Sync Private repo to public mirror - #135
Merged
Merged
Conversation
commit f62ef952556ebcda3ad568d3864177be628f0af0
Merge: 6c008119 15c3457e
Author: Fabian <feldbergf@gmail.com>
Date: Tue Aug 4 13:56:35 2026 +0100
Merge pull request #305 from launchdarkly/ffeldberg/REL-15193/merge-public-history
Merge public ld-openapi history, so mirroring stops conflicting
commit 15c3457ec09e701131df6b6e13ada49bfd923b55
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Tue Aug 4 13:23:41 2026 +0100
Drop the Confluence links ahead of mirroring
Two comments carried the internal runbook URL - the release.yml header and
preflight.sh's - and this repo is mirrored to the public launchdarkly/ld-openapi,
where a link nobody outside the company can open is noise at best. Both now refer
to "the release runbook" without the URL; the surrounding explanations, which are
the part that actually helps a reader, are untouched.
Nothing else was changed. The remaining references to internal repositories,
paths, the trust-policy identity and the Slack channel are reasonable to have in
public: they are names of things, not credentials, and several are already public
- .github/runs-on.yml with its `_extends: .github-private` exists verbatim in the
public repo today.
The only other match in the tree is the generator jar, which is a local download
and gitignored; no .jar is committed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit 951b78585e748f788d6bc7ef342e899b7f8e5f3c
Merge: 6c008119 dd8e70fe
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Tue Aug 4 13:12:59 2026 +0100
Merge public ld-openapi history, keeping this repo's work
The two repos last shared an ancestor in October 2024 (94cdd5e5, "prepare 17.0.0
release"): 224 commits here, 10 there. That is why mirroring private onto public
conflicts add/add on the workflow files - both sides created them independently
after the split - and why the mirror job has never completed.
Merging public in first establishes shared history, so the mirror in the other
direction is an ordinary fast-forwardable merge rather than a conflict to
re-resolve by hand on every release.
Content-wise this changes almost nothing, which is the useful finding: public had
nothing this repo lacks. All four conflicts resolved to our side.
README.md, Makefile public's are strict subsets. Ours keeps the axios
1.18.1 pin and the push_dry_run prerequisite.
ci.yml, release.yml ours; public's predate the automation entirely.
samples/javascript, left deleted. Neither existed at the merge base;
templates/javascript public acquired them through earlier mirror merges
and a01aa45c removed the php and javascript targets
here deliberately. Re-adding them would undo that.
The 10 public-only commits are duplicates of work already here, applied
separately - the SEC-7924 action pinning and the CODEOWNERS renames - so nothing
unique is lost. CODEOWNERS and dependency-scan-gha.yml were already identical.
Also pins runs-on/action, the one third-party action still on a floating tag, to
match what SEC-7924 established on the public side. launchdarkly/octosts-action
stays on @v1 deliberately: it is first-party and its maintainer pushes security
updates to that tag.
Verified: no conflict markers, all three workflows parse, selfcheck 10/10, and the
staged tree differs from this repo's main by exactly the one pin.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit 6c008119702631d051f93c9556f794d935c7b49f
Merge: b59f010b 6a22265b
Author: Fabian <feldbergf@gmail.com>
Date: Tue Aug 4 12:47:23 2026 +0100
Merge pull request #304 from launchdarkly/ffeldberg/REL-15193/downstream-and-verify-fixes
Fix the three defects the 24.0.0 release exposed
commit 6a22265ba3c63f55c068ec22b5419511c67b049f
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Tue Aug 4 12:24:52 2026 +0100
Skip the trust-policy checks on a response that is not a policy
The selfcheck job failed in CI on this branch, reporting that the policy grants no
permissions and lists no repositories:
repos/${GONFALON}/commits/main needs 'contents' but the policy grants: []
FAIL pr-downstream targets absent from the policy's repositories: ...
Caused by the change in the previous commit that gave the CI step a GITHUB_TOKEN.
The policy lives in a private repo that token cannot read, so `gh api` now returns
a 404 error body on stdout instead of nothing. The fetch used `|| true`, which
discarded the exit status but kept the body, and a GitHub API error body is valid
YAML - so it parsed into a dict with none of the keys the checks read, and they
failed against something that was never a policy. Before the token was added, gh
produced no output and the checks skipped correctly.
Two fixes, because either alone leaves a hole. The fetch now respects gh's exit
status rather than swallowing it, and the result is shape-checked for the four keys
the checks actually read before any of them run. Anything else means SKIP, with a
message naming which situation applies - not readable at all, or fetched but not a
policy - so a skip is diagnosable instead of ambient.
This is the same defect class as the previous commit, one layer along: there the
check passed having verified nothing, here it failed having verified something that
was not the subject. Validate the input before trusting a verdict about it.
Verified against the exact CI condition - a stub returning the 404 body with a
non-zero exit - which now yields three SKIPs and exit 0; against a 200 whose body
is not a policy, which SKIPs and names the missing keys; and with the real policy
present, which still runs everything, 10/10.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit da4734df42b62cf9370523770fab230b4d15a2e8
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Tue Aug 4 12:09:24 2026 +0100
Bring CLAUDE.md and README.md up to date, and keep internals out of both
This repo is mirrored to the public launchdarkly/ld-openapi, so both files are
effectively public. Neither now names the internal service repo that owns the
spec, the federated-token infrastructure or its trust-policy identity, the
internal policy or IaC repositories, internal service accounts, team names, Slack
channels, or internal documentation URLs. The public repo has no references to any
of those today, so this keeps that boundary rather than widening it. Where an
internal system matters to understanding the flow it is described by what it does,
with the concrete names left to the workflow files.
CLAUDE.md is also brought current: the three gates and their overrides, the
credential audit, both downstream PR jobs and why they are skipped on a rehearsal,
verify-published's hard and soft checks and the reason the Go proxy is soft, the
selfcheck harness and the two rules it enforces about itself, the id-token
requirement including the reusable-workflow double grant, and the fact that a
rehearsal's log is nearly indistinguishable from a real release. Also records the
immutability of published registry versions and the re-run failed jobs rule, which
are the two things most likely to turn a partial failure into a worse one.
README.md previously described releases in one sentence. It now walks the actual
sequence, lists the inputs worth knowing, and states the immutable-version
constraint. It also documents single-language generation, the template override
convention and its coupling to GENERATOR_VERSION, and how generated clients are
verified - all things a reader of the public repo would otherwise have to infer
from the Makefile.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit e179fc8f656fa8ffd48fb6a8b074a33d33dde01f
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Tue Aug 4 12:01:49 2026 +0100
Stop selfcheck passing when it verified nothing
Review finding, and correct. The ACTION-INPUTS check swallowed every lookup
failure and only counted successes, so if no action could be resolved it printed
"CHECKED 0" and then PASSed. In CI that was guaranteed: the selfcheck step had no
GH_TOKEN, so `gh api` failed for every action and the check reported success
having verified nothing - false assurance about exactly the mistake it was added
to catch.
Now reports SKIP when it resolved nothing, and SKIP naming the specific actions
when it resolved only some, rather than passing on a partial sample.
The CI step also now passes GITHUB_TOKEN, which is sufficient to read the pinned
action repos - all public - so the check actually runs there instead of skipping
forever. A permanently-skipped check is barely better than a falsely-passing one.
The same shape existed in two other checks, so fixed the class rather than the
instance: a count derived by extracting from the workflows means "the extractor
broke" far more often than it means "the repo is clean". The OIDC check now
cross-references the raw YAML text and fails if the workflows mention
octosts-action while it detected no token-minting job; POLICY-REPOS fails if it
finds no pr-downstream targets at all.
