Sync Private repo to public mirror - #135
Merged
Merged
Conversation
commit f62ef952556ebcda3ad568d3864177be628f0af0 Merge: 6c008119 15c3457e Author: Fabian <[email protected]> Date: Tue Aug 4 13:56:35 2026 +0100 Merge pull request #305 from launchdarkly/ffeldberg/REL-15193/merge-public-history Merge public ld-openapi history, so mirroring stops conflicting commit 15c3457ec09e701131df6b6e13ada49bfd923b55 Author: Fabian <[email protected]> Date: Tue Aug 4 13:23:41 2026 +0100 Drop the Confluence links ahead of mirroring Two comments carried the internal runbook URL - the release.yml header and preflight.sh's - and this repo is mirrored to the public launchdarkly/ld-openapi, where a link nobody outside the company can open is noise at best. Both now refer to "the release runbook" without the URL; the surrounding explanations, which are the part that actually helps a reader, are untouched. Nothing else was changed. The remaining references to internal repositories, paths, the trust-policy identity and the Slack channel are reasonable to have in public: they are names of things, not credentials, and several are already public - .github/runs-on.yml with its `_extends: .github-private` exists verbatim in the public repo today. The only other match in the tree is the generator jar, which is a local download and gitignored; no .jar is committed. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit 951b78585e748f788d6bc7ef342e899b7f8e5f3c Merge: 6c008119 dd8e70fe Author: Fabian <[email protected]> Date: Tue Aug 4 13:12:59 2026 +0100 Merge public ld-openapi history, keeping this repo's work The two repos last shared an ancestor in October 2024 (94cdd5e5, "prepare 17.0.0 release"): 224 commits here, 10 there. That is why mirroring private onto public conflicts add/add on the workflow files - both sides created them independently after the split - and why the mirror job has never completed. Merging public in first establishes shared history, so the mirror in the other direction is an ordinary fast-forwardable merge rather than a conflict to re-resolve by hand on every release. Content-wise this changes almost nothing, which is the useful finding: public had nothing this repo lacks. All four conflicts resolved to our side. README.md, Makefile public's are strict subsets. Ours keeps the axios 1.18.1 pin and the push_dry_run prerequisite. ci.yml, release.yml ours; public's predate the automation entirely. samples/javascript, left deleted. Neither existed at the merge base; templates/javascript public acquired them through earlier mirror merges and a01aa45c removed the php and javascript targets here deliberately. Re-adding them would undo that. The 10 public-only commits are duplicates of work already here, applied separately - the SEC-7924 action pinning and the CODEOWNERS renames - so nothing unique is lost. CODEOWNERS and dependency-scan-gha.yml were already identical. Also pins runs-on/action, the one third-party action still on a floating tag, to match what SEC-7924 established on the public side. launchdarkly/octosts-action stays on @v1 deliberately: it is first-party and its maintainer pushes security updates to that tag. Verified: no conflict markers, all three workflows parse, selfcheck 10/10, and the staged tree differs from this repo's main by exactly the one pin. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit 6c008119702631d051f93c9556f794d935c7b49f Merge: b59f010b 6a22265b Author: Fabian <[email protected]> Date: Tue Aug 4 12:47:23 2026 +0100 Merge pull request #304 from launchdarkly/ffeldberg/REL-15193/downstream-and-verify-fixes Fix the three defects the 24.0.0 release exposed commit 6a22265ba3c63f55c068ec22b5419511c67b049f Author: Fabian <[email protected]> Date: Tue Aug 4 12:24:52 2026 +0100 Skip the trust-policy checks on a response that is not a policy The selfcheck job failed in CI on this branch, reporting that the policy grants no permissions and lists no repositories: repos/${GONFALON}/commits/main needs 'contents' but the policy grants: [] FAIL pr-downstream targets absent from the policy's repositories: ... Caused by the change in the previous commit that gave the CI step a GITHUB_TOKEN. The policy lives in a private repo that token cannot read, so `gh api` now returns a 404 error body on stdout instead of nothing. The fetch used `|| true`, which discarded the exit status but kept the body, and a GitHub API error body is valid YAML - so it parsed into a dict with none of the keys the checks read, and they failed against something that was never a policy. Before the token was added, gh produced no output and the checks skipped correctly. Two fixes, because either alone leaves a hole. The fetch now respects gh's exit status rather than swallowing it, and the result is shape-checked for the four keys the checks actually read before any of them run. Anything else means SKIP, with a message naming which situation applies - not readable at all, or fetched but not a policy - so a skip is diagnosable instead of ambient. This is the same defect class as the previous commit, one layer along: there the check passed having verified nothing, here it failed having verified something that was not the subject. Validate the input before trusting a verdict about it. Verified against the exact CI condition - a stub returning the 404 body with a non-zero exit - which now yields three SKIPs and exit 0; against a 200 whose body is not a policy, which SKIPs and names the missing keys; and with the real policy present, which still runs everything, 10/10. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit da4734df42b62cf9370523770fab230b4d15a2e8 Author: Fabian <[email protected]> Date: Tue Aug 4 12:09:24 2026 +0100 Bring CLAUDE.md and README.md up to date, and keep internals out of both This repo is mirrored to the public launchdarkly/ld-openapi, so both files are effectively public. Neither now names the internal service repo that owns the spec, the federated-token infrastructure or its trust-policy identity, the internal policy or IaC repositories, internal service accounts, team names, Slack channels, or internal documentation URLs. The public repo has no references to any of those today, so this keeps that boundary rather than widening it. Where an internal system matters to understanding the flow it is described by what it does, with the concrete names left to the workflow files. CLAUDE.md is also brought current: the three gates and their overrides, the credential audit, both downstream PR jobs and why they are skipped on a rehearsal, verify-published's hard and soft checks and the reason the Go proxy is soft, the selfcheck harness and the two rules it enforces about itself, the id-token requirement including the reusable-workflow double grant, and the fact that a rehearsal's log is nearly indistinguishable from a real release. Also records the immutability of published registry versions and the re-run failed jobs rule, which are the two things most likely to turn a partial failure into a worse one. README.md previously described releases in one sentence. It now walks the actual sequence, lists the inputs worth knowing, and states the immutable-version constraint. It also documents single-language generation, the template override convention and its coupling to GENERATOR_VERSION, and how generated clients are verified - all things a reader of the public repo would otherwise have to infer from the Makefile. