ci(postman): test this branch's API code, and unpin the contract workflow

[roncodes]

Two one-line problems, both of which meant this repository's contract check was not testing this repository.

1. It was running an old copy of the workflow

The call was pinned to fleetbase/fleetbase@dev-v0.7.53, a ref that predates every fix to the contract workflow — including the one where the collections were never actually executing (the step ran for 25ms, produced no output, and passed).

Now @main. The reusable workflow defaults fleetbase-ref to main and tests against fleetbase/fleetbase-api:latest, so releases are picked up automatically and there is no ref here to remember to bump. Each run records the resolved image digest in its job summary, so results stay traceable.

2. It was testing the published package, not this branch

This is the substantive one. With build-from-source: false the stack boots the published API image, and fleetbase/core-api is a composer dependency baked into that image. So a PR here booted the released version and ran the collections against it. Its own API changes were never exercised — the check was green on code that was not under review, which is worse than no check because it reads as coverage.

overlay-package (fleetbase/fleetbase#582) makes the reusable workflow check this repository out at the commit under test and swap it into the running container. It then dumps the autoloader — necessary, because the image is built with --optimize-autoloader and the frozen classmap would otherwise hide any class added or moved on the branch — clears caches, runs migrations, and re-checks health so a broken overlay fails loudly.

jobs:
  contract:
    uses: fleetbase/fleetbase/.github/workflows/api-contract.yml@main
    with:
      collections: "Fleetbase Core API"
      build-from-source: false
      overlay-package: fleetbase/core-api
    secrets: inherit

overlay-path is not needed here: this repository's root is the package root (composer.json declares fleetbase/core-api).

What to expect on the first run

This is the first time these collections will execute against this package's actual branch code, so treat failures as real signal rather than regression. Collection-side fixes landed separately in fleetbase/postman#11, which took the Fleetbase API collection from 85/180 to 129/180 requests returning 2xx.

The overlay has not been exercised end to end anywhere yet — it was verified structurally (vendor layout, package root, the 579-entry frozen classmap, composer availability in the container). This run is its first real test.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (05d63aa) to head (5087bb1).
⚠️ Report is 2 commits behind head on dev-v1.6.56.

Additional details and impacted files

@@               Coverage Diff               @@
##             dev-v1.6.56      #238   +/-   ##
===============================================
  Coverage         100.00%   100.00%           
  Complexity          6716      6716           
===============================================
  Files                396       396           
  Lines              22410     22410           
===============================================
  Hits               22410     22410           

Flag	Coverage Δ
backend	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.