sync-openapi-artifacts.yml

name: Sync OpenAPI Artifacts

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version name (e.g., 2025-12-15.clover)'
        required: true
        type: string

permissions:
  contents: write

jobs:
  sync:
    runs-on: ubuntu-latest
    steps:
      - name: Fetch app installation token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: gh-api-token
        with:
          app-id: ${{ secrets.GH_APP_STRIPE_OPENAPI_APP_ID }}
          private-key: ${{ secrets.GH_APP_STRIPE_OPENAPI_PRIVATE_KEY }}
          # The token checks out this repository and pushes the synced spec
          # artifacts back to it. Scope defaults to the current repository.
          permission-contents: write

      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # This is the one checkout in the repo that keeps its persisted
          # credential, because the last step is a plain `git push` that needs
          # it. zizmor's artipacked finding is about the credential escaping via
          # an uploaded artifact; this workflow uploads none, and the push is the
          # final step, so there is nothing after it to leak through.
          token: ${{ steps.gh-api-token.outputs.token }}

      - name: Get current version
        id: current-version
        run: echo "value=$(jq -r '.info.version' ./latest/openapi.spec3.json 2>/dev/null || echo 'unknown')" >> $GITHUB_OUTPUT

      - name: Create directories
        run: |
          mkdir -p ./latest
          mkdir -p ./preview

      - name: Download latest (GA) JSON specs
        run: |
          curl -fsSL "https://b.stripecdn.com/api-artifacts/assets/openapi/${INPUTS_VERSION}/ga/public.json" \
            -o ./latest/openapi.spec3.json
          curl -fsSL "https://b.stripecdn.com/api-artifacts/assets/openapi/${INPUTS_VERSION}/ga/sdk.json" \
            -o ./latest/openapi.spec3.sdk.json
        env:
          INPUTS_VERSION: ${{ inputs.version }}

      - name: Download latest (GA) YAML specs
        run: |
          curl -fsSL "https://b.stripecdn.com/api-artifacts/assets/openapi/${INPUTS_VERSION}/ga/public.yaml" \
            -o ./latest/openapi.spec3.yaml
          curl -fsSL "https://b.stripecdn.com/api-artifacts/assets/openapi/${INPUTS_VERSION}/ga/sdk.yaml" \
            -o ./latest/openapi.spec3.sdk.yaml
        env:
          INPUTS_VERSION: ${{ inputs.version }}

      - name: Download preview JSON specs
        run: |
          curl -fsSL "https://b.stripecdn.com/api-artifacts/assets/openapi/${INPUTS_VERSION}/public_preview/sdk.json" \
            -o ./preview/openapi.spec3.sdk.json
        env:
          INPUTS_VERSION: ${{ inputs.version }}

      - name: Download preview YAML specs
        run: |
          curl -fsSL "https://b.stripecdn.com/api-artifacts/assets/openapi/${INPUTS_VERSION}/public_preview/sdk.yaml" \
            -o ./preview/openapi.spec3.sdk.yaml
        env:
          INPUTS_VERSION: ${{ inputs.version }}

      - name: Download private preview JSON specs
        run: |
          curl -fsSL "https://b.stripecdn.com/api-artifacts/assets/openapi/${INPUTS_VERSION}/private_preview/sdk.json" \
            -o ./preview/openapi.private_preview.spec3.sdk.json
        env:
          INPUTS_VERSION: ${{ inputs.version }}

      - name: Download private preview YAML specs
        run: |
          curl -fsSL "https://b.stripecdn.com/api-artifacts/assets/openapi/${INPUTS_VERSION}/private_preview/sdk.yaml" \
            -o ./preview/openapi.private_preview.spec3.sdk.yaml
        env:
          INPUTS_VERSION: ${{ inputs.version }}

      - name: Check for changes
        id: changes
        run: |
          if git diff --quiet && [ -z "$(git ls-files --others --exclude-standard)" ]; then
            echo "has_changes=false" >> $GITHUB_OUTPUT
            echo "No changes detected, skipping commit step"
          else
            echo "has_changes=true" >> $GITHUB_OUTPUT
          fi

      - name: Commit and push
        if: steps.changes.outputs.has_changes == 'true'
        run: |
          git config user.name "Stripe OpenAPI"
          git config user.email "105521251+stripe-openapi[bot]@users.noreply.github.com"
          git add -A
          git commit -m "Update OpenAPI for ${INPUTS_VERSION}"
          git push
        env:
          INPUTS_VERSION: ${{ inputs.version }}