workos 7.1.2 → 9.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6e48d8fb142eca494c5b316c17dd940cfbb2244a5c1589a9b30cc7106f850631
-  data.tar.gz: 1fd7a0f9e75d74109e01e6a54546cf7f83155c78e64ea321e77d032e219a749c
+  metadata.gz: d298622f18f3a7fa937e4a37bb7e65ef37553a09ff6299fa32e5899f6ad62dfc
+  data.tar.gz: c8ae0ea79b8d4d9713edc1c22f5f55afc47dc7f5c5374430f7ac3c1eb7c4138a
 SHA512:
-  metadata.gz: 29c7c96477e7d66be140bee056673e9d5385beb15da8cad3011e9a3335d8d6ebcf902d9547c2188656ed0fdb0cdde724df79a6eb240507e501a46c6c0cded34e
-  data.tar.gz: 34592fb5ecd1d1e52f06338115f3740a02304f1c3d077c06a8038bb8bb009dd769073d2bff0bf782558a945bd3ff9b4270c868a1101ebf2c7ac6443bbaf735cd
+  metadata.gz: e341612af96eb751ee97935c6560b80f647b7032bc37145fa953bf0ed3a72b432d947b8b93a95743ee6bad7bd8bb92336de4140dd202fc23e4ebc7c046dd53b4
+  data.tar.gz: 8df40fc5b71007946287b91b0fedf215b2cb19312f6180c9ec577aecfdfbbfd06482228ba7519aa23eb0be065c5d55088073abcdbbcce65b2b161eb970d089ed

data/.github/workflows/ci.yml

@@ -21,8 +21,8 @@ jobs:
           - '3.4'
           - '4.0'
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+      - uses: ruby/setup-ruby@12fd324f1d0b43274fdc8130f6980590a667c455 # 1.312.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true

data/.github/workflows/docs.yml

@@ -0,0 +1,49 @@
+name: Publish API Docs
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: pages
+  cancel-in-progress: false
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+      - uses: ruby/setup-ruby@12fd324f1d0b43274fdc8130f6980590a667c455 # 1.312.0
+        with:
+          bundler-cache: true
+      - run: ./script/docs
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+      - name: Archive site
+        run: |
+          tar \
+            --dereference --hard-dereference \
+            --directory docs/_site \
+            -cvf "$RUNNER_TEMP/artifact.tar" \
+            --exclude=.git \
+            --exclude=.github \
+            .
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: github-pages
+          path: ${{ runner.temp }}/artifact.tar
+          retention-days: 1
+          if-no-files-found: error
+  deploy:
+    needs: build
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        id: deployment

data/.github/workflows/lint.yml

@@ -15,8 +15,8 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+      - uses: ruby/setup-ruby@12fd324f1d0b43274fdc8130f6980590a667c455 # 1.312.0
         with:
           bundler-cache: true
 

data/.github/workflows/release-please.yml

@@ -5,17 +5,33 @@ on:
     branches:
       - main
 
+concurrency:
+  group: release-please
+  cancel-in-progress: false
+
 permissions:
   contents: write
   pull-requests: write
 
 jobs:
+  # release-please owns tag + GitHub Release creation (no
+  # skip-github-release). Because it tags every release inside its own run
+  # — before it computes the next release PR — it always knows the previous
+  # release boundary, so it never regenerates the changelog from the start
+  # of history or proposes a spurious major bump. Creating the release with
+  # the app token also fires the `release: published` event that release.yml
+  # uses to publish to RubyGems. This job is kept minimal so nothing
+  # downstream (changelog enrichment, release notes) can fail it.
   release-please:
     runs-on: ubuntu-latest
+    outputs:
+      pr: ${{ steps.release.outputs.pr }}
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
       - name: Generate token
         id: generate-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # 3.2.0
         with:
           app-id: ${{ vars.SDK_BOT_APP_ID }}
           private-key: ${{ secrets.SDK_BOT_PRIVATE_KEY }}
@@ -25,29 +41,167 @@ jobs:
         with:
           token: ${{ steps.generate-token.outputs.token }}
 
-      - name: Update Gemfile.lock on release PR
-        if: steps.release.outputs.pr
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+  # While the release PR is open, enrich it before it merges. Runs as its
+  # own job (gated on the PR existing) so a failure here can never block the
+  # release or any publish that depends on release-please.
+  enrich-release-pr:
+    needs: release-please
+    if: needs.release-please.outputs.pr
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate token
+        id: generate-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # 3.2.0
+        with:
+          app-id: ${{ vars.SDK_BOT_APP_ID }}
+          private-key: ${{ secrets.SDK_BOT_PRIVATE_KEY }}
+
+      - name: Checkout release PR branch
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
         with:
-          ref: ${{ fromJSON(steps.release.outputs.pr).headBranchName }}
+          ref: ${{ fromJSON(needs.release-please.outputs.pr).headBranchName }}
           token: ${{ steps.generate-token.outputs.token }}
 
