feat: Speakeasy API client bootstrap (PDE-755)

.genignore

@@ -1,9 +1,7 @@
-# Hand-written webhook signature verification — never overwrite with generated code.
-# helpers.py must stay too: utils/__init__.py eagerly imports it, so dropping it
-# would break `from convoy.utils.webhook import Webhook` at package init.
-convoy/utils/webhook.py
-convoy/utils/helpers.py
-convoy/utils/__init__.py
+# Hand-written webhook signature verification — never overwrite with generated
+# code. It lives inside the generated src/convoy tree so the import path stays
+# `from convoy.utils.webhook import Webhook`; only this file is hand-owned.
+src/convoy/utils/webhook.py
 
 # Shared signature contract + verify unit tests (hand-authored).
 test/signature-vectors.json

.github/workflows/run-tests.yml

@@ -21,14 +21,20 @@ jobs:
       - name: Install package
         run: |
           python -m pip install --upgrade pip
-          pip install -e .
+          # Pre-generation the repo has no installable package yet; the verify
+          # tests import from src/ directly (PYTHONPATH below).
+          pip install -e . || echo "editable install unavailable (pre-generation); continuing"
           pip install pytest
 
       - name: Verify hand-written modules are present
         run: |
-          test -f convoy/utils/webhook.py
+          test -f src/convoy/utils/webhook.py
           test -f test/signature-vectors.json
           test -f test/test_shared_vectors.py
 
       - name: Execute verify + shared vector tests
+        env:
+          # PEP 420 namespace packages: `convoy.utils.webhook` resolves from
+          # src/ before generation adds real __init__.py files.
+          PYTHONPATH: src
         run: pytest test/test_webhook.py test/test_shared_vectors.py -q

MIGRATION.md

@@ -3,14 +3,14 @@
 ## What changed
 
 - The **public HTTP API client** will be generated from Convoy's OpenAPI spec (`docs/v3/openapi3.yaml`) via [Speakeasy](https://www.speakeasy.com/).
-- **Webhook signature verification stays hand-written.** Generators do not own crypto. `convoy/utils/webhook.py` and the shared `test/signature-vectors.json` contract remain the source of truth for verify (see `.genignore`).
+- **Webhook signature verification stays hand-written.** Generators do not own crypto. `src/convoy/utils/webhook.py` and the shared `test/signature-vectors.json` contract remain the source of truth for verify (see `.genignore`).
 
 ## Breaking change policy
 
 Shipping the Speakeasy client is an intentional **1.x** break from the hand-written `0.x` surfaces. Method shapes are **not** silently preserved.
 
-1. This bootstrap PR wires Speakeasy + protects verify.
-2. The first `sdk_generation.yaml` run opens a PR that replaces the hand-written HTTP client with generated code and publishes as `1.x`. Generation keeps the `convoy` import root (`moduleName: convoy` in `.speakeasy/gen.yaml`); that PR **must relocate `convoy/utils/webhook.py` into the generated module tree unchanged** so `from convoy.utils.webhook import Webhook` keeps resolving.
+1. This bootstrap PR wires Speakeasy, removes the deprecated hand-written HTTP client, and relocates verify to `src/convoy/utils/webhook.py` (inside the generated module tree, so `from convoy.utils.webhook import Webhook` keeps resolving — `moduleName: convoy` in `.speakeasy/gen.yaml`).
+2. The first `sdk_generation.yaml` run opens a PR that adds the OpenAPI-generated client and publishes as `1.x`.
 3. Consumers pin `0.x` until they migrate call sites.
 
 ## Verify (unchanged)