chore(main): release 0.1.16 (#163) #47
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: API catalog drift | |
| # Regenerates the embedded API catalog from the upstream gdcorp-platform | |
| # commerce.*-specification repos and fails if the committed catalog has drifted. | |
| # This is the source-drift guard (catches per-operation / per-endpoint changes). | |
| # The always-on structural guard (domains + endpoint counts vs the intentional | |
| # list) lives in `cargo test` | |
| # (committed_catalog_matches_expected_domains_and_manifest) and runs on every PR. | |
| # | |
| # Reads the gdcorp-platform spec repos via a GitHub App (the default GITHUB_TOKEN | |
| # only reaches this repo). The app is installed on the gdcorp-platform org with | |
| # read-only Contents access; its Client ID and private key are provisioned here | |
| # as the `SPEC_SYNC_CLIENT_ID` / `SPEC_SYNC_PRIVATE_KEY` secrets and exchanged | |
| # for a short-lived installation token at job start. | |
| on: | |
| schedule: | |
| - cron: "17 6 * * 1" # Mondays ~06:17 UTC | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| drift: | |
| runs-on: ubuntu-latest | |
| # Guard against a hung network fetch to the spec repos burning runner minutes. | |
| timeout-minutes: 20 | |
| defaults: | |
| run: | |
| working-directory: rust | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Generate spec-sync app token | |
| id: spec-sync-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.SPEC_SYNC_CLIENT_ID }} | |
| private-key: ${{ secrets.SPEC_SYNC_PRIVATE_KEY }} | |
| owner: gdcorp-platform | |
| permission-contents: read | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable | |
| - name: Regenerate catalog from upstream specs | |
| # Runs from the job-default working-directory (rust/) — cargo needs the workspace. | |
| env: | |
| GITHUB_TOKEN: ${{ steps.spec-sync-token.outputs.token }} | |
| run: cargo run -p generate-api-catalog | |
| - name: Fail on drift | |
| working-directory: . | |
| run: | | |
| # manifest.json carries a generated-at timestamp that changes every run; | |
| # stage the generated directory, then unstage that timestamp-only file. | |
| # The staged diff catches modifications, deletions, and new untracked domains. | |
| git add -A -- rust/schemas/api | |
| git restore --staged -- rust/schemas/api/manifest.json | |
| if ! git diff --cached --quiet -- rust/schemas/api; then | |
| echo "::error::Embedded API catalog is stale vs upstream commerce.*-specification repos. Regenerate with: (cd rust && GITHUB_TOKEN=<token> cargo run -p generate-api-catalog) and commit." | |
| git diff --cached --stat -- rust/schemas/api | |
| exit 1 | |
| fi | |
| echo "API catalog is in sync with upstream specs." |