The notify-python-sdk job in .github/workflows/release.yml opens an
Incorporate codeanalyzer-python vX.Y.Z issue on codellm-devkit/python-sdk
on every tagged release.
It has no dedup and no close path, so the issues accumulate monotonically.
Seven were filed (v0.3.1 through v1.1.1) and none were ever closed — the
SDK backlog carried all seven at once while its pin sat at a single version.
The job also assumes a single consumer state, but the SDK pin is per-line:
main tracked 0.3.1 while release/2.0 tracked 1.0.2. The job comment
acknowledges this directly:
Issues are repository-scoped (not branch-scoped), so this opens one on python-sdk.
That mismatch is the defect — the work is line-scoped, the tracking is not.
Decision
Drop cross-repo issue filing entirely. SDK pin bumps become a deliberate
manual act, taken when the integration is ready to adapt rather than when a
tag happens to be pushed.
The equivalent Java-side mechanism (sdk-lockstep.yml in codeanalyzer-java)
is being removed in the same sweep. TypeScript never had one.
Scope
- remove the
notify-python-sdk job from .github/workflows/release.yml
CLDK_AUTH_TOKEN becomes unused in this workflow — the homebrew-tap
step uses HOMEBREW_TAP_TOKEN, not this one. Check for other consumers
before revoking it.
The
notify-python-sdkjob in.github/workflows/release.ymlopens anIncorporate codeanalyzer-python vX.Y.Zissue oncodellm-devkit/python-sdkon every tagged release.
It has no dedup and no close path, so the issues accumulate monotonically.
Seven were filed (v0.3.1 through v1.1.1) and none were ever closed — the
SDK backlog carried all seven at once while its pin sat at a single version.
The job also assumes a single consumer state, but the SDK pin is per-line:
maintracked 0.3.1 whilerelease/2.0tracked 1.0.2. The job commentacknowledges this directly:
That mismatch is the defect — the work is line-scoped, the tracking is not.
Decision
Drop cross-repo issue filing entirely. SDK pin bumps become a deliberate
manual act, taken when the integration is ready to adapt rather than when a
tag happens to be pushed.
The equivalent Java-side mechanism (
sdk-lockstep.ymlin codeanalyzer-java)is being removed in the same sweep. TypeScript never had one.
Scope
notify-python-sdkjob from.github/workflows/release.ymlCLDK_AUTH_TOKENbecomes unused in this workflow — the homebrew-tapstep uses
HOMEBREW_TAP_TOKEN, not this one. Check for other consumersbefore revoking it.