chore: regenerate catalog from OpenAPI spec

[github-actions]

Automated catalog update from the Kosli OpenAPI spec.

Please review the diff to verify the changes look correct before merging.

[claude]

Claude finished @github-actions[bot]'s task in 3m 17s —— View job

---

Catalog diff review

Verdict: safe to merge on the "no capability loss" axis — no actions added, none removed. All 335/39 changed lines are schema refinements inside 21 existing actions. But several are constraint tightenings that narrow what previously-valid payloads the API will accept, so they're worth a conscious look before merging.

---

1. Actions added

None. Action count is 118 → 118, and the diff contains zero changed "id": lines.

2. Actions removed

None. Because the count held steady at 118 and no "id" line appears on either side of the diff, this is not the #16 stale-branch-clobber case, nor the #18 retired-endpoint case. No per-removal confirmation against the live spec is needed for this PR.

3. Actions changed (21)

a. New conditional validation on attestation bodies — added to all 10 attestation endpoints (post_custom_attestation, post_generic_attestation, post_jira_attestation, post_junit_attestation, post_override_attestation, post_pull_request_attestation, post_snyk_attestation, post_sonar_attestation, post_system_attestation):

{"if": {"properties":{"target_artifacts":{"minItems":1}},
        "required":["target_artifacts","artifact_fingerprint"]},
 "then": {"properties":{"target_artifacts":{"maxItems":1}}}},
{"if": {"not":{"required":["artifact_fingerprint"]},
        "properties":{"target_artifacts":{"minItems":1}},
        "required":["target_artifacts"]},
 "then": {"required":["git_commit_info"]}}

Net effect the LLM must now satisfy: with artifact_fingerprint set you may pass at most one target_artifacts entry; without it, a non-empty target_artifacts requires git_commit_info. Note post_override_attestation places this allOf at the top-level schema rather than under data_json, matching that endpoint's flatter body shape — consistent with the spec, not a generator bug.

b. annotations key pattern narrowed — hyphens no longer permitted. In all 9 data_json-shaped attestation actions:
^[A-Za-z0-9_-]+$ → ^[A-Za-z0-9_]+$

And in create_artifact, annotations went from a free-form {"additionalProperties":true,"type":"object"} to the same ^[A-Za-z0-9_]+$ pattern. This is the most user-visible tightening in the PR: an annotation key like build-id was valid before and is not now. Confirm this is a deliberate upstream change rather than a spec typo — the two patterns differ by one character and a - inside a character class is easy to drop by accident.

c. create_artifact gained a top-level allOf: requires one of git_commit / git_commit_info, and forbids template when both trail_name and template_reference_name are given. Also filename gained "minLength": 1.

d. post_pull_request_attestation — pull_requests restructured. Was array<V1 | V2>; is now array<V1> | array<V2>. Semantically this means V1 and V2 pull-request shapes can no longer be mixed within a single list. Pure refactor at the JSON-Schema level, real narrowing at the API level.

e. Notification/action targets (create_or_update_env_action, create_or_update_flow_action, put_environment_notifications, update_environment_notification) — the catch-all {"additionalProperties":true,"type":"object"} branch was dropped from the targets anyOf and replaced by an explicit, documented NestedConfigActionTarget (type + config, additionalProperties: false). This is a net improvement for the LLM — the untyped escape hatch gave execute_write_action no guidance; the typed branch does. webhook also gained "pattern": "^https://" in the SLACK and WEBHOOK branches.

f. New name/identifier patterns:

Action	Field	New pattern
create_flow_with_template	data_json.name	^[a-zA-Z0-9][a-zA-Z0-9\.\-_~]*$
create_trail	data_json.name	^[a-zA-Z0-9][a-zA-Z0-9\-_.~]*$
rename_environment	new_name	^[a-zA-Z0-9][a-zA-Z0-9\.\-_]*$
rename_flow	new_name	^[a-zA-Z0-9][a-zA-Z0-9\.\-_~]*$
post_control	identifier	^[a-zA-Z0-9\-._~]+$
k8s_report	owner uid	UUID pattern

Env names disallow ~ while flow names allow it — an upstream asymmetry, not a generator artifact, but a reviewer should sanity-check that it's intended.

g. deprecated flags: no new deprecated: true fields. The existing include_scaling deprecation notice on create_env and update_env was reworded — "can be turned off but no longer turned on" → "are no longer recorded, so this field is ignored", which is a stronger statement than before.

h. Misc: post_junit_attestation → junit_results gained "minItems": 1 (empty result arrays now rejected).

4. Dangling references

None. Nothing was removed or renamed, so there is nothing to dangle. Verified anyway:

• src/hints.json keys put_policy and create_flow_with_template — both still present (src/catalog.json:8648, src/catalog.json:880). ✅
• No other file changed in this PR (git diff --name-only → src/catalog.json alone).

One pre-existing observation, unrelated to this PR: test/fixtures/catalog-subset.json contains ids that don't exist in the real catalog — list_environments, list_flows, search_artifacts_by_sha (the real ones are list_envs, get_flows, get_artifact_by_commit_sha). Harmless for searchActions unit tests, which only need well-formed entries, but it means the fixture isn't actually a slice of the catalog any more. Not a blocker here. Fix this →

5. Sanity checks

Check	Result
Action count	118 → 118 — no suspicious drop ✅
Surviving $ref	0 occurrences in src/catalog.json — all refs inlined ✅
searchText present	118/118 actions ✅
Duplicate ids	none ✅
Files touched	src/catalog.json only ✅

---

What to check before merging

1. The annotations hyphen removal (3b) is the one change that can silently break working user payloads. Worth a quick confirm against https://app.kosli.com/api/v2/openapi.json that ^[A-Za-z0-9_]+$ is intentional.
2. pull_requests no longer accepts mixed V1/V2 entries (3d) — confirm that's an intended API restriction.

Everything else is additive documentation or a tightening that makes the catalog more useful to the LLM.

---

Not done: I could not run npm ci / npm test / npm run build — those commands weren't in this run's allowed tools, so the build and test suite were not executed locally. CI on this PR covers build + test + .mcpb smoke test; rely on that. I also did not re-fetch the live OpenAPI spec to verify the two changes flagged above — that check is still open.

Task list

• Read the catalog diff
• Enumerate actions added / removed / changed
• Grep for dangling references (src/, test/, README.md)
• Sanity checks (action count, surviving $ref)
• Post summary

· branch [`chore/update-catalog`](https://github.com/kosli-dev/mcp-server/tree/chore/update-catalog)