feat: Migrate github actions from cloud sdk and update pnpm version

.github/actions/changesets-fixed-version-bump/action.yml

@@ -0,0 +1,11 @@
+name: 'Fixed version bump'
+description: 'Bumps version for fixed packages and the root package.json using changesets.'
+inputs:
+  majorVersion:
+    description: 'When setting a major version this needs to be set to the actual major version to avoid accidental major version bumps.'
+outputs:
+  version:
+    description: 'The new version'
+runs:
+  using: 'node24'
+  main: 'dist/index.js'

.github/actions/check-pr/action.yml

@@ -0,0 +1,9 @@
+name: 'Check PR'
+description: 'Checks the current PR for semantical correctness and appropriate changelog.'
+inputs:
+  changed-files:
+    description: 'Changed files in the .changeset directory on the current PR.'
+    required: true
+runs:
+  using: 'node24'
+  main: 'dist/index.js'

.github/actions/check-public-api/action.yml

@@ -0,0 +1,14 @@
+name: 'Check public API'
+description: 'Checks whether the public API is correctly exported.'
+inputs:
+  force_internal_exports:
+    description: 'Whether to force that everything is exported through the internal API.'
+    default: 'false'
+  excluded_packages:
+    description: 'Packages to exclude when checking the public API.'
+  ignored_path_pattern:
+    description: 'Regular expression for paths to be ignore when checking the public API.'
+
+runs:
+  using: 'node24'
+  main: 'dist/index.js'

.github/actions/commit-and-tag/action.yml

@@ -0,0 +1,27 @@
+name: 'Commit and tag'
+description: Commits and tags the current changes.
+inputs:
+  version:
+    required: true
+    description: Version to use for the tag and commit message
+  user-email:
+    description: User e-mail address to use for the commit
+    default: sap-cloud-sdk@github.com
+  user-name:
+    description: User name to use for the commit
+    default: sap-cloud-sdk
+runs:
+  using: 'composite'
+  steps:
+    - env:
+        VERSION: ${{ inputs.version }}
+        USER_EMAIL: ${{ inputs.user-email }}
+        USER_NAME: ${{ inputs.user-name }}
+      shell: bash
+      run: |
+        git config --global user.email "$USER_EMAIL"
+        git config --global user.name "$USER_NAME"
+        git add -A
+        git commit -m "v$VERSION"
+        git tag "v$VERSION" -m "v$VERSION"
+        git push --follow-tags

.github/actions/get-changelog/action.yml

@@ -0,0 +1,8 @@
+name: 'Get current changelog'
+description: 'Gets the current changelog'
+outputs:
+  changelog:
+    description: 'The current changelog'
+runs:
+  using: 'node24'
+  main: 'dist/index.js'

.github/actions/merge-and-write-changelogs/action.yml

@@ -0,0 +1,5 @@
+name: 'Merge Changelogs'
+description: 'Merges all public changelogs from changesets into a single changelog.'
+runs:
+  using: 'node24'
+  main: 'dist/index.js'

.github/renovate.jsonc

@@ -58,7 +58,7 @@
             "pinDigests": false
         },
         {
-            "matchPackageNames": ["@sap-cloud-sdk/**", "sap/cloud-sdk-js", "sap/cloud-sdk-js/**"],
+            "matchPackageNames": ["@sap-cloud-sdk/**"],
             "groupName": "sap-cloud-sdk",
             "minimumReleaseAge": null,
             "pinDigests": false

.github/workflows/api-docs.yml

@@ -15,7 +15,8 @@
     permissions:
       contents: read
     steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup
       - name: Generate API documentation
         run: |
           pnpm generate

.github/workflows/auto-fix-lint.yml

@@ -19,11 +19,12 @@
           client-id: ${{ secrets.SAP_AI_SDK_BOT_CLIENT_ID }}
           private-key: ${{ secrets.SAP_AI_SDK_BOT_PRIVATE_KEY }}
           permission-contents: write
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.head_ref }}
-          persist-credentials: true
           token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: true
+      - uses: ./.github/actions/setup
       - run: pnpm lint:fix
       - name: Commit Changes if needed
         env:

