From 2fbc0650a61407f669640f7a8a9efb80274b6626 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Mon, 11 May 2026 00:59:10 +0200 Subject: [PATCH] ci: warn-only OpenAPI spec drift check Adds an OpenAPI generation step to the Security & Quality workflow that flags drift between the Zod registry and the committed docs/api/openapi.yaml. Runs with continue-on-error: true so v1.4.23 informs without blocking; v1.4.24+ flips it to a hard gate once the registry has caught up with the legacy hand-maintained spec. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/security.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 07f9a1cf1..4ba396512 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -41,6 +41,24 @@ jobs: - name: Unit tests run: pnpm test + # v1.4.23 W4 F5c — OpenAPI spec drift check. + # + # `continue-on-error: true` is intentional for v1.4.23: the + # registry covers only the iOS-touched routes today, and the + # legacy hand-maintained spec at docs/api/openapi-v1422-legacy.yaml + # carries the rest. Once the registry hits ~95% coverage in + # v1.4.24+, flip this to a hard gate by removing + # `continue-on-error`. + - name: OpenAPI spec drift check + continue-on-error: true + run: | + pnpm openapi:generate + if ! git diff --exit-code docs/api/openapi.yaml; then + echo "::warning::OpenAPI spec out of date. Run 'pnpm openapi:generate' locally and commit the changes." + exit 1 + fi + echo "::notice::OpenAPI spec in sync with Zod source schemas." + dependency-audit: name: Dependency Audit runs-on: ubuntu-latest