Release SDK updates

[kernel-internal]

710780c ci: promote through merge-commit pull requests
bf366f0 ci: add stlc promotion workflows

---

Note

Medium Risk
Workflows can force-push release branches and auto-merge into production using elevated GitHub App permissions; misconfiguration or ancestry drift could block or incorrectly sync repos.

Overview
Adds two GitHub Actions workflows that wire kernel-python-sdk-staging to production kernel-python-sdk using merge-commit PRs (not squash/rebase) so both repos stay on one ancestry chain.

Promote SDKs (stlc-promote.yml) runs on staging main pushes: mints a GitHub App token for the production repo, skips work when production’s tree already matches staging, otherwise force-pushes staging main to production stainless/release, opens a “Release SDK updates” PR if needed, and enables auto-merge with a merge commit.

Sync SDK repos (stlc-sync.yml) adds a back-sync job (cron, manual, or prod-released dispatch) that fast-forwards staging main from production when staging is behind, with a guard that fails if staging is not an ancestor of production. Production release events can dispatch prod-released to staging (optional STAGING_DISPATCH_TOKEN). Staging pushes to non-generated commits can dispatch seal-custom-code to kernel/kernel (optional CONFIG_DISPATCH_TOKEN).

^{Reviewed by Cursor Bugbot for commit 710780c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 5 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 710780c. Configure here.}

[cursor]

Back-sync lacks production auth

Medium Severity

The back-sync job fetches production/main over anonymous HTTPS after stripping checkout credentials, while promote uses a GitHub App token for the same production repo. If kernel/kernel-python-sdk is private, git fetch production main fails and back-sync never runs, leaving staging out of date despite a working promote path.

 

^{Reviewed by Cursor Bugbot for commit 710780c. Configure here.}

[cursor]

Back-sync triggers seal dispatch

Medium Severity

The seal-dispatch job runs on every staging push to main and only skips commits whose message contains Stainless-Generated-From or whose author is stlc-bot. When back-sync fast-forwards staging main to production/main, that push still fires seal-dispatch and can emit seal-custom-code for production merge commits, mislabeling automated back-sync as custom staging code.

 

^{Reviewed by Cursor Bugbot for commit 710780c. Configure here.}

[cursor]

PR body breaks shell quoting

Low Severity

The promote step builds gh pr create --body via unescaped $(git log --oneline production/main..origin/main) inside double quotes. Commit subjects containing double quotes, backticks, or $ can terminate or alter the shell word and cause gh pr create to fail or pass a truncated body, leaving no open promote PR while later merge steps still run.

 

^{Reviewed by Cursor Bugbot for commit 710780c. Configure here.}

[cursor]

Auto-merge failures report success

High Severity

The promote job runs gh pr merge with --auto but appends || echo, so a non-zero exit from the CLI (auto-merge disabled, branch protection, failing required checks, merge conflicts, or insufficient app permissions) still leaves the workflow step and job green. Staging can remain unpromoted to production while automation looks healthy.

 

^{Reviewed by Cursor Bugbot for commit 710780c. Configure here.}

[cursor]

Existing promote PR never updated

Low Severity

The step is named “Open or update the promote PR”, but when an open PR from stainless/release already exists the script skips gh pr create and never refreshes title or body. Later staging pushes still force-update the head branch, so the open PR can list an outdated git log while containing newer commits.

 

^{Reviewed by Cursor Bugbot for commit 710780c. Configure here.}