Merge to beta - #1895
Merged
Merged
Conversation
…8788c6f (#1876) Co-authored-by: Stripe OpenAPI <105521251+stripe-openapi[bot]@users.noreply.github.com>
* Add zizmor config scoping the ref-pin policy to the stripe namespace Actions under stripe/* are first-party and tracked on a branch on purpose, so requiring a commit hash for them would be churn without a security gain. Scoping the policy to that namespace keeps the blanket hash requirement in force for every third-party action. This lands before the pins so the auto-fixer honours the policy and leaves stripe/openapi/actions/* alone rather than hash-pinning them for a revert. Committed-By-Agent: claude * Pin GitHub Actions references to commit hashes A tag is a mutable pointer, so any action referenced by tag can change what CI executes without a commit here. Pinning to a full commit hash makes the reference immutable and the version comment auditable. Thirteen of the fourteen pins came from the auto-fixer; every hash was then resolved against its claimed tag through the GitHub API before committing. pypa/gh-action-pypi-publish was pinned by hand because the auto-fixer cannot resolve a version for a branch reference. It tracked release/v1, whose head is currently tag v1.14.2, so the pin is both immutable and current. Dependabot would be the mechanism to keep it moving. Also sets persist-credentials: false on all three checkouts. The default leaves the workflow token in .git/config for the rest of the job, where any later step can read it; none of these jobs push, so nothing needs it retained. Committed-By-Agent: claude * Upgrade pinned actions off end-of-life runtimes Pinning froze these at the versions master happened to reference, and four of the five were on a Node runtime GitHub force-migrates, which every job warns about today: extractions/setup-just v2.0.0 -> v4.0.0 actions/checkout v3.7.0 -> v7.0.1 (node16 -> node24) actions/setup-python v4.9.1 -> v7.0.0 (node16 -> node24) actions/upload-artifact v4.6.2 -> v7.0.1 (node20 -> node24) actions/download-artifact v4.3.0 -> v8.0.1 (node20 -> node24) The artifact pair moves together on purpose: build uploads dist and publish downloads it, and upload v7 / download v8 are the majors upstream ships as a pair. download-artifact v5's breaking change is scoped to downloads by ID; this one downloads by name, so it does not apply. v8 skips decompression based on Content-Type, which only diverges when the uploader sets archive: false, and this workflow does not. setup-python's cache input has no default in v7, unlike setup-node's package-manager-cache from v5 onward, so the upgrade adds no cache surface to audit. v7 drops the pip-install input, which this workflow never set. All five majors require Actions runner 2.327.1 or later, which the GitHub-hosted runners this workflow uses already satisfy. Committed-By-Agent: claude * document download-artifact v8 digest-mismatch behavior v8 fails the job on an artifact digest mismatch where v4 only logged a warning. The publish job is tag-gated, so CI never exercises it — the first person to see this failure will be mid-release, and the escape hatch should be next to the code rather than in a PR body. Committed-By-Agent: claude * Add zizmor workflow security check Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com> * Add temporary release workflow probe Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com> * Remove temporary release workflow probe Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com> --------- Co-authored-by: codex <noreply@openai.com>
Committed-By-Agent: claude # Conflicts: # CHANGELOG.md # VERSION # pyproject.toml # stripe/_account.py # stripe/_api_version.py # stripe/_customer_session.py # stripe/_invoice.py # stripe/_payment_intent.py # stripe/_product.py # stripe/_setup_attempt.py # stripe/_setup_intent.py # stripe/_source.py # stripe/_subscription.py # stripe/_subscription_schedule.py # stripe/_version.py # stripe/financial_connections/_session.py # stripe/params/__init__.py # stripe/params/_invoice_create_params.py # stripe/params/_invoice_modify_params.py # stripe/params/_invoice_update_params.py # stripe/params/_product_create_params.py # stripe/params/_subscription_create_params.py # stripe/params/_subscription_modify_params.py # stripe/params/_subscription_update_params.py # stripe/params/_webhook_endpoint_create_params.py # stripe/params/_webhook_endpoint_modify_params.py # stripe/params/_webhook_endpoint_update_params.py # stripe/params/checkout/_session_create_params.py # stripe/params/tax/_registration_create_params.py # stripe/tax/_calculation.py # stripe/tax/_calculation_line_item.py # stripe/tax/_registration.py # stripe/tax/_transaction.py # stripe/terminal/_reader.py
xavdid
approved these changes
Aug 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why?
Routine merge of master changes into the
betarelease channel.What?
Merged master into
betausing sdk-codegen's automerge tooling (tools/automerge/python-beta.yaml).Net change is limited to
.github/workflows/ci.yml, the new.github/workflows/zizmor.ymland.github/zizmor.yml, and the GA CHANGELOG entries.One manual resolution: took
beta's copy ofstripe/params/_customer_session_create_params.py. The automerge chunk merge emitted a second copy of theCustomerSessionCreateParamsComponentsActiveEntitlementsTypedDict that both branches already had.beta's copy is a strict superset of master's (it also carriesTaxIdElement), so taking it loses nothing.See Also