.github/workflows/auto-gen.yml

@@ -19,11 +19,12 @@
           client-id: ${{ secrets.SAP_AI_SDK_BOT_CLIENT_ID }}
           private-key: ${{ secrets.SAP_AI_SDK_BOT_PRIVATE_KEY }}
           permission-contents: write
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.head_ref }}
-          persist-credentials: true
           token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: true
+      - uses: ./.github/actions/setup
       - name: Generate and apply patches
         shell: bash
         run: |

.github/workflows/build.yml

@@ -20,7 +20,8 @@
         node-version: [26, 24, 22]
 
     steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup
         with:
           node-version: ${{ matrix.node-version }}
       # type-check can run in parallel to unit tests
@@ -50,7 +51,8 @@
     permissions:
       contents: read
     steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup
       - name: Enforce generated code is up to date
         shell: bash
         run: |
@@ -74,14 +76,12 @@
       # Independent read-only checks — run them concurrently.
       - parallel:
           - name: Check public API
-            uses: sap/cloud-sdk-js/.github/actions/check-public-api@main
+            uses: ./.github/actions/check-public-api
             with:
               force_internal_exports: 'false'
               ignored_path_pattern: '.*?/client/.*?/schema|.*?/zod/.*?'
           - name: Check dependencies
             run: pnpm check:deps --reporter=github-actions
-          - name: License Check
-            uses: sap/cloud-sdk-js/.github/actions/check-license@main
           - name: API Doc Check
             run: pnpm doc
       - wait-all:

.github/workflows/bump.yml

@@ -23,23 +23,24 @@
           client-id: ${{ secrets.SAP_AI_SDK_BOT_CLIENT_ID }}
           private-key: ${{ secrets.SAP_AI_SDK_BOT_PRIVATE_KEY }}
           permission-contents: write
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          token: ${{ steps.app-token.outputs.token }}
           ref: 'main'
+          token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
+      - uses: ./.github/actions/setup
       - name: Bump version
         id: bump
-        uses: sap/cloud-sdk-js/.github/actions/changesets-fixed-version-bump@main
+        uses: ./.github/actions/changesets-fixed-version-bump
         with:
           majorVersion: ${{ inputs.majorVersion }}
       - name: Merge and write changelogs
         id: merge-changelogs
         env:
           VERSION: ${{ steps.bump.outputs.version }}
-        uses: sap/cloud-sdk-js/.github/actions/merge-and-write-changelogs@main
+        uses: ./.github/actions/merge-and-write-changelogs
       - name: Commit and tag
-        uses: sap/cloud-sdk-js/.github/actions/commit-and-tag@main
+        uses: ./.github/actions/commit-and-tag
         with:
           version: ${{ steps.bump.outputs.version }}
           user-name: ${{ vars.SAP_AI_SDK_BOT_NAME }}
@@ -64,7 +65,8 @@
           permission-contents: write
           permission-pull-requests: write
       - name: Checkout current repository
-        uses: sap/cloud-sdk-js/.github/actions/setup@main
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup
         with:
           node-version: ${{ vars.DEFAULT_NODE_VERSION }}
       - name: Fetch full commit history (blobless)

.github/workflows/check-pr.yml

@@ -21,6 +21,7 @@
           persist-credentials: false
           sparse-checkout: |
             .github/PULL_REQUEST_TEMPLATE.md
+            .github/actions
             .changeset
       - name: Collect changed files
         id: changed-files
@@ -29,6 +30,6 @@
           files: |
             .changeset/**
             !.changeset/config.json
-      - uses: sap/cloud-sdk-js/.github/actions/check-pr@main
+      - uses: ./.github/actions/check-pr
         with:
           changed-files: ${{ steps.changed-files.outputs.added_files }} ${{ steps.changed-files.outputs.modified_files }}

