Split spec sync into a read-only generate job and a PR job

Author: shrijayan

.github/workflows/sync-spec.yml

@@ -10,21 +10,27 @@ on:
         required: false
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
-  sync:
+  generate:
+    # Runs third-party npm code, so it has a read-only token and no stored credentials.
     runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - uses: astral-sh/setup-uv@v6
       - uses: oven-sh/setup-bun@v2
       - name: Resolve version
         id: version
+        env:
+          REQUESTED: ${{ inputs.version }}
         run: |
-          version="${{ inputs.version }}"
-          if [ -z "$version" ]; then version=$(npm view @opencode/protocol version); fi
+          version="${REQUESTED:-$(npm view @opencode/protocol version)}"
+          if ! printf '%s' "$version" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then echo "Invalid version: $version"; exit 1; fi
           effect=$(npm view "@opencode/protocol@$version" dependencies.effect)
           echo "version=$version" >> "$GITHUB_OUTPUT"
           echo "effect=$effect" >> "$GITHUB_OUTPUT"
@@ -33,20 +39,42 @@ jobs:
         run: |
           bun add --exact --ignore-scripts "@opencode/protocol@${{ steps.version.outputs.version }}" "effect@${{ steps.version.outputs.effect }}"
           bun run extract.ts
-      - name: Regenerate client
+      - name: Regenerate and verify
         run: |
           uv sync --locked
           uv run python -m codegen
           uv run ruff check .
           uv run pyright
           uv run pytest -m "not live"
+      - run: git diff > sync.patch
+      - uses: actions/upload-artifact@v4
+        with:
+          name: sync-patch
+          path: sync.patch
+
+  pull-request:
+    # Has write access but only applies the reviewed patch; it runs no project or npm code.
+    needs: generate
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/download-artifact@v4
+        with:
+          name: sync-patch
+      - name: Apply patch
+        run: |
+          if [ -s sync.patch ]; then git apply sync.patch; fi
+          rm sync.patch
       - uses: peter-evans/create-pull-request@v7
         with:
-          branch: sync/opencode-${{ steps.version.outputs.version }}
-          title: "Sync with OpenCode ${{ steps.version.outputs.version }}"
-          commit-message: "Sync with OpenCode ${{ steps.version.outputs.version }}"
+          branch: sync/opencode-${{ needs.generate.outputs.version }}
+          title: "Sync with OpenCode ${{ needs.generate.outputs.version }}"
+          commit-message: "Sync with OpenCode ${{ needs.generate.outputs.version }}"
           body: |
-            Regenerated from `@opencode/protocol@${{ steps.version.outputs.version }}`.
+            Regenerated from `@opencode/protocol@${{ needs.generate.outputs.version }}`.
 
             Review `api.md` for added, removed or changed operations before merging.
           delete-branch: true