From d17ba1cd85a67dce341b59e92d74ea2bf13cedee Mon Sep 17 00:00:00 2001 From: PeteLevineA Date: Wed, 3 Jun 2026 14:54:00 -0400 Subject: [PATCH 1/3] Introduce oasdiff and oasdiff breaking changes workflow on PR to main --- .github/workflows/breaking-changes.yaml | 47 +++++++++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 .github/workflows/breaking-changes.yaml diff --git a/.github/workflows/breaking-changes.yaml b/.github/workflows/breaking-changes.yaml new file mode 100644 index 0000000..90b7552 --- /dev/null +++ b/.github/workflows/breaking-changes.yaml @@ -0,0 +1,47 @@ +name: OpenAPI Breaking Changes +on: + pull_request: + branches: + - main + +jobs: + detect-breaking-changes: + runs-on: ubuntu-latest + steps: + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: 20 + + # 1. Prepare PR Spec + - name: Checkout PR + uses: actions/checkout@v4 + with: + path: pr + + - name: Build PR Spec + working-directory: pr + run: | + npm install + npm run build + + # 2. Prepare Base Spec + - name: Checkout Base Branch + uses: actions/checkout@v4 + with: + ref: ${{ github.base_ref }} + path: base + + - name: Build Base Spec + working-directory: base + run: | + npm install + npm run build + + # 3. Compare with oasdiff + - name: Check for Breaking Changes + uses: oasdiff/oasdiff-action/breaking@v0.0.37 + with: + base: 'base/dist/latest/openapi.yaml' + revision: 'pr/dist/latest/openapi.yaml' + fail-on: 'ERR' From 6682ff6ea96679f366051552085fd4d87bba0ab9 Mon Sep 17 00:00:00 2001 From: PeteLevineA Date: Fri, 5 Jun 2026 09:14:02 -0400 Subject: [PATCH 2/3] Address security and performance feedback in breaking-changes workflow - Restrict token permissions with `permissions: contents: read` - Prevent token persistence in checkout steps - Use `npm ci --ignore-scripts` to mitigate malicious lifecycle scripts - Implement dependency caching for `npm` to speed up workflow - Add concurrency limits to prevent redundant workflow runs - Add a 10 minute job timeout Co-authored-by: Cursor --- .github/workflows/breaking-changes.yaml | 43 +++++++++++++++++-------- 1 file changed, 29 insertions(+), 14 deletions(-) diff --git a/.github/workflows/breaking-changes.yaml b/.github/workflows/breaking-changes.yaml index 90b7552..d4439c4 100644 --- a/.github/workflows/breaking-changes.yaml +++ b/.github/workflows/breaking-changes.yaml @@ -4,38 +4,52 @@ on: branches: - main +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: + contents: read + jobs: detect-breaking-changes: runs-on: ubuntu-latest + timeout-minutes: 10 steps: - - name: Setup Node.js - uses: actions/setup-node@v4 - with: - node-version: 20 - - # 1. Prepare PR Spec + # 1. Checkout Branches - name: Checkout PR uses: actions/checkout@v4 with: path: pr + persist-credentials: false - - name: Build PR Spec - working-directory: pr - run: | - npm install - npm run build - - # 2. Prepare Base Spec - name: Checkout Base Branch uses: actions/checkout@v4 with: ref: ${{ github.base_ref }} path: base + persist-credentials: false + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: 20 + cache: 'npm' + cache-dependency-path: | + pr/package-lock.json + base/package-lock.json + + # 2. Build Specs + - name: Build PR Spec + working-directory: pr + run: | + npm ci --ignore-scripts + npm run build - name: Build Base Spec working-directory: base run: | - npm install + npm ci --ignore-scripts npm run build # 3. Compare with oasdiff @@ -45,3 +59,4 @@ jobs: base: 'base/dist/latest/openapi.yaml' revision: 'pr/dist/latest/openapi.yaml' fail-on: 'ERR' + From 72b5eec45ca546dfc99b55060f8ee46b2d2c05c7 Mon Sep 17 00:00:00 2001 From: PeteLevineA Date: Fri, 5 Jun 2026 10:21:39 -0400 Subject: [PATCH 3/3] Update breaking-changes workflow to use Node 22 and Yarn caching Co-authored-by: Cursor --- .github/workflows/breaking-changes.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/breaking-changes.yaml b/.github/workflows/breaking-changes.yaml index d4439c4..c36ef41 100644 --- a/.github/workflows/breaking-changes.yaml +++ b/.github/workflows/breaking-changes.yaml @@ -33,24 +33,24 @@ jobs: - name: Setup Node.js uses: actions/setup-node@v4 with: - node-version: 20 - cache: 'npm' + node-version: 22 + cache: 'yarn' cache-dependency-path: | - pr/package-lock.json - base/package-lock.json + pr/yarn.lock + base/yarn.lock # 2. Build Specs - name: Build PR Spec working-directory: pr run: | - npm ci --ignore-scripts - npm run build + yarn install --frozen-lockfile --ignore-scripts + yarn build - name: Build Base Spec working-directory: base run: | - npm ci --ignore-scripts - npm run build + yarn install --frozen-lockfile --ignore-scripts + yarn build # 3. Compare with oasdiff - name: Check for Breaking Changes