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit e179fc8f656fa8ffd48fb6a8b074a33d33dde01f Author: Fabian <[email protected]> Date: Tue Aug 4 12:01:49 2026 +0100 Stop selfcheck passing when it verified nothing Review finding, and correct. The ACTION-INPUTS check swallowed every lookup failure and only counted successes, so if no action could be resolved it printed "CHECKED 0" and then PASSed. In CI that was guaranteed: the selfcheck step had no GH_TOKEN, so `gh api` failed for every action and the check reported success having verified nothing - false assurance about exactly the mistake it was added to catch. Now reports SKIP when it resolved nothing, and SKIP naming the specific actions when it resolved only some, rather than passing on a partial sample. The CI step also now passes GITHUB_TOKEN, which is sufficient to read the pinned action repos - all public - so the check actually runs there instead of skipping forever. A permanently-skipped check is barely better than a falsely-passing one. The same shape existed in two other checks, so fixed the class rather than the instance: a count derived by extracting from the workflows means "the extractor broke" far more often than it means "the repo is clean". The OIDC check now cross-references the raw YAML text and fails if the workflows mention octosts-action while it detected no token-minting job; POLICY-REPOS fails if it finds no pr-downstream targets at all. Verified: unauthenticated gh now yields SKIP rather than PASS; breaking the OIDC extractor while leaving the real usage in place is caught as "the check is broken"; a normal local run still passes 10/10. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit ee1baff0785af5a54a2d6bdc84ac5bcca1fd8fc1 Author: Fabian <[email protected]> Date: Tue Aug 4 11:53:23 2026 +0100 Fix the three defects the 24.0.0 release exposed All three surfaced only during a real release, and all three are now covered by selfcheck so they cannot recur silently. Team reviewers cannot be requested with a federated token. The provider job failed with "Unable to request reviewers. If requesting team reviewers a 'repo' scoped PAT is required" - after it had already created PR #528 - so the work succeeded and the job went red on a trailing step. This is a consequence of moving from a PAT to OctoSTS; foundation's workflow gets away with team-reviewers because it still uses a PAT. Both downstream jobs now request the dispatcher instead. CODEOWNERS in each downstream repo still pulls in the owning team, so nothing is lost. The pinned pr-downstream has no `dryrun` input. Passing one produced only a warning, and the value was ignored, so both downstream jobs were attempting real PR creation during a rehearsal. They only failed to open PRs because the version they bump to did not exist yet - luck, not design, and the dry run's safety was documented on the strength of that input existing. Both jobs are now skipped outright when dryRun is set, which is honest about what a rehearsal can cover: these jobs cannot be exercised without a published version to bump to. The Go module proxy check is now soft rather than hard. Go has no publish step - the tag is the release, and the tag is already checked directly - and proxy.golang.org caches negative lookups, so the earlier dry run's `go get` for v24.0.0 made it serve "unknown revision" for a while afterwards. That failed verify-published on a release where every registry had in fact published, which then skipped the GitHub releases and both downstream PRs. Adds an ACTION-INPUTS check to selfcheck: for every third-party action pinned to a ref, it fetches that ref's action.yml and asserts each input the workflow passes is actually declared. Verified by reintroducing `dryrun` and confirming it is caught as "not an input of launchdarkly-labs/pr-downstream@08b3feb5df32". Covers 24 pinned action/input pairs. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit b59f010b9267ea7f634428f33024616633b8a5d4 Merge: 2a1a906e 9ce6910e Author: Fabian <[email protected]> Date: Mon Aug 3 16:48:01 2026 +0100 Merge pull request #303 from launchdarkly/ffeldberg/REL-15193/parity-gate-diagnostics Say what the spec-parity gate is waiting for commit 9ce6910e63988797cc531b7ce78db8821616b88a Author: Fabian <[email protected]> Date: Mon Aug 3 16:24:25 2026 +0100 Close a blind spot in selfcheck's endpoint extraction Review finding, and correct on both counts. The drift-explanation block added a gonfalon call listing commits that touch the spec path. Its URL sits on a backslash continuation line, and the extractor matched only `gh_gonfalon api "..."` on a single line - so the call was invisible. It was therefore neither validated against the granted permissions nor reported as unrecognised, which is exactly the silent gap the endpoint table exists to close. Six calls existed; selfcheck was checking five. That is worse than a missing table entry, because it defeats the guarantee documented in CLAUDE.md: an unknown endpoint is supposed to fail rather than be assumed fine. A missing entry is loud; an undetected call is not. Fixes both halves: - joins backslash continuations before extracting, so no future call can slip past regardless of formatting, and errors out if extraction finds nothing at all rather than silently passing an empty set - adds /commits?path= -> contents to the table Now checks 6 of 6 calls. The endpoint needs `contents`, which the policy already grants, so no trust-policy change is needed. Verified by planting an unrecognised endpoint on a continuation line - now caught as "not in selfcheck's endpoint->permission table" - and by pointing a same-line call at /status, still caught as needing an ungranted permission. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit 0333f8a8b43fcdb165f81ef375bdafd0769c0eca Author: Fabian <[email protected]> Date: Mon Aug 3 16:16:19 2026 +0100 Add skipSpecParity, so a pending deploy cannot block a release Gate 1 refuses to release while gonfalon main's spec is ahead of production. That is the right default - it keeps the published release notes matched to the spec that actually ships - but it has no override, so an undeployed spec commit blocks the release entirely, for as long as the deploy takes. Right now that is holding up 24.0.0 over six schema properties: VR-65 adds _site/_links.site to AITool, PromptSnippet, AgentGraph, AIConfigs, PromptSnippets and AITools, and production has not picked it up in over two hours. Paths and schema counts are otherwise identical between the two specs. skipSpecParity releases what production is serving. It does not change what ships, since the build downloads the spec from production either way - it changes whether the run refuses to proceed. The cost is that version and changelog still come from main, so release notes may describe merged-but-undeployed changes and the downstream gonfalon PR would record them against this version. Those entries need trimming in that PR, which requires review anyway. The gate logs exactly that when the flag is used. Default is unchanged: without the flag it still waits and then fails with the commit it was waiting on. