Update Go API bindings to version 0.0.59 and automate future updates

.github/workflows/go.yml

@@ -9,17 +9,21 @@ on:
   pull_request:
     branches: [ "master" ]
 
+permissions:
+  contents: read
+
 jobs:
 
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: 1.19
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
 
       - name: Build
         run: go build -v ./...

.github/workflows/update-bindings.yml

@@ -0,0 +1,107 @@
+name: Update API bindings
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Binding version (leave blank to auto-increment the patch version)"
+        required: false
+        type: string
+  schedule:
+    # Daily at 06:00 UTC
+    - cron: "0 6 * * *"
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update-bindings:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Set up tools
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+
+      - name: Generate bindings
+        run: mise run generate
+
+      - name: Detect changes
+        id: detect
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+        run: |
+          if [ -n "$INPUT_VERSION" ] || [ -n "$(git status --porcelain)" ]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "Bindings already match the current API; no PR needed."
+          fi
+
+      - name: Bump version and regenerate
+        if: steps.detect.outputs.changed == 'true'
+        id: versions
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+        run: |
+          api_version=$(curl -s --max-time 30 "https://api.cloudsmith.io/status/check/basic/" | jq -r '.version')
+          if [ -z "$api_version" ] || [ "$api_version" = "null" ]; then
+            echo "Could not fetch CloudSmith API version" >&2
+            exit 1
+          fi
+
+          current_version=$(grep -oE '"[0-9]+\.[0-9]+\.[0-9]+"' bin/generate | head -1 | tr -d '"')
+          if [ -n "$INPUT_VERSION" ]; then
+            new_version="$INPUT_VERSION"
+          else
+            IFS='.' read -r major minor patch <<< "$current_version"
+            new_version="${major}.${minor}.$((patch + 1))"
+          fi
+
+          sed -i -E "s/PKG_VERSION=\\\$\\{1:-\"[0-9.]+\"\\}/PKG_VERSION=\${1:-\"${new_version}\"}/" bin/generate
+          mise run generate
+
+          echo "api_version=$api_version" >> "$GITHUB_OUTPUT"
+          echo "new_version=$new_version" >> "$GITHUB_OUTPUT"
+
+      - name: Close stale automated binding PRs
+        if: steps.detect.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          NEW_VERSION: ${{ steps.versions.outputs.new_version }}
+        run: |
+          keep="automated/update-bindings-v${NEW_VERSION}"
+          gh pr list --state open --json number,headRefName \
+            --jq '.[]
+              | select(.headRefName | startswith("automated/update-bindings-"))
+              | select(.headRefName != "'"$keep"'")
+              | .number' \
+          | while read -r number; do
+              [ -n "$number" ] || continue
+              gh pr close "$number" --delete-branch \
+                --comment "Superseded by automated bindings update v${NEW_VERSION}."
+            done
+
+      - name: Create pull request
+        if: steps.detect.outputs.changed == 'true'
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          branch: automated/update-bindings-v${{ steps.versions.outputs.new_version }}
+          base: master
+          title: "Update Go API bindings to version ${{ steps.versions.outputs.new_version }}"
+          commit-message: "Update Go API bindings to version ${{ steps.versions.outputs.new_version }}"
+          body: |
+            Automated API bindings update.
+
+            - Binding version: `${{ steps.versions.outputs.new_version }}`
+            - CloudSmith API version: `${{ steps.versions.outputs.api_version }}`
+
+            Generated by the **Update API bindings** workflow.
+          labels: |
+            bindings
+            automated
+          delete-branch: true

.github/workflows/zizmor.yml

@@ -0,0 +1,32 @@
+name: Security
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - ".github/workflows/**"
+  pull_request:
+    branches:
+      - "**"
+    paths:
+      - ".github/workflows/**"
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Scan GitHub Actions workflows
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7

.mise.toml

@@ -0,0 +1,16 @@
+# Host toolchain for working with this repo. Note: binding generation runs
+# inside the pinned openapitools/openapi-generator-cli Docker image (see
+# bin/generate), so Docker remains a separate prerequisite that mise does not
+# manage. The CI test matrix pins its own runtimes via the same versions here.
+
+[tools]
+go = "1.23"
+jq = "latest"
+
+[tasks.generate]
+description = "Regenerate the Go bindings (requires Docker)"
+run = "./bin/generate"
+
+[tasks.update-bindings]
+description = "Bump the version, regenerate bindings, and open a PR"
+run = "./scripts/update-bindings.sh"

.pre-commit-config.yaml

@@ -0,0 +1,5 @@
+repos:
+- repo: https://github.com/zizmorcore/zizmor-pre-commit
+  rev: v1.27.0
+  hooks:
+    - id: zizmor

CONTRIBUTING.MD

@@ -2,23 +2,44 @@
 
 Please refer to Cloudsmith's standard guide on [Open-Source Contributing](https://docs.cloudsmith.com/contributing).
 
+## Toolchain
+
+Host tools are pinned with [mise](https://mise.jdx.dev/) via `.mise.toml`
+(`go` and `jq`). Run `mise install` once to provision them. Binding generation
+also requires [Docker](https://www.docker.com/) — it runs the pinned
+`openapi-generator-cli` image and is a separate prerequisite that mise does not
+manage. GNU sed is used for the post-generation fixups (`gsed` on macOS via
+Homebrew, plain `sed` on Linux).
+
+Convenience tasks:
+
+* `mise run generate` — regenerate the Go bindings
+* `mise run update-bindings` — bump the version, regenerate, and open a PR
+
 ## Updating bindings
 
 ### Manual approach
 
 * Update `PKG_VERSION` in `bin/generate`
-* Run `bin/generate` to generate bindings
+* Run `bin/generate` (or `mise run generate`) to generate bindings
 * Create a PR specifing API and binding version
 * Create git tag and release in github
 
-### Automated approach
+### Automated approach (local)
 
-* Run `./scripts/update-bindings.sh` to automatically update the bindings.
+* Run `./scripts/update-bindings.sh` (or `mise run update-bindings`) to automatically update the bindings.
 * This will then provide you with the URL for the PR to release the updated bindings.
 * Preferred usage: `./scripts/update-bindings.sh`
 * For full options and usage examples, run: `./scripts/update-bindings.sh --help`
 * After PR is merged, follow the displayed instructions to create the git tag and GitHub release.
 
+### Automated approach (CI)
+
+* The **Update API bindings** GitHub Actions workflow regenerates the bindings
+  and opens a PR — on demand (`workflow_dispatch`, optionally with a specific
+  version) or daily on a schedule. It opens a PR only when the regenerated
+  bindings actually change, and closes any superseded automated PRs first.
+
 ## Contributor License Agreement
 
 By making any contributions to Cloudsmith Ltd projects you agree to be bound by the terms of the Cloudsmith Ltd [Contributor License Agreement](https://docs.cloudsmith.com/contributor-license-agreement).

README.md

@@ -5,8 +5,8 @@ The API to the Cloudsmith Service
 ## Overview
 This API client was generated by the [OpenAPI Generator](https://openapi-generator.tech) project.  By using the [OpenAPI-spec](https://www.openapis.org/) from a remote server, you can easily generate an API client.
 
-- API version: 1.1206.0
-- Package version: 0.0.58
+- API version: 1.1288.1
+- Package version: 0.0.59
 - Generator version: 7.9.0
 - Build package: org.openapitools.codegen.languages.GoClientCodegen
 For more information, please visit [https://help.cloudsmith.io](https://help.cloudsmith.io)