v0.1.11

Every action now runs on oasdiff v1.27.0, which adds a versioning policy and more validate checks.

Action behaviour change: include-checks no longer elevates a check

If your workflow uses the include-checks input to make an optional check fail the build, that step will stop failing on this release. oasdiff v1.27.0 retires the optional-checks mechanism: every check now runs, and severity is the only lever. --include-checks is accepted, prints a deprecation notice, and is otherwise ignored, so a check you elevated with it now reports at its default severity instead of as an error.

To keep the gate, set the severity explicitly. Put a .oasdiff.yaml at the root of the repo the action runs in:

# .oasdiff.yaml
severity-levels: .oasdiff-levels.txt

# .oasdiff-levels.txt
response-non-success-status-removed    err

and drop the include-checks input from the workflow. The same file is how you disable a check (none) or downgrade one (warn, info).

Highlights

New: catch a breaking change that shipped without a major version bump

If you version your API with semantic versioning, a breaking change is supposed to come with a major version bump. oasdiff now compares info.version on each side against the changes it found and reports a breaking change that did not get one. Three findings, one per way it can go wrong:

Check id	Reported when a breaking change was detected and
api-version-not-bumped	the version is unchanged
api-version-decreased	the version moved backwards, e.g. 2.0.0 to 1.0.0
api-major-version-not-bumped	the version moved, but not the major, e.g. 1.0.0 to 1.1.0

They are informational by default, so no workflow starts failing on upgrade. To enforce the policy, add the ids to the severity-levels file described above:

# .oasdiff-levels.txt
api-version-not-bumped          err
api-version-decreased           err
api-major-version-not-bumped    err

and fail the step on errors:

- uses: oasdiff/oasdiff-action/breaking@v0.1.11
  with:
    base: main:openapi.yaml
    revision: openapi.yaml
    fail-on: ERR

Nothing is reported unless a breaking change is present and both versions parse as semver, so specs versioned by date, by a bare v1, or not versioned at all are left alone. Below 1.0.0 a minor bump is enough, since semver gives the minor the major's role there. See VERSIONING.md.

This closes a request from @rethab in #154, which asked for a way to fail a workflow when a breaking change lands without a version bump. That no longer needs continue-on-error and a second step comparing versions: it is a finding like any other.

New validate checks

The validate action reports two new classes of problem:

• Constraints that nothing can satisfy, for example a minimum above the maximum, and the same for minLength/maxLength, minItems/maxItems, minProperties/maxProperties and minContains/maxContains.
• A format that belongs to a different type, for example format: date-time on an integer, which is silently ignored at runtime.

Other changes in oasdiff v1.27.0

• request-body-enum-value-removed is now an error rather than informational. Removing an enum value from a request body rejects payloads that were valid before. If your step fails on errors, this can newly fail a run; set the id to warn or info in the severity-levels file to keep the previous behaviour.
• oasdiff checks now names its rule set. If you run it in a workflow, use oasdiff checks changelog (or checks validate); the bare command now prints the available listings.

For the full list, see the oasdiff v1.27.0 release notes.

Full Changelog: v0.1.10...v0.1.11