ci(openapi): require the pinned server commit to be reachable from server main - #61
Merged
Merged
Conversation
`openapi-contract verify-source` only asserted that the server checkout
is *at* the pinned commit, and CI checks out exactly the pinned SHA, so
that assertion could never fail.
A pull-request head SHA stays fetchable from Life-USTC/server forever,
so the pin could point at a commit that was never on main while every
check passed: the provenance verified, the checkout matched, and the
vendored spec was byte-identical to the source.
This repository hit it. api/openapi.provenance.json was pinned at
fea7bb21ead65fa4da1d51d8ef36ef914a647783 ("fix(young): complete release
contracts", 2026-09-15) in #57, a pull-request head that is not an
ancestor of server main -- the server squash-merges, so PR heads never
land there. The generated client came from a discarded branch snapshot
and CI reported success until the contract was re-synced from 222eeb61.
Add `openapi-contract verify-reachable SERVER_DIR`, asserting
`git merge-base --is-ancestor <pin> <main>` against the server checkout.
`verify-source` and `sync` both call it, so CI rejects an unreachable
pin and the nightly sync refuses to write one.
Ancestry needs real history, so the server checkouts now use
`fetch-depth: 0` and fetch `refs/heads/main` explicitly. A shallow
checkout stays shallow even after fetching main, so the script refuses
to run there instead of guessing: a check that cannot be evaluated is
worse than no check. The same refusal covers a missing main ref and a
pin the checkout does not contain.
scripts/openapi-contract.test.sh builds synthetic server histories and
proves the check rejects an unmerged branch head -- reproducing the
incident where HEAD and the vendored spec both matched the pin -- and
accepts the main tip and older main commits. `make test` runs it before
the Go suite.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
OpenAPI provenance accepted any fetchable server commit, including a pull-request head that never reached server main.
What changed
Result
The CLI cannot silently vendor a contract generated from an unmerged server branch.