ci: post-install regen pipeline improvements

.github/workflows/regen.yml

@@ -77,17 +77,20 @@ jobs:
       - name: Resolve inputs
         id: in
         env:
-          DISPATCH_SPEC_URL: ${{ github.event.inputs.spec_url }}
+          # Note: spec_url is intentionally NOT in this env block. It comes from a
+          # private repo's release URL and should not appear in step env-logging.
+          # Instead we jq it out of $GITHUB_EVENT_PATH and immediately add-mask it.
           DISPATCH_CLEAN: ${{ github.event.inputs.clean }}
           DISPATCH_GEN_VER: ${{ github.event.inputs.generator_version }}
-          PAYLOAD_SPEC_URL: ${{ github.event.client_payload.spec_url }}
-          PAYLOAD_SPEC_TAG: ${{ github.event.client_payload.spec_tag }}
           PAYLOAD_CLEAN: ${{ github.event.client_payload.clean }}
           PAYLOAD_GEN_VER: ${{ github.event.client_payload.generator_version }}
         run: |
           set -euo pipefail
-          spec_url="${DISPATCH_SPEC_URL:-${PAYLOAD_SPEC_URL:-}}"
-          spec_tag="${PAYLOAD_SPEC_TAG:-}"
+          spec_url=$(jq -r '.inputs.spec_url // .client_payload.spec_url // ""' "$GITHUB_EVENT_PATH")
+          spec_tag=$(jq -r '.client_payload.spec_tag // ""' "$GITHUB_EVENT_PATH")
+          if [[ -n "$spec_url" ]]; then
+            echo "::add-mask::$spec_url"
+          fi
           clean="${DISPATCH_CLEAN:-${PAYLOAD_CLEAN:-false}}"
           gen_ver="${DISPATCH_GEN_VER:-${PAYLOAD_GEN_VER:-}}"
           [[ "$clean" != "true" ]] && clean="false"
@@ -98,13 +101,51 @@ jobs:
             echo "gen_ver<<EOF"; printf '%s\n' "$gen_ver"; echo "EOF"
           } >> "$GITHUB_OUTPUT"
 
-      - name: Update spec from URL
+      - name: Resolve spec source repo from SDK_SPEC_REPO secret
+        if: steps.in.outputs.spec_url != ''
+        id: spec_repo
+        env:
+          SDK_SPEC_REPO: ${{ secrets.SDK_SPEC_REPO }}
+        run: |
+          set -euo pipefail
+          if [[ -z "$SDK_SPEC_REPO" ]]; then
+            echo "!! SDK_SPEC_REPO secret is not set (expected: owner/repo)" >&2
+            exit 1
+          fi
+          if [[ "$SDK_SPEC_REPO" != */* ]]; then
+            echo "!! SDK_SPEC_REPO must be in 'owner/repo' format" >&2
+            exit 1
+          fi
+          owner="${SDK_SPEC_REPO%%/*}"
+          repo="${SDK_SPEC_REPO##*/}"
+          # Mask both halves so neither appears in any later log
+          echo "::add-mask::$owner"
+          echo "::add-mask::$repo"
+          echo "owner=$owner" >> "$GITHUB_OUTPUT"
+          echo "repo=$repo" >> "$GITHUB_OUTPUT"
+
+      - name: Mint download token from GitHub App
+        if: steps.in.outputs.spec_url != ''
+        id: download_token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.SDK_DISPATCH_APP_ID }}
+          private-key: ${{ secrets.SDK_DISPATCH_APP_PRIVATE_KEY }}
+          owner: ${{ steps.spec_repo.outputs.owner }}
+          repositories: ${{ steps.spec_repo.outputs.repo }}
+
+      - name: Download spec from release
         if: steps.in.outputs.spec_url != ''
         env:
-          SPEC_URL: ${{ steps.in.outputs.spec_url }}
+          SPEC_TAG: ${{ steps.in.outputs.spec_tag }}
+          SPEC_REPO: ${{ secrets.SDK_SPEC_REPO }}
+          GH_TOKEN: ${{ steps.download_token.outputs.token }}
         run: |
           set -euo pipefail
-          curl --fail --location --show-error --silent "$SPEC_URL" -o openapi/goodsender.yaml
+          gh release download "$SPEC_TAG" \
+            --repo "$SPEC_REPO" \
+            --pattern goodsender.yaml \
+            --output openapi/goodsender.yaml
 
       - name: Regenerate
         env:
@@ -153,7 +194,6 @@ jobs:
 
             - Trigger: `${{ github.event_name }}`
             - Spec tag: `${{ steps.in.outputs.spec_tag || '(none — in-repo spec used)' }}`
-            - Spec URL: `${{ steps.in.outputs.spec_url || '(none)' }}`
             - Clean: `${{ steps.in.outputs.clean }}`
             - Generator version: `${{ steps.in.outputs.gen_ver || '(default from scripts/regen.sh)' }}`
             - Conformance tests (`tests/run.sh mock`): **${{ steps.tests.outcome }}**