Verified: unauthenticated gh now yields SKIP rather than PASS; breaking the OIDC
extractor while leaving the real usage in place is caught as "the check is
broken"; a normal local run still passes 10/10.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit ee1baff0785af5a54a2d6bdc84ac5bcca1fd8fc1
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Tue Aug 4 11:53:23 2026 +0100
Fix the three defects the 24.0.0 release exposed
All three surfaced only during a real release, and all three are now covered by
selfcheck so they cannot recur silently.
Team reviewers cannot be requested with a federated token. The provider job failed
with "Unable to request reviewers. If requesting team reviewers a 'repo' scoped PAT
is required" - after it had already created PR #528 - so the work succeeded and the
job went red on a trailing step. This is a consequence of moving from a PAT to
OctoSTS; foundation's workflow gets away with team-reviewers because it still uses
a PAT. Both downstream jobs now request the dispatcher instead. CODEOWNERS in each
downstream repo still pulls in the owning team, so nothing is lost.
The pinned pr-downstream has no `dryrun` input. Passing one produced only a
warning, and the value was ignored, so both downstream jobs were attempting real
PR creation during a rehearsal. They only failed to open PRs because the version
they bump to did not exist yet - luck, not design, and the dry run's safety was
documented on the strength of that input existing. Both jobs are now skipped
outright when dryRun is set, which is honest about what a rehearsal can cover:
these jobs cannot be exercised without a published version to bump to.
The Go module proxy check is now soft rather than hard. Go has no publish step -
the tag is the release, and the tag is already checked directly - and
proxy.golang.org caches negative lookups, so the earlier dry run's `go get` for
v24.0.0 made it serve "unknown revision" for a while afterwards. That failed
verify-published on a release where every registry had in fact published,
which then skipped the GitHub releases and both downstream PRs.
Adds an ACTION-INPUTS check to selfcheck: for every third-party action pinned to a
ref, it fetches that ref's action.yml and asserts each input the workflow passes is
actually declared. Verified by reintroducing `dryrun` and confirming it is caught
as "not an input of launchdarkly-labs/pr-downstream@08b3feb5df32". Covers 24 pinned
action/input pairs.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit b59f010b9267ea7f634428f33024616633b8a5d4
Merge: 2a1a906e 9ce6910e
Author: Fabian <feldbergf@gmail.com>
Date: Mon Aug 3 16:48:01 2026 +0100
Merge pull request #303 from launchdarkly/ffeldberg/REL-15193/parity-gate-diagnostics
Say what the spec-parity gate is waiting for
commit 9ce6910e63988797cc531b7ce78db8821616b88a
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Mon Aug 3 16:24:25 2026 +0100
Close a blind spot in selfcheck's endpoint extraction
Review finding, and correct on both counts.
The drift-explanation block added a gonfalon call listing commits that touch the
spec path. Its URL sits on a backslash continuation line, and the extractor
matched only `gh_gonfalon api "..."` on a single line - so the call was invisible.
It was therefore neither validated against the granted permissions nor reported as
unrecognised, which is exactly the silent gap the endpoint table exists to close.
Six calls existed; selfcheck was checking five.
That is worse than a missing table entry, because it defeats the guarantee
documented in CLAUDE.md: an unknown endpoint is supposed to fail rather than be
assumed fine. A missing entry is loud; an undetected call is not.
Fixes both halves:
- joins backslash continuations before extracting, so no future call can slip
past regardless of formatting, and errors out if extraction finds nothing at
all rather than silently passing an empty set
- adds /commits?path= -> contents to the table
Now checks 6 of 6 calls. The endpoint needs `contents`, which the policy already
grants, so no trust-policy change is needed.
Verified by planting an unrecognised endpoint on a continuation line - now caught
as "not in selfcheck's endpoint->permission table" - and by pointing a same-line
call at /status, still caught as needing an ungranted permission.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit 0333f8a8b43fcdb165f81ef375bdafd0769c0eca
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Mon Aug 3 16:16:19 2026 +0100
Add skipSpecParity, so a pending deploy cannot block a release
Gate 1 refuses to release while gonfalon main's spec is ahead of production. That
is the right default - it keeps the published release notes matched to the spec
that actually ships - but it has no override, so an undeployed spec commit blocks
the release entirely, for as long as the deploy takes.
Right now that is holding up 24.0.0 over six schema properties: VR-65 adds
_site/_links.site to AITool, PromptSnippet, AgentGraph, AIConfigs, PromptSnippets
and AITools, and production has not picked it up in over two hours. Paths and
schema counts are otherwise identical between the two specs.
skipSpecParity releases what production is serving. It does not change what ships,
since the build downloads the spec from production either way - it changes whether
the run refuses to proceed. The cost is that version and changelog still come from
main, so release notes may describe merged-but-undeployed changes and the
downstream gonfalon PR would record them against this version. Those entries need
trimming in that PR, which requires review anyway. The gate logs exactly that when
the flag is used.
Default is unchanged: without the flag it still waits and then fails with the
commit it was waiting on.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit 98f8799c0330c7981c76541b0eda352ef34675f3
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Mon Aug 3 16:08:47 2026 +0100
Say what the spec-parity gate is waiting for
The gate reported only two blob hashes - "prod=c0314584 main=1a42c60b" - then
polled silently for up to 30 minutes. That says nothing about what is in flight or
how stale production is, which is the only question an operator has when a release
stalls here.
On the first mismatch it now resolves prod's blob back to the gonfalon commit that
produced it, and names both sides:
prod is serving apidocs/openapi-public-final.json from 70f24a20b 2026-07-31T17:20:52Z
feat(releases): expose active phase status on release progression API (#68403)
main's latest spec commit is f5999286e 2026-08-03T14:59:00Z
Add canonical relative _site links to public API resources (VR-65) (#67542)
Resolved once rather than per poll, so a long wait costs a handful of extra API
calls rather than hundreds.
If prod's spec matches no recent commit on main it now says so explicitly instead
of waiting silently. That would mean production is serving something never merged,
or the file moved, and either is worth stopping for.
The timeout message names the commit being waited on and why the wait matters:
releasing early would publish release notes describing endpoints the shipped spec
does not contain.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit 2a1a906eedf123002e92ce6669b7d171c7ae23dc
Merge: e5599709 69d3a58c
Author: Fabian <feldbergf@gmail.com>
Date: Mon Aug 3 15:58:07 2026 +0100
Merge pull request #302 from launchdarkly/ffeldberg/REL-15193/gonfalon-checks-permission
Fix the gonfalon CI gate and the OctoSTS scope check
commit 69d3a58c0e972cc8a3a2c6a63765af7b1d6f31a8
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Mon Aug 3 15:48:58 2026 +0100
Add a local selfcheck for the release automation
Every failure in this automation so far was discoverable without running a
release, but nothing was checking for it, so each one cost a merge, a dispatch,
and a wait. This closes that loop: static checks that run in seconds locally and
gate CI.
One check per defect that actually shipped:
OIDC a job used octosts-action without id-token: write
POLICY-PERM the CI gate called an endpoint the trust policy did not permit
POLICY-MATCH an unanchored job_workflow_ref that could never match
POLICY-REPOS a downstream target missing from the policy's allowlist
SECRETS a workflow referenced a secret that did not exist
DRYRUN a make dry-run target that was a silent no-op
PORTABILITY mapfile and bare sed -i, which break on macOS bash 3.2
Verified by reintroducing all six defects one at a time and confirming each is
caught with a specific message, not just a generic failure.
