[gjtorikian]

Why

spec-changes.yml and replay-spec-changes.yml POSTed each changed-services manifest to the SDK bot at /internal/spec-changes, HMAC-signed with SPEC_CHANGES_SECRET. Runner traffic cannot be IP-scoped, so that endpoint needed its own WAF exception, and every run since Oct 30 has failed on it.

Pairs with workos/sdk-automation-bot feat/spec-changes-artifact-ingest, which pulls the artifact on this workflow's workflow_run webhook.

What

• spec-changes.yml: build the manifest with --output spec-changes/<sha>.json and upload it as artifact spec-changes-<sha> (14-day retention). No upload when there are no changed services. Re-running the workflow re-publishes, which is the recovery path for a missed delivery.
• replay-spec-changes.yml: mode: upload replaces push. The script writes one <sha>.json per target into spec-changes/, uploaded as spec-changes-replay-<run_id>.
• scripts/replay-spec-changes.mjs: --push/--bot-url become --output-dir, still gated on --confirm REPLAY_SPEC_CHANGES. The HMAC POST path is gone.

actionlint clean on both workflows. npm test: 163 pass.

After merge

Delete the SPEC_CHANGES_SECRET Actions secret; nothing reads it anymore.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; the remaining test gap is non-blocking.

Findings

1.  File writes lack test coverage ▶

Fix with agent prompt

### Issue 1
scripts/__tests__/replay-spec-changes.spec.mjs:undefined-105
The updated tests check `--output-dir` parsing but never exercise the new file-writing branch. Add tests using a temporary directory to check `<sha>.json` contents, skipping empty manifests, dry runs writing nothing, and a bad later target leaving no earlier files. These are the guarantees the artifact upload now depends on.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

The PR replaces signed manifest POSTs with workflow artifacts for the SDK bot to download.

• Regular spec-change runs publish manifests as GitHub artifacts.
• Historical replays reach the SDK bot as workflow artifacts.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Spec merge] --> B[Build manifest]
  C[Confirmed historical replay] --> D[Rebuild manifests]
  B --> E{Changed services?}
  D --> E
  E -->|Yes| F[Upload workflow artifact]
  E -->|No| G[Skip upload]
  F --> H[SDK bot receives workflow_run]
  H --> I[Download manifests and upsert by SHA]

Loading

_{Reviews (2) · Last reviewed commit: "fix(ci): cover replay manifest writes an..." · Reviewed by Greptile}

[greptile-apps]

File writes lack test coverage

The updated tests check --output-dir parsing but never exercise the new file-writing branch. Add tests using a temporary directory to check <sha>.json contents, skipping empty manifests, dry runs writing nothing, and a bad later target leaving no earlier files. These are the guarantees the artifact upload now depends on.

Prompt To Fix With AI

This is a comment left during a code review.
Path: scripts/__tests__/replay-spec-changes.spec.mjs
Line: 102

Comment:
**File writes lack test coverage**

The updated tests check `--output-dir` parsing but never exercise the new file-writing branch. Add tests using a temporary directory to check `<sha>.json` contents, skipping empty manifests, dry runs writing nothing, and a bad later target leaving no earlier files. These are the guarantees the artifact upload now depends on.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!