Release SDK updates

.github/workflows/ci.yml

@@ -18,7 +18,7 @@ jobs:
   lint:
     timeout-minutes: 10
     name: lint
-    runs-on: ${{ github.repository == 'stainless-sdks/retell-python' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
+    runs-on: 'ubuntu-latest'
     if: (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -44,7 +44,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    runs-on: ${{ github.repository == 'stainless-sdks/retell-python' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
+    runs-on: 'ubuntu-latest'
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -64,7 +64,7 @@ jobs:
 
       - name: Get GitHub OIDC Token
         if: |-
-          github.repository == 'stainless-sdks/retell-python' &&
+          github.repository == 'RetellAI/retell-python-sdk-staging' &&
           !startsWith(github.ref, 'refs/heads/stl/')
         id: github-oidc
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@@ -73,7 +73,7 @@ jobs:
 
       - name: Upload tarball
         if: |-
-          github.repository == 'stainless-sdks/retell-python' &&
+          github.repository == 'RetellAI/retell-python-sdk-staging' &&
           !startsWith(github.ref, 'refs/heads/stl/')
         env:
           URL: https://pkg.stainless.com/s
@@ -84,7 +84,7 @@ jobs:
   test:
     timeout-minutes: 10
     name: test
-    runs-on: ${{ github.repository == 'stainless-sdks/retell-python' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
+    runs-on: 'ubuntu-latest'
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/release-doctor.yml

@@ -12,6 +12,17 @@ jobs:
     if: github.repository == 'RetellAI/retell-python-sdk' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next')
 
     steps:
+      - name: Validate SDK GitHub App access
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ secrets.DOCS_SYNC_APP_CLIENT_ID }}
+          private-key: ${{ secrets.DOCS_MANAGER_PVT_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: retell-python-sdk
+          permission-contents: write
+          permission-pull-requests: write
+          permission-issues: write
+
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check release environment

.github/workflows/release-please.yml

@@ -1,20 +1,61 @@
 name: Release Please
+
 on:
   push:
     branches:
       - main
+  schedule:
+    - cron: '7,22,37,52 * * * *'
+  workflow_dispatch:
+
+concurrency:
+  group: sdk-release-please
+  cancel-in-progress: false
 
-permissions:
-  contents: write
-  pull-requests: write
+permissions: {}
 
 jobs:
   release-please:
-    if: github.repository == 'RetellAI/retell-python-sdk'
+    name: release please
     runs-on: ubuntu-latest
+    if: github.repository == 'RetellAI/retell-python-sdk' && github.ref == 'refs/heads/main' && vars.SDK_RELEASES_ENABLED == 'true'
+
+    timeout-minutes: 10
 
     steps:
+      - name: Mint SDK automation token
+        id: sdk-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ secrets.DOCS_SYNC_APP_CLIENT_ID }}
+          private-key: ${{ secrets.DOCS_MANAGER_PVT_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: |
+            docs
+            retell-typescript-sdk
+            retell-python-sdk
+          permission-contents: write
+          permission-pull-requests: write
+          permission-issues: write
+
+      - name: Checkout shared release policy
+        uses: actions/checkout@v4
+        with:
+          repository: RetellAI/docs
+          ref: main
+          path: .release-policy
+          token: ${{ steps.sdk-token.outputs.token }}
+          persist-credentials: false
+
+      - name: Check whether release notes are frozen
+        id: policy
+        env:
+          GH_TOKEN: ${{ steps.sdk-token.outputs.token }}
+        run: python3 .release-policy/script/sdk_release_policy.py frozen --repo "${{ github.repository }}"
+
       - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
         id: release
+        if: steps.policy.outputs.frozen != 'true'
         with:
-          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          token: ${{ steps.sdk-token.outputs.token }}
+          skip-github-pull-request: ${{ steps.policy.outputs.refresh != 'true' }}

.github/workflows/stlc-auto-merge.yml

@@ -0,0 +1,172 @@
+name: Auto-merge SDK release PRs
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches: [main]
+  workflow_run:
+    workflows: ['CI', 'Release Doctor']
+    types: [completed]
+  schedule:
+    - cron: '*/15 * * * *'
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'Optional PR number to evaluate'
+        required: false
+      release_now:
+        description: 'Bypass the 24-hour interval; all checks still apply'
+        type: boolean
+        default: false
+
+concurrency:
+  group: sdk-auto-merge
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  pull-requests: read
+  checks: read
+  statuses: read
+  actions: read
+
+jobs:
+  auto-merge:
+    if: github.repository == 'RetellAI/retell-python-sdk' && github.ref == 'refs/heads/main' && vars.SDK_RELEASES_ENABLED == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      GH_TOKEN: ${{ github.token }}
+      REPO: ${{ github.repository }}
+    steps:
+      - name: Mint SDK automation token
+        id: sdk-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ secrets.DOCS_SYNC_APP_CLIENT_ID }}
+          private-key: ${{ secrets.DOCS_MANAGER_PVT_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: |
+            docs
+            retell-typescript-sdk
+            retell-python-sdk
+          permission-contents: write
+          permission-pull-requests: write
+
+      - name: Checkout shared release policy
+        uses: actions/checkout@v4
+        with:
+          repository: RetellAI/docs
+          ref: main
+          path: .release-policy
+          token: ${{ steps.sdk-token.outputs.token }}
+          persist-credentials: false
+
+      - name: Merge qualifying green PRs
+        shell: bash
+        env:
+          MERGE_TOKEN: ${{ steps.sdk-token.outputs.token }}
+          EVENT_NAME: ${{ github.event_name }}
+          EVENT_PR: ${{ github.event.pull_request.number }}
+          INPUT_PR: ${{ inputs.pr_number }}
+          RELEASE_NOW: ${{ inputs.release_now || false }}
+          SDK_ACTIONS_READ_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+
+          if [ "$EVENT_NAME" = "pull_request_target" ]; then
+            numbers="$EVENT_PR"
+          elif [ "$EVENT_NAME" = "workflow_dispatch" ] && [ -n "$INPUT_PR" ]; then
+            numbers="$INPUT_PR"
+          else
+            numbers=$(gh pr list --repo "$REPO" --base main --state open --limit 1000 --json number --jq '.[].number')
+          fi
+
+          while IFS= read -r pr; do
+            [ -n "$pr" ] || continue
+            if [[ ! "$pr" =~ ^[1-9][0-9]*$ ]]; then
+              echo "::error::Invalid PR number."
+              exit 1
+            fi
+            echo "Evaluating PR #$pr"
+            pr_json=$(gh pr view "$pr" --repo "$REPO" --json state,title,isDraft,headRefName,headRefOid,headRepository,isCrossRepository,baseRefName,mergeStateStatus)
+            title=$(jq -r '.title' <<<"$pr_json")
+            is_draft=$(jq -r '.isDraft' <<<"$pr_json")
+            head_ref=$(jq -r '.headRefName' <<<"$pr_json")
+            head_sha=$(jq -r '.headRefOid' <<<"$pr_json")
+            head_repo=$(jq -r '.headRepository.nameWithOwner // ""' <<<"$pr_json")
+            is_cross_repository=$(jq -r '.isCrossRepository' <<<"$pr_json")
+            base_ref=$(jq -r '.baseRefName' <<<"$pr_json")
+
+            if [ "$(jq -r .state <<<"$pr_json")" != "OPEN" ] || [ "$base_ref" != "main" ] || [ "$is_draft" = "true" ]; then
+              echo "Skipping PR #$pr: not a ready PR to main."
+              continue
+            fi
+
+            if [ "$is_cross_repository" = "true" ] || [ "$head_repo" != "$REPO" ]; then
+              echo "Skipping PR #$pr: head branch is not in $REPO."
+              continue
+            fi
+
+            merge_flag=""
+            if [ "$head_ref" = "stainless-release" ] && [ "$title" = "Release SDK updates" ]; then
+              merge_flag="--merge"
+            elif [[ "$head_ref" == release-please--* ]] && [[ "$title" == release:* ]]; then
+              merge_flag="--squash"
+            else
+              echo "Skipping PR #$pr: not an automated SDK release PR."
+              continue
+            fi
+
+            ci_runs=$(gh api "/repos/$REPO/actions/workflows/ci.yml/runs?head_sha=$head_sha&event=push&per_page=1")
+            if ! jq -e '.workflow_runs[0] | .status == "completed" and .conclusion == "success"' <<<"$ci_runs" >/dev/null; then
+              echo "Skipping PR #$pr: push CI has not passed for $head_sha."
+              continue
+            fi
+
+            check_pages=$(gh api --paginate --slurp "/repos/$REPO/commits/$head_sha/check-runs?filter=latest&per_page=100")
+            check_runs=$(jq '[.[].check_runs[] | select(.name != "auto-merge" or .app.slug != "github-actions")]' <<<"$check_pages")
+            check_count=$(jq 'length' <<<"$check_runs")
+            if [ "$check_count" -eq 0 ]; then
+              echo "Skipping PR #$pr: no check runs found yet."
+              continue
+            fi
+
+            bad_checks=$(jq '[.[] | select(.status != "completed" or (.conclusion != "success" and .conclusion != "skipped"))] | length' <<<"$check_runs")
+            if [ "$bad_checks" -ne 0 ]; then
+              echo "Skipping PR #$pr: checks are pending or failed."
+              continue
+            fi
+
+            statuses=$(gh api "/repos/$REPO/commits/$head_sha/status")
+            status_count=$(jq '.total_count' <<<"$statuses")
+            status_state=$(jq -r '.state' <<<"$statuses")
+            if [ "$status_count" -gt 0 ] && [ "$status_state" != "success" ]; then
+              echo "Skipping PR #$pr: commit statuses are $status_state."
+              continue
+            fi
+
+            if [ "$merge_flag" = "--merge" ]; then
+              policy=$(GH_TOKEN="$MERGE_TOKEN" python3 .release-policy/script/sdk_release_policy.py frozen --repo "$REPO")
+              if grep -qx 'frozen=true' <<< "$policy"; then
+                echo "Skipping PR #$pr: finish the current version release first."
+                continue
+              fi
+            fi
+
+            if [ "$merge_flag" = "--squash" ]; then
+              policy_args=(ready --repo "$REPO" --pr "$pr")
+              if [ "$EVENT_NAME" = "workflow_dispatch" ] && [ "$RELEASE_NOW" = "true" ]; then
+                policy_args+=(--force)
+              fi
+              policy=$(GH_TOKEN="$MERGE_TOKEN" python3 .release-policy/script/sdk_release_policy.py "${policy_args[@]}")
+              echo "$policy"
+              if ! grep -qx 'ready=true' <<< "$policy"; then
+                continue
+              fi
+            fi
+
+            echo "Merging PR #$pr with ${merge_flag}."
+            GH_TOKEN="$MERGE_TOKEN" gh pr merge "$pr" --repo "$REPO" "$merge_flag" --delete-branch --match-head-commit "$head_sha"
+            echo "Merged PR #$pr."
+          done <<<"$numbers"