fix(ci): vendor Speakeasy executor + checkout fix for tag-based SDK generation

.github/workflows/sdk-generate-on-release-dispatch.yml

@@ -1,7 +1,6 @@
-# Tag pushes set GITHUB_REF to refs/tags/..., which makes Speakeasy's sdk-generation-action
-# compute an invalid PR base (see GetTargetBaseBranch in sdk-generation-action). Dispatching
-# the real generation workflow with ref: main fixes github.ref / GITHUB_REF for that run so
-# PRs target main. The tag name is passed as an input for version conditionals.
+# Tag pushes would make Speakeasy use refs/tags/... as the GitHub PR base (invalid). We dispatch
+# sdk-generate-on-release.yml with ref = the tag so checkout matches the release commit; that workflow
+# sets pr_base_is_main on sdk-generate-one so GITHUB_REF is forced to main for Speakeasy only.
 name: SDK generate on release tag — dispatch
 
 on:
@@ -16,7 +15,7 @@ jobs:
       actions: write
       contents: read
     steps:
-      - name: Dispatch SDK generation on main
+      - name: Dispatch SDK generation at release tag
         uses: actions/github-script@v7
         with:
           script: |
@@ -25,7 +24,7 @@ jobs:
               owner: context.repo.owner,
               repo: context.repo.repo,
               workflow_id: 'sdk-generate-on-release.yml',
-              ref: 'main',
+              ref: tag,
               inputs: {
                 release_tag: tag
               }

.github/workflows/sdk-generate-on-release.yml

@@ -4,25 +4,39 @@
 # See contributing/release.md and contributing/sdks.md for the release process and lock file details.
 #
 # Started via workflow_dispatch only. Tag pushes are handled by sdk-generate-on-release-dispatch.yml,
-# which dispatches this workflow with ref: main so Speakeasy opens PRs against main (not an invalid
-# tag-derived base). release_tag carries the tag name (e.g. v0.13.2) for version conditionals.
+# which dispatches with ref = tag so the tree matches the release. pr_base_is_main rewires GITHUB_REF
+# for Speakeasy so PRs still target main.
 name: SDK generate on release tag
 
 on:
   workflow_dispatch:
     inputs:
       release_tag:
-        description: "Release tag (e.g. v0.15.0). Set automatically when run from tag dispatch; optional for manual UI runs."
-        required: false
+        description: "Release tag (e.g. v0.15.0). Must match the workflow ref (run from this tag)."
+        required: true
         type: string
-        default: ""
 
 jobs:
+  ensure-release-ref-is-tag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require workflow checkout to match release_tag
+        run: |
+          tag="${{ github.event.inputs.release_tag }}"
+          expected="refs/tags/${tag}"
+          actual="${{ github.ref }}"
+          if [ "$actual" != "$expected" ]; then
+            echo "::error::Run this workflow from tag ${tag} (ref must be ${expected}). In the UI, choose that tag under \"Use workflow from\". Got: ${actual}"
+            exit 1
+          fi
+
   generate-go:
+    needs: ensure-release-ref-is-tag
     uses: ./.github/workflows/sdk-generate-one.yml
     with:
       target: outpost-go
       force: true
+      pr_base_is_main: true
       # SDK version override only when Outpost is released as v1.0.0
       set_version: ${{ github.event.inputs.release_tag == 'v1.0.0' && '1.0.0' || '' }}
     secrets:
@@ -35,6 +49,7 @@ jobs:
     with:
       target: outpost-python
       force: true
+      pr_base_is_main: true
       set_version: ${{ github.event.inputs.release_tag == 'v1.0.0' && '1.0.0' || '' }}
     secrets:
       github_access_token: ${{ secrets.GITHUB_TOKEN }}
@@ -47,6 +62,7 @@ jobs:
     with:
       target: outpost-ts
       force: true
+      pr_base_is_main: true
       set_version: ${{ github.event.inputs.release_tag == 'v1.0.0' && '1.0.0' || '' }}
     secrets:
       github_access_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/sdk-generate-one.yml

@@ -19,6 +19,11 @@ on:
         required: false
         type: boolean
         default: false
+      pr_base_is_main:
+        description: "Speakeasy reads GITHUB_REF for PR base; set true when checkout is a tag so PRs still target main"
+        required: false
+        type: boolean
+        default: false
     secrets:
       github_access_token:
         required: true
@@ -37,12 +42,13 @@ jobs:
       pull-requests: write
       statuses: write
       id-token: write
-    uses: speakeasy-api/sdk-generation-action/.github/workflows/workflow-executor.yaml@v15
+    uses: ./.github/workflows/speakeasy-workflow-executor-v15.yml
     with:
       force: ${{ inputs.force }}
       mode: pr
       target: ${{ inputs.target }}
       set_version: ${{ inputs.set_version || '' }}
+      pr_base_is_main: ${{ inputs.pr_base_is_main }}
     secrets:
       github_access_token: ${{ secrets.github_access_token }}
       speakeasy_api_key: ${{ secrets.speakeasy_api_key }}