openapi-diff.yml

name: OpenAPI Diff
on: [pull_request]
permissions:
  contents: read
  pull-requests: write
jobs:
  openapi-diff:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout HEAD
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          ref: ${{ github.head_ref }}
          path: head
      - name: Checkout BASE
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          ref: ${{ github.base_ref }}
          path: base
      - name: Generate oasdiff changelog
        run: | # Write the full comment body to a file rather than a step output.
          # A large changelog interpolated into a JS action's `body:` input becomes a
          # huge INPUT_BODY env var, which can blow past the OS argv+envp size limit
          # and crash the action with "Argument list too long". Writing straight to a
          # file and using `body-path` avoids that entirely.
          {
            echo "## OpenAPI Changes"
            echo ""
            echo "<details>"
            echo "<summary>Show/hide changes</summary>"
            echo ""
            echo '```'
            for spec in base/openapi/specs/*.yaml; do
              base_spec="$spec"
              head_spec="head/openapi/specs/$(basename "$spec")"
              if [ -f "$head_spec" ]; then
                echo "## Changes for $(basename "$spec"):"
                docker run --rm \
                  --workdir ${{ github.workspace }} \
                  --volume ${{ github.workspace }}:${{ github.workspace }}:rw \
                  -e GITHUB_WORKSPACE=${{ github.workspace }} \
                  tufin/oasdiff changelog \
                  "$base_spec" \
                  "$head_spec"
                echo ""
              fi
            done
            echo '```'
            echo ""
            echo "Unexpected changes? Ensure your branch is up-to-date with \`main\` (consider rebasing)."
            echo "</details>"
          } > comment_body.md
      - name: Find existing comment
        id: find_comment
        uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          repository: ${{ github.repository }}
          issue-number: ${{ github.event.pull_request.number }}
          body-includes: "## OpenAPI Changes"
      - name: Post changes as comment
        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5
        # Even if no changes, make sure to update old comment if it was found.
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          edit-mode: "replace"
          repository: ${{ github.repository }}
          issue-number: ${{ github.event.pull_request.number }}
          comment-id: ${{ steps.find_comment.outputs.comment-id }}
          body-path: comment_body.md
      - name: Check for breaking changes
        id: oasdif_breaking
        run: |
          for spec in base/openapi/specs/*.yaml; do
            base_spec="$spec"
            head_spec="head/openapi/specs/$(basename "$spec")"
            if [ -f "$head_spec" ]; then
              echo "Checking $(basename "$spec") for breaking changes..."
              err_ignore_flag=()
              err_ignore_file="head/openapi/specs/oasdiff-err-ignore.txt"
              if [ -f "$err_ignore_file" ]; then
                err_ignore_flag=(--err-ignore "$err_ignore_file")
              fi
              docker run --rm \
                --workdir ${{ github.workspace }} \
                --volume ${{ github.workspace }}:${{ github.workspace }}:ro \
                -e GITHUB_WORKSPACE=${{ github.workspace }} \
                tufin/oasdiff breaking \
                --fail-on ERR \
                --format githubactions \
                "${err_ignore_flag[@]}" \
                "$base_spec" \
                "$head_spec"
            fi
          done