From d12cd70c9406a9cf7ba76b2e178610552f0dbedd Mon Sep 17 00:00:00 2001
From: AdamFlanagan-Nscale
 <164037640+AdamFlanagan-Nscale@users.noreply.github.com>
Date: Fri, 16 Oct 2026 16:48:08 +0100
Subject: [PATCH] ci: notify nscale-sdk-go when a spec is published

Sends an openapi-published repository_dispatch to nscale-sdk-go on every
publish to <service>/main or <service>/latest, so the Go SDK regenerates
without waiting for someone to run `just update`.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/notify-sdk.yml | 45 ++++++++++++++++++++++++++++++++
 README.md                        |  2 ++
 2 files changed, 47 insertions(+)
 create mode 100644 .github/workflows/notify-sdk.yml

diff --git a/.github/workflows/notify-sdk.yml b/.github/workflows/notify-sdk.yml
new file mode 100644
index 0000000..015e3c9
--- /dev/null
+++ b/.github/workflows/notify-sdk.yml
@@ -0,0 +1,45 @@
+name: Notify SDKs
+
+# Tells downstream SDKs that a spec was published, so they can regenerate.
+# Fires on the publish-spec action's pushes to main (a release also rewrites
+# <service>/latest/, so the path filter catches those too).
+#
+# The dispatch is only a nudge: nscaledev/nscale-sdk-go works out for itself
+# which packages drifted, against the tip of main at the time it runs, and opens
+# a PR per package (see its spec-refresh.yml). It also runs nightly, so a missed
+# dispatch only delays a refresh rather than losing it.
+#
+# Runs as the nscale-actions GitHub App, which needs contents: write on
+# nscale-sdk-go to send a repository_dispatch. Needs NSCALE_ACTIONS_APP_ID
+# (variable) and NSCALE_ACTIONS_APP_PK (secret) visible to this repo.
+on:
+  push:
+    branches: [main]
+    paths:
+      - "*/main/openapi.yaml"
+      - "*/latest/openapi.yaml"
+
+permissions:
+  contents: read
+
+jobs:
+  go-sdk:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Mint App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.NSCALE_ACTIONS_APP_ID }}
+          private-key: ${{ secrets.NSCALE_ACTIONS_APP_PK }}
+          owner: nscaledev
+          repositories: nscale-sdk-go
+
+      - name: Dispatch openapi-published
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          SHA: ${{ github.sha }}
+        run: |
+          gh api repos/nscaledev/nscale-sdk-go/dispatches \
+            -f event_type=openapi-published \
+            -f "client_payload[sha]=$SHA"
diff --git a/README.md b/README.md
index ee2c097..290e09e 100644
--- a/README.md
+++ b/README.md
@@ -42,6 +42,8 @@ That last check exists because sanitization only removes what a source repo expl
 
 `main` requires the `test` and `check` status checks to pass and blocks force-pushes/deletions, but admins are exempt from required checks (`enforce_admins: false`) — deliberately, since the action pushes straight to `main` with no PR, and a brand-new commit can never have a passing check recorded against it before it lands. Whatever account `OPENAPI_PUBLISH_TOKEN` belongs to needs admin or maintain access here, or its pushes will be rejected the same way a non-admin's would be.
 
+Each publish to `main` (including the `<service>/latest/` update a release makes) sends an `openapi-published` `repository_dispatch` to [`nscale-sdk-go`](https://github.com/nscaledev/nscale-sdk-go), which regenerates the affected Go clients and opens PRs. See [`notify-sdk.yml`](.github/workflows/notify-sdk.yml).
+
 ## Local development
 
 Node 20+, no global installs required: