Runs on oasdiff v1.37.0

Every action now uses oasdiff v1.37.0 as its base image (#212). No action input or output changed, so a workflow only needs @v0.1.23, or nothing at all if it already points at @v0.

What this picks up for a workflow that checks breaking changes:

• Nine new checks, which can fail a job that passed before. Moving a deprecated resource's sunset date earlier is now reported for endpoints, parameters and properties, deleting a deprecated property's sunset date is reported, and validate flags a schema that no payload can satisfy. Each one is downgradable with --severity-levels.
• Localized output no longer prints %!(EXTRA ...) in Spanish, Russian and Portuguese, which affected 30 messages.
• An unparseable x-sunset or x-stability-level value is shown quoted, so an empty value or one padded with a space is visible in the annotation rather than vanishing from it.

The full list is in the oasdiff v1.37.0 release notes, including the change fingerprints that move and what that means for a tool carrying review state.

Full Changelog: v0.1.22...v0.1.23

Highlights

Upgraded to oasdiff v1.36.0

Every action now runs tufin/oasdiff:v1.36.0 (#211). What a workflow author sees:

• Inline annotations land on the changed line in a JSON spec. Source locations used to need a YAML spec, so a JSON one produced annotations attached to the file with no line or column, and the side-by-side review linked from the PR comment showed no source text at all. Both now behave as they do for YAML. One limit: positions are only as fine as the document's line breaks, so a minified spec with everything on one line puts every annotation on line 1. Run it through jq . if your specs are generated.
• Sunset and deprecation annotations point at the field they are about. Six sunset ids annotated the deprecated line rather than the x-sunset date they complain about, and a parameter's deprecation finding looked for deprecated in the parameter's schema, so it landed on the operation line or carried no line at all.
• Adding an allOf branch to a request is an error again, on request-body-all-of-added and request-property-all-of-added. Both were reported as warnings with a comment suggesting another branch might still keep a constraint that was dropped, which cannot happen: adding a branch only narrows what a request may send. A job that fails on error will now fail on these.
• New fingerprints for findings inside an allOf, anyOf or oneOf branch. The branch name no longer ends in a separator, and the name is part of the fingerprint, so a stored approval for one of these changes is requested once more.
• validate returns its findings in the same order every run, sorted by file, line and column, so a step that compares stored reports stops seeing a reshuffle on every push. A spec with callbacks can also report findings it did not before, and multiple-of-not-positive is now schema-multiple-of-not-positive.
• The diff action takes --exclude-elements tags, which drops tag changes from diff and summary, both the tags an operation is listed under and the document's own tag definitions.

Also in the image: git revisions work on a repository mounted from the host, so the rev:path syntax no longer fails with "detected dubious ownership" on a self-hosted runner.

Full Changelog: v0.1.21...v0.1.22

Highlights

Upgraded to oasdiff v1.35.0

Every action now runs tufin/oasdiff:v1.35.0 (#210). What a workflow author sees:

• The diff action returns the same output on every run. Parts of the diff were built from map iteration, which Go randomizes, so the order of added, deleted and modified entries moved between runs of the same comparison. A job that diffs the same pair of specs twice now gets identical bytes.
• Two new info changes on the changelog and breaking actions, api-security-component-oauth-scope-added and api-security-component-oauth-scope-changed, because all four OAuth flows are checked now rather than only implicit. A security scheme whose authorizationCode, password or clientCredentials flow changed used to report nothing. Each finding names the flow it belongs to.
• Removing a deprecated property follows its sunset date. A removed request property or required response property that carries deprecated: true reports request-property-removed-with-deprecation or response-required-property-removed-with-deprecation at info with no x-sunset, *-removed-before-sunset at error before the date, and nothing after it. Jobs that fail on error may see a removal escalate where the spec sets a future sunset date.
• Security scheme URLs are compared by meaning. https://Login.Example.com:443/token and https://login.example.com/token no longer report a change.
• Two crashes are fixed. An x-extensible-enum holding numbers ([1, 2]) no longer panics when a value is removed, and a callback that references itself no longer overflows the stack.

Also in the image: a refused external $ref exits 123 on every load path, so a step keying off the exit code can offer the allow-external-refs remedy consistently.

Full Changelog: v0.1.20...v0.1.21

A security release. Every action that uploads a review is affected in its default configuration, so upgrade.

If you pin @v0, as the README recommends, you already have this: the v0 tag now points here, so your next run picks it up with no change on your side. If you pin an exact version, move it to v0.1.20.