The endpoint-to-permission table is the interesting part: it maps each API call
preflight makes through the federated token to the GitHub App permission that
call requires, and fails if the trust policy does not grant it. An unrecognised
endpoint is a failure rather than an assumed pass, so adding a call without
considering permissions cannot silently reintroduce a 403.
Trust-policy checks need the policy, which lives in the private
launchdarkly/.github-private. Locally it is read from a checkout or via gh; in CI
neither is available, so those three checks skip and the run still passes on the
remaining five. Confirmed by running with gh shadowed by a failing stub.
Also quotes the bump assignments in preflight.sh to clear SC2209, so shellcheck
is clean at -S warning across every script this automation owns and the gate is
meaningful.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit 139d1c6362dcf03ee5585e8a4ca0e11e056b639d
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Mon Aug 3 15:32:14 2026 +0100
Fix the gonfalon CI gate and the OctoSTS scope check
Two separate defects, found by the second dry run on main. The id-token fix
worked - the token minted and the trust policy matched - so these are what was
behind it.
Preflight's Gate 2 died with "Resource not accessible by integration (HTTP 403)".
It called /commits/{sha}/status, which needs the `statuses` permission. No policy
in launchdarkly/.github-private grants that and it may not be available on the
OctoSTS app at all, so the gate now uses check-runs only, which needs
`checks: read` - granted, and with precedent in service-template-go-sync. The
tradeoff is that legacy commit statuses from external systems are no longer
considered; the GitHub Actions checks are what "is gonfalon green" means here.
Also paginates, which the previous version did not: gonfalon main currently has
84 check runs, well past the first page of 30.
The audit reported "missing push on launchdarkly/gonfalon (granted: none)" for a
token that had just been minted with contents: write. The check inspected
`.permissions` on the repo endpoint, which reports a *user's* role - push, pull,
admin - and an App installation token has no role, only granular permissions, so
that field is always empty for it. My local tests passed only because I stood a
PAT in for the minted token, which does have a role. It now enumerates scope with
/installation/repositories, which is what actually catches the failure worth
catching: a repo missing from the policy's allowlist. An installation token's
permission set cannot be read back over the API, so write access is reported
UNVERIFIED and is proven only when a downstream PR opens.
Requires adding `checks: read` to the trust policy; that is a separate change in
launchdarkly/.github-private.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit e559970938c3ec7286b926cdbb10e810ebf93ce0
Merge: d0bb8ac4 3c690bcd
Author: Fabian <feldbergf@gmail.com>
Date: Mon Aug 3 15:21:19 2026 +0100
Merge pull request #301 from launchdarkly/ffeldberg/REL-15193/octosts-id-token-permission
Grant id-token: write to every job that mints an OctoSTS token
commit 3c690bcd5412f4daca956ca350ab24b9952ad185
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Mon Aug 3 15:04:29 2026 +0100
Grant id-token: write to every job that mints an OctoSTS token
The first dry run on main failed in both Preflight and Token audit with:
Missing required environment variables - have you set 'id-token: write' in your
workflow?
octosts-action exchanges a GitHub Actions OIDC token, which requires
id-token: write on the job. Only the release job had it, granted long ago for the
AWS OIDC role that fetches the Java signing key; the four jobs added by the
release automation did not, so every exchange failed before it could reach the
trust policy.
Adds it to preflight, downstream-gonfalon, downstream-terraform-provider, and the
token-audit caller. For token-audit it has to be granted twice - on the calling
job here and at the workflow level in token-audit.yml - because a reusable
workflow is capped by the permissions its caller holds, and token-audit.yml's own
block previously restricted it to contents: read.
Nothing was wrong with the trust policy: the exchange never got far enough to
consult it. The audit's continue-on-error on the mint step did its job, reporting
"no federated token was minted" and still checking everything else, which is what
isolated this to the OIDC step rather than the policy.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit d0bb8ac407088e8c3edca93cc164015dddc144b7
Merge: f71c64cd a6e006e1
Author: Fabian <feldbergf@gmail.com>
Date: Mon Aug 3 15:00:02 2026 +0100
Merge pull request #300 from launchdarkly/ffeldberg/REL-15193/automate-openapi-client-releases
Prepare for fully automating openapi client releases
commit a6e006e1998378eec05ee8f2af337d5859b2dead
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Mon Aug 3 14:48:09 2026 +0100
Correct the pre-merge testing note for the main-only trust policy
The OctoSTS grant is pinned to refs/heads/main, so the earlier claim that branch
dispatches federate no longer holds. Everything else in release.yml is still
testable from a branch; the federated-token steps are not.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit d8fbfa52554dd599bf5000b9d72c3dd75bf5157a
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Mon Aug 3 14:27:58 2026 +0100
Document that OctoSTS claim patterns are anchored
octo-sts compiles each claim pattern as regexp.Compile("^" + v + "$"), and
job_workflow_ref always carries an @refs/heads/... suffix, so a pattern ending at
.yml silently matches nothing and every token exchange is denied. Cost us a round
of review on the trust policy; worth recording next to the other two traps.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit d38a46d222851aabdfed1fce996b90d0f14a88cf
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Mon Aug 3 14:22:55 2026 +0100
Request review from team-enterprise on the provider PR
terraform-provider-launchdarkly's CODEOWNERS assigns everything outside /docs/ to
@launchdarkly/team-enterprise. team-integrations was a guess and wrong.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit b86a2edfd9b073d4519fca4ffa1142c66364f7fe
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Mon Aug 3 14:18:06 2026 +0100
Federate downstream access with OctoSTS, and add the terraform provider
Replaces the PR_CREATOR_GH_TOKEN approach entirely, per review feedback on the
terraform PR: OctoSTS mints credentials at runtime, so no long-lived token has to
be provisioned, stored, or rotated for this. The terraform change that would have
added one is dropped.
Both downstream jobs and the preflight gonfalon reads now take their token from
launchdarkly/octosts-action@v1, governed by a ld-openapi-downstream trust policy
in launchdarkly/.github-private. BOT_TOKEN keeps only what it already had: the
client repos and the public mirror.
Two things about the policy that are easy to get wrong. LaunchDarkly's instance
reads policies from .github/launchdarkly/, not the .github/chainguard/ path that
both the upstream octo-sts README and the action's own docs document - the
documented path exists nowhere in the org. And org-scoped policies carry a
`repositories` allowlist, so a new downstream target has to be added there or the
minted token cannot see it.
Adds downstream-terraform-provider, so a release also opens a bump PR against
terraform-provider-launchdarkly. That repo gets its own `make
update-api-client-go`, mirroring gonfalon's, keeping each codemod beside the
imports it rewrites - ~220 files there, and plain Go rather than bazel. Its
commit message uses a chore(deps) prefix because the repo runs release-please and
a feat prefix would cut a provider release on its own.
