feat: route cli generation through openapi-generation-next

[TristanSpeakEasy]

Why

The private generator is now published from openapi-generation-next at v2.928.0, while the canonical module/import path must remain unchanged until the separate repository-rename migration. The CLI needs an explicit, temporary remote Go module replacement so day-to-day generator work can move to -next without breaking existing imports.

What changed

• Require canonical github.com/speakeasy-api/openapi-generation/v2 v2.928.0 and route it to github.com/speakeasy-api/openapi-generation-next/v2 v2.928.0 through one exact remote replacement.
• Use released generation-context v1.0.0 and speakeasy-core v0.22.2; no local filesystem dependency replacements are included.
• Pass caller-decided commercial/AGPL generation context to regular and cancellable generator execution, with focused coverage for authenticated state, cancellation, and invalid partial authentication.
• Preserve direct/unauthenticated behavior in workflow and lint generation paths.
• Make scripts/upgrade.bash inspect Go module state structurally, query openapi-generation-next while the replacement is active, and update the require and replacement versions together.

Review notes

• The temporary replace is intentional and must remain until the separately approved repository rename. Imports stay canonical.
• scripts/upgrade.bash is the main migration-sensitive behavior: it switches release lookup only when it detects the exact approved replacement and rejects mismatched require/replace versions.
• This PR does not rename repositories, change generator release workflow/protection, enable WASM delivery, or change snapshot routing.
• Do not merge until the separately tracked protected normal-release rehearsal on openapi-generation-next has completed successfully.

Testing

• go test ./internal/sdkgen ./internal/run ./cmd/lint ./cmd/generate -count=1
• go test -race ./internal/sdkgen -run 'TestWithGenerationContext' -count=1
• go build ./...
• go vet ./...
• go mod tidy twice with no diff; go mod verify
• bash -n scripts/upgrade.bash
• Isolated cold-cache module resolution using the exact canonical require plus remote -next replacement.
• Independent review found no actionable issues.

Rollout / deployment notes

• Hosted CLI validation/release already uses GOPRIVATE and BOT_REPO_TOKEN Git URL rewrite for private speakeasy-api modules. Its selected-repository access to openapi-generation-next must be confirmed by the PR’s hosted checks before merge.
• After the later rename, remove only the temporary remote replacement, keep imports canonical, restore canonical release lookup in scripts/upgrade.bash, and refresh module sums.

---

Summary by cubic

Routes CLI generation to openapi-generation-next with canonical imports and makes generation license-aware (Commercial vs AGPL). Also stabilizes Windows quickstart tests by running them serially and increases CI test timeouts to 30m.

• New Features

  • Route github.com/speakeasy-api/openapi-generation/v2 v2.928.0 to github.com/speakeasy-api/openapi-generation-next/v2 v2.928.0 via a remote replace; imports remain canonical.
  • Integrate generation-context v1.0.0: choose Commercial vs AGPL by access; apply to generate and cancellable runs; lint uses Direct AGPL if unauthenticated; workflow sets context from workspace or Direct; preserves cancellation; rejects partial auth; add tests for workflow and cancellable contexts.
  • Loosen changelog test to allow bootstrap releases with generic entries.
  • Bump github.com/speakeasy-api/speakeasy-core to v0.22.2.

• Migration

  • Keep the temporary replace until the repository rename; imports stay github.com/speakeasy-api/openapi-generation/v2.
  • scripts/upgrade.bash reads go.mod structurally, switches release lookup to openapi-generation-next when the replace is active, enforces matching require/replace versions, and updates both together.

^{Written for commit f76078e. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 8 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[2ynn]

LGTM but would recommend tightening the test coverage