feat: Migrate github actions from cloud sdk and update pnpm version by BrigittaK307 · Pull Request #2247 · SAP/ai-sdk-js

BrigittaK307 · 2026-09-03T07:16:49Z

Context

Closes SAP/ai-sdk-js-backlog#ISSUENUMBER.

What this PR does and why it is needed

hyperspace-pr-bot · 2026-09-03T07:17:10Z

Summary

The following content is AI-generated and provides a summary of the pull request:

Migrate GitHub Actions from Cloud SDK and Update pnpm Version

What this PR does and why it is needed

This PR migrates all GitHub Actions workflow dependencies away from sap/cloud-sdk-js shared actions and brings them inline within the sap/ai-sdk-js repository. It also updates the pnpm version to v12 and refreshes the lockfile accordingly.

Key changes:

GitHub Actions Workflows: All references to sap/cloud-sdk-js/.github/actions/*@main have been replaced with local action references (e.g., uses: ./.github/actions/setup, ./.github/actions/check-public-api, etc.) across all workflow files:
- api-docs.yml, auto-fix-lint.yml, auto-gen.yml, build.yml, bump.yml, check-pr.yml, draft-release.yml, e2e-tests.yml, fosstars.yml, issue-reply.yml, publish-canary.yml, publish-release.yml, smoke-tests.yml, spec-update.yaml
- build.yml also removes the previously used sap/cloud-sdk-js/.github/actions/check-license step
actions/checkout pinned: All workflows now explicitly include actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 before the local setup action
Renovate config: Removed sap/cloud-sdk-js and sap/cloud-sdk-js/** from the sap-cloud-sdk package group match rules; updated the zizmor.yml unpinned-uses policy to only allow the own sap/ai-sdk-js/* repository
fosstars.yml: Updates OWASP dependency check to add --disablePnpmAudit flag and syncs the pnpm version comment to reflect 12.0.0
package.json: Adds devEngines field declaring pnpm v12 as the required package manager
pnpm-lock.yaml: Regenerated to reflect pnpm v12 format — removes supports-color and debug peer dependency suffixes from resolved package identifiers, resulting in cleaner/shorter lock entries across the entire dependency tree

🔄 Regenerate and Update Summary
✏️ Insert as PR Description (deletes this comment)
🗑️ Delete comment

PR Bot Information

Version: 1.31.13

File Content Strategy: Full file content
Correlation ID: 24d95c30-a82f-11f1-8562-26d887ab3cf1
Output Template: Repository PR Template
LLM: anthropic--claude-4.6-sonnet
Summary Prompt: Default Prompt
Event Trigger: issue_comment.edited

      contents: read
    steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1



    steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1


      contents: read
    steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1


      contents: read
    steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1



    steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1



    steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1


          permission-contents: read
          permission-pull-requests: read
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1


      id-token: write
    steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1


      contents: read
    steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1


davidkna-sap

You might be able to avoid the zizmor issues and some of the additions if you first submit a PR with the setup-action only (unused) and then start using it in another PR once merged.

BrigittaK307 · 2026-09-03T12:44:37Z

You might be able to avoid the zizmor issues and some of the additions if you first submit a PR with the setup-action only (unused) and then start using it in another PR once merged.

Thank you for the tip! I will try to do that.

Adds the reusable setup action (.github/actions/setup) and other composite/node actions so workflows can reference them locally instead of via the external sap/cloud-sdk-js repo.

These actions belong with the broader CI workflow changes tracked in that branch, not here.

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

…e minimum openai to ^7.5.0 (#2218) * feat(openai)!: migrate Realtime URL to buildRealtimeURL callback, raise minimum openai to ^7.5.0 * Update .changeset/realtime-openai-7.5.md Co-authored-by: David Knaack <david.knaack@sap.com> * refactor(openai): simplify buildRealtimeURL callback and remove explicit return type * fix(sample-code): restore explicit return type on responsesApiStream * chore(sample-code): bump openai to 7.5.0 to match packages/openai peerDep * chore: sync pnpm-lock.yaml with branch lockfile (knip 6.32.3, oxlint 1.80.0) * fix: Changes from lint * fix(openai): remove buildRealtimeURL callback and api-version from realtime URL * Update .changeset/realtime-openai-7.5.md Co-authored-by: Marika Marszalkowski <marika.marszalkowski@sap.com> * chore(deps): update dependency hyparquet-writer to v0.16.7 (#2231) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency hyparquet-writer to v0.16.8 (#2232) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore: Update model list (2026-08-18) (#2173) * chore(deps): update dependency @upstash/context7-mcp to v4.0.4 (#2236) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --------- Co-authored-by: David Knaack <david.knaack@sap.com> Co-authored-by: sap-ai-sdk-bot[bot] <272306433+sap-ai-sdk-bot[bot]@users.noreply.github.com> Co-authored-by: Marika Marszalkowski <marika.marszalkowski@sap.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

These action files are being introduced in a separate PR (I753325-652-setup-action) and will be available locally once that PR is merged into main.

Adds the reusable composite/node actions so workflows can reference them locally instead of via the external sap/cloud-sdk-js repo.