The token audit now mints a token and checks it rather than inspecting a stored
secret. What fails with federation is the federation: a missing policy, a
job_workflow_ref that does not match, or a repo left out of the allowlist. It
checks both downstream repos, and reports clearly when no token was minted at
all. Note the policy has to name token-audit.yml as well as release.yml, because
a reusable workflow reports its own path in job_workflow_ref, not the caller's.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit d6efcf2561ffb741600416620b9d07339a5a0ab8
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Mon Aug 3 13:51:45 2026 +0100
Detect the terraform placeholder in the token audit
The SSM parameters backing these secrets are created by terraform holding the
literal string SET_IN_PARAMETER_STORE, and the real value is written by hand
afterwards. Between those two points the GitHub secret exists but is the
placeholder, and GitHub answers an API call with it as "Bad credentials" - true
but unhelpful. Name the actual situation instead.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit ffff51c05bb2e1a2e4a3f9f13654ee3174718038
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Mon Aug 3 13:44:21 2026 +0100
Set GOPRIVATE for the gonfalon downstream job
pr-downstream rewrites all github.com URLs to authenticate with the supplied
token, and gonfalon's `make tidy` then resolves Go modules from private
launchdarkly repos. Without GOPRIVATE, go consults proxy.golang.org for those
paths and gets a 404. The equivalent gonfalon job in launchdarkly/foundation's
pr-downstream workflow sets this at the workflow level; ours had not.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit 5fdbee71b0a334e425e1df887e7336933fcdd1d6
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Mon Aug 3 13:41:53 2026 +0100
Read gonfalon with PR_CREATOR_GH_TOKEN, and stop failing valid RubyGems keys
Findings from the first dispatched token audit.
BOT_TOKEN cannot see launchdarkly/gonfalon at all, so preflight died on its very
first gate. It should never have been asked to: BOT_TOKEN is the releaser
credential for the client repos, and granting the release bot read access to the
main application repo just to fetch a spec blob and a changelog is the wrong
trade. Preflight now reads gonfalon through GONFALON_TOKEN, defaulting to
PR_CREATOR_GH_TOKEN, whose service account already has push on gonfalon. Client
repo calls still use BOT_TOKEN. Consequence: PR_CREATOR_GH_TOKEN is needed on
every run, not only when the downstream PR job is enabled, so the audit now
demands read unconditionally and push only when that job will run.
The RUBYGEM_API_KEY failure was my check, not the credential. RubyGems API keys
are scoped, and a key scoped to push_rubygem - which is all releasing needs, and
the correct level of privilege - is rejected by /api/v1/profile/me.json. The last
release published fine, so the key is valid. There is no read-only endpoint a
push-only key can pass, so this is now reported UNVERIFIED alongside PYPI_TOKEN
rather than as a failure.
Also softened the Central Portal probe: a non-401/403 response reflects the
probe's request shape, not the credentials. Verified the probe still detects
genuinely bad credentials, which return 401.
Confirmed by the same audit run: BOT_TOKEN does have push on the public
ld-openapi, so dropping PUBLIC_MIRROR_GH_TOKEN was correct.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit ac9c822b0530ffb69754f0df0a3c1b4cd6f7f531
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Mon Aug 3 12:28:43 2026 +0100
Use BOT_TOKEN for the public mirror instead of a new secret
Checking how the terraform repo provisions these credentials showed that one of
the two secrets this branch introduced does not need to exist.
Public ld-openapi grants "sa-release-bots" = "Releaser" in
accounts/github/launchdarkly/common/repo_ld-openapi.tf, the identical grant the
api-client-* repos carry, and BOT_TOKEN is the releaser token
(/global/services/github/releaser-github-token) that already pushes to those
repos on every release. So the mirror can use BOT_TOKEN for both sides, and
PUBLIC_MIRROR_GH_TOKEN is dropped: one fewer secret to provision, and no
terraform change needed for mirroring.
The audit now checks BOT_TOKEN's push access on launchdarkly/ld-openapi rather
than the existence of a separate secret, still gated on mirrorPublic.
PR_CREATOR_GH_TOKEN is left as is. It resolves as an organization-level secret:
foundation's pr-downstream workflow has been succeeding with no repo-level
secret of that name and none declared for it in terraform. Whether it reaches
this repo depends on the org secret's visibility, which needs org admin to read,
so the token audit is the way to find out. CLAUDE.md records the fallback -
declare it per-repo as integration-framework-private, accelerate, and gonfalon
do. No access grant is needed on gonfalon either way: pd-sa-pr-creator already
has push there.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit f4e5ff14c34c97ff632d1453a18f3063c205d0c7
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Mon Aug 3 12:21:11 2026 +0100
Pin axios to 1.18.1 to unbreak the TypeScript client build
The generated TypeScript client has stopped compiling, which blocks CI on every
PR and would fail a real release at build_clients:
common.ts(108,14): error TS2527: The inferred type of 'createRequestFunction'
references an inaccessible 'unique symbol' type. A type annotation is necessary.
Nothing in this repo caused it. axios 1.19.0, released 2026-07-29, added
`declare const axiosResponseDefault: unique symbol` to index.d.ts and refers to
it from the public return type of request(). The symbol is never exported, so
tsc cannot name it while inferring the type of createRequestFunction. Because
axiosVersion was a floating ^1.13.1, every build since picked up 1.19.0. Bisected
locally: 1.13.1 through 1.18.1 all build, 1.19.0 alone fails. The last green CI
run was 22 June, when 1.18.1 was current.
Not fixed upstream: openapi-generator master still emits the unannotated
function, and 1.19.0 is still axios latest with no patch release.
Pinning is deliberately the stopgap rather than the fix. The real fix is a
common.mustache override annotating the returned closure, `): Promise<R> =>`
with `as Promise<R>` on the axios.request call, which I verified compiles clean
against 1.19.0 and against older axios. It is deferred because it adds a fifth
template override to keep in sync on generator upgrades. The Makefile comment
records both the reasoning and when to revert.
Verified by regenerating the client from scratch and running what CI runs: npm
install, tsc and the esm build both emit, and the sample compiles against the
result. The sample's npm start was not run locally as it needs LD_API_KEY and
creates a real flag.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit fc72f93bd6eb57f2d5cb86c616ee0954d99e22c4
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Mon Aug 3 12:10:16 2026 +0100
Fix release-graph and dry-run defects found in review
Three defects, all real:
verify-published demanded a v<version> tag on all five client repos, but
`make push` tags only Go that way; the other four get a bare <version>, and
their v<version> tag is created later by create-release, which runs *after*
verification. Every healthy release would have reported four failures, failed
the job, and skipped create-release, the gonfalon PR, and the mirror - telling
the operator to delete tags and retry. My own validation missed it because I
tested against 23.0.0, an already-completed release where create-release had
long since added the v tags. Now checks what exists at that point in the graph.
`make push_dry_run` was a no-op: the target carried GIT_PUSH_COMMAND and
GIT_PUSH_DESC assignments but, unlike push_test, no prerequisite on `push`, so
it printed "Nothing to be done" and exited 0. A rehearsal therefore never
cloned a client repo, never committed, and never checked push access, while
CLAUDE.md claimed it did all three. Latent in the repo before this branch, and
the pre-existing publish-dry-run.sh was affected too.
Version derivation took the first entry of the tags endpoint, which GitHub does
not document as semver-sorted and which is not lexicographically safe either
(v9.0.0 vs v17.0.0). Now filters to release tags and sorts with sort -V.
Also adds openDownstreamPr, mirroring mirrorPublic, and makes the token audit
demand only the credentials the current run will use. Without this a missing
PR_CREATOR_GH_TOKEN or PUBLIC_MIRROR_GH_TOKEN blocks the audit gate and so
blocks any rehearsal - neither secret exists in this repo yet, so the flow
could not be exercised at all before creating them.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit 5a233dfe54d13e1d98569032b809eb1befae0913
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Mon Aug 3 11:40:49 2026 +0100
Audit release credentials read-only, and gate releases on it
Answers "do these tokens have the permissions they need?" without a release.