+      # Inline pending changelog fragments under the version heading
+      # release-please just wrote in CHANGELOG.md. For PRs that have a
+      # fragment (the autogen flow always writes one), drop the line
+      # release-please rendered and use the fragment instead. For PRs
+      # without a fragment (typical for human-authored PRs), keep what
+      # release-please wrote. Fragments are deleted in the same commit.
+      # Idempotent: if no fragments exist, skip silently.
+      - name: Inline rich changelog fragments
+        env:
+          PR_JSON: ${{ needs.release-please.outputs.pr }}
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          fragments=(.changelog-pending/*.md)
+          if [ ${#fragments[@]} -eq 0 ]; then
+            echo "No .changelog-pending fragments; leaving release-please CHANGELOG.md as-is."
+            exit 0
+          fi
+
+          VERSION=$(echo "$PR_JSON" | jq -r '.title' | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
+          export VERSION
+
+          python3 - <<'PY'
+          import os, re, pathlib, glob
+
+          version = os.environ["VERSION"]
+
+          # Load fragments + extract the PR number each one covers from
+          # its top-line "* [#NN](url) ...".
+          fragments = []
+          covered = set()
+          for path in sorted(glob.glob(".changelog-pending/*.md")):
+              body = pathlib.Path(path).read_text().rstrip()
+              m = re.search(r'\[#(\d+)\]', body)
+              if m:
+                  covered.add(m.group(1))
+              fragments.append(body)
+
+          changelog = pathlib.Path("CHANGELOG.md")
+          text = changelog.read_text()
+          section_re = re.compile(
+              r'(^## \[' + re.escape(version) + r'\][^\n]*\n)(.*?)(?=^## |\Z)',
+              re.MULTILINE | re.DOTALL,
+          )
+          match = section_re.search(text)
+          if not match:
+              raise SystemExit(f"Could not find '## [{version}]' heading in CHANGELOG.md")
+          heading, body = match.group(1), match.group(2)
+
+          # Drop any release-please line that references a PR we have a
+          # fragment for.
+          kept = []
+          for line in body.split("\n"):
+              if any(pr in covered for pr in re.findall(r'\[#(\d+)\]', line)):
+                  continue
+              kept.append(line)
+          filtered = "\n".join(kept)
+
+          # Collapse "### Heading\n(blank lines)\n" with nothing under
+          # it. Run repeatedly until stable in case of stacked empties.
+          empty_section = re.compile(
+              r'^### [^\n]*\n(?:\s*\n)*(?=^### |\Z)',
+              re.MULTILINE,
+          )
+          while True:
+              new = empty_section.sub('', filtered)
+              if new == filtered:
+                  break
+              filtered = new
+          filtered = filtered.strip()
+
+          parts = []
+          if filtered:
+              parts.append(filtered)
+          parts.extend(fragments)
+          new_body = "\n\n".join(parts)
+
+          new_text = text[:match.start()] + heading + "\n" + new_body + "\n\n" + text[match.end():]
+          changelog.write_text(new_text)
+          PY
+
+          git config user.name "workos-sdk-automation[bot]"
+          git config user.email "255426317+workos-sdk-automation[bot]@users.noreply.github.com"
+          git rm .changelog-pending/*.md
+          git add CHANGELOG.md
+          git commit -m "chore: inline release notes from .changelog-pending"
+          git push
+
       - name: Set up Ruby
-        if: steps.release.outputs.pr
-        uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
+        uses: ruby/setup-ruby@12fd324f1d0b43274fdc8130f6980590a667c455 # 1.312.0
         with:
           ruby-version: ruby
 
       - name: Bundle install and commit
-        if: steps.release.outputs.pr
         run: |
           bundle install
           if git diff --quiet Gemfile.lock; then
             echo "Gemfile.lock is up to date"
           else
-            git config user.name "github-actions[bot]"
-            git config user.email "github-actions[bot]@users.noreply.github.com"
+            git config user.name "workos-sdk-automation[bot]"
+            git config user.email "255426317+workos-sdk-automation[bot]@users.noreply.github.com"
             git add Gemfile.lock
             git commit -m "chore: update Gemfile.lock"
             git push
           fi
+
+  # After release-please tags the release and creates the GitHub Release,
+  # replace its body with the rich section from CHANGELOG.md (release-please
+  # writes only its terse default rendering). Cosmetic-only: never fails the
+  # release if the section can't be found.
+  update-release-notes:
+    needs: release-please
+    if: needs.release-please.outputs.release_created == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate token
+        id: generate-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # 3.2.0
+        with:
+          app-id: ${{ vars.SDK_BOT_APP_ID }}
+          private-key: ${{ secrets.SDK_BOT_PRIVATE_KEY }}
+
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        with:
+          token: ${{ steps.generate-token.outputs.token }}
+
+      - name: Set rich release notes from CHANGELOG.md
+        env:
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
+          TAG: ${{ needs.release-please.outputs.tag_name }}
+        run: |
+          set -euo pipefail
+          VERSION="${TAG#v}"
+          awk -v v="$VERSION" '
+            $0 ~ ("^## \\[" v "\\]") { found=1; next }
+            found && /^## \[/ { exit }
+            found
+          ' CHANGELOG.md > /tmp/release-notes.md
+          if [ -s /tmp/release-notes.md ]; then
+            gh release edit "$TAG" --notes-file /tmp/release-notes.md
+          else
+            echo "No CHANGELOG.md body for $TAG; keeping release-please default notes."
+          fi

data/.github/workflows/release.yml

@@ -22,10 +22,10 @@ jobs:
           role-to-assume: rg_oidc_akr_fn8dx45asckvmsnd2kka
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
+        uses: ruby/setup-ruby@12fd324f1d0b43274fdc8130f6980590a667c455 # 1.312.0
         with:
           bundler-cache: true
 

data/.gitignore

@@ -50,3 +50,5 @@
 
 .vscode
 .idea/
+docs/_site/
+.yardoc/

data/.last-synced-sha

@@ -1 +1 @@
-92db0495807c86fbbc4d45bd266a6c1f5bcbb59c
+23faa38318d596e581656934ed72c4a18476d742