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit 98f8799c0330c7981c76541b0eda352ef34675f3 Author: Fabian <[email protected]> Date: Mon Aug 3 16:08:47 2026 +0100 Say what the spec-parity gate is waiting for The gate reported only two blob hashes - "prod=c0314584 main=1a42c60b" - then polled silently for up to 30 minutes. That says nothing about what is in flight or how stale production is, which is the only question an operator has when a release stalls here. On the first mismatch it now resolves prod's blob back to the gonfalon commit that produced it, and names both sides: prod is serving apidocs/openapi-public-final.json from 70f24a20b 2026-07-31T17:20:52Z feat(releases): expose active phase status on release progression API (#68403) main's latest spec commit is f5999286e 2026-08-03T14:59:00Z Add canonical relative _site links to public API resources (VR-65) (#67542) Resolved once rather than per poll, so a long wait costs a handful of extra API calls rather than hundreds. If prod's spec matches no recent commit on main it now says so explicitly instead of waiting silently. That would mean production is serving something never merged, or the file moved, and either is worth stopping for. The timeout message names the commit being waited on and why the wait matters: releasing early would publish release notes describing endpoints the shipped spec does not contain. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit 2a1a906eedf123002e92ce6669b7d171c7ae23dc Merge: e5599709 69d3a58c Author: Fabian <[email protected]> Date: Mon Aug 3 15:58:07 2026 +0100 Merge pull request #302 from launchdarkly/ffeldberg/REL-15193/gonfalon-checks-permission Fix the gonfalon CI gate and the OctoSTS scope check commit 69d3a58c0e972cc8a3a2c6a63765af7b1d6f31a8 Author: Fabian <[email protected]> Date: Mon Aug 3 15:48:58 2026 +0100 Add a local selfcheck for the release automation Every failure in this automation so far was discoverable without running a release, but nothing was checking for it, so each one cost a merge, a dispatch, and a wait. This closes that loop: static checks that run in seconds locally and gate CI. One check per defect that actually shipped: OIDC a job used octosts-action without id-token: write POLICY-PERM the CI gate called an endpoint the trust policy did not permit POLICY-MATCH an unanchored job_workflow_ref that could never match POLICY-REPOS a downstream target missing from the policy's allowlist SECRETS a workflow referenced a secret that did not exist DRYRUN a make dry-run target that was a silent no-op PORTABILITY mapfile and bare sed -i, which break on macOS bash 3.2 Verified by reintroducing all six defects one at a time and confirming each is caught with a specific message, not just a generic failure. The endpoint-to-permission table is the interesting part: it maps each API call preflight makes through the federated token to the GitHub App permission that call requires, and fails if the trust policy does not grant it. An unrecognised endpoint is a failure rather than an assumed pass, so adding a call without considering permissions cannot silently reintroduce a 403. Trust-policy checks need the policy, which lives in the private launchdarkly/.github-private. Locally it is read from a checkout or via gh; in CI neither is available, so those three checks skip and the run still passes on the remaining five. Confirmed by running with gh shadowed by a failing stub. Also quotes the bump assignments in preflight.sh to clear SC2209, so shellcheck is clean at -S warning across every script this automation owns and the gate is meaningful. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit 139d1c6362dcf03ee5585e8a4ca0e11e056b639d Author: Fabian <[email protected]> Date: Mon Aug 3 15:32:14 2026 +0100 Fix the gonfalon CI gate and the OctoSTS scope check Two separate defects, found by the second dry run on main. The id-token fix worked - the token minted and the trust policy matched - so these are what was behind it. Preflight's Gate 2 died with "Resource not accessible by integration (HTTP 403)". It called /commits/{sha}/status, which needs the `statuses` permission. No policy in launchdarkly/.github-private grants that and it may not be available on the OctoSTS app at all, so the gate now uses check-runs only, which needs `checks: read` - granted, and with precedent in service-template-go-sync. The tradeoff is that legacy commit statuses from external systems are no longer considered; the GitHub Actions checks are what "is gonfalon green" means here. Also paginates, which the previous version did not: gonfalon main currently has 84 check runs, well past the first page of 30. The audit reported "missing push on launchdarkly/gonfalon (granted: none)" for a token that had just been minted with contents: write. The check inspected `.permissions` on the repo endpoint, which reports a *user's* role - push, pull, admin - and an App installation token has no role, only granular permissions, so that field is always empty for it. My local tests passed only because I stood a PAT in for the minted token, which does have a role. It now enumerates scope with /installation/repositories, which is what actually catches the failure worth catching: a repo missing from the policy's allowlist. An installation token's permission set cannot be read back over the API, so write access is reported UNVERIFIED and is proven only when a downstream PR opens. Requires adding `checks: read` to the trust policy; that is a separate change in launchdarkly/.github-private. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit e559970938c3ec7286b926cdbb10e810ebf93ce0 Merge: d0bb8ac4 3c690bcd Author: Fabian <[email protected]> Date: Mon Aug 3 15:21:19 2026 +0100 Merge pull request #301 from launchdarkly/ffeldberg/REL-15193/octosts-id-token-permission Grant id-token: write to every job that mints an OctoSTS token commit 3c690bcd5412f4daca956ca350ab24b9952ad185 Author: Fabian <[email protected]> Date: Mon Aug 3 15:04:29 2026 +0100 Grant id-token: write to every job that mints an OctoSTS token The first dry run on main failed in both Preflight and Token audit with: Missing required environment variables - have you set 'id-token: write' in your workflow? octosts-action exchanges a GitHub Actions OIDC token, which requires id-token: write on the job. Only the release job had it, granted long ago for the AWS OIDC role that fetches the Java signing key; the four jobs added by the release automation did not, so every exchange failed before it could reach the trust policy. Adds it to preflight, downstream-gonfalon, downstream-terraform-provider, and the token-audit caller. For token-audit it has to be granted twice - on the calling job here and at the workflow level in token-audit.yml - because a reusable workflow is capped by the permissions its caller holds, and token-audit.yml's own block previously restricted it to contents: read. Nothing was wrong with the trust policy: the exchange never got far enough to consult it. The audit's continue-on-error on the mint step did its job, reporting "no federated token was minted" and still checking everything else, which is what isolated this to the OIDC step rather than the policy. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit d0bb8ac407088e8c3edca93cc164015dddc144b7 Merge: f71c64cd a6e006e1 Author: Fabian <[email protected]> Date: Mon Aug 3 15:00:02 2026 +0100 Merge pull request #300 from launchdarkly/ffeldberg/REL-15193/automate-openapi-client-releases Prepare for fully automating openapi client releases commit a6e006e1998378eec05ee8f2af337d5859b2dead Author: Fabian <[email protected]> Date: Mon Aug 3 14:48:09 2026 +0100 Correct the pre-merge testing note for the main-only trust policy The OctoSTS grant is pinned to refs/heads/main, so the earlier claim that branch dispatches federate no longer holds. Everything else in release.yml is still testable from a branch; the federated-token steps are not. