Generate SDKs with self-hosted stlc

[sjmiller609]

Summary

Moves the Go and TypeScript SDKs from hosted Stainless generation to self-hosted stlc.

• installs the private stlc packages at exact commit SHAs on Node.js 24
• generates and validates SDKs in internal staging repositories, including real PR previews and isolated integration-test branches
• promotes reviewed staging batches to the public SDK repositories with manual fast-forward workflows
• fast-forwards production release commits back to staging
• preserves exported custom code through committed tracking state and seal-back automation
• disables the hosted Stainless workflow

Validation

• real generation completed for Go and TypeScript
• Go tests passed
• TypeScript: 377 passed, 82 skipped
• no exported API, request/response, authentication, retry, pagination, or runtime behavior drift from hosted output
• PR previews passed against both staging repositories
• no-op promotion checks passed after setting every staging default branch to main
• repository CI, actionlint, YAML parsing, Prettier, and Semgrep pass

After merge

The merge triggers generation onto staging main. Review the staging changes, manually run each staging repository's Promote SDKs workflow, then verify release-please, package publishing, and production-to-staging back-sync before removing hosted-only secrets or uninstalling the Stainless GitHub App.

---

Note

High Risk
This changes how published Go/TypeScript SDKs are built and pushed (new secrets, app tokens, staging vs production repos); mistakes could ship wrong SDK output or drop custom code if seal-back tracking lags.

Overview
Replaces the hosted Stainless GitHub Action workflow with a self-hosted stlc pipeline that builds Go and TypeScript SDKs from this repo’s OpenAPI/Stainless config.

A new composite action installs pinned stlc CLI and generator packages (Node 24, Go, pnpm) using a private read token. stlc-generate.yml drives PR preview branches on staging SDK repos, posts an stlc show manifest comment, validates with bootstrap/lint/test, pushes staging main on merge, opens auto-merge PRs for stainless/custom-code tracking files, and cleans up preview branches when PRs close. workflow_dispatch with integration_test pushes isolated test branches and draft PRs without touching production paths.

stainless.yaml now declares staging_repo and release publish settings per target. The repo adds a stainless/ workspace (workspace.json, committed custom-code tracking JSON, gitignore for generated sdks/ and builds/). Operator flow is documented in docs/runbooks/sdk-generation-stlc.md.

^{Reviewed by Cursor Bugbot for commit 9e93ede. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

-->

✱ stlc build

✅ go code · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

112 files generated at 2e08943 (pushed)

go get github.com/kernel/hypeman-go-staging@2e0894395788c6a304a6199a0290e238767b57ab

✅ typescript code · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

134 files generated at dfa4e78 (pushed)

Diagnostics: 💡 0 new / 5 total note

Level	Code	Message	Targets

Build metadata

Build	bd_765FLGbk-jade-fern
Timestamp	2026-08-05T22:52:22.352Z
stlc	8413509
Spec hash	33da8d5c02bb
Config hash	9125eb22cb4c

---

This comment is auto-generated by stlc and is kept up to date as you push.
If you push new commits, re-run this workflow to update this comment.
Last updated: 2026-08-05 22:52:40 UTC

[sjmiller609]

Strict review of head aa60130 — verdict: approve (cannot submit a formal GitHub approval as the PR author).

• Runbook docs/runbooks/sdk-generation-stlc.md covers all durable ops: staging previews, main generation, manual Promote SDKs fast-forward promotion (verified in hypeman-*-staging stlc-promote.yml: workflow_dispatch only, ancestor check refuses divergence, never force-pushes), release-please + scheduled back-sync (stlc-sync.yml), integration-test safety/cleanup, custom-code sealing/tracking, recovery commands, pinned stlc revision upgrades, delayed hosted-app removal.
• Removed content is one-time cutover/setup history only; workflow header comment updated accordingly.
• All checks pass; no unresolved review threads.

[rgarcia]

reviewed — overall flow looks solid; two things worth addressing:

correctness

• .github/workflows/stlc-generate.yml:235-236 — the clean-worktree validation misses untracked files. consider checking git status --porcelain --untracked-files=all so bootstrap or test artifacts cannot affect the pushed build without being detected.

docs

• docs/runbooks/sdk-generation-stlc.md:39-48 — the operator commands do not establish the stainless/ working directory, although CI invokes stlc there. consider adding cd stainless before the build and recovery commands so the snippets work from a fresh checkout.