A dry run cannot: create-release is skipped entirely, pr-downstream skips PR
creation, and the publish dry-run scripts never authenticate to any registry,
so a rehearsal proves almost nothing about credentials.
token-audit.sh asks each provider directly, using only GETs and whoami-style
calls. For GitHub it reads `.permissions` on the repo endpoint, which reflects
what that specific token can do. It reports UNVERIFIED rather than passing
silently where no read-only check exists: PyPI has no token introspection
endpoint, and confirming LD_API_KEY can write would mean writing.
This runs as a gate on every release rather than only on rehearsals. A bad
registry credential would otherwise surface after `make push` had already
tagged five client repos, which is the case that forces the
delete-the-tags-and-retry dance the runbook warns about. Mirroring is checked
conditionally so a missing PUBLIC_MIRROR_GH_TOKEN cannot block a release that
runs with mirrorPublic off.
Also fixes a bug in the dry-run path added in the previous commit: the
scripts/release-dry-run/*.sh scripts all copy their would-be-published
artifacts into LD_RELEASE_ARTIFACTS_DIR and fail on mkdir when it is unset,
which it was. The workflow now sets it and uploads the result, so a rehearsal
also shows exactly what would have been published.
ci.yml gains workflow_dispatch, both so it can run against any branch and
because its sample programs create and delete a real flag - which is the only
way to confirm LD_API_KEY has write access, the one thing the audit cannot
check.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit 16dfecf27e7121ab045d0329a16f10f4f2ca1c5f
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Mon Aug 3 11:33:54 2026 +0100
Add CLAUDE.md
Documents what is not discoverable from a quick read of the repo: that this is
a generator rather than a library, that the spec is downloaded from production
at build time so build output depends on what is deployed, that the mustache
overrides are verbatim upstream copies which must be re-copied when
GENERATOR_VERSION moves, and how the release automation and its gates work.
Also records two things that mislead on inspection: `make push` clones
api-client-typescript-axios, which is a GitHub redirect to the renamed
api-client-typescript rather than a mismatch to fix; and non-Go client repos
carry two tags per release, a bare X.Y.Z from `make push` plus vX.Y.Z created
by the create-release job, both of which must be deleted before retrying a
failed release.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit 1f58676806a67e76eefcd4cc8fd32ff0dff7b52e
Author: Fabian <ffeldberg@launchdarkly.com>
Date: Mon Aug 3 11:33:43 2026 +0100
Automate the client library release runbook
Releasing client libraries required a human to work through a Confluence
runbook: check that gonfalon is healthy, ask in Slack whether any spec
changes are mid-flight, decide patch/minor/major from the changelog, wait for
the spec commit to reach production, paste the version and changelog markdown
into a workflow_dispatch form, spot-check the registries, then open two
gonfalon changes and mirror this repo to its public counterpart by hand.
release.yml now derives its own inputs and enforces each precondition as a
gate, so a normal release is a dispatch with no inputs at all. Every input
that remains is an override: releaseVersion, bumpType, dryRun, force,
mirrorPublic, skipCiGate.
The key gate is spec parity. gonfalon commits the published spec at
apidocs/openapi-public-final.json and production serves that file byte for
byte, so `git hash-object` of the production download equals gonfalon's git
blob SHA for that path. Equality means production is caught up AND nothing is
mid-flight, which is what the Slack check and the wait-for-deploy step were
approximating. It is polled until it holds, and compared by blob SHA through
the tree API because the file is ~2.8MB, past the contents API's 1MB raw
limit. Every subsequent read from gonfalon is pinned to the commit parity
resolved to: main moves often, and reading the spec and the changelog at
separate moments can otherwise pair a changelog with a spec it does not
describe.
Bump type is inferred from the '### ' headings of gonfalon's [Unreleased]
section. '### Changed' is genuinely ambiguous, covering breaking and additive
changes alike, so the rule errs toward major and an unrecognised heading
aborts rather than guesses.
Post-publish, the workflow polls the registries and client repo tags instead
of trusting a spot-check, opens a single gonfalon PR carrying both the
changelog rename and the api-client-go bump, and squash-mirrors onto the
public repo. Two deliberate stopping points: the gonfalon PR does not
auto-merge, because a major bump rewrites import paths across ~18 Go files
and the Bazel graph; and the mirror aborts on conflict rather than resolving,
because that push is not practically reversible and the runbook's guidance
there is "use your discretion".
The gonfalon dependency codemod lives in gonfalon as `make
update-api-client-go`, beside the imports it rewrites, rather than in a
workflow YAML here.
publish.sh gains a DRY_RUN path routing to push_dry_run and publish_dry_run,
so a dispatch with dryRun rehearses the whole flow while pushing and
publishing nothing.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit f71c64cd69981c5ecfe38e526b5f7794a9419930
Merge: 33d54cc2 8adf2b2a
Author: ari-launchdarkly <asalem@launchdarkly.com>
Date: Wed Jun 17 11:29:43 2026 -0700
Merge pull request #298 from launchdarkly/devin/1781712015-replace-fm-foundations-with-team-foundation
Replace team-fm-foundations with team-foundation in CODEOWNERS
commit 8adf2b2afd72079e32a5620d4538afb91c884e6b
Author: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed Jun 17 16:00:16 2026 +0000
Replace team-fm-foundations with team-foundation in CODEOWNERS
commit 33d54cc2308bd5ae9da5c43d6a1e0de495406b51
Merge: 3f87e7c1 34580ece
Author: Owen McCarthy <omccarth333@gmail.com>
Date: Tue Mar 24 09:43:17 2026 -0400
Merge pull request #296 from launchdarkly/security/SEC-7924/pin-github-actions
chore: [SEC-7924] pin third-party GitHub Actions to commit SHAs
commit 34580ece17b33599919cc9ffd434c52308159843
Author: Patrick Kaeding <pkaeding@launchdarkly.com>
Date: Mon Mar 23 23:22:07 2026 -0400
[SEC-7924] chore: pin third-party GitHub Actions to commit SHAs
Pin all third-party GitHub Actions to full-length commit SHAs to prevent
supply chain attacks. Addresses findings from the
third-party-action-not-pinned-to-commit-sha Semgrep rule.