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit d8fbfa52554dd599bf5000b9d72c3dd75bf5157a Author: Fabian <[email protected]> Date: Mon Aug 3 14:27:58 2026 +0100 Document that OctoSTS claim patterns are anchored octo-sts compiles each claim pattern as regexp.Compile("^" + v + "$"), and job_workflow_ref always carries an @refs/heads/... suffix, so a pattern ending at .yml silently matches nothing and every token exchange is denied. Cost us a round of review on the trust policy; worth recording next to the other two traps. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit d38a46d222851aabdfed1fce996b90d0f14a88cf Author: Fabian <[email protected]> Date: Mon Aug 3 14:22:55 2026 +0100 Request review from team-enterprise on the provider PR terraform-provider-launchdarkly's CODEOWNERS assigns everything outside /docs/ to @launchdarkly/team-enterprise. team-integrations was a guess and wrong. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit b86a2edfd9b073d4519fca4ffa1142c66364f7fe Author: Fabian <[email protected]> Date: Mon Aug 3 14:18:06 2026 +0100 Federate downstream access with OctoSTS, and add the terraform provider Replaces the PR_CREATOR_GH_TOKEN approach entirely, per review feedback on the terraform PR: OctoSTS mints credentials at runtime, so no long-lived token has to be provisioned, stored, or rotated for this. The terraform change that would have added one is dropped. Both downstream jobs and the preflight gonfalon reads now take their token from launchdarkly/octosts-action@v1, governed by a ld-openapi-downstream trust policy in launchdarkly/.github-private. BOT_TOKEN keeps only what it already had: the client repos and the public mirror. Two things about the policy that are easy to get wrong. LaunchDarkly's instance reads policies from .github/launchdarkly/, not the .github/chainguard/ path that both the upstream octo-sts README and the action's own docs document - the documented path exists nowhere in the org. And org-scoped policies carry a `repositories` allowlist, so a new downstream target has to be added there or the minted token cannot see it. Adds downstream-terraform-provider, so a release also opens a bump PR against terraform-provider-launchdarkly. That repo gets its own `make update-api-client-go`, mirroring gonfalon's, keeping each codemod beside the imports it rewrites - ~220 files there, and plain Go rather than bazel. Its commit message uses a chore(deps) prefix because the repo runs release-please and a feat prefix would cut a provider release on its own. The token audit now mints a token and checks it rather than inspecting a stored secret. What fails with federation is the federation: a missing policy, a job_workflow_ref that does not match, or a repo left out of the allowlist. It checks both downstream repos, and reports clearly when no token was minted at all. Note the policy has to name token-audit.yml as well as release.yml, because a reusable workflow reports its own path in job_workflow_ref, not the caller's. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit d6efcf2561ffb741600416620b9d07339a5a0ab8 Author: Fabian <[email protected]> Date: Mon Aug 3 13:51:45 2026 +0100 Detect the terraform placeholder in the token audit The SSM parameters backing these secrets are created by terraform holding the literal string SET_IN_PARAMETER_STORE, and the real value is written by hand afterwards. Between those two points the GitHub secret exists but is the placeholder, and GitHub answers an API call with it as "Bad credentials" - true but unhelpful. Name the actual situation instead. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit ffff51c05bb2e1a2e4a3f9f13654ee3174718038 Author: Fabian <[email protected]> Date: Mon Aug 3 13:44:21 2026 +0100 Set GOPRIVATE for the gonfalon downstream job pr-downstream rewrites all github.com URLs to authenticate with the supplied token, and gonfalon's `make tidy` then resolves Go modules from private launchdarkly repos. Without GOPRIVATE, go consults proxy.golang.org for those paths and gets a 404. The equivalent gonfalon job in launchdarkly/foundation's pr-downstream workflow sets this at the workflow level; ours had not. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit 5fdbee71b0a334e425e1df887e7336933fcdd1d6 Author: Fabian <[email protected]> Date: Mon Aug 3 13:41:53 2026 +0100 Read gonfalon with PR_CREATOR_GH_TOKEN, and stop failing valid RubyGems keys Findings from the first dispatched token audit. BOT_TOKEN cannot see launchdarkly/gonfalon at all, so preflight died on its very first gate. It should never have been asked to: BOT_TOKEN is the releaser credential for the client repos, and granting the release bot read access to the main application repo just to fetch a spec blob and a changelog is the wrong trade. Preflight now reads gonfalon through GONFALON_TOKEN, defaulting to PR_CREATOR_GH_TOKEN, whose service account already has push on gonfalon. Client repo calls still use BOT_TOKEN. Consequence: PR_CREATOR_GH_TOKEN is needed on every run, not only when the downstream PR job is enabled, so the audit now demands read unconditionally and push only when that job will run. The RUBYGEM_API_KEY failure was my check, not the credential. RubyGems API keys are scoped, and a key scoped to push_rubygem - which is all releasing needs, and the correct level of privilege - is rejected by /api/v1/profile/me.json. The last release published fine, so the key is valid. There is no read-only endpoint a push-only key can pass, so this is now reported UNVERIFIED alongside PYPI_TOKEN rather than as a failure. Also softened the Central Portal probe: a non-401/403 response reflects the probe's request shape, not the credentials. Verified the probe still detects genuinely bad credentials, which return 401. Confirmed by the same audit run: BOT_TOKEN does have push on the public ld-openapi, so dropping PUBLIC_MIRROR_GH_TOKEN was correct. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit ac9c822b0530ffb69754f0df0a3c1b4cd6f7f531 Author: Fabian <[email protected]> Date: Mon Aug 3 12:28:43 2026 +0100 Use BOT_TOKEN for the public mirror instead of a new secret Checking how the terraform repo provisions these credentials showed that one of the two secrets this branch introduced does not need to exist. Public ld-openapi grants "sa-release-bots" = "Releaser" in accounts/github/launchdarkly/common/repo_ld-openapi.tf, the identical grant the api-client-* repos carry, and BOT_TOKEN is the releaser token (/global/services/github/releaser-github-token) that already pushes to those repos on every release. So the mirror can use BOT_TOKEN for both sides, and PUBLIC_MIRROR_GH_TOKEN is dropped: one fewer secret to provision, and no terraform change needed for mirroring. The audit now checks BOT_TOKEN's push access on launchdarkly/ld-openapi rather than the existence of a separate secret, still gated on mirrorPublic. PR_CREATOR_GH_TOKEN is left as is. It resolves as an organization-level secret: foundation's pr-downstream workflow has been succeeding with no repo-level secret of that name and none declared for it in terraform. Whether it reaches this repo depends on the org secret's visibility, which needs org admin to read, so the token audit is the way to find out. CLAUDE.md records the fallback - declare it per-repo as integration-framework-private, accelerate, and gonfalon do. No access grant is needed on gonfalon either way: pd-sa-pr-creator already has push there. