.github/PULL_REQUEST_TEMPLATE.md

@@ -1,3 +1,5 @@
+_**READ BEFORE MERGING:** All PRs require approval by both Server AND SDK teams before merging! This is why the number of required approvals is "2" and not "1"--two reviewers from the same team is NOT sufficient. If your PR is not approved by someone in BOTH teams, it may be summarily reverted._
+
 <!-- Describe what has changed in this PR -->
 **What changed?**
 

.github/workflows/create-release.yml

@@ -0,0 +1,135 @@
+name: "Create release"
+
+on:
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: "Branch to be tagged"
+        required: true
+        default: master
+      tag:
+        description: "Tag for new version (v1.23.4)"
+        required: true
+      base_tag:
+        description: "Base tag to generate commit list for release notes"
+        required: true
+      skip_sdk_check:
+        description: "Skip sdk-go compatibility check"
+        type: boolean
+
+jobs:
+  prepare-inputs:
+    name: "Prepare inputs"
+    runs-on: ubuntu-latest
+    outputs:
+      api_commit_sha: ${{ steps.pin_commits.outputs.api_commit_sha }}
+      api_go_commit_sha: ${{ steps.pin_commits.outputs.api_go_commit_sha }}
+    steps:
+      - name: Checkout api
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.inputs.branch }}
+          fetch-depth: 0
+          fetch-tags: true
+          path: api
+
+      - name: Checkout api-go
+        uses: actions/checkout@v4
+        with:
+          repository: temporalio/api-go
+          ref: ${{ github.event.inputs.branch }}
+          submodules: true
+          path: api-go
+
+      - name: Validate inputs
+        env:
+          BRANCH: ${{ github.event.inputs.branch }}
+          TAG: ${{ github.event.inputs.tag }}
+          BASE_TAG: ${{ github.event.inputs.base_tag }}
+        working-directory: ./api
+        run: |
+          if ! [[ "${TAG}" =~ ^v.* ]]; then
+            echo "::error::Tag is not prefixed with 'v'"
+            exit 1
+          fi
+
+          if [[ -n "$(git tag -l "$TAG")" ]]; then
+            echo "::error::Tag already exists"
+            exit 1
+          fi
+
+          if [[ -z "$BASE_TAG" || -z "$(git tag -l "$BASE_TAG")" ]]; then
+            echo "::error::Base tag not specified or does not exist"
+            exit 1
+          fi
+
+      - name: Pin commits sha
+        id: pin_commits
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BRANCH: ${{ github.event.inputs.branch }}
+        run: |
+          API_COMMIT_SHA=$(git -C ./api rev-parse HEAD)
+          API_GO_COMMIT_SHA=$(git -C ./api-go rev-parse HEAD)
+          API_GO_API_COMMIT_SHA=$(git -C ./api-go rev-parse HEAD:proto/api)
+          if [[ "${API_GO_API_COMMIT_SHA}" != "${API_COMMIT_SHA}" ]]; then
+            echo "::error::api-go ref ${API_GO_COMMIT_SHA} does not reference api ref ${API_COMMIT_SHA}, api-go repo might not be up-to-date."
+            exit 1
+          fi
+          echo "api_commit_sha=$API_COMMIT_SHA" >> "$GITHUB_OUTPUT"
+          echo "api_go_commit_sha=$API_GO_COMMIT_SHA" >> "$GITHUB_OUTPUT"
+
+  check-compatibility-sdk-go:
+    needs: prepare-inputs
+    if: ${{ github.event.inputs.skip_sdk_check == false || github.event.inputs.skip_sdk_check == 'false' }}
+    uses: temporalio/api-go/.github/workflows/check-sdk-compat.yml@master
+    with:
+      sdk_ref: latest
+      api_ref: ${{ needs.prepare-inputs.outputs.api_go_commit_sha }}
+
+  create-release:
+    name: "Create release"
+    needs: [prepare-inputs, check-compatibility-sdk-go]
+    if: |
+      !cancelled() &&
+      needs.prepare-inputs.result == 'success' &&
+      contains(fromJSON('["success", "skipped"]'), needs.check-compatibility-sdk-go.result)
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Generate token
+        id: generate_token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.TEMPORAL_CICD_APP_ID }}
+          private-key: ${{ secrets.TEMPORAL_CICD_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.prepare-inputs.outputs.api_commit_sha }}
+          token: ${{ steps.generate_token.outputs.token }}
+
+      - name: Create release
+        env:
+          GH_TOKEN: ${{ steps.generate_token.outputs.token }}
+          REF: ${{ needs.prepare-inputs.outputs.api_commit_sha }}
+          TAG: ${{ github.event.inputs.tag }}
+          BASE_TAG: ${{ github.event.inputs.base_tag }}
+        run: |
+          gh repo set-default ${{ github.repository }}
+          gh release create "$TAG" --target "$REF" --latest --generate-notes --notes-start-tag "$BASE_TAG" --draft
+
+  release-api-go:
+    needs: [prepare-inputs, create-release]
+    if: |
+      !cancelled() &&
+      needs.create-release.result == 'success'
+    uses: temporalio/api-go/.github/workflows/create-release.yml@master
+    with:
+      ref: ${{ needs.prepare-inputs.outputs.api_go_commit_sha }}
+      tag: ${{ github.event.inputs.tag }}
+      api_commit_sha: ${{ needs.prepare-inputs.outputs.api_commit_sha }}
+      base_tag: ${{ github.event.inputs.base_tag }}
+    secrets: inherit

.github/workflows/push-to-buf.yml

@@ -0,0 +1,20 @@
+name: Push to Buf Registry
+
+on:
+  push:
+    tags:
+      - 'v**'
+    branches:
+      - master
+permissions:
+  contents: read
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+      - uses: bufbuild/buf-action@v1
+        with:
+          version: 1.49.0
+          token: ${{ secrets.BUF_TEMPORALIO_TOKEN }}

