Commit 3825298
## Why
CLI **v1.795.2** breaks `speakeasy tag promote` for customers using
registry tagging in CI (reported by Unkey):
```
Error: {"message":"err_unauthorized: unauthorized -- bearer token missing","status_code":403}
Error: failed to tag registry images: error running speakeasy tag: ... speakeasy tag promote
```
**This is not a security exposure** — the server still enforces auth
(`MustHaveConsistentWorkspaceIDClaimHTTP`). It's a spec/codegen defect:
the client stopped *sending* credentials.
`v1.795.1..v1.795.2` changes only `go.mod`/`go.sum`, and the operative
line is `speakeasy-client-sdk-go/v3 v3.26.7 -> v3.27.0`.
## What broke
v3.27.0 was the first regeneration of that SDK since 2025-05-06. It
picked up a registry spec defect live since March:
`openapi_artifacts.yaml` and `openapi_subscriptions.yaml` declare no
top-level `security`, so once `speakeasy merge` began pushing global
security down onto individual operations (#1952, registry#4559), their
13 operations composed as `security: []`.
The generated SDK therefore dropped `utils.PopulateSecurity` from **all
11 Artifacts and both Subscriptions operations**.
Verified against a local test server, identical calling code:
| Operation | v3.26.7 | v3.27.0 |
|---|---|---|
| `Artifacts.PostTags` | `X-Api-Key` sent | **no auth header** |
| `Artifacts.GetRevisions` | `X-Api-Key` sent | **no auth header** |
| `Workspaces.Get` (control) | `X-Api-Key` sent | `X-Api-Key` sent |
Affected CLI paths: `registry/tagging.go` -> `Artifacts.PostTags`
(powers `tag promote`, `tag apply`, `ci tag`) and
`internal/remote/sources.go:153` -> `Artifacts.GetRevisions`.
This went unnoticed for five months because the other consumers (webapp,
admin SDK) authenticate via `credentials: 'include'` cookies, so a
missing security parameter is invisible to them. The
header-authenticated public Go SDK was frozen by a broken regen since
May 2025 — so it kept shipping correct pre-March code until now.
## Why revert rather than fix forward
- Customers tracking `speakeasyVersion: latest` pick this up
automatically; the breakage is spreading.
- The real fix spans three repos (registry spec -> SDK regen -> CLI
bump) and can't land quickly.
- #2117 was explicit groundwork — "No behaviour change in this PR" — and
what it enables (openapi-generation#55) is **still open**, so this gives
up no live functionality.
## Verification
- `go build ./...` — clean
- `go test ./registry/... ./pkg/merge/...` — pass
- Resolved deps back to `client-sdk-go v3.26.7` / `speakeasy-core
v0.22.2`; all 11 `PopulateSecurity` calls restored
## Follow-up
1. Cut **v1.795.3** — the revert only helps once released.
2. Add top-level `security` to `openapi_artifacts.yaml` +
`openapi_subscriptions.yaml` in speakeasy-registry. `openapi_admin.yaml`
has the same defect (36 ops, no impact today).
3. Re-land #2117 on a fixed v3.27.1.
4. Consider a warning in `pkg/merge` when `setExplicitNoSecurity` marks
operations unsecured — it silently performs a security-downgrading
transform, which is what let this ship.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
1 parent 5c2f293 commit 3825298
2 files changed
Lines changed: 10 additions & 15 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
50 | 50 | | |
51 | 51 | | |
52 | 52 | | |
53 | | - | |
54 | | - | |
| 53 | + | |
| 54 | + | |
55 | 55 | | |
56 | 56 | | |
57 | 57 | | |
58 | 58 | | |
59 | 59 | | |
60 | | - | |
| 60 | + | |
61 | 61 | | |
62 | 62 | | |
63 | 63 | | |
| |||
233 | 233 | | |
234 | 234 | | |
235 | 235 | | |
236 | | - | |
237 | 236 | | |
238 | 237 | | |
239 | 238 | | |
| |||
263 | 262 | | |
264 | 263 | | |
265 | 264 | | |
266 | | - | |
267 | 265 | | |
268 | 266 | | |
269 | 267 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
558 | 558 | | |
559 | 559 | | |
560 | 560 | | |
561 | | - | |
562 | | - | |
563 | | - | |
564 | | - | |
| 561 | + | |
| 562 | + | |
| 563 | + | |
| 564 | + | |
565 | 565 | | |
566 | 566 | | |
567 | 567 | | |
| |||
576 | 576 | | |
577 | 577 | | |
578 | 578 | | |
579 | | - | |
580 | | - | |
581 | 579 | | |
582 | 580 | | |
583 | 581 | | |
| |||
594 | 592 | | |
595 | 593 | | |
596 | 594 | | |
597 | | - | |
598 | | - | |
| 595 | + | |
| 596 | + | |
599 | 597 | | |
600 | 598 | | |
601 | 599 | | |
| |||
682 | 680 | | |
683 | 681 | | |
684 | 682 | | |
| 683 | + | |
685 | 684 | | |
686 | | - | |
687 | | - | |
688 | 685 | | |
689 | 686 | | |
690 | 687 | | |
| |||
0 commit comments