Changes

• Base image bumped to oasdiff v1.34.1, which enforces the external-refs policy in the reader that --open installs (#209). Every action that uploads a review runs oasdiff with --open, so without the fix the allow-external-refs input had no effect on that path: a spec arriving in a pull request could read a file from the runner or reach an arbitrary URL, and the content went into the uploaded review. The input itself was already correct and already defaulted to false; only the enforcement one layer down was missing. Affects breaking, changelog and pr-comment. Reported by Zachariah Mithani (AploSec). See GHSA-6h8r-wgc5-q3xv.

oasdiff v1.34.0: security checks and one finding per shared-schema change

Every action now runs oasdiff v1.34.0.

• Security changes are judged by who can call the endpoint. Securing an operation that had no security requirement, directly or through a top-level security it inherits, now fails breaking. Replacing or narrowing the top-level security list is reported on each operation that inherits it, at the operation's levels, instead of once at info. Changing how a security scheme sends credentials (its type, an API key's name or location, the HTTP scheme, the OpenID Connect URL) is breaking too.
• A change in a shared schema is reported once per check, naming the schema, listing the first three properties it applies to and counting all of them, so large specs produce far fewer annotations.
• More accurate verdicts for removing a whole enum, date or time to date-time, and readOnly / writeOnly flips, and faster comparisons of large specs.

When you upgrade, expect some findings to change once: shared-schema findings carry the schema detail in their text, and top-level security findings move to the operations that inherit the list. Review decisions or err-ignore lines tied to the old findings may need updating.

No changes to the actions themselves. oasdiff/oasdiff-action/*@v0 now points at this release.

oasdiff v1.33.0: recursive schemas, fast and deterministic

Every action now runs oasdiff v1.33.0, which reworks how recursive schemas are compared. A workflow on a spec whose schemas reference each other in cycles no longer runs until the job times out, with or without flatten-allof, and the structured diff of such a spec is the same on every run.

Two consequences when you upgrade: a change inside a recursive schema is now reported once per entry into the cycle rather than once for every path through it, so those comparisons produce far fewer annotations; and the circularRef field is gone again from diff json/yaml output, where cyclic mismatches now appear as ordinary field-level diffs.

No changes to the actions themselves. oasdiff/oasdiff-action/*@v0 now points at this release.

oasdiff v1.32.1: fixes the hang on cyclic schemas

Every action now runs oasdiff v1.32.1, which fixes the v1.32.0 hang on specs whose schemas reference each other in cycles (oasdiff #1252). A workflow on such a spec no longer runs until the job times out. Recursive schemas are handled as in v1.31.0 again, so the circularRef field of diff json/yaml output is back and the non-determinism of oasdiff #1230 is back until the next release; everything else from v1.32.0 is kept.

No changes to the actions themselves. oasdiff/oasdiff-action/*@v0 now points at this release.

What's Changed

• ci: lint every shell surface with shellcheck and actionlint by @reuvenharrison in #204
• bump: oasdiff v1.32.0 by @reuvenharrison in #205

Full Changelog: v0.1.15...v0.1.16

Highlights

Upgraded to oasdiff v1.31.0

All actions (breaking, changelog, diff, pr-comment, validate) now run on oasdiff v1.31.0 (#203). No workflow changes are needed: update your uses: ref and your existing inputs keep working. Two behavior changes are worth knowing before you upgrade:

• Some changes now fail breaking that previously passed. Removing a constraint such as maximum or minLength from a response or response header is now an error (the server may return values old clients never had to handle), and setting a constraint on a request parameter is an error for every constraint keyword. These are part of 106 new checks completing set/unset coverage for all constraint keywords. If a flagged change is intended, lower the specific check with a severity-levels file.
• Fewer false failures on read-only properties. Restricting a readOnly request property (or a writeOnly response property) no longer fails as breaking: such a property never appears in a request, so the change is reported at info with a comment saying why.

See the oasdiff v1.31.0 release notes for the full list.

Full Changelog: v0.1.14...v0.1.15

Highlights

Upgraded to oasdiff v1.30.0

Every action now runs on oasdiff v1.30.0, the largest change to breaking-change detection since the checker was introduced. Severities are now derived from a single reviewed model of what each change does to the API contract, which corrected 36 checks and added 58 new ones, so the breaking and changelog actions may report differently on the same diff:

• Changes that now fail a breaking step: setting a bound (maxLength, minItems, multipleOf and friends) where none existed, removing a security requirement or adding a security scope, adding a branch or value to a response union.
• Changes that no longer fail: request parameter default changes, removing optional response properties and headers, dropping an allOf conjunct.
• New detection: OpenAPI 3.1 boolean schemas (items: false tuples), positional prefixItems comparison (reordering entries is now caught), OpenAPI 3.2 QUERY and custom methods, and constraint keywords that were previously unchecked (maxItems, maxProperties, minProperties, multipleOf, uniqueItems).

If a step starts failing on a change your team accepts, override that check's severity with severity-levels in .oasdiff.yaml in your repo; the full list of changed checks is in the oasdiff v1.30.0 release notes.

Full Changelog: v0.1.13...v0.1.14