From 3c0c79fdd4fbcb810e0cc1db2e9a88c18c5310e4 Mon Sep 17 00:00:00 2001
From: zeekay <ai@hanzo.ai>
Date: Sat, 18 Jul 2026 12:27:37 -0700
Subject: [PATCH] =?UTF-8?q?fix(generate):=20authenticated=20spec=20fetch?=
 =?UTF-8?q?=20=E2=80=94=20hanzoai/openapi=20is=20private?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

raw.githubusercontent.com/hanzoai/openapi/main/hanzo.yaml 404s (openapi is a
private repo), so every spec-update regen failed at the fetch. Fetch hanzo.yaml
through the GitHub Contents API with a SPEC_TOKEN (repo/contents:read on
hanzoai/openapi) instead. Local SPEC=... override unchanged.
---
 .github/workflows/generate.yml |  3 +++
 scripts/generate.sh            | 11 +++++++++--
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/generate.yml b/.github/workflows/generate.yml
index 75a63ffc..f9fdd4f8 100644
--- a/.github/workflows/generate.yml
+++ b/.github/workflows/generate.yml
@@ -24,6 +24,9 @@ jobs:
           python-version: '3.12'
       - name: Regenerate
         run: ./scripts/generate.sh
+        env:
+          # Read token for the private hanzoai/openapi (repo/contents:read).
+          SPEC_TOKEN: ${{ secrets.SPEC_TOKEN }}
       - name: Verify it imports
         run: |
           python -m pip install -q urllib3 python-dateutil 'pydantic>=2' typing-extensions
diff --git a/scripts/generate.sh b/scripts/generate.sh
index 741b9bc2..da85aa77 100755
--- a/scripts/generate.sh
+++ b/scripts/generate.sh
@@ -13,12 +13,19 @@ set -euo pipefail
 cd "$(dirname "$0")/.."
 
 GENERATOR_VERSION="${GENERATOR_VERSION:-7.14.0}"
-SPEC_URL="${SPEC_URL:-https://raw.githubusercontent.com/hanzoai/openapi/main/hanzo.yaml}"
+# hanzoai/openapi is private — fetch hanzo.yaml through the GitHub API with a
+# token (SPEC_TOKEN). raw.githubusercontent.com only serves public repos (it
+# 404s on a private repo). Local override still honored: SPEC=/path/to/hanzo.yaml.
+SPEC_REPO="${SPEC_REPO:-hanzoai/openapi}"
+SPEC_REF="${SPEC_REF:-main}"
 SPEC="${SPEC:-}"
 JAR="${JAR:-/tmp/openapi-generator-cli-${GENERATOR_VERSION}.jar}"
 
 if [ -z "$SPEC" ]; then
-  SPEC="$(mktemp)"; curl -fsSL "$SPEC_URL" -o "$SPEC"
+  : "${SPEC_TOKEN:?SPEC_TOKEN required to read private $SPEC_REPO}"
+  SPEC="$(mktemp)"
+  curl -fsSL -H "Authorization: Bearer $SPEC_TOKEN" -H "Accept: application/vnd.github.raw" \
+    "https://api.github.com/repos/$SPEC_REPO/contents/hanzo.yaml?ref=$SPEC_REF" -o "$SPEC"
 fi
 if [ ! -f "$JAR" ]; then
   curl -fsSL -o "$JAR" \