.github/workflows/draft-release.yml

@@ -12,10 +12,12 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup
       - name: Get Changelog
         id: get-changelog
-        uses: sap/cloud-sdk-js/.github/actions/get-changelog@main
+        uses: ./.github/actions/get-changelog
+        uses: ./.github/actions/get-changelog
       - name: Create Draft Release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/e2e-tests.yml

@@ -25,7 +25,8 @@
     permissions:
       contents: read
     steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup
       - name: Create .env file
         env:
           AICORE_SERVICE_KEY: ${{ secrets[matrix.secret-name] }} # zizmor: ignore[overprovisioned-secrets]

.github/workflows/fosstars.yml

@@ -23,9 +23,11 @@
       checks: write
       contents: write
     steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup
       # OWASP runs in Docker and cannot see the runner's pnpm install. Put the
-      # standalone pnpm 11 bundle in the mounted workspace instead.
+      # standalone pnpm bundle in the mounted workspace instead.
+      # Keep this version in sync with devEngines.packageManager.version in package.json.
       - name: Install pnpm for OWASP container
         shell: bash
         env:
@@ -56,6 +58,7 @@
           args: >
             --failOnCVSS 7
             --disableYarnAudit
+            --disablePnpmAudit
             --exclude '**/.local/pnpm/**'
             --nodeAuditSkipDevDependencies
             --pnpm /github/workspace/.local/pnpm/pnpm

.github/workflows/issue-reply.yml

@@ -34,7 +34,8 @@
       # issues: write
 
     steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup
         with:
           registry-token: ${{ secrets.NPM_TOKEN_ARTIFACTORY }}
 

.github/workflows/publish-canary.yml

@@ -20,7 +20,8 @@
       id-token: write
 
     steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup
         with:
           pnpm-install-args: ''
           package-manager-cache: false

.github/workflows/publish-release.yml

@@ -31,7 +31,8 @@
           repositories: ai-sdk
           permission-contents: read
           permission-pull-requests: read
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup
         with:
           package-manager-cache: false
       - name: Determine Release Notes PR Branch Name
@@ -75,7 +76,8 @@
       contents: read
       id-token: write
     steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup
         with:
           package-manager-cache: false
       - name: publish

.github/workflows/smoke-tests.yml

@@ -13,7 +13,8 @@
     permissions:
       contents: read
     steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup
       - name: Update smoke test dependencies
         # Always use latest SDK packages for smoke tests to ensure they are tested against the latest version.
         run: pnpm --filter @sap-ai-sdk/smoke-tests update '@sap-ai-sdk/*' --no-save --ignore-scripts

.github/workflows/spec-update.yaml

@@ -77,10 +77,11 @@
       CREATE_PR: ${{ inputs.create-pr }}
       BRANCH: spec-update/${{ inputs.service }}/${{ inputs.ref }}
     steps:
-      - uses: sap/cloud-sdk-js/.github/actions/setup@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          persist-credentials: true
           token: ${{ secrets.GITHUB_TOKEN }}
+          persist-credentials: true
+      - uses: ./.github/actions/setup
 
       - name: 'Checkout or Create Branch'
         id: branch

.github/zizmor.yml

@@ -6,9 +6,8 @@ rules:
   dangerous-triggers:
     ignore:
       - dependabot-pnpm-lock.yml
-  # allow unpinned references to own repositories
+  # allow unpinned references to own repository
   unpinned-uses:
     config:
       policies:
         'sap/ai-sdk-js/*': any
-        'sap/cloud-sdk-js/*': any

package.json

@@ -36,6 +36,12 @@
     "sample-cap": "pnpm -F=@sap-ai-sdk/sample-cap run",
     "check:deps": "knip --config knip.config.mjs -W '!.' -W '!./sample-cap'"
   },
+  "devEngines": {
+    "packageManager": {
+      "name": "pnpm",
+      "version": "12"
+    }
+  },
   "devDependencies": {
     "@changesets/cli": "3.0.2",
     "@sap-ai-sdk/ai-api": "workspace:^",