# OpenAPI 破坏性变更门禁(契约先行加固)
# 仅在 PR 改动 docs/api-contracts/** 时触发;逐域用 oasdiff 比对 base 与 PR 的 OpenAPI,发现破坏性差异即失败。
# 注:本文件必须位于仓库根 .github/workflows/ 下;自建 Gitea Actions 不扫描 muse-cloud/.github/workflows/。
# 镜像钉版本 tufin/oasdiff:v1.19.1(机械门禁须可复现,避免 :latest 漂移改变判定口径)。
# 检测逻辑已本地验证(2026-06-17,oasdiff v1.19.1 对全部 7 域真实契约 5/5:无变更/新增可选参数/新增端点→放行,
#   参数变必填/删端点→拦截;复现脚本见 .agents/knowledge §七)。残留:远端 Gitea Actions 首次 PR 触发、base.sha
#   worktree 与 docker run 仍需一次真实 PR(改 docs/api-contracts/**)确认。
name: OpenAPI Breaking Change Check

on:
  pull_request:
    branches: [ main ]
    paths:
      - 'docs/api-contracts/**'

jobs:
  openapi-diff:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: 检出 base 分支契约到 /tmp/base
        run: git worktree add /tmp/base "${{ github.event.pull_request.base.sha }}"
      - name: oasdiff 破坏性变更检测(逐业务域)
        run: |
          set -euo pipefail
          fail=0
          for d in account ai content events knowledge market meta; do
            base="/tmp/base/docs/api-contracts/$d/openapi.yaml"
            head="docs/api-contracts/$d/openapi.yaml"
            if [ ! -f "$base" ] || [ ! -f "$head" ]; then
              echo "跳过 $d(base 或 PR 缺该契约文件)"; continue
            fi
            echo "== oasdiff breaking: $d =="
            docker run --rm -v "$PWD:/pr" -v /tmp/base:/base tufin/oasdiff:v1.19.1 breaking \
              "/base/docs/api-contracts/$d/openapi.yaml" "/pr/docs/api-contracts/$d/openapi.yaml" \
              --fail-on ERR || fail=1
          done
          exit $fail