[dependabot]

Bumps oasdiff/oasdiff-action from 0.1.12 to 0.1.14.

Release notes

Sourced from oasdiff/oasdiff-action's releases.

v0.1.14

Highlights

Upgraded to oasdiff v1.30.0

Every action now runs on oasdiff v1.30.0, the largest change to breaking-change detection since the checker was introduced. Severities are now derived from a single reviewed model of what each change does to the API contract, which corrected 36 checks and added 58 new ones, so the breaking and changelog actions may report differently on the same diff:

• Changes that now fail a breaking step: setting a bound (maxLength, minItems, multipleOf and friends) where none existed, removing a security requirement or adding a security scope, adding a branch or value to a response union.
• Changes that no longer fail: request parameter default changes, removing optional response properties and headers, dropping an allOf conjunct.
• New detection: OpenAPI 3.1 boolean schemas (items: false tuples), positional prefixItems comparison (reordering entries is now caught), OpenAPI 3.2 QUERY and custom methods, and constraint keywords that were previously unchecked (maxItems, maxProperties, minProperties, multipleOf, uniqueItems).

If a step starts failing on a change your team accepts, override that check's severity with severity-levels in .oasdiff.yaml in your repo; the full list of changed checks is in the oasdiff v1.30.0 release notes.

Full Changelog: oasdiff/oasdiff-action@v0.1.13...v0.1.14

v0.1.13

Highlights

Upgraded to oasdiff v1.29.1

All actions now run on oasdiff v1.29.1 (#194, #201).

include-checks is deprecated: use .oasdiff.yaml instead

oasdiff retired the optional-checks mechanism behind include-checks, so the input has been silently doing nothing. The actions no longer forward it to the CLI and instead emit a warning annotation explaining the replacement. Workflows that still pass the input keep working rather than failing on an unknown flag (#197).

To make a specific check fail the build, list it in a severity-levels file and point .oasdiff.yaml at it:

# .oasdiff.yaml
severity-levels: ./oasdiff-levels.txt
fail-on: ERR

# oasdiff-levels.txt
api-version-not-bumped    err

Anonymous delivery reporting for review comments

The breaking, changelog, and pr-comment actions now send oasdiff.com one anonymous event per run saying whether the review link was posted as a PR comment or fell back to the job summary, so the defaults can be improved. No repo, organization, or user identity is sent, failures never affect the run, and setting OASDIFF_INTERNAL=1 skips it entirely (#195).

Fixes

• A failed comparison no longer reads as a clean result. When oasdiff could not load or parse a spec, the breaking and diff actions failed the step but still wrote No breaking changes / No changes to the step output, job summary, and PR comment, and the validate action published findings=0 with all counts at zero for an unloadable spec. All three now stop as soon as the comparison fails, so anything reading the outputs, or running with continue-on-error, sees the failure instead of a clean report. Regression tests pin the behavior for each action (#199, thanks @​lucas-monteiro-g, who found this and opened #198 with a fix and a test fixture).

Full Changelog: oasdiff/oasdiff-action@v0.1.12...v0.1.13

Commits

• 54d7a75 bump: oasdiff v1.30.0 (#202)
• 2649ebe bump: oasdiff v1.29.1 (#201)
• 5ad1d21 Stop reporting a failed comparison as a clean result (#199)
• aac8c66 Stop pretending include-checks works, and point it at .oasdiff.yaml (#197)
• b803cbd report anonymously whether the review comment could be posted (#195)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #37.