feat!: rebuild the client on API specification 2.26.1

.github/workflows/ci.yml

@@ -0,0 +1,33 @@
+name: CI
+
+# Build and load checks. Everything that needs a credential runs elsewhere and reports
+# back as a commit status, so no secret is reachable from this workflow.
+
+on:
+  pull_request:
+  push:
+    branches: [master, main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: build (php ${{ matrix.php }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ['8.2', '8.3', '8.4']
+    steps:
+      - uses: actions/checkout@v4
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+      - run: composer install --no-interaction --no-progress
+      - name: Lint every source file
+        run: find src -name '*.php' -print0 | xargs -0 -n1 php -l > /dev/null

.github/workflows/release.yml

@@ -0,0 +1,48 @@
+name: Release
+
+# PHP has no publish step: Packagist reads the tag pushed by tag-on-merge.yml and needs no
+# credential (FR-021a). This workflow only asserts the tag and the manifest agree, so a mismatched
+# release is caught here rather than silently published by Packagist.
+
+on:
+  push:
+    tags: ['v[0-9]+.[0-9]+.[0-9]+']
+
+permissions:
+  contents: write # create the GitHub release
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: The tag must match the packaged version
+        run: |
+          # Every tag in this repository, and in api-reference, carries the v. The version
+          # inside the package never does, so the tag is compared with it stripped.
+          TAG="${GITHUB_REF_NAME#v}"
+          PKG="$(cat VERSION)"
+          [ "$TAG" = "$PKG" ] || { echo "tag $TAG != VERSION $PKG"; exit 1; }
+          echo "Packagist will pick up tag $TAG from its repository webhook."
+
+      # The tag alone left the repository's Releases page showing a version from years ago as
+      # "Latest", which is what anyone browsing the repository sees first. The notes come from the
+      # CHANGELOG section for this version, so the release says what changed rather than nothing.
+      - name: Publish the GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          NOTES="$(awk -v v="$VERSION" '
+            $0 ~ "^## \\[?" v "\\]?" { found = 1; next }
+            found && /^## / { exit }
+            found { print }
+          ' CHANGELOG.md)"
+          [ -n "$NOTES" ] || NOTES="See CHANGELOG.md for $VERSION."
+          # Creating one that exists is an error, and a re-run of a release that already happened
+          # should be a no-op rather than a red build.
+          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
+            echo "Release $GITHUB_REF_NAME already exists; nothing to do."
+          else
+            gh release create "$GITHUB_REF_NAME" --title "$GITHUB_REF_NAME" --notes "$NOTES"
+          fi

.github/workflows/tag-on-merge.yml

@@ -0,0 +1,40 @@
+name: Tag on merge
+
+# Merging is what creates the version tag, and the tag is what publishes (FR-007f, FR-019a).
+# A breaking release waits for a human to merge, which is how the FR-019 approval is expressed.
+
+on:
+  push:
+    branches: [master, main]
+
+permissions:
+  contents: write
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    steps:
+      # SDK_RELEASE_TOKEN, not the automatic GITHUB_TOKEN. GitHub does not start a workflow run for
+      # an event created with GITHUB_TOKEN, so a tag pushed with it would never trigger release.yml
+      # and nothing would ever publish. That failure is silent: the tag appears, the release
+      # workflow simply never runs. Needs contents:write on this repository.
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.SDK_RELEASE_TOKEN }}
+      - name: Tag the version if it is new
+        run: |
+          test -n "${{ secrets.SDK_RELEASE_TOKEN }}" || {
+            echo "SDK_RELEASE_TOKEN is not set: the tag would not trigger release.yml"; exit 1;
+          }
+          # v-prefixed, matching every tag this repository and api-reference already carry.
+          # The version inside the package stays bare; only the git tag is prefixed.
+          VERSION="v$(cat VERSION)"
+          if git rev-parse "$VERSION" >/dev/null 2>&1; then
+            echo "Tag $VERSION already exists, nothing to do."
+            exit 0
+          fi
+          git config user.name  "Flat SDK bot"
+          git config user.email "developers@flat.io"
+          git tag -a "$VERSION" -m "Release $VERSION"
+          git push origin "$VERSION"

.gitignore

@@ -4,3 +4,10 @@ composer.phar
 # Commit your application's lock file http://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file
 # You may choose to ignore a library lock file http://getcomposer.org/doc/02-libraries.md#lock-file
 # composer.lock
+
+# build artifacts
+vendor/
+composer.phar
+.sdkgen-scratch/
+.openapi-spec.yaml
+.DS_Store