fix: repair regen workflow (9/9 failing runs)

[aggmoulik]

Problem

regen.yml has failed 9 out of 9 scheduled runs, every Monday since 2026-06-01. The repo is still on its initial commit, so the vendored _gen tree has not moved since May while the API has.

Two independent bugs:

1. BSD sed on a GNU runner. The import-rewrite block used sed -i '' -e .... On ubuntu-latest, GNU sed reads '' as a filename:

sed: can't read : No such file or directory
##[error]Process completed with exit code 123

2. Version discovery returned empty. The workflow scraped a Location: redirect header with curl -sI. It resolved to an empty string, and because empty != the current pin, the no-op guard did not fire — the workflow proceeded to sed the pin to "" and regenerate with a blank version.

What this changes

Vendoring stays. The BSR pip package cannot be used as a dependency: it installs as top-level openstatus/, which collides with this SDK's own public openstatus package — the exact reason regen.sh vendors under _gen with rewritten imports.

area	before	after
import rewrite	sed -i '' (BSD)	sed -i (GNU)
discovery	curl -sI scraping a redirect header	buf registry module commit resolve
commit marker	readonly BUF_SCHEMA_COMMIT in regen.sh, duplicated into VERSION	passed as $1, written to VERSION only
empty result	silently blanked the pin	::error:: + exit 1
archive ref	commit-pinned URL	main label
release.yml	publishes from any repo	guarded to openstatusHQ/sdk-python

Flow

weekly cron / workflow_dispatch
  ├─ setup buf (buf-action, setup_only)
  ├─ buf registry module commit resolve buf.build/openstatus/api:main --format json
  │    → {"commit":"65e5c…","source_control_url":"https://github.com/openstatusHQ/openstatus/commit/…"}
  │    fail closed if empty or "null"
  ├─ bash scripts/regen.sh <commit>     fetches main.zip, vendors, writes _gen/VERSION
  ├─ bump patch in pyproject.toml       only if _gen actually changed
  └─ create-pull-request                no-ops on a clean tree; body links the source commit

The commit is resolved at run time and written to VERSION by the same command that writes the code, so the marker cannot disagree with the tree. There is no value to seed by hand — which is what made the first fork test a silent no-op.

Verification

regen.sh runs to completion for the first time:

$ bash scripts/regen.sh 65e5c3248a1e4c95abf37e7022bd4b8e
Done. Generated tree at src/openstatus/_gen
Schema commit recorded at src/openstatus/_gen/VERSION
EXIT=0

It surfaced the accumulated drift: 31 files changed, 516 insertions, 204 deletions, including the optional presence markers on description/active/public in the monitor .pyi stubs.

Dispatched end to end in a fork — the workflow resolved the commit, regenerated, bumped 0.1.0 → 0.1.1, and opened a PR.

Notes for review

• buf registry module commit resolve needs no authentication for this public module.
• The no-arg guard is deliberate: scripts/regen.sh with no argument exits usage: regen.sh <schema-commit> rather than generating with a blank marker.
• Needs Allow GitHub Actions to create and approve pull requests enabled, or a SDK_BOT_TOKEN secret. The workflow falls back to github.token when the secret is absent, but PRs from that token do not trigger on: pull_request, so ci.yml will not run on them.