Open a PR automatically when a native SDK releases

[ianrumac]

Adds .github/workflows/native-sdk-bump.yml. It runs on the native-sdk-release repository_dispatch sent by Superwall-Android and Superwall-iOS. It can also be run by hand from the Actions tab (platform, an optional version where blank means latest, and dry_run), or called by another workflow through workflow_call.

What it does

1. Checks the target. The version comes from the dispatch, or is the native repo's latest release. Only plain x.y.z versions are accepted. It does nothing if the pin is already at or above that version, or if a native-sdk/<platform>-<version> branch already exists.
2. Bumps the version and opens a PR against develop:
   • The Android pin in android/build.gradle, or the iOS pin in both ios/superwallkit_flutter.podspec and ios/superwallkit_flutter/Package.swift.
   • A patch bump in pubspec.yaml. If the current version isn't on pub.dev yet (a release is already staged), the entry joins that release instead.
   • A CHANGELOG line. A second native bump in the same release replaces the earlier "Updates … SDK to" line.
   • The PR body includes the native CHANGELOG entries for every version between the old and new pin.
3. Runs the Pi agent on that PR, with the release notes and the native source checked out at the new tag (git diff old new for API changes). It follows CLAUDE.md's Pigeon workflow to implement any new or changed public API, checks the result with flutter analyze, flutter test and an example APK build, and pushes onto the same PR. If nothing is needed, it explains why in the description. If the agent fails, the bump PR stays and gets a comment saying so.

.github/scripts/native-changelog.py pulls out the version range. It only treats ## x.y.z as section boundaries, since Android also uses ## Fixes subheadings. changelog-entry.py writes the CHANGELOG entry.

Dry run: dry_run: true applies the bump and prints the diff and the full agent prompt. It pushes nothing, opens no PR and doesn't run the agent.

Setup

• ANTHROPIC_API_KEY secret.
• SDK_BOT_TOKEN secret (recommended): a PAT or App token with contents and pull-requests write. Without it the PR is made with GITHUB_TOKEN, which doesn't trigger other workflows, and you need to enable "Allow GitHub Actions to create and approve pull requests".
• Optional PI_MODEL repo variable.

Testing

• actionlint and shellcheck pass.
• Ran in dry-run mode with local-ci, which uses the real GitHub Actions runner. iOS 4.16.3 → 4.17.0, with the podspec pin lowered locally just for the test: the podspec was bumped, pubspec.yaml went 2.6.0 → 2.6.1 (the pub.dev check worked), and the CHANGELOG entry, 4.17.0 release notes and prompt were all correct. iOS 4.17.0, the current pin, was correctly skipped.
• local-ci's emulated remote only has main, so for those runs BASE_BRANCH was pointed at main locally. The committed workflow still targets develop.
• To make the workflow runnable under local-ci, values pass between steps through $GITHUB_ENV rather than step outputs, and the branch check goes through the GitHub API instead of git ls-remote. Behaviour on GitHub is unchanged.
• Not tested: PR creation and the agent run, which can only happen once this is on main. Swift can't be compiled on the Linux runner; the agent is told to say so in the PR.

Counterparts: superwall/Superwall-Android#473, superwall/Superwall-iOS#538.

🤖 Generated with Claude Code

https://claude.ai/code/session_015S6mZpaJyu9J5v7NPv2WCS