection and auto-merge is off, so there is nothing safe to auto-merge against, and no release job checks that the registry actually serves the new version.

Solution

• .github/workflows/bot-pull-requests.yml (identical in all seven SDKs) runs .github/scripts/bot-pull-request.sh when a Spec sync, release or CI run finishes, every 30 minutes as a safety net, and by hand. For chore/spec-sync and release-please--* pull requests opened by the automation it:
  • starts ci.yml on the pull request's branch with workflow_dispatch (exempt from the approval gate, no new token, no approval of runs); its checks land on the head commit;
  • turns on auto-merge with squash (gh pr merge --auto --squash --match-head-commit), as the spec sync's BEGIN_COMMIT_OVERRIDE block needs, so GitHub merges only once the required check passes;
  • holds the pull request for a person (label needs-alex, one comment, auto-merge off) when the latest spec sync failed a check, when it asks for a major version (a release pull request for a new major, or a sync with ! or a BREAKING CHANGE: footer; under the 11-06 policy an API change, breaking or not, is feat(spec), a minor, and merges), when it has commits from people, or when main has no required check. It leaves alone anything labelled do-not-merge and anything whose auto-merge a person turned off, and removes its own label once the reason is gone;
  • starts the release workflows on main when the newest commit has no run of them, because a merge made by a GITHUB_TOKEN auto-merge starts no push workflow.
• ci.yml: one CI passed job that needs every CI job (the live sandbox tests excepted); it becomes main's required status check after this merges.
• Release: a registry job (no credentials, runs nothing from the release) waits until the registry serves the version, or fails the run (.github/scripts/wait-for-registry.sh, identical in all seven).
• docs/DESIGN.md 3.1 and 13 (the same text in all seven), CLAUDE.md and AGENTS.md describe it.
• The event that starts it all is mintlify-docs server-sdk-spec-sync.yml (separate pull request): on a merge to main that changes an OpenAPI document it waits until docs.didit.me serves the merged bytes, then starts spec-sync.yml here. mintlify-docs main documents only what production serves, so nothing ships before it is live. The daily schedule stays as the safety net.

spec-sync.yml and release-please-config.json are not touched.

Verification

• actionlint (with shellcheck) on every changed workflow and shellcheck on both scripts: clean.
• bot-pull-request.sh against a fake gh in 16 scenarios: CI started and auto-merge on; failed sync, draft, !, BREAKING CHANGE: footer, commits from people, no required check and a new major each held with label and comment; do-not-merge, a person's needs-alex and a manual auto-merge off left alone; the automation's own label removed once cleared; catch-up starts only the release workflow with no run on main's head.
• wait-for-registry.sh against the live registries: PyPI 1.1.0, npm 2.1.0, proxy.golang.org v1.1.0, Maven Central 1.1.0, Packagist v2.1.1, RubyGems 2.1.2, NuGet Didit and Didit.Extensions.DependencyInjection 1.1.0 all found; a missing version fails with an error.
• End to end after merge: the next spec sync pull request gets CI without approval and auto-merge (proof in the follow-up comment).

🤖 Generated with Claude Code

[arosasg]

Codex review (codex CLI, account codex-7, model gpt-5.6-sol)

---

💡 Code review

Reviewed commit: 271c4f9

No blocking findings in commit 271c4f9.

Verdict: APPROVE

[arosasg]

Codex review (codex CLI, account codex-2, model gpt-5.6-sol)

---

💡 Code review

Reviewed commit: 49bce76

No actionable findings in commit 49bce76.

Verdict: APPROVE