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit f4e5ff14c34c97ff632d1453a18f3063c205d0c7 Author: Fabian <[email protected]> Date: Mon Aug 3 12:21:11 2026 +0100 Pin axios to 1.18.1 to unbreak the TypeScript client build The generated TypeScript client has stopped compiling, which blocks CI on every PR and would fail a real release at build_clients: common.ts(108,14): error TS2527: The inferred type of 'createRequestFunction' references an inaccessible 'unique symbol' type. A type annotation is necessary. Nothing in this repo caused it. axios 1.19.0, released 2026-07-29, added `declare const axiosResponseDefault: unique symbol` to index.d.ts and refers to it from the public return type of request(). The symbol is never exported, so tsc cannot name it while inferring the type of createRequestFunction. Because axiosVersion was a floating ^1.13.1, every build since picked up 1.19.0. Bisected locally: 1.13.1 through 1.18.1 all build, 1.19.0 alone fails. The last green CI run was 22 June, when 1.18.1 was current. Not fixed upstream: openapi-generator master still emits the unannotated function, and 1.19.0 is still axios latest with no patch release. Pinning is deliberately the stopgap rather than the fix. The real fix is a common.mustache override annotating the returned closure, `): Promise<R> =>` with `as Promise<R>` on the axios.request call, which I verified compiles clean against 1.19.0 and against older axios. It is deferred because it adds a fifth template override to keep in sync on generator upgrades. The Makefile comment records both the reasoning and when to revert. Verified by regenerating the client from scratch and running what CI runs: npm install, tsc and the esm build both emit, and the sample compiles against the result. The sample's npm start was not run locally as it needs LD_API_KEY and creates a real flag. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit fc72f93bd6eb57f2d5cb86c616ee0954d99e22c4 Author: Fabian <[email protected]> Date: Mon Aug 3 12:10:16 2026 +0100 Fix release-graph and dry-run defects found in review Three defects, all real: verify-published demanded a v<version> tag on all five client repos, but `make push` tags only Go that way; the other four get a bare <version>, and their v<version> tag is created later by create-release, which runs *after* verification. Every healthy release would have reported four failures, failed the job, and skipped create-release, the gonfalon PR, and the mirror - telling the operator to delete tags and retry. My own validation missed it because I tested against 23.0.0, an already-completed release where create-release had long since added the v tags. Now checks what exists at that point in the graph. `make push_dry_run` was a no-op: the target carried GIT_PUSH_COMMAND and GIT_PUSH_DESC assignments but, unlike push_test, no prerequisite on `push`, so it printed "Nothing to be done" and exited 0. A rehearsal therefore never cloned a client repo, never committed, and never checked push access, while CLAUDE.md claimed it did all three. Latent in the repo before this branch, and the pre-existing publish-dry-run.sh was affected too. Version derivation took the first entry of the tags endpoint, which GitHub does not document as semver-sorted and which is not lexicographically safe either (v9.0.0 vs v17.0.0). Now filters to release tags and sorts with sort -V. Also adds openDownstreamPr, mirroring mirrorPublic, and makes the token audit demand only the credentials the current run will use. Without this a missing PR_CREATOR_GH_TOKEN or PUBLIC_MIRROR_GH_TOKEN blocks the audit gate and so blocks any rehearsal - neither secret exists in this repo yet, so the flow could not be exercised at all before creating them. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit 5a233dfe54d13e1d98569032b809eb1befae0913 Author: Fabian <[email protected]> Date: Mon Aug 3 11:40:49 2026 +0100 Audit release credentials read-only, and gate releases on it Answers "do these tokens have the permissions they need?" without a release. A dry run cannot: create-release is skipped entirely, pr-downstream skips PR creation, and the publish dry-run scripts never authenticate to any registry, so a rehearsal proves almost nothing about credentials. token-audit.sh asks each provider directly, using only GETs and whoami-style calls. For GitHub it reads `.permissions` on the repo endpoint, which reflects what that specific token can do. It reports UNVERIFIED rather than passing silently where no read-only check exists: PyPI has no token introspection endpoint, and confirming LD_API_KEY can write would mean writing. This runs as a gate on every release rather than only on rehearsals. A bad registry credential would otherwise surface after `make push` had already tagged five client repos, which is the case that forces the delete-the-tags-and-retry dance the runbook warns about. Mirroring is checked conditionally so a missing PUBLIC_MIRROR_GH_TOKEN cannot block a release that runs with mirrorPublic off. Also fixes a bug in the dry-run path added in the previous commit: the scripts/release-dry-run/*.sh scripts all copy their would-be-published artifacts into LD_RELEASE_ARTIFACTS_DIR and fail on mkdir when it is unset, which it was. The workflow now sets it and uploads the result, so a rehearsal also shows exactly what would have been published. ci.yml gains workflow_dispatch, both so it can run against any branch and because its sample programs create and delete a real flag - which is the only way to confirm LD_API_KEY has write access, the one thing the audit cannot check. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit 16dfecf27e7121ab045d0329a16f10f4f2ca1c5f Author: Fabian <[email protected]> Date: Mon Aug 3 11:33:54 2026 +0100 Add CLAUDE.md Documents what is not discoverable from a quick read of the repo: that this is a generator rather than a library, that the spec is downloaded from production at build time so build output depends on what is deployed, that the mustache overrides are verbatim upstream copies which must be re-copied when GENERATOR_VERSION moves, and how the release automation and its gates work. Also records two things that mislead on inspection: `make push` clones api-client-typescript-axios, which is a GitHub redirect to the renamed api-client-typescript rather than a mismatch to fix; and non-Go client repos carry two tags per release, a bare X.Y.Z from `make push` plus vX.Y.Z created by the create-release job, both of which must be deleted before retrying a failed release. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit 1f58676806a67e76eefcd4cc8fd32ff0dff7b52e Author: Fabian <[email protected]> Date: Mon Aug 3 11:33:43 2026 +0100 Automate the client library release runbook Releasing client libraries required a human to work through a Confluence runbook: check that gonfalon is healthy, ask in Slack whether any spec changes are mid-flight, decide patch/minor/major from the changelog, wait for the spec commit to reach production, paste the version and changelog markdown into a workflow_dispatch form, spot-check the registries, then open two gonfalon changes and mirror this repo to its public counterpart by hand. release.yml now derives its own inputs and enforces each precondition as a gate, so a normal release is a dispatch with no inputs at all. Every input that remains is an override: releaseVersion, bumpType, dryRun, force, mirrorPublic, skipCiGate. The key gate is spec parity. gonfalon commits the published spec at apidocs/openapi-public-final.json and production serves that file byte for byte, so `git hash-object` of the production download equals gonfalon's git blob SHA for that path. Equality means production is caught up AND nothing is mid-flight, which is what the Slack check and the wait-for-deploy step were approximating. It is polled until it holds, and compared by blob SHA through the tree API because the file is ~2.8MB, past the contents API's 1MB raw limit. Every subsequent read from gonfalon is pinned to the commit parity resolved to: main moves often, and reading the spec and the changelog at separate moments can otherwise pair a changelog with a spec it does not describe. Bump type is inferred from the '### ' headings of gonfalon's [Unreleased] section. '### Changed' is genuinely ambiguous, covering breaking and additive changes alike, so the rule errs toward major and an unrecognised heading aborts rather than guesses. Post-publish, the workflow polls the registries and client repo tags instead of trusting a spot-check, opens a single gonfalon PR carrying both the changelog rename and the api-client-go bump, and squash-mirrors onto the public repo. Two deliberate stopping points: the gonfalon PR does not auto-merge, because a major bump rewrites import paths across ~18 Go files and the Bazel graph; and the mirror aborts on conflict rather than resolving, because that push is not practically reversible and the runbook's guidance there is "use your discretion". The gonfalon dependency codemod lives in gonfalon as `make update-api-client-go`, beside the imports it rewrites, rather than in a workflow YAML here. publish.sh gains a DRY_RUN path routing to push_dry_run and publish_dry_run, so a dispatch with dryRun rehearses the whole flow while pushing and publishing nothing. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> commit f71c64cd69981c5ecfe38e526b5f7794a9419930 Merge: 33d54cc2 8adf2b2a Author: ari-launchdarkly <[email protected]> Date: Wed Jun 17 11:29:43 2026 -0700 Merge pull request #298 from launchdarkly/devin/1781712015-replace-fm-foundations-with-team-foundation Replace team-fm-foundations with team-foundation in CODEOWNERS commit 8adf2b2afd72079e32a5620d4538afb91c884e6b Author: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Wed Jun 17 16:00:16 2026 +0000 Replace team-fm-foundations with team-foundation in CODEOWNERS commit 33d54cc2308bd5ae9da5c43d6a1e0de495406b51 Merge: 3f87e7c1 34580ece Author: Owen McCarthy <[email protected]> Date: Tue Mar 24 09:43:17 2026 -0400 Merge pull request #296 from launchdarkly/security/SEC-7924/pin-github-actions chore: [SEC-7924] pin third-party GitHub Actions to commit SHAs commit 34580ece17b33599919cc9ffd434c52308159843 Author: Patrick Kaeding <[email protected]> Date: Mon Mar 23 23:22:07 2026 -0400 [SEC-7924] chore: pin third-party GitHub Actions to commit SHAs Pin all third-party GitHub Actions to full-length commit SHAs to prevent supply chain attacks. Addresses findings from the third-party-action-not-pinned-to-commit-sha Semgrep rule. commit 3f87e7c1043a786bee5a105dc796a30d99976ba1 Merge: a01aa45c dbef4100 Author: Kane Parkinson <[email protected]> Date: Wed Mar 18 11:32:34 2026 -0700 Merge pull request #295 from launchdarkly/devin/1773853464-update-codeowners-team-name Update CODEOWNERS: rename team-fm-next to team-fm-foundations commit dbef410061f7191faae111a62e48aa69b3f2f224 Author: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Wed Mar 18 18:04:11 2026 +0000 Update CODEOWNERS: rename team-fm-next to team-fm-foundations Co-Authored-By: Kane Parkinson <[email protected]> commit a01aa45cd0f3c1157acd9bed71468638cda4a5e2 Author: Ben Woskow <[email protected]> Date: Fri Jan 23 16:46:14 2026 -0800 [REL-11803] removing the php and javascript targets (#294) removing the php and javascript targets commit 7eab99a5ad75ec763b0ea5716c6cf5078b331ee8 Author: Ben Woskow <[email protected]> Date: Wed Jan 7 13:07:28 2026 -0800 [REL-11491] Extracting out the api version value to a variable (#293) commit 52ac35599899195b42297042ce468143a4ac8afc Author: Ben Woskow <[email protected]> Date: Wed Jan 7 10:26:07 2026 -0800 [REL-11491] Setting the default API version to v4 + fixing several CI breakages (#291) commit e27ba4fb0546ba8887d43f40a1ae9a4da32fa74d Merge: 6284ec26 3781843c Author: Tony Knopp <[email protected]> Date: Wed Jan 7 12:06:24 2026 -0500 Merge pull request #292 from launchdarkly/tknopp/chore/update-codeowners Update CODEOWNERS for Next ownership commit 3781843ce80d2baee83854f7d02494cd441486b9 Author: Tony Knopp <[email protected]> Date: Wed Jan 7 11:55:34 2026 -0500 Update CODEOWNERS Adding fm-next commit 6284ec261eee157295f52b24d99a52d7e2a45a3d Author: Drew Inglis <[email protected]> Date: Wed Dec 3 15:11:44 2025 -0800 Fix whitespace in GH workflow files (#289) Remove EOL whitespace add newlines at ends of files for POSIX compliance commit 2135ae0b698caab33c1747c2988f4edf099418f9 Author: Cody Spath <[email protected]> Date: Wed Oct 29 11:17:33 2025 -0400 [REL-10444] add additionalProperty to set axios version to latest (#287) feat: add additionalProperty to set axios version > 1.12.0 commit 53f454df53736c40b8476fdeba938babfca3b65d Author: Isabelle Miller <[email protected]> Date: Tue Oct 21 15:25:32 2025 +0200 [REL-10233] add dependency-scan GHA to OpenAPI generation (#286) * [REL-10233] i think this should do it * [REL-10233] mkdir if not exists commit 1d577448d7a114665bdcda06bb043bab00fc22ed Author: Henry Barrow <[email protected]> Date: Fri Oct 17 15:42:30 2025 +0100 [REL-10138] Fix Gradle task name to closeAndReleaseSonatypeStagingRepository (#285) The correct task name from gradle-nexus-publish-plugin includes 'Staging': - Incorrect: closeAndReleaseSonatypeRepository - Correct: closeAndReleaseSonatypeStagingRepository This fixes the error 'Task closeAndReleaseSonatypeRepository not found in root project'. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude <[email protected]> commit de4f88351e7c483d99b4d3f9496a9ab432d3c0a8 Author: Henry Barrow <[email protected]> Date: Thu Oct 16 16:29:48 2025 +0100 [REL-10138] Migrate from nexus-staging plugin to gradle-nexus-publish-plugin (#283) * [REL-10138] Fix nexusStaging serverUrl for Sonatype Central Add missing serverUrl configuration to the nexusStaging block to point to the new Sonatype Central staging API. Without this property, the plugin defaults to the old OSSRH URL that was shut down on June 30, 2025, causing 401 Unauthorized errors when attempting to close and release repositories. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]> * [REL-10138] Migrate from nexus-staging plugin to gradle-nexus-publish-plugin Migrate from the old io.codearte.nexus-staging plugin to the newer io.github.gradle-nexus.publish-plugin to properly support Sonatype Central. The old plugin was causing 403 Forbidden errors because it wasn't fully compatible with the Sonatype Central staging API. The new plugin is the recommended solution and provides better support for the new API. Changes: - Replace io.codearte.nexus-staging plugin with io.github.gradle-nexus.publish-plugin v2.0.0 - Remove nexusStaging configuration block and publishing.repositories.maven block - Add nexusPublishing configuration with proper Sonatype Central URLs - Update publish script to use new task names: publishToSonatype and closeAndReleaseSonatypeRepository 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]> --------- Co-authored-by: Claude <[email protected]> commit 155120dfc589ee4d23c132f2fbbd6c3338d465bf Author: Tilde Thurium <[email protected]> Date: Thu Oct 16 07:11:31 2025 -0700 remove developer relations from CODEOWNERS (#284) commit 87063ce51413ef9a930a92f3f7c9456a567ebd5c Author: Lucy <[email protected]> Date: Wed Oct 15 14:38:58 2025 -0700 (bug-fix) Update form-data dependency (#275) There's a critical security vulnerability in `form-data` 3.4.0, which was a transitive dependency of superagent 5.3.0. The superagent version is set in [this mustache file](https://github.com/OpenAPITools/openapi-generator/blob/ddb15d4b9d6fa0f04090b5db3d64ea1b8a6d0ee6/modules/openapi-generator/src/main/resources/Javascript/libraries/javascript/package.mustache) in the openapi generator, but we can override that with our own local `package.mustache`. This bumps the superagent version for the generated `api-client-javascript` to `^7.0.0`, which imports form-data 4.0.4. commit cc162dae45a08699914652721da4fadd5727e827 Author: Henry Barrow <[email protected]> Date: Wed Oct 15 17:33:25 2025 +0100 [REL-10138] Fix nexusStaging serverUrl for Sonatype Central (#282) Add missing serverUrl configuration to the nexusStaging block to point to the new Sonatype Central staging API. Without this property, the plugin defaults to the old OSSRH URL that was shut down on June 30, 2025, causing 401 Unauthorized errors when attempting to close and release repositories. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude <[email protected]> commit c2c2badabdaab248a3a0e3a523b77b707df8877c Author: Henry Barrow <[email protected]> Date: Wed Oct 15 16:49:09 2025 +0100 [REL-10138] Migrate Maven publish from OSSRH to Sonatype Central (#281) * [REL-10138] Migrate Maven publish from OSHH to Sonatype Central * [REL-10138] Revert signing password change * [REL-10138] Update publish URL following https://central.sonatype.org/publish/publish-portal-ossrh-staging-api/ commit 99219f91673b153cbecc890046939d11b0290479 Author: Henry Barrow <[email protected]> Date: Fri Oct 10 14:11:10 2025 +0100 [REL-10048] Fix Java build (#280) * [REL-10048] Add build step to test java build * [REL-10048] Remove unnecessary template * [REL-10048] Just focus on java * [REL-10048] build everything * [REL-10048] try fixing build * [REL-10048] update template * [REL-10048] update template * [REL-10048] update template * [REL-10048] rename artifact reference * [REL-10048] delete build action commit ddcca6afcd7ce8969b732d28beda9b4e7c373573 Author: Henry Barrow <[email protected]> Date: Thu Oct 9 21:33:09 2025 +0100 [REL-10048] Update generator to v7.16.0 (#279) * [REL-10048] Try updating to latest version of generator * [REL-10048] Bump php version commit 00a02e1fb16ffa745643b533f50a357c33545b4b Author: Brodie Vivio <[email protected]> Date: Thu Oct 9 09:36:34 2025 -0700 [EXPT-3347] Attempt to Fix Java Compilation Errors (#276) * fix java testImplementation import to account for openapi generator version bump to 7.5.0 commit e9f4b2728c632a7c30a68a351854331433ceb22b Author: Henry Barrow <[email protected]> Date: Thu Oct 9 16:24:19 2025 +0100 Bump generator to v 7.5.0 (#250) * Bump generator to v 7.5.0 * Fix go client * Fix python client * Fix go template * Bump go in CI and update Makefile * Try removing python partial header * Fix typescript client * Use Api instead of API in go client * Update python model package name * Remove python template reference * Revert models change * Remove typescript template files * [sc-242972] Fix GHA multiline issue * [sc-242972] Ignore scripts * [sc-242972] try bumping js version * [sc-242972] Try fixing js * [sc-242972] Swtch to using npm run build * [sc-242972] Switch to ES6 * [sc-242972] Downgrade to node 20 * [sc-242972] switch back to require * [sc-242972] Don't use link command * [sc-242972] commit package.json * [sc-242972] Try cleaning node module * [sc-242972] modernize * [sc-242972] Try checking in package-lock * [sc-242972] Use babel preset * [sc-242972] Comment out JS test * [sc-242972] Add Check Success job commit 7286ff63eb1c7e6e612ea33ee39857db145e223f Merge: 6fe39caa 8d5a479d Author: Abhishek Acharya <[email protected]> Date: Thu Oct 9 00:52:35 2025 +0530 Merge pull request #277 from launchdarkly/aacharya/migration-gha Gha migration commit 8d5a479db74e49d06c51228c107ca986d0c68659 Author: Abhishek Acharya <[email protected]> Date: Thu Oct 9 00:32:35 2025 +0530 revert java code as its working fine commit fb1c75dfa6a00b44de688b04a684c5afb78259af Author: Abhishek Acharya <[email protected]> Date: Thu Oct 9 00:25:58 2025 +0530 testing java fix commit 4db0165eaf5face1ba8edbb4a4ae6e1a67686fa7 Author: Abhishek Acharya <[email protected]> Date: Thu Oct 9 00:18:12 2025 +0530 fixing js version commit 9b1f5031164da183cea1b3ac1886de75f78f8b7b Author: Abhishek Acharya <[email protected]> Date: Thu Oct 9 00:13:08 2025 +0530 js fix commit 91178912eb2032f745ab085a719bbb319e5e3341 Author: Abhishek Acharya <[email protected]> Date: Wed Oct 8 21:17:21 2025 +0530 fixing flag npx commit ad6767a7fa3c101fcb9dfe777155ebb5d8bffded Author: Abhishek Acharya <[email protected]> Date: Wed Oct 8 21:09:58 2025 +0530 fixing javascript commit 4a44e85f1fd0d699666a530bdec14dfd177d6b70 Author: Abhishek Acharya <[email protected]> Date: Wed Oct 8 20:49:57 2025 +0530 fixing go commit f33e7c11267537b8903a68daf53052352a8b0719 Author: Abhishek Acharya <[email protected]> Date: Wed Oct 8 20:40:54 2025 +0530 fixing ruby commit 9d613f7ab663e97d579ae3f6a960876a83c8c2de Author: Abhishek Acharya <[email protected]> Date: Wed Oct 8 20:27:27 2025 +0530 fixing uid commit 33cd388402521c4a8bce5b141deaf626829e0427 Author: Abhishek Acharya <[email protected]> Date: Wed Oct 8 20:21:12 2025 +0530 added api key commit 4cdc1e9adfbcec53861504344e056ae6f22b0185 Author: Abhishek Acharya <[email protected]> Date: Wed Oct 8 20:00:51 2025 +0530 adding php as well commit 1547f0363943e768d5bb9a072a217f751ed95b9f Author: Abhishek Acharya <[email protected]> Date: Tue Oct 7 22:14:54 2025 +0530 back to gha commit d3939bf77339350aef8b7c9c8363e268cf853a67 Author: Abhishek Acharya <[email protected]> Date: Tue Oct 7 22:11:30 2025 +0530 removed cache in build step commit 57633b59a43c144c01e04fb13d3413fc22acb5e9 Author: Abhishek Acharya <[email protected]> Date: Tue Oct 7 22:09:10 2025 +0530 removed sudo commit db240d49ed21f434c379cf4f6f3cc21e6417359b Author: Abhishek Acharya <[email protected]> Date: Tue Oct 7 22:04:35 2025 +0530 fixing uid commit bf762491fd7ce0573035800f41719ddcf510b4f5 Author: Abhishek Acharya <[email protected]> Date: Tue Oct 7 22:01:04 2025 +0530 added user commit a7fbecd63af149dd583ce85baa1860d2e95a5e31 Author: Abhishek Acharya <[email protected]> Date: Tue Oct 7 21:59:16 2025 +0530 updating runson commit a8a2e46177ed299437453e80bf97f20ed367009d Author: Abhishek Acharya <[email protected]> Date: Tue Oct 7 21:56:34 2025 +0530 removed id commit cd75526f730c56534d1aa8d8ecda144ad2317e42 Author: Abhishek Acharya <[email protected]> Date: Tue Oct 7 21:54:31 2025 +0530 adding rusnon commit 48580d2d9496fc3496ffb2179e85e0a3251a8217 Author: Abhishek Acharya <[email protected]> Date: Tue Oct 7 21:49:50 2025 +0530 fixing version commit 429aa3743b84135ad0c05bd358945214046198da Author: Abhishek Acharya <[email protected]> Date: Tue Oct 7 21:42:34 2025 +0530 testing gha commit 62e57c733235f4ba91fc7622a55280de985e6c7b Author: Abhishek Acharya <[email protected]> Date: Tue Oct 7 20:53:45 2025 +0530 user id fix commit 030b16a9e865d47cd434c52a058baff112b47951 Author: Abhishek Acharya <[email protected]> Date: Tue Oct 7 20:47:49 2025 +0530 testing gha