cowork-bot: automated improvements (cowork/improve-api-contract-guardian)#56
Merged
Merged
Conversation
…-wide defect fix)
… diff engine The diff engine only compared the global `security` requirement, so a spec that dropped auth from a single endpoint (making it public), newly required auth, or switched security schemes on one operation produced NO change — the gate reported green while a real security-relevant contract change shipped. Add _diff_operation_security(): compares each shared operation's own `security` (which overrides global), normalizing requirement/scope ordering to a set of scheme-name groups so only genuine changes surface. Transitions are classified DANGEROUS, mirroring the existing global-security treatment: operation_security_added / _removed / _changed, with human-readable descriptions (e.g. 'DELETE /admin no longer requires authentication'). +8 targeted tests (172->173 suite total, all green); README + CHANGELOG updated.
Previously the diff engine only compared content-type presence within requestBody/responses; inline schemas sharing a content type were never compared, so a response dropping a field or a request adding a required field passed silently (green while broken). Add _diff_media_type_schema / _diff_inline_schema with direction-aware breaking semantics (request: new required field breaks; response: dropped/no-longer-guaranteed field breaks; type changes break both). $ref targets are only flagged when the ref itself changes, deferring component detail to _diff_schemas to avoid double-reporting. Adds 13 regression tests.
Previously _diff_inline_schema only compared top-level properties, so a breaking change buried one level down (e.g. a required field added deep in a request body, or a field dropped from a nested response object / array-of-object items) was reported as 'no change' -- the silent-green failure class this tool exists to catch. Now recurse into nested object properties and array-of-object item schemas with the same request/response-aware breaking semantics, guarded by a depth limit and skipping nested $ref targets (component-level diffing owns those). +4 regression tests (nested response field removal, nested required request field, array-item field removal, and a no-false-positive guard); 188 tests pass, ruff clean.
api-contract-guardian is NOT on public PyPI. The badge 404s and 'pip install api-contract-guardian' fails. Replace with a note directing users to the git+ install method.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
🤖 Automated Code Review✅ Ruff Lint — No issues
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated improvement PR from the Cowork repo-improver rotation. Changes: detect operation-level (per-endpoint) security changes in diff engine, diff inline request/response schemas within media types, add actions/checkout step to cowork-auto-pr.yml.