.github/workflows/trigger-api-go-delete-release.yml

@@ -0,0 +1,13 @@
+name: "Trigger api-go delete release"
+
+on:
+  release:
+    types: [deleted]
+
+jobs:
+  trigger-api-go-delete-release:
+    uses: temporalio/api-go/.github/workflows/delete-release.yml@master
+    with:
+      tag: ${{ github.event.release.tag_name }}
+      api_commit_sha: ${{ github.event.release.target_commitish }}
+    secrets: inherit

.github/workflows/trigger-api-go-publish-release.yml

@@ -0,0 +1,13 @@
+name: "Trigger api-go publish release"
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  trigger-api-go-publish-release:
+    uses: temporalio/api-go/.github/workflows/publish-release.yml@master
+    with:
+      tag: ${{ github.event.release.tag_name }}
+      api_commit_sha: ${{ github.event.release.target_commitish }}
+    secrets: inherit

.github/workflows/trigger-api-go-update.yml

@@ -30,39 +30,31 @@ jobs:
           owner: ${{ github.repository_owner }}
           repositories: api-go # generate a token with permissions to trigger GHA in api-go repo
 
-      - name: Prepare inputs
-        id: prepare_inputs
+      - name: Dispatch api-go Github Action
+        env:
+          GH_TOKEN: ${{ steps.generate_token.outputs.token }}
+          EVENT_PUSH_BRANCH: ${{ github.event.ref }}
+          EVENT_PUSH_COMMIT_AUTHOR: ${{ github.event.head_commit.author.name }}
+          EVENT_PUSH_COMMIT_AUTHOR_EMAIL: ${{ github.event.head_commit.author.email }}
+          EVENT_PUSH_COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+          EVENT_WF_DISPATCH_BRANCH: ${{ github.event.inputs.branch }}
         run: |
           case "${{ github.event_name }}" in
             "push")
-              BRANCH=${{ github.event.ref }}
-              BRANCH=${BRANCH#refs/heads/}
-              COMMIT_AUTHOR=${{ toJSON(github.event.head_commit.author.name) }}
-              COMMIT_AUTHOR_EMAIL=${{ toJSON(github.event.head_commit.author.email) }}
-              COMMIT_MESSAGE=${{ toJSON(github.event.head_commit.message) }}
+              BRANCH="${EVENT_PUSH_BRANCH#refs/heads/}"
+              COMMIT_AUTHOR="${EVENT_PUSH_COMMIT_AUTHOR}"
+              COMMIT_AUTHOR_EMAIL="${EVENT_PUSH_COMMIT_AUTHOR_EMAIL}"
+              COMMIT_MESSAGE="${EVENT_PUSH_COMMIT_MESSAGE}"
               ;;
 
             "workflow_dispatch")
-              BRANCH="${{ github.event.inputs.branch }}"
+              BRANCH="${EVENT_WF_DISPATCH_BRANCH}"
               COMMIT_AUTHOR="Temporal Data"
               COMMIT_AUTHOR_EMAIL="commander-data@temporal.io"
               COMMIT_MESSAGE="Update proto"
               ;;
           esac
 
-          echo "BRANCH=${BRANCH}" >> $GITHUB_OUTPUT
-          echo "COMMIT_AUTHOR=${COMMIT_AUTHOR}" >> $GITHUB_OUTPUT
-          echo "COMMIT_AUTHOR_EMAIL=${COMMIT_AUTHOR_EMAIL}" >> $GITHUB_OUTPUT
-          echo "COMMIT_MESSAGE=${COMMIT_MESSAGE}" >> $GITHUB_OUTPUT
-
-      - name: Dispatch api-go Github Action
-        env:
-          GH_TOKEN: ${{ steps.generate_token.outputs.token }}
-          BRANCH: ${{ steps.prepare_inputs.outputs.BRANCH }}
-          COMMIT_AUTHOR: ${{ steps.prepare_inputs.outputs.COMMIT_AUTHOR }}
-          COMMIT_AUTHOR_EMAIL: ${{ steps.prepare_inputs.outputs.COMMIT_AUTHOR_EMAIL }}
-          COMMIT_MESSAGE: ${{ steps.prepare_inputs.outputs.COMMIT_MESSAGE }}
-        run: |
           gh workflow run update-proto.yml -R https://github.com/temporalio/api-go \
             -r master \
             -f branch="${BRANCH}" \

Makefile

@@ -1,4 +1,4 @@
-SHELL=/bin/bash -o pipefail
+SHELL=bash -o pipefail
 
 $(VERBOSE).SILENT:
 ############################# Main targets #############################
@@ -76,7 +76,7 @@ http-api-docs:
 ##### Plugins & tools #####
 grpc-install:
 	@printf $(COLOR) "Install/update protoc and plugins..."
-	@go install go.temporal.io/api/cmd/protogen@latest
+	@go install go.temporal.io/api/cmd/protogen@master
 	@go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
 	@go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
 	@go install github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-grpc-gateway@latest

buf.yaml

@@ -1,6 +1,8 @@
 version: v1
+name: buf.build/temporalio/api
 deps:
   - buf.build/grpc-ecosystem/grpc-gateway
+  - buf.build/googleapis/googleapis
 build:
   excludes:
     # Buf won't accept a local dependency on the google protos but we need them
@@ -11,8 +13,8 @@ breaking:
     - WIRE_JSON
   ignore:
     - google
-    # Remove after applying nexus spec description change
-    - temporal/api/nexus/v1/message.proto
+    # TODO (yuri) remove this
+    - temporal/api/workflow/v1/message.proto
 lint:
   use:
     - DEFAULT