[pimlock]

Summary

Ports sdk-go's core sync automation. An hourly workflow opens a bump PR for each new core release tag. A nightly workflow compares core main with the pin and keeps one Core main drift issue current. Both scripts run locally with --dry-run.

Stacked on #12, which provides the E2E lane that bump PRs run.

Related Issue

Closes #5. Part of NVIDIA/OpenShell#5287.

Changes

• core-watch.yml (hourly, or by hand with a tag) runs scripts/core-sync/core-tags.sh, then scripts/core-sync/open-bump-pr.sh for each tag. Each bump PR, chore(core): track <tag> on branch core/<tag>:

  • moves OPENSHELL_CORE_REF, regenerates the bindings with mise run proto:gen, and refreshes the files copied from core;
  • shows the proto diff between the two tags in its body;
  • is labeled core-bump plus stable or prerelease.

  Every new stable tag gets a PR, plus the newest pre-release. A newer pre-release proposal closes the older one. A proposal is never reopened once closed.

• core-drift.yml (nightly) runs scripts/core-sync/drift-check.sh, then update-drift-issue.sh, which creates, updates or closes the Core main drift issue. It checks three things:

  • buf breaking between the pin and core main, for the protos the SDK generates;
  • the unit tests against bindings regenerated from main;
  • the RPCs no SDK code calls (informational only).

• report-failure.sh adds a dated line to that issue when either workflow fails.

• scripts/vendored-core-files.txt lists the files copied from core: the OAuth fixture, its license sidecar and the E2E Dockerfile. conformance:check and the bump script both read it, so adding a copied file is a one-line change.

• mise tasks: core:tags, core:bump, core:drift.

• Docs: scripts/README.md has the script and workflow tables. The README and CONTRIBUTING.md each have a short section on keeping up with core.

Differences from sdk-go:

• The pin lives in mise.toml, not buf.gen.yaml.
• The drift check runs the Python unit tests instead of go build and go vet, and finds uncovered RPCs in the _pb2_grpc.py stubs.
• The bump PR body doesn't say that merging tags a release yet; that belongs to ci: tag lockstep releases and publish to PyPI with trusted publishing #8.
• The scripts live in scripts/core-sync/, next to scripts/e2e/ from test(e2e): run the SDK E2E suite against the pinned core gateway #12, instead of hack/automation/ (ci: shared CI checks across the SDK repositories #11 tracks one layout for all SDK repositories).

Bump PRs run E2E against their own pin, because e2e.yml reads OPENSHELL_CORE_REF from the PR branch.

Needs before it runs on main:

• The App and the sdk-bot environment (ci: GitHub App and sdk-bot environment for the automation #7).
• The labels core-bump, stable, prerelease and core-drift, copied from sdk-go: these already exist.

Testing

• mise run core:tags prints v0.1.8-pre.3; with --all, it prints pre.1 to pre.3.
• mise run core:bump -- v0.1.8-pre.3 --dry-run --base HEAD builds the bump commit (pin, 2 binding files, no copied-file changes) and prints the PR body with the proto diff. It removes its local branch and worktree afterwards.
• mise run core:drift against core main (af02016) passes: no breaking changes, and the unit tests pass on regenerated bindings. It lists 73 uncovered RPCs.
• update-drift-issue.sh --dry-run creates no issue for a passing report and would create one for a failing report. report-failure.sh --dry-run would create the issue with the failure line.
• conformance:check passes, and fails when the vendored Dockerfile is edited.
• mise run check, shellcheck, actionlint and zizmor pass.
• A real core-watch run opens a bump PR, and a real core-drift run updates the drift issue. Both need ci: GitHub App and sdk-bot environment for the automation #7.