commit 3f87e7c1043a786bee5a105dc796a30d99976ba1
Merge: a01aa45c dbef4100
Author: Kane Parkinson <93555788+kparkinson-ld@users.noreply.github.com>
Date: Wed Mar 18 11:32:34 2026 -0700
Merge pull request #295 from launchdarkly/devin/1773853464-update-codeowners-team-name
Update CODEOWNERS: rename team-fm-next to team-fm-foundations
commit dbef410061f7191faae111a62e48aa69b3f2f224
Author: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed Mar 18 18:04:11 2026 +0000
Update CODEOWNERS: rename team-fm-next to team-fm-foundations
Co-Authored-By: Kane Parkinson <kparkinson@launchdarkly.com>
commit a01aa45cd0f3c1157acd9bed71468638cda4a5e2
Author: Ben Woskow <48036130+bwoskow-ld@users.noreply.github.com>
Date: Fri Jan 23 16:46:14 2026 -0800
[REL-11803] removing the php and javascript targets (#294)
removing the php and javascript targets
commit 7eab99a5ad75ec763b0ea5716c6cf5078b331ee8
Author: Ben Woskow <48036130+bwoskow-ld@users.noreply.github.com>
Date: Wed Jan 7 13:07:28 2026 -0800
[REL-11491] Extracting out the api version value to a variable (#293)
commit 52ac35599899195b42297042ce468143a4ac8afc
Author: Ben Woskow <48036130+bwoskow-ld@users.noreply.github.com>
Date: Wed Jan 7 10:26:07 2026 -0800
[REL-11491] Setting the default API version to v4 + fixing several CI breakages (#291)
commit e27ba4fb0546ba8887d43f40a1ae9a4da32fa74d
Merge: 6284ec26 3781843c
Author: Tony Knopp <tknopp@launchdarkly.com>
Date: Wed Jan 7 12:06:24 2026 -0500
Merge pull request #292 from launchdarkly/tknopp/chore/update-codeowners
Update CODEOWNERS for Next ownership
commit 3781843ce80d2baee83854f7d02494cd441486b9
Author: Tony Knopp <tknopp@launchdarkly.com>
Date: Wed Jan 7 11:55:34 2026 -0500
Update CODEOWNERS
Adding fm-next
commit 6284ec261eee157295f52b24d99a52d7e2a45a3d
Author: Drew Inglis <drewinglis@launchdarkly.com>
Date: Wed Dec 3 15:11:44 2025 -0800
Fix whitespace in GH workflow files (#289)
Remove EOL whitespace
add newlines at ends of files for POSIX compliance
commit 2135ae0b698caab33c1747c2988f4edf099418f9
Author: Cody Spath <cspath@launchdarkly.com>
Date: Wed Oct 29 11:17:33 2025 -0400
[REL-10444] add additionalProperty to set axios version to latest (#287)
feat: add additionalProperty to set axios version > 1.12.0
commit 53f454df53736c40b8476fdeba938babfca3b65d
Author: Isabelle Miller <imiller@launchdarkly.com>
Date: Tue Oct 21 15:25:32 2025 +0200
[REL-10233] add dependency-scan GHA to OpenAPI generation (#286)
* [REL-10233] i think this should do it
* [REL-10233] mkdir if not exists
commit 1d577448d7a114665bdcda06bb043bab00fc22ed
Author: Henry Barrow <hbarrow@launchdarkly.com>
Date: Fri Oct 17 15:42:30 2025 +0100
[REL-10138] Fix Gradle task name to closeAndReleaseSonatypeStagingRepository (#285)
The correct task name from gradle-nexus-publish-plugin includes 'Staging':
- Incorrect: closeAndReleaseSonatypeRepository
- Correct: closeAndReleaseSonatypeStagingRepository
This fixes the error 'Task closeAndReleaseSonatypeRepository not found in root project'.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
commit de4f88351e7c483d99b4d3f9496a9ab432d3c0a8
Author: Henry Barrow <hbarrow@launchdarkly.com>
Date: Thu Oct 16 16:29:48 2025 +0100
[REL-10138] Migrate from nexus-staging plugin to gradle-nexus-publish-plugin (#283)
* [REL-10138] Fix nexusStaging serverUrl for Sonatype Central
Add missing serverUrl configuration to the nexusStaging block to point to the new Sonatype Central staging API. Without this property, the plugin defaults to the old OSSRH URL that was shut down on June 30, 2025, causing 401 Unauthorized errors when attempting to close and release repositories.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* [REL-10138] Migrate from nexus-staging plugin to gradle-nexus-publish-plugin
Migrate from the old io.codearte.nexus-staging plugin to the newer
io.github.gradle-nexus.publish-plugin to properly support Sonatype Central.
The old plugin was causing 403 Forbidden errors because it wasn't fully
compatible with the Sonatype Central staging API. The new plugin is the
recommended solution and provides better support for the new API.
Changes:
- Replace io.codearte.nexus-staging plugin with io.github.gradle-nexus.publish-plugin v2.0.0
- Remove nexusStaging configuration block and publishing.repositories.maven block
- Add nexusPublishing configuration with proper Sonatype Central URLs
- Update publish script to use new task names: publishToSonatype and closeAndReleaseSonatypeRepository
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
commit 155120dfc589ee4d23c132f2fbbd6c3338d465bf
Author: Tilde Thurium <tthurium@launchdarkly.com>
Date: Thu Oct 16 07:11:31 2025 -0700
remove developer relations from CODEOWNERS (#284)
commit 87063ce51413ef9a930a92f3f7c9456a567ebd5c
Author: Lucy <thelucyvoigt@gmail.com>
Date: Wed Oct 15 14:38:58 2025 -0700
(bug-fix) Update form-data dependency (#275)
There's a critical security vulnerability in `form-data` 3.4.0, which
was a transitive dependency of superagent 5.3.0. The superagent version
is set in [this mustache
file](https://github.com/OpenAPITools/openapi-generator/blob/ddb15d4b9d6fa0f04090b5db3d64ea1b8a6d0ee6/modules/openapi-generator/src/main/resources/Javascript/libraries/javascript/package.mustache)
in the openapi generator, but we can override that with our own local
`package.mustache`. This bumps the superagent version for the generated
`api-client-javascript` to `^7.0.0`, which imports form-data 4.0.4.
commit cc162dae45a08699914652721da4fadd5727e827
Author: Henry Barrow <hbarrow@launchdarkly.com>
Date: Wed Oct 15 17:33:25 2025 +0100
[REL-10138] Fix nexusStaging serverUrl for Sonatype Central (#282)
Add missing serverUrl configuration to the nexusStaging block to point to the new Sonatype Central staging API. Without this property, the plugin defaults to the old OSSRH URL that was shut down on June 30, 2025, causing 401 Unauthorized errors when attempting to close and release repositories.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
commit c2c2badabdaab248a3a0e3a523b77b707df8877c
Author: Henry Barrow <hbarrow@launchdarkly.com>
Date: Wed Oct 15 16:49:09 2025 +0100
[REL-10138] Migrate Maven publish from OSSRH to Sonatype Central (#281)
* [REL-10138] Migrate Maven publish from OSHH to Sonatype Central
* [REL-10138] Revert signing password change
* [REL-10138] Update publish URL following https://central.sonatype.org/publish/publish-portal-ossrh-staging-api/
commit 99219f91673b153cbecc890046939d11b0290479
Author: Henry Barrow <hbarrow@launchdarkly.com>
Date: Fri Oct 10 14:11:10 2025 +0100
[REL-10048] Fix Java build (#280)
* [REL-10048] Add build step to test java build
* [REL-10048] Remove unnecessary template
