v0.1.11

Every action now runs on oasdiff v1.27.0, which adds a versioning policy and more validate checks.

Action behaviour change: include-checks no longer elevates a check

If your workflow uses the include-checks input to make an optional check fail the build, that step will stop failing on this release. oasdiff v1.27.0 retires the optional-checks mechanism: every check now runs, and severity is the only lever. --include-checks is accepted, prints a deprecation notice, and is otherwise ignored, so a check you elevated with it now reports at its default severity instead of as an error.

To keep the gate, set the severity explicitly. Put a .oasdiff.yaml at the root of the repo the action runs in:

# .oasdiff.yaml
severity-levels: .oasdiff-levels.txt

# .oasdiff-levels.txt
response-non-success-status-removed    err

and drop the include-checks input from the workflow. The same file is how you disable a check (none) or downgrade one (warn, info).

Highlights

New: catch a breaking change that shipped without a major version bump

If you version your API with semantic versioning, a breaking change is supposed to come with a major version bump. oasdiff now compares info.version on each side against the changes it found and reports a breaking change that did not get one. Three findings, one per way it can go wrong:

Check id	Reported when a breaking change was detected and
api-version-not-bumped	the version is unchanged
api-version-decreased	the version moved backwards, e.g. 2.0.0 to 1.0.0
api-major-version-not-bumped	the version moved, but not the major, e.g. 1.0.0 to 1.1.0

They are informational by default, so no workflow starts failing on upgrade. To enforce the policy, add the ids to the severity-levels file described above:

# .oasdiff-levels.txt
api-version-not-bumped          err
api-version-decreased           err
api-major-version-not-bumped    err

and fail the step on errors:

- uses: oasdiff/oasdiff-action/breaking@v0.1.11
  with:
    base: main:openapi.yaml
    revision: openapi.yaml
    fail-on: ERR

Nothing is reported unless a breaking change is present and both versions parse as semver, so specs versioned by date, by a bare v1, or not versioned at all are left alone. Below 1.0.0 a minor bump is enough, since semver gives the minor the major's role there. See VERSIONING.md.

This closes a request from @rethab in #154, which asked for a way to fail a workflow when a breaking change lands without a version bump. That no longer needs continue-on-error and a second step comparing versions: it is a finding like any other.

New validate checks

The validate action reports two new classes of problem:

• Constraints that nothing can satisfy, for example a minimum above the maximum, and the same for minLength/maxLength, minItems/maxItems, minProperties/maxProperties and minContains/maxContains.
• A format that belongs to a different type, for example format: date-time on an integer, which is silently ignored at runtime.

Other changes in oasdiff v1.27.0

• request-body-enum-value-removed is now an error rather than informational. Removing an enum value from a request body rejects payloads that were valid before. If your step fails on errors, this can newly fail a run; set the id to warn or info in the severity-levels file to keep the previous behaviour.
• oasdiff checks now names its rule set. If you run it in a workflow, use oasdiff checks changelog (or checks validate); the bare command now prints the available listings.

For the full list, see the oasdiff v1.27.0 release notes.

Full Changelog: v0.1.10...v0.1.11

v0.1.10

Security release. Every action now runs on oasdiff v1.26.1.

Highlights

Security fix: git revision parsed as a git option (GHSA-m3wq-w7x2-4q6m)

All six actions (breaking, changelog, diff, pr-comment, validate, verify) move their base image from tufin/oasdiff:v1.26.0 to tufin/oasdiff:v1.26.1, which fixes an option-injection issue on the git-revision load path.

oasdiff passed git revisions to git as operands with no end-of-options separator, so a revision beginning with - was parsed by git as an option rather than a revision. git show --output=<path> writes git's output to a chosen path (an arbitrary file overwrite running as the invoking user), and git fetch --upload-pack=<program> makes git execute a program.

oasdiff v1.26.1 fixes this in two layers: every git invocation now passes --end-of-options, and a revision beginning with - is rejected before git is invoked.

Who should upgrade: anyone pinned to an exact action version. If you pin @v0, you already have this, since v0 now points at this release.

Workflow authors: if you interpolate untrusted input into the base: or revision: inputs, upgrade. Workflows that pass literal refs or file paths were not affected.

Full Changelog: v0.1.9...v0.1.10

v0.1.9

What's Changed

Updates the bundled oasdiff to v1.26.0, which adds breaking-change and changelog detection for response header schema changes: type, format, and nullability. A response header going from string/date-time to integer, for example, is now reported where it was previously silent.

See the oasdiff v1.26.0 release notes for the full list.

Note: specs with response-header type, format, or nullability changes may surface new findings on your PRs, including new breaking-change errors. Adjust per-check with .oasdiff.yaml severity settings if needed.

