ci: pin the Speakeasy CLI to 1.795.1

[laurencemcknight]

Why

The monorepo-release dispatch for paygentic-v21.3.0 failed here after generation had already succeeded:

speakeasy tag promote -c <target> -t main,published
{"message":"err_unauthorized: unauthorized -- bearer token missing","status_code":403}
failed to tag registry images

Speakeasy CLI 1.795.2 (released 2026-08-24 13:29Z) bumped speakeasy-client-sdk-go to v3.27.0, which regenerated artifacts.go with auth stripped from every Artifacts.* method — SecuritySource is nil and the utils.PopulateSecurity call is gone. PopulateSecurity call sites: 11 in v3.26.7, 0 in v3.27.0, while auth.go (3) and codesamples.go (4) kept theirs, so this is a regression rather than a deliberate redesign.

speakeasy tag promote reaches the registry through Artifacts.PostTags, so it now sends no Authorization header and the registry rejects it.

Upstream cause is speakeasy-client-sdk-go#50: that regen restores top-level security via an overlay, but its own comment notes operations declaring security: [] keep that override — which the registry's artifact endpoints do. Verification there was go build / go vet / apidiff, none of which catch a client that silently omits an auth header. No upstream issue or fix is open as of this PR.

The blast radius is why this is worth pinning rather than waiting: it breaks tag promote for every consumer on latest, including Speakeasy's own generation action.

What

Pin speakeasy_version: "1.795.1" — the last release on the working client SDK (v3.26.7).

This only affects the action's own CLI invocations. Generation itself already uses the speakeasyVersion pinned in .speakeasy/workflow.yaml, so generated output is unchanged by this PR.

Impact of the failed run

Generation had already committed the regenerated SDK to main and pushed its version tag before the registry tagging failed, so the publish jobs were skipped and the tagged version never reached the package registry. A plain re-run will no-op — gen.lock is already current, so there is no diff left to trigger generation. After merging this, the recovery run needs force=true, which bumps and publishes the next patch version. The already-pushed tag stays as a git tag that never shipped.

Unpinning

Drop the pin once upstream ships a fix. Until then latest is broken for this step.

[laurencemcknight]

Closing unmerged — the speakeasy_version input is [DEPRECATED] and silently ignored by workflow-executor@v15, so this pin is a no-op. Confirmed on paygentic/sdk-node, which pinned 1.795.1 and still downloaded v1.795.3 at runtime.

Moot regardless: Speakeasy shipped v1.795.3 at 16:00Z reverting the break (speakeasy-api/speakeasy#2120, 'revert: bump speakeasy-core/client-sdk-go (#2117) — restores registry auth'), back on client-sdk-go v3.26.7. Unpinned latest is correct again.