chore: auto-sync OpenAPI source to Gram (no manual uploads)#2959
Merged
Conversation
Adds gram.json (declarative Gram deployment pointing at the clean public spec packages/docs/openapi.json) + a workflow that runs 'gram push' whenever the spec changes on main (and on manual dispatch). Keeps the hosted MCP's tools in sync with the API automatically — no UI uploads. Requires repo secrets GRAM_API_KEY (provider-scoped Gram key) and GRAM_PROJECT (project slug). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
1 issue found across 2 files
Confidence score: 4/5
- This PR is likely safe to merge, with one moderate security-hardening gap rather than a functional regression risk.
- In
.github/workflows/gram-sync.yml, the missing explicitpermissionsblock can leaveGITHUB_TOKENwith broader default access (often write), which increases blast radius if the workflow or dependencies are compromised. - Pay close attention to
.github/workflows/gram-sync.yml- set least-privilege token permissions (for example, read-only contents) to reduce CI security risk.
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
Verified against the Gram CLI source (speakeasy-api/gram): 'gram push' requires --org (GRAM_ORG) in addition to --project; the installer drops the binary in /usr/local/bin (already on PATH), so the manual GITHUB_PATH line was wrong. Org+project slugs aren't secret (they're in the dashboard URL), so they're hardcoded as env; only GRAM_API_KEY stays a secret. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Addresses cubic + CodeQL findings: the workflow only checks out the repo to push the spec, so it needs read-only contents access, not the default (often write) token permissions. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
Author
|
@cubic-dev-ai review it |
Contributor
@tofikwest I have started the AI code review. It will take a few minutes to complete. |
Contributor
|
🎉 This PR is included in version 3.66.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Manually uploading the OpenAPI spec into Gram every time is an anti-pattern. This makes the hosted MCP's source auto-sync with the API.
What
gram.json— declarative Gram deployment pointing at the clean public spec (packages/docs/openapi.json, which has the deny-list applied — not the raw/api/docs-json)..github/workflows/gram-sync.yml— runsgram pushwheneverpackages/docs/openapi.json(orgram.json) changes onmain, plus manualworkflow_dispatch. New/changed endpoints flow into the hosted MCP automatically.One-time setup required (then fully hands-off)
GRAM_API_KEY= that keyGRAM_PROJECT= your Gram project slugNote
First
workflow_dispatchrun validates the CLI install/flags — ifgramisn't found (PATH) or a flag needs adjusting, it's a one-line fix (normal CLI bring-up).🤖 Generated with Claude Code
Summary by cubic
Automates syncing the hosted MCP in Gram with the clean public OpenAPI spec. Removes manual uploads by pushing updates from
packages/docs/openapi.jsonvia CI.New Features
gram.jsonpointing topackages/docs/openapi.json(clean spec)..github/workflows/gram-sync.ymlto rungram pushon changes or manual dispatch; exportsGRAM_ORGandGRAM_PROJECT; sets least-privilegepermissions: contents: read.Migration
GRAM_API_KEYrepo secret.GRAM_ORG/GRAM_PROJECTin the workflow, then run “Sync MCP source to Gram” once to seed.Written for commit e53e2af. Summary will update on new commits.
Review in cubic