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

…e minimum openai to ^7.5.0 (#2218) * feat(openai)!: migrate Realtime URL to buildRealtimeURL callback, raise minimum openai to ^7.5.0 * Update .changeset/realtime-openai-7.5.md Co-authored-by: David Knaack <david.knaack@sap.com> * refactor(openai): simplify buildRealtimeURL callback and remove explicit return type * fix(sample-code): restore explicit return type on responsesApiStream * chore(sample-code): bump openai to 7.5.0 to match packages/openai peerDep * chore: sync pnpm-lock.yaml with branch lockfile (knip 6.32.3, oxlint 1.80.0) * fix: Changes from lint * fix(openai): remove buildRealtimeURL callback and api-version from realtime URL * Update .changeset/realtime-openai-7.5.md Co-authored-by: Marika Marszalkowski <marika.marszalkowski@sap.com> * chore(deps): update dependency hyparquet-writer to v0.16.7 (#2231) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency hyparquet-writer to v0.16.8 (#2232) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore: Update model list (2026-08-18) (#2173) * chore(deps): update dependency @upstash/context7-mcp to v4.0.4 (#2236) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --------- Co-authored-by: David Knaack <david.knaack@sap.com> Co-authored-by: sap-ai-sdk-bot[bot] <272306433+sap-ai-sdk-bot[bot]@users.noreply.github.com> Co-authored-by: Marika Marszalkowski <marika.marszalkowski@sap.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

These action files are being introduced in a separate PR (I753325-652-setup-action) and will be available locally once that PR is merged into main.

Adds the reusable composite/node actions so workflows can reference them locally instead of via the external sap/cloud-sdk-js repo.

    steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup


-          persist-credentials: true
          token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: true
+      - uses: ./.github/actions/setup


-          persist-credentials: true
          token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: true
+      - uses: ./.github/actions/setup


    steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup


    steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup


    steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup


          permission-pull-requests: read
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup


    steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup


    steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup


-          persist-credentials: true
          token: ${{ secrets.GITHUB_TOKEN }}
+          persist-credentials: true
+      - uses: ./.github/actions/setup


github-advanced-security Bot found potential problems Sep 3, 2026

View reviewed changes

davidkna-sap reviewed Sep 3, 2026

View reviewed changes

BrigittaK307 changed the base branch from main to I753325-652-setup-action September 4, 2026 07:12

Base automatically changed from I753325-652-setup-action to main September 8, 2026 12:11

BrigittaK307 force-pushed the I753325-652 branch from ecce0e1 to 6d30805 Compare September 8, 2026 13:02

BrigittaK307 and others added 22 commits September 8, 2026 16:32

feat(ci): add setup action and other GitHub composite actions

c4e91f9

Adds the reusable setup action (.github/actions/setup) and other composite/node actions so workflows can reference them locally instead of via the external sap/cloud-sdk-js repo.

chore(ci): move non-setup actions to I753325-652 branch

0619528

These actions belong with the broader CI workflow changes tracked in that branch, not here.

Added github actions to repo and replaced with devEngines

8292691

Added setup action and checkout step to workflows

ae38681

version change and added github actions to ignore list

e9c5f65

fixed dep check

1ca8188

Updated lockfile

78d0ef8

chore(deps): update dependency @upstash/context7-mcp to v4.0.4 (#2236)

0075d10

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update dependency orval to v8.27.0 (#2243)

1936870

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

regenerated lockfile

14a3909

chore(ci): remove action files — will come from setup-action PR

228e720

These action files are being introduced in a separate PR (I753325-652-setup-action) and will be available locally once that PR is merged into main.

feat(ci): add composite and node GitHub Actions

bdd3b69

Adds the reusable composite/node actions so workflows can reference them locally instead of via the external sap/cloud-sdk-js repo.

Added github actions to repo and replaced with devEngines

703c437

Added setup action and checkout step to workflows

32edcab

version change and added github actions to ignore list

7cf923f

fixed dep check

08aca00

Updated lockfile

f5d2591

chore(deps): update dependency @upstash/context7-mcp to v4.0.4 (#2236)

44ab11c

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update dependency zod to v4.5.1 (#2238)

6d41c2a

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update dependency zod to v4.5.2 (#2239)

7cffba4

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate Bot and others added 7 commits September 8, 2026 16:32

chore(deps): update dependency orval to v8.27.0 (#2243)

d997715

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update dependency hyparquet-writer to v0.16.9 (#2245)

548ecda

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update dependency zod to v4.5.4 (#2246)

e7e968d

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

regenerated lockfile

dcec9e1

chore(ci): remove action files — will come from setup-action PR

0277562

These action files are being introduced in a separate PR (I753325-652-setup-action) and will be available locally once that PR is merged into main.

feat(ci): add composite and node GitHub Actions

da039e0

Adds the reusable composite/node actions so workflows can reference them locally instead of via the external sap/cloud-sdk-js repo.

regenerated lockfile

561662d

BrigittaK307 force-pushed the I753325-652 branch from 6d30805 to 561662d Compare September 8, 2026 13:35

github-advanced-security Bot found potential problems Sep 8, 2026

View reviewed changes

fix: include path in check-pr workflow

85fb4f8

Navigation Menu

Uh oh!

feat: Migrate github actions from cloud sdk and update pnpm version - #2247

feat: Migrate github actions from cloud sdk and update pnpm version#2247
BrigittaK307 wants to merge 30 commits into
mainfrom
I753325-652

BrigittaK307 commented Sep 3, 2026

Uh oh!

hyperspace-pr-bot Bot commented Sep 3, 2026 •

edited

Loading

Uh oh!

Uh oh!

davidkna-sap left a comment

Uh oh!

BrigittaK307 commented Sep 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

BrigittaK307 commented Sep 3, 2026

Context

What this PR does and why it is needed

Uh oh!

hyperspace-pr-bot Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Migrate GitHub Actions from Cloud SDK and Update pnpm Version

What this PR does and why it is needed

Key changes:

Uh oh!

Uh oh!

davidkna-sap left a comment

Choose a reason for hiding this comment

Uh oh!

BrigittaK307 commented Sep 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

hyperspace-pr-bot Bot commented Sep 3, 2026 •

edited

Loading