* [REL-10048] Just focus on java
* [REL-10048] build everything
* [REL-10048] try fixing build
* [REL-10048] update template
* [REL-10048] update template
* [REL-10048] update template
* [REL-10048] rename artifact reference
* [REL-10048] delete build action
commit ddcca6afcd7ce8969b732d28beda9b4e7c373573
Author: Henry Barrow <hbarrow@launchdarkly.com>
Date: Thu Oct 9 21:33:09 2025 +0100
[REL-10048] Update generator to v7.16.0 (#279)
* [REL-10048] Try updating to latest version of generator
* [REL-10048] Bump php version
commit 00a02e1fb16ffa745643b533f50a357c33545b4b
Author: Brodie Vivio <10712242+bvivio@users.noreply.github.com>
Date: Thu Oct 9 09:36:34 2025 -0700
[EXPT-3347] Attempt to Fix Java Compilation Errors (#276)
* fix java testImplementation import to account for openapi generator version bump to 7.5.0
commit e9f4b2728c632a7c30a68a351854331433ceb22b
Author: Henry Barrow <hbarrow@launchdarkly.com>
Date: Thu Oct 9 16:24:19 2025 +0100
Bump generator to v 7.5.0 (#250)
* Bump generator to v 7.5.0
* Fix go client
* Fix python client
* Fix go template
* Bump go in CI and update Makefile
* Try removing python partial header
* Fix typescript client
* Use Api instead of API in go client
* Update python model package name
* Remove python template reference
* Revert models change
* Remove typescript template files
* [sc-242972] Fix GHA multiline issue
* [sc-242972] Ignore scripts
* [sc-242972] try bumping js version
* [sc-242972] Try fixing js
* [sc-242972] Swtch to using npm run build
* [sc-242972] Switch to ES6
* [sc-242972] Downgrade to node 20
* [sc-242972] switch back to require
* [sc-242972] Don't use link command
* [sc-242972] commit package.json
* [sc-242972] Try cleaning node module
* [sc-242972] modernize
* [sc-242972] Try checking in package-lock
* [sc-242972] Use babel preset
* [sc-242972] Comment out JS test
* [sc-242972] Add Check Success job
commit 7286ff63eb1c7e6e612ea33ee39857db145e223f
Merge: 6fe39caa 8d5a479d
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Thu Oct 9 00:52:35 2025 +0530
Merge pull request #277 from launchdarkly/aacharya/migration-gha
Gha migration
commit 8d5a479db74e49d06c51228c107ca986d0c68659
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Thu Oct 9 00:32:35 2025 +0530
revert java code as its working fine
commit fb1c75dfa6a00b44de688b04a684c5afb78259af
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Thu Oct 9 00:25:58 2025 +0530
testing java fix
commit 4db0165eaf5face1ba8edbb4a4ae6e1a67686fa7
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Thu Oct 9 00:18:12 2025 +0530
fixing js version
commit 9b1f5031164da183cea1b3ac1886de75f78f8b7b
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Thu Oct 9 00:13:08 2025 +0530
js fix
commit 91178912eb2032f745ab085a719bbb319e5e3341
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Wed Oct 8 21:17:21 2025 +0530
fixing flag npx
commit ad6767a7fa3c101fcb9dfe777155ebb5d8bffded
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Wed Oct 8 21:09:58 2025 +0530
fixing javascript
commit 4a44e85f1fd0d699666a530bdec14dfd177d6b70
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Wed Oct 8 20:49:57 2025 +0530
fixing go
commit f33e7c11267537b8903a68daf53052352a8b0719
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Wed Oct 8 20:40:54 2025 +0530
fixing ruby
commit 9d613f7ab663e97d579ae3f6a960876a83c8c2de
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Wed Oct 8 20:27:27 2025 +0530
fixing uid
commit 33cd388402521c4a8bce5b141deaf626829e0427
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Wed Oct 8 20:21:12 2025 +0530
added api key
commit 4cdc1e9adfbcec53861504344e056ae6f22b0185
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Wed Oct 8 20:00:51 2025 +0530
adding php as well
commit 1547f0363943e768d5bb9a072a217f751ed95b9f
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Tue Oct 7 22:14:54 2025 +0530
back to gha
commit d3939bf77339350aef8b7c9c8363e268cf853a67
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Tue Oct 7 22:11:30 2025 +0530
removed cache in build step
commit 57633b59a43c144c01e04fb13d3413fc22acb5e9
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Tue Oct 7 22:09:10 2025 +0530
removed sudo
commit db240d49ed21f434c379cf4f6f3cc21e6417359b
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Tue Oct 7 22:04:35 2025 +0530
fixing uid
commit bf762491fd7ce0573035800f41719ddcf510b4f5
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Tue Oct 7 22:01:04 2025 +0530
added user
commit a7fbecd63af149dd583ce85baa1860d2e95a5e31
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Tue Oct 7 21:59:16 2025 +0530
updating runson
commit a8a2e46177ed299437453e80bf97f20ed367009d
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Tue Oct 7 21:56:34 2025 +0530
removed id
commit cd75526f730c56534d1aa8d8ecda144ad2317e42
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Tue Oct 7 21:54:31 2025 +0530
adding rusnon
commit 48580d2d9496fc3496ffb2179e85e0a3251a8217
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Tue Oct 7 21:49:50 2025 +0530
fixing version
commit 429aa3743b84135ad0c05bd358945214046198da
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Tue Oct 7 21:42:34 2025 +0530
testing gha
commit 62e57c733235f4ba91fc7622a55280de985e6c7b
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Tue Oct 7 20:53:45 2025 +0530
user id fix
commit 030b16a9e865d47cd434c52a058baff112b47951
Author: Abhishek Acharya <aacharya@launchdarkly.com>
Date: Tue Oct 7 20:47:49 2025 +0530
testing gha migration
commit 6fe39caa2c3b291a3feb292089749bb726b72573
Merge: c55c9591 b70ba044
Author: Chris Blackburn <blaqbern@users.noreply.github.com>
Date: Fri Apr 4 17:27:27 2025 -0400
Merge pull request #274 from launchdarkly/cblackburn/fix-pypi-upload-error
update packaging to be compatible with latest twine
commit b70ba04442bb40862d368b397719f78c1c220788
Author: Chris Blackburn <cblackburn@launchdarkly.com>
Date: Fri Apr 4 15:52:45 2025 -0400
update packaging to be compatible with latest twine
commit c55c9591a2a3e63fc4ab8f3cdcba7e33b721c8d7
Author: Henry Barrow <hbarrow@launchdarkly.com>
Date: Tue Feb 25 10:13:45 2025 +0000
Update CODEOWNERS file (#273)
Update CODEOWNERS: replace @launchdarkly/team-release-backend with @launchdarkly/team-enterprise
commit cc3ded54daed148e711cc17535e162366207eee9
Author: Lucy <thelucyvoigt@gmail.com>
Date: Wed Jan 29 09:48:13 2025 -0800
[DOCS-1155] Update README-PREFIX to not hardcode latest version (#272)
The README prefix that gets prepended to all generated API client
library READMEs had the latest API version hard coded. Now that that
version is being deprecated it causes confusion. This updates it to not
hard code the exact latest version value.
