snapshot of https://github.com/tldraw/tldraw.git (main, 2026-09-23; blobs > 131072B omitted)

.github/workflows/trigger-sdk-hotfix.yml

@@ -0,0 +1,70 @@
+name: Trigger sdk hotfix
+
+# pull_request_target rather than push/pull_request: hotfix PRs (e.g. the automated
+# release-notes updates) carry `[skip ci]` in their commit messages, which suppresses
+# push- and pull_request-triggered workflows entirely — the label had no effect.
+# GitHub's skip-ci markers do not apply to pull_request_target. The `closed` event
+# replaces the old push-to-main trigger (which ran on every merge just to check
+# labels), and `labeled` allows re-triggering a hotfix by re-adding the label to an
+# already-merged PR. Secrets exposure is safe here: the job only runs for merged PRs
+# carrying a maintainer-applied hotfix label, checkout uses the trusted base branch,
+# and the only PR-derived code the script builds is the PR's already-merged commit
+# from main.
+on:
+  pull_request_target:
+    types: [closed, labeled]
+    branches:
+      - main
+
+defaults:
+  run:
+    shell: bash
+
+permissions:
+  contents: read
+
+jobs:
+  trigger:
+    name: Trigger an SDK hotfix
+    runs-on: ubuntu-latest
+    concurrency: npm-publish
+    environment: npm deploy
+    if: |
+      github.event.pull_request.merged == true &&
+      ((github.event.action == 'closed' &&
+        (contains(github.event.pull_request.labels.*.name, 'sdk-hotfix-please') ||
+         contains(github.event.pull_request.labels.*.name, 'docs-hotfix-please'))) ||
+       (github.event.action == 'labeled' &&
+        (github.event.label.name == 'sdk-hotfix-please' || github.event.label.name == 'docs-hotfix-please')))
+
+    steps:
+      - name: Generate a token
+        id: generate_token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.HUPPY_APP_ID }}
+          private-key: ${{ secrets.HUPPY_APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+          token: ${{ steps.generate_token.outputs.token }}
+          fetch-depth: 0
+
+      - name: Configure git credentials
+        run: git config --global url."https://x-access-token:${{ steps.generate_token.outputs.token }}@github.com/".insteadOf "https://github.com/"
+
+      - uses: ./.github/actions/setup
+
+      - name: Maybe trigger sdk hotfix
+        run: |
+          set -e
+          git config --global user.name 'huppy-bot[bot]'
+          git config --global user.email '128400622+huppy-bot[bot]@users.noreply.github.com'
+          git log --oneline -10
+          yarn tsx internal/scripts/trigger-sdk-hotfix.ts
+        env:
+          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
+          TLDRAW_BEMO_URL: https://demo.tldraw.xyz
+          DISCORD_DEPLOY_WEBHOOK_URL: ${{ secrets.DISCORD_DEPLOY_WEBHOOK_URL }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}