ci: bot-opened SDK regen PRs don't trigger spec-sdk-tests (GITHUB_TOKEN limitation)

[leggetter]

Trigger

Empirically confirmed today: the Speakeasy bot SDK regen PRs that merged for Go (#935) and Python (#937) v1.4.0 did not trigger spec-sdk-tests.yml (#925) — the workflow specifically built to validate that exact scenario.

Workflow run history shows runs against feature branches and our PR branches, but zero runs against either speakeasy-sdk-regen-1780079455 (Go) or speakeasy-sdk-regen-1780079461 (Python).

Alex flagged this — quote: "it seems we need to rethink our CI strategy because Claude said PR opened by CI won't trigger CI."

Root cause

GitHub Actions deliberately suppresses workflow triggers for PRs (and pushes) created via the default GITHUB_TOKEN. From the docs:

When you use the repository's GITHUB_TOKEN to perform tasks, events triggered by the GITHUB_TOKEN […] will not create a new workflow run. This prevents you from accidentally creating recursive workflow runs.

The SDK generation workflow (sdk-generate-one.yml → speakeasy-workflow-executor-v15.yml) opens its PRs using GITHUB_TOKEN, so by design those PRs don't fire downstream CI.

Impact

The "bot regen PR" path is the primary scenario #925 and #929 were built to gate. With this limitation in place:

• spec-sdk-tests.yml (alignment validation between PR's spec + PR's server) skipped on every bot regen PR.
• spec-sdk-tests-vs-release.yml (ci(spec-sdk-tests-vs-release): test PR's SDK against latest released Outpost #927 — new SDK vs latest released Outpost) skipped on every bot regen PR.
• Net result: SDK regens continue to merge unvalidated, exactly the failure mode this whole effort was meant to close.

Fix options

1. Use a PAT or GitHub App token for bot PR creation. Standard pattern. PR events look like they came from a user, downstream workflows trigger normally. Requires creating + rotating the credential. Affects no existing workflow code beyond the token reference.
2. Run spec-sdk-tests inline inside the SDK generation workflow before opening the PR. The PR comes with results from its own gen workflow. Couples the gen workflow to the contract suite; harder to evolve independently.
3. Manual re-trigger (close+reopen, gh run rerun, /run-ci comment hook). Cheapest to implement; requires human ceremony per release; defeats the "automatic gate" intent.

Recommend option 1 — solves it once, applies automatically to any future workflow we add.

Acceptance

• Next bot SDK regen PR fires spec-sdk-tests.yml (and spec-sdk-tests-vs-release.yml if its path filter matches).
• Same for any future workflow gated on PR events touching SDK paths.

Related

• #921 — original spec-sdk-tests CI tracking
• #925 — adds the workflow that's getting skipped
• #927 — adds the second workflow that's getting skipped
• #929 — extends ci(spec-sdk-tests-vs-release): test PR's SDK against latest released Outpost #927; ready for review
• chore: 🐝 Update SDK - Generate OUTPOST-GO 1.4.0 #935, chore: 🐝 Update SDK - Generate OUTPOST-PYTHON 1.4.0 #937 — the bot PRs from today that demonstrate the gap

🤖 Generated with Claude Code