fix: this improves the way we do opena api diffing

[gastonfournier]

About the changes

This now checks out the commit from where your branch "branched" from main and makes the diff.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Review	Updated (UTC)
unleash-docs	Ignored	Preview	Jan 9, 2026 1:13pm

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

Pull request overview

This PR improves the OpenAPI diffing workflow by comparing against the merge-base commit where the feature branch diverged from the base branch (typically main), rather than comparing against a specific version or the tip of main. The workflow now builds and runs the Unleash backend directly instead of using docker-compose.

Key changes:

• Introduces merge-base detection to find the exact commit where the branch diverged
• Replaces docker-compose-based setup with direct Node.js backend execution using GitHub Actions postgres service
• Updates from port 3000 to port 4242 for the backend service

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The postgres service image should specify a version tag instead of using the implicit "latest" tag. Using "postgres" without a version tag can lead to unexpected behavior when the latest version changes. Consider pinning to a specific version like "postgres:15" or "postgres:16" to ensure consistent and reproducible builds.

Suggested change

	image: postgres
	image: postgres:16

[Copilot]

Checking out a commit SHA directly (line 48) puts the repository in a detached HEAD state. After this checkout, Node.js dependencies are installed (line 55), but the package.json and yarn.lock from the baseline commit might be incompatible with the later current branch state. This could cause the workflow to fail if there are dependency changes between the baseline and current branch.

[Copilot]

The workflow will fail if the backend doesn't start successfully. After starting the backend with "&", there's no check to ensure the process actually started. If the backend fails to start, the wait loop will timeout, but there's no cleanup or logging of the backend process output which would help debug failures.

[Copilot]

The "Determine baseline commit" step will fail when triggered by workflow_dispatch event if the base branch doesn't exist on origin or if the merge-base cannot be determined. The script should handle potential git command failures and validate that BASE_SHA is not empty before proceeding.

Suggested change

	git fetch origin "${{ github.event.pull_request.base.ref }}"
	BASE_SHA=$(git merge-base "origin/${{ github.event.pull_request.base.ref }}" "${{ github.sha }}")
	else
	git fetch origin main
	BASE_SHA=$(git rev-parse "origin/main")
	fi
	echo "BASE_SHA=$BASE_SHA" >> $GITHUB_ENV
	if ! git fetch origin "${{ github.event.pull_request.base.ref }}"; then
	echo "Failed to fetch base branch 'origin/${{ github.event.pull_request.base.ref }}'."
	exit 1
	fi
	BASE_SHA=$(git merge-base "origin/${{ github.event.pull_request.base.ref }}" "${{ github.sha }}") || {
	echo "Failed to determine merge-base with 'origin/${{ github.event.pull_request.base.ref }}'."
	exit 1
	}
	else
	if ! git fetch origin main; then
	echo "Failed to fetch base branch 'origin/main'."
	exit 1
	fi
	BASE_SHA=$(git rev-parse "origin/main") || {
	echo "Failed to resolve 'origin/main'."
	exit 1
	}
	fi
	if [ -z "$BASE_SHA" ]; then
	echo "BASE_SHA is empty; unable to determine baseline commit."
	exit 1
	fi
	echo "BASE_SHA=$BASE_SHA" >> "$GITHUB_ENV"

[Copilot]

Missing the -p flag for mkdir. If the frontend/build directory already exists from a previous run or caching, the mkdir command will fail. Use "mkdir -p frontend/build" to ensure idempotent behavior.

Suggested change

	mkdir frontend/build
	mkdir -p frontend/build

[Copilot]

The workflow still declares a "stable_version" input (line 14-17) but this input is no longer used anywhere in the workflow after the changes. The old docker-compose-based approach used UNLEASH_VERSION variable which referenced this input, but the new approach checks out the baseline commit directly. This unused input should be removed to avoid confusion.