migration commit 6fe39caa2c3b291a3feb292089749bb726b72573 Merge: c55c9591 b70ba044 Author: Chris Blackburn <[email protected]> Date: Fri Apr 4 17:27:27 2025 -0400 Merge pull request #274 from launchdarkly/cblackburn/fix-pypi-upload-error update packaging to be compatible with latest twine commit b70ba04442bb40862d368b397719f78c1c220788 Author: Chris Blackburn <[email protected]> Date: Fri Apr 4 15:52:45 2025 -0400 update packaging to be compatible with latest twine commit c55c9591a2a3e63fc4ab8f3cdcba7e33b721c8d7 Author: Henry Barrow <[email protected]> Date: Tue Feb 25 10:13:45 2025 +0000 Update CODEOWNERS file (#273) Update CODEOWNERS: replace @launchdarkly/team-release-backend with @launchdarkly/team-enterprise commit cc3ded54daed148e711cc17535e162366207eee9 Author: Lucy <[email protected]> Date: Wed Jan 29 09:48:13 2025 -0800 [DOCS-1155] Update README-PREFIX to not hardcode latest version (#272) The README prefix that gets prepended to all generated API client library READMEs had the latest API version hard coded. Now that that version is being deprecated it causes confusion. This updates it to not hard code the exact latest version value. Co-authored-by: Lucy Voigt <[email protected]> commit 40c5eb48d5ec6cfb2de776f2e4bf115e15a9622f Author: Lucy <[email protected]> Date: Fri Dec 13 14:22:54 2024 -0800 Typo in Makefile (#271) Co-authored-by: Lucy Voigt <[email protected]> commit c93ababb686d1a7fc673f6fd77d1cade45793931 Author: Lucy <[email protected]> Date: Fri Dec 13 13:38:33 2024 -0800 Download gpg key to correct path (#270) Co-authored-by: Lucy Voigt <[email protected]> commit 341fb72cee867a0ea2d607f922dd3f7291328b03 Author: Lucy <[email protected]> Date: Fri Dec 13 13:06:39 2024 -0800 Correct path for java code signing keyring (#269) Co-authored-by: Lucy Voigt <[email protected]> commit f30ab00f0801ff22b83d5ad2a6ac76ffe283a67c Author: Lucy <[email protected]> Date: Fri Dec 13 12:45:41 2024 -0800 Add publishing secrets as env vars to get written to files (#268) Co-authored-by: Lucy Voigt <[email protected]> commit b287e4349714f977604c00861228321d5a6a34b2 Author: Lucy <[email protected]> Date: Fri Dec 13 12:31:33 2024 -0800 Run prepare script to set up secrets for publishing (#267) Co-authored-by: Lucy Voigt <[email protected]> commit 1a98ecee139c2ea85a6bf9cc5eea6957b8497026 Author: Lucy <[email protected]> Date: Fri Dec 13 12:15:45 2024 -0800 Try setting stack size in gradle.properties (#266) Co-authored-by: Lucy Voigt <[email protected]> commit d8ad9d964800721e9918eb356d8f97a8ae4a166b Author: Lucy <[email protected]> Date: Fri Dec 13 11:58:33 2024 -0800 Bump java thread stack size (#265) Co-authored-by: Lucy Voigt <[email protected]> commit 8ba48f4f5ad25774084a184ebfa3fa162e3f8b49 Author: Paddy <[email protected]> Date: Fri Dec 13 11:39:21 2024 -0800 Log the stack size for Java. (#264) commit 9ad100c439975f53ef017b54400aa029f503b2e6 Author: Lucy <[email protected]> Date: Fri Dec 13 10:45:31 2024 -0800 Remove java env attempt (#263) Co-authored-by: Lucy Voigt <[email protected]> commit 2aaf6895c71471cf7e94f4f9f145f548873dd640 Author: Lucy <[email protected]> Date: Fri Dec 13 10:40:10 2024 -0800 Use java 11 instead of 17 (#262) Co-authored-by: Lucy Voigt <[email protected]> commit e96e03c092284e7680dc442cfec37e44b8ab7e96 Author: Lucy <[email protected]> Date: Fri Dec 13 10:20:19 2024 -0800 Give GH action permission (#261) Co-authored-by: Lucy Voigt <[email protected]> commit 69623c06abe4d13d03c8f9002e1e1866dc589d6c Author: Lucy <[email protected]> Date: Fri Dec 13 10:12:56 2024 -0800 Sudo python update for file permissions (#260) Co-authored-by: Lucy Voigt <[email protected]> commit fcd541d13137330b6482e4656c4978ae160c6899 Author: Lucy <[email protected]> Date: Fri Dec 13 10:06:50 2024 -0800 Sudo install golang (#259) Co-authored-by: Lucy Voigt <[email protected]> commit 46dfb4d496a082acd5448c4b71d4f22f09abb03b Author: Lucy <[email protected]> Date: Fri Dec 13 09:50:40 2024 -0800 [RO-771] Add manual setup steps (#258) Add manual setup steps Co-authored-by: Lucy Voigt <[email protected]> commit 8252b34383534bea27c7608ac5a783ffebaf52a9 Author: Lucy <[email protected]> Date: Thu Dec 12 15:59:29 2024 -0800 Try default ubuntu image and hope it magically has everything we need (#257) Co-authored-by: Lucy Voigt <[email protected]> commit e568639a77930556368fecf970436bf9ef11ebeb Author: Lucy <[email protected]> Date: Thu Dec 12 15:52:33 2024 -0800 Try pinning checkout version to work with Docker images (#256) Co-authored-by: Lucy Voigt <[email protected]> commit c90a0da7d69cb026f1a1655b717946edbe115d39 Author: Lucy <[email protected]> Date: Thu Dec 12 15:34:06 2024 -0800 [RO-771] Migrate repo from Releaser to manual GH Action (#255) * [RO-771] Migrate repo from Releaser to manual GH Action This moves the release process for LD API client libraries from Releaser to Github Actions. I looked at improving the release process itself (to not write out secrets to files, or use more standard release tools) and ultimately it seemed easiest to move everything wholesale and make any improvements to the actual process separately. * Add back releaser files --------- Co-authored-by: Lucy Voigt <[email protected]> commit 4511d082be56e24a295e04561b8894f54218257d Merge: fc9eae4c 94cdd5e5 Author: LaunchDarklyReleaseBot <[email protected]> Date: Mon Oct 14 10:23:53 2024 +0000 merge from public after release commit fc9eae4cb017ebefb65a6ffb43c1a794a749a82f Author: Henry Barrow <[email protected]> Date: Fri Aug 16 15:51:55 2024 +0100 Transfer code ownership (#254) * Transfer code ownership * Add developer relations commit 3b039a2a8c3c84e29baf902c6ab679e3f7269a1f Merge: 3b7867c3 8f621bbb Author: LaunchDarklyReleaseBot <[email protected]> Date: Thu May 16 11:32:19 2024 +0000 merge from public after release commit 3b7867c31ab233038013b8ffe1bc19aec19d15c3 Author: Henry Barrow <[email protected]> Date: Thu May 16 12:21:27 2024 +0100 Fix typo in package.json template extension (#253) * Fix typo in package.json template name * Remove ESM clause commit e7cc9a6fdd41553ec874c48746831a79ab7ba59f Merge: 9a23b8a0 0d065e9a Author: LaunchDarklyReleaseBot <[email protected]> Date: Thu May 16 10:14:05 2024 +0000 merge from public after release commit 9a23b8a01b1a1744516ecee373509cd2a68aacf7 Author: Henry Barrow <[email protected]> Date: Wed May 15 15:40:59 2024 +0100 Generate go interface (#252) commit ec516afb7c24a31f1e648814df527c3b37cd1f3b Author: Henry Barrow <[email protected]> Date: Wed May 15 15:20:03 2024 +0100 Update Axios dependency in Typescript client (#251) * Update .gitignore * Try updating axios * Update package.json * Update sample commit fa0f8b84746ccd07c2a75306d7594b918aae9e8c Author: Lucy Voigt <[email protected]> Date: Mon Apr 10 14:16:48 2023 -0700 Only include 'View code' link if sample code is available (#248) * Only include 'View code' link if sample code is available * Add description to Typescript README --------- Co-authored-by: Lucy Voigt <[email protected]> commit a73a23a22eda0c78823342769de2acc0104e75cc Merge: 3fdd0fb1 8375579c Author: LaunchDarklyReleaseBot <[email protected]> Date: Tue Feb 28 02:11:32 2023 +0000 merge from public after release commit 3fdd0fb1af9106e726667226f381b4584791529f Author: Lucy Voigt <[email protected]> Date: Mon Feb 27 17:53:34 2023 -0800 Update SSM parameter paths (#247) Co-authored-by: Lucy Voigt <[email protected]> c…
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
cspath1
approved these changes
Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.