Co-authored-by: Lucy Voigt <lvoigt@launchdarkly.com>
commit 40c5eb48d5ec6cfb2de776f2e4bf115e15a9622f
Author: Lucy <thelucyvoigt@gmail.com>
Date: Fri Dec 13 14:22:54 2024 -0800
Typo in Makefile (#271)
Co-authored-by: Lucy Voigt <lvoigt@launchdarkly.com>
commit c93ababb686d1a7fc673f6fd77d1cade45793931
Author: Lucy <thelucyvoigt@gmail.com>
Date: Fri Dec 13 13:38:33 2024 -0800
Download gpg key to correct path (#270)
Co-authored-by: Lucy Voigt <lvoigt@launchdarkly.com>
commit 341fb72cee867a0ea2d607f922dd3f7291328b03
Author: Lucy <thelucyvoigt@gmail.com>
Date: Fri Dec 13 13:06:39 2024 -0800
Correct path for java code signing keyring (#269)
Co-authored-by: Lucy Voigt <lvoigt@launchdarkly.com>
commit f30ab00f0801ff22b83d5ad2a6ac76ffe283a67c
Author: Lucy <thelucyvoigt@gmail.com>
Date: Fri Dec 13 12:45:41 2024 -0800
Add publishing secrets as env vars to get written to files (#268)
Co-authored-by: Lucy Voigt <lvoigt@launchdarkly.com>
commit b287e4349714f977604c00861228321d5a6a34b2
Author: Lucy <thelucyvoigt@gmail.com>
Date: Fri Dec 13 12:31:33 2024 -0800
Run prepare script to set up secrets for publishing (#267)
Co-authored-by: Lucy Voigt <lvoigt@launchdarkly.com>
commit 1a98ecee139c2ea85a6bf9cc5eea6957b8497026
Author: Lucy <thelucyvoigt@gmail.com>
Date: Fri Dec 13 12:15:45 2024 -0800
Try setting stack size in gradle.properties (#266)
Co-authored-by: Lucy Voigt <lvoigt@launchdarkly.com>
commit d8ad9d964800721e9918eb356d8f97a8ae4a166b
Author: Lucy <thelucyvoigt@gmail.com>
Date: Fri Dec 13 11:58:33 2024 -0800
Bump java thread stack size (#265)
Co-authored-by: Lucy Voigt <lvoigt@launchdarkly.com>
commit 8ba48f4f5ad25774084a184ebfa3fa162e3f8b49
Author: Paddy <paddy@carvers.com>
Date: Fri Dec 13 11:39:21 2024 -0800
Log the stack size for Java. (#264)
commit 9ad100c439975f53ef017b54400aa029f503b2e6
Author: Lucy <thelucyvoigt@gmail.com>
Date: Fri Dec 13 10:45:31 2024 -0800
Remove java env attempt (#263)
Co-authored-by: Lucy Voigt <lvoigt@launchdarkly.com>
commit 2aaf6895c71471cf7e94f4f9f145f548873dd640
Author: Lucy <thelucyvoigt@gmail.com>
Date: Fri Dec 13 10:40:10 2024 -0800
Use java 11 instead of 17 (#262)
Co-authored-by: Lucy Voigt <lvoigt@launchdarkly.com>
commit e96e03c092284e7680dc442cfec37e44b8ab7e96
Author: Lucy <thelucyvoigt@gmail.com>
Date: Fri Dec 13 10:20:19 2024 -0800
Give GH action permission (#261)
Co-authored-by: Lucy Voigt <lvoigt@launchdarkly.com>
commit 69623c06abe4d13d03c8f9002e1e1866dc589d6c
Author: Lucy <thelucyvoigt@gmail.com>
Date: Fri Dec 13 10:12:56 2024 -0800
Sudo python update for file permissions (#260)
Co-authored-by: Lucy Voigt <lvoigt@launchdarkly.com>
commit fcd541d13137330b6482e4656c4978ae160c6899
Author: Lucy <thelucyvoigt@gmail.com>
Date: Fri Dec 13 10:06:50 2024 -0800
Sudo install golang (#259)
Co-authored-by: Lucy Voigt <lvoigt@launchdarkly.com>
commit 46dfb4d496a082acd5448c4b71d4f22f09abb03b
Author: Lucy <thelucyvoigt@gmail.com>
Date: Fri Dec 13 09:50:40 2024 -0800
[RO-771] Add manual setup steps (#258)
Add manual setup steps
Co-authored-by: Lucy Voigt <lvoigt@launchdarkly.com>
commit 8252b34383534bea27c7608ac5a783ffebaf52a9
Author: Lucy <thelucyvoigt@gmail.com>
Date: Thu Dec 12 15:59:29 2024 -0800
Try default ubuntu image and hope it magically has everything we need (#257)
Co-authored-by: Lucy Voigt <lvoigt@launchdarkly.com>
commit e568639a77930556368fecf970436bf9ef11ebeb
Author: Lucy <thelucyvoigt@gmail.com>
Date: Thu Dec 12 15:52:33 2024 -0800
Try pinning checkout version to work with Docker images (#256)
Co-authored-by: Lucy Voigt <lvoigt@launchdarkly.com>
commit c90a0da7d69cb026f1a1655b717946edbe115d39
Author: Lucy <thelucyvoigt@gmail.com>
Date: Thu Dec 12 15:34:06 2024 -0800
[RO-771] Migrate repo from Releaser to manual GH Action (#255)
* [RO-771] Migrate repo from Releaser to manual GH Action
This moves the release process for LD API client libraries from Releaser
to Github Actions. I looked at improving the release process itself (to
not write out secrets to files, or use more standard release tools) and
ultimately it seemed easiest to move everything wholesale and make any
improvements to the actual process separately.
* Add back releaser files
---------
Co-authored-by: Lucy Voigt <lvoigt@launchdarkly.com>
commit 4511d082be56e24a295e04561b8894f54218257d
Merge: fc9eae4c 94cdd5e5
Author: LaunchDarklyReleaseBot <launchdarklyreleasebot@launchdarkly.com>
Date: Mon Oct 14 10:23:53 2024 +0000
merge from public after release
commit fc9eae4cb017ebefb65a6ffb43c1a794a749a82f
Author: Henry Barrow <hbarrow@launchdarkly.com>
Date: Fri Aug 16 15:51:55 2024 +0100
Transfer code ownership (#254)
* Transfer code ownership
* Add developer relations
commit 3b039a2a8c3c84e29baf902c6ab679e3f7269a1f
Merge: 3b7867c3 8f621bbb
Author: LaunchDarklyReleaseBot <launchdarklyreleasebot@launchdarkly.com>
Date: Thu May 16 11:32:19 2024 +0000
merge from public after release
commit 3b7867c31ab233038013b8ffe1bc19aec19d15c3
Author: Henry Barrow <hbarrow@launchdarkly.com>
Date: Thu May 16 12:21:27 2024 +0100
Fix typo in package.json template extension (#253)
* Fix typo in package.json template name
* Remove ESM clause
commit e7cc9a6fdd41553ec874c48746831a79ab7ba59f
Merge: 9a23b8a0 0d065e9a
Author: LaunchDarklyReleaseBot <launchdarklyreleasebot@launchdarkly.com>
Date: Thu May 16 10:14:05 2024 +0000
merge from public after release
commit 9a23b8a01b1a1744516ecee373509cd2a68aacf7
Author: Henry Barrow <hbarrow@launchdarkly.com>
Date: Wed May 15 15:40:59 2024 +0100
Generate go interface (#252)
commit ec516afb7c24a31f1e648814df527c3b37cd1f3b
Author: Henry Barrow <hbarrow@launchdarkly.com>
Date: Wed May 15 15:20:03 2024 +0100
Update Axios dependency in Typescript client (#251)
* Update .gitignore
* Try updating axios
* Update package.json
* Update sample
commit fa0f8b84746ccd07c2a75306d7594b918aae9e8c
Author: Lucy Voigt <thelucyvoigt@gmail.com>
Date: Mon Apr 10 14:16:48 2023 -0700
Only include 'View code' link if sample code is available (#248)
* Only include 'View code' link if sample code is available
* Add description to Typescript README
---------
Co-authored-by: Lucy Voigt <lvoigt@launchdarkly.com>
commit a73a23a22eda0c78823342769de2acc0104e75cc
Merge: 3fdd0fb1 8375579c
Author: LaunchDarklyReleaseBot <launchdarklyreleasebot@launchdarkly.com>
Date: Tue Feb 28 02:11:32 2023 +0000
merge from public after release
commit 3fdd0fb1af9106e726667226f381b4584791529f
Author: Lucy Voigt <thelucyvoigt@gmail.com>
Date: Mon Feb 27 17:53:34 2023 -0800
Update SSM parameter paths (#247)
Co-authored-by: Lucy Voigt <lvoigt@launchdarkly.com>
c…
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
cspath1
approved these changes
Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.