# OpenAPI 破坏性变更门禁(契约先行加固)
# 仅在 PR 改动 docs/api-contracts/** 时触发;逐域用 oasdiff 比对 base 与 PR 的 OpenAPI,发现破坏性差异即失败。
# 注:独立于主 maven 构建,避免误配影响主门禁。**首次接入后需一次真实 CI 运行验证**(本地无法运行 GitHub Actions/oasdiff)。
name: OpenAPI Breaking Change Check

on:
  pull_request:
    branches: [ main ]
    paths:
      - 'docs/api-contracts/**'

jobs:
  openapi-diff:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: 检出 base 分支契约到 /tmp/base
        run: git worktree add /tmp/base "${{ github.event.pull_request.base.sha }}"
      - name: oasdiff 破坏性变更检测(逐业务域)
        run: |
          set -euo pipefail
          fail=0
          for d in account ai content events knowledge market meta; do
            base="/tmp/base/docs/api-contracts/$d/openapi.yaml"
            head="docs/api-contracts/$d/openapi.yaml"
            if [ ! -f "$base" ] || [ ! -f "$head" ]; then
              echo "跳过 $d(base 或 PR 缺该契约文件)"; continue
            fi
            echo "== oasdiff breaking: $d =="
            docker run --rm -v "$PWD:/pr" -v /tmp/base:/base tufin/oasdiff breaking \
              "/base/docs/api-contracts/$d/openapi.yaml" "/pr/docs/api-contracts/$d/openapi.yaml" \
              --fail-on ERR || fail=1
          done
          exit $fail