• bump: oasdiff v1.26.0 by @reuvenharrison in #191

Full Changelog: v0.1.8...v0.1.9

v0.1.8

Upgraded to oasdiff v1.25.1

The action now runs oasdiff v1.25.1. Most notably, a required request property with a default value is now reported as a breaking change (error) rather than informational, because a request that omits a required property is invalid under the new contract whether or not the property has a default. See the oasdiff v1.25.1 release notes.

Full Changelog: v0.1.7...v0.1.8

v0.1.7

Highlights

Upgraded to oasdiff v1.24.0

Every action (breaking, changelog, diff, pr-comment, validate) now runs on oasdiff v1.24.0: the side-by-side review groups each change under the source block that produced it and scales to any spec size, validate adds the ambiguous-parameter-serialization and duplicate-enum-value checks, and an API split across several microservice specs can now be reviewed as one.

No workflow changes are required: existing steps pick up the newer engine automatically on your next run.

Full Changelog: v0.1.6...v0.1.7

v0.1.6

Highlights

Upgraded to oasdiff v1.23.0

Every action (breaking, changelog, diff, pr-comment, validate) now runs on oasdiff v1.23.0: nullability changes are recognized in all three equivalent forms (the nullable keyword, the 3.1 type array, and the null oneOf wrapping) and reported as a single, correctly-leveled finding, for bodies, properties, and parameters, in both directions. Wrapping a $ref'd schema in oneOf: [{type: "null"}, ...] no longer produces false breaking errors. See the nullability guide.

No workflow changes are required: existing steps pick up the newer engine automatically on your next run.

Full Changelog: v0.1.5...v0.1.6

v0.1.5

Runs on oasdiff v1.22.0

Every action now runs on oasdiff v1.22.0: precise source locations for every reported change (security, stability, sunset, x-extensible-enum), the new oasdiff schema command, and a fix for OpenAPI 3.1 multi-type arrays under --flatten-allof.

Changes

• Upgraded to oasdiff v1.22.0 (#186).
• Docs: clarify what changelog, breaking, and diff each cover, and link the diff action to its section (#184, #185).

Pin the action at @v0 to pick up this and future releases automatically.

v0.1.4

What's Changed

This release updates the GitHub Action to oasdiff v1.21.0. See the oasdiff v1.21.0 release notes for the detection and output improvements it brings: response type widening vs narrowing, a crash fix for schema-less media types, more response-side checks, and clearer change messages.

Full Changelog: v0.1.3...v0.1.4

v0.1.3

Highlights

Pro review mode in the changelog action

Given an oasdiff-token, the changelog action now posts an encrypted Pro review on your pull requests. The specs are encrypted client-side in CI and only ciphertext is uploaded, so oasdiff cannot read them; the decryption key lives only in the review link's URL fragment. The action posts a PR comment linking to a side-by-side review where your team approves or rejects each change, and the oasdiff commit status gates merge until every breaking change is approved.

- uses: oasdiff/oasdiff-action/changelog@v0.1.3
  with:
    base: main:openapi.yaml
    revision: openapi.yaml
    oasdiff-token: ${{ secrets.OASDIFF_TOKEN }}
    github-token: ${{ github.token }}

(needs permissions: pull-requests: write and statuses: write)

Upgraded to oasdiff v1.20.0

The action images now run oasdiff v1.20.0.

Fixes

• Graceful message when a trial or subscription expires. When a plan lapses, the pr-comment and Pro changelog actions now surface a clear "your plan has expired, renew here" message and keep the workflow green, instead of failing with an opaque HTTP 402 error.

Full Changelog: v0.1.2...v0.1.3

v0.1.2

Highlights

The PR comment now posts by default

The breaking and changelog actions now default github-token to ${{ github.token }}, so the review/changelog comment posts to the PR automatically on any repo whose job GITHUB_TOKEN already has write access, with no workflow edit (#167). Previously most repos only ever saw the review link in the job summary, which almost nobody opens. If your org forces a read-only default token you still need to add permissions: pull-requests: write, and fork PRs are unchanged (read-only token). The comment copy is also clearer about the capability-by-URL model and how specs stay encrypted in CI, plus an explicit opt-out: set review: false to stop posting.

New @v0 moving major tag

A v0 tag is now published and re-pointed on every stable release, so you can pin to @v0 and pick up later patches and minors (like the comment improvements above) automatically, with no workflow change (#168).

- uses: oasdiff/oasdiff-action/breaking@v0

A new Versioning section in the README covers @v0 (recommended), exact pins like @v0.1.1 (reproducible CI), and @main (unreleased tip). README examples now use @v0.

Upgraded to oasdiff v1.19.1

Every action now runs on oasdiff v1.19.1.

Full Changelog: v0.1.1...v0.1.2