[dependabot]

Bumps oasdiff/oasdiff-action from 0.1.12 to 0.1.20.

Release notes

Sourced from oasdiff/oasdiff-action's releases.

v0.1.20

A security release. Every action that uploads a review is affected in its default configuration, so upgrade.

If you pin @v0, as the README recommends, you already have this: the v0 tag now points here, so your next run picks it up with no change on your side. If you pin an exact version, move it to v0.1.20.

Changes

• Base image bumped to oasdiff v1.34.1, which enforces the external-refs policy in the reader that --open installs (#209). Every action that uploads a review runs oasdiff with --open, so without the fix the allow-external-refs input had no effect on that path: a spec arriving in a pull request could read a file from the runner or reach an arbitrary URL, and the content went into the uploaded review. The input itself was already correct and already defaulted to false; only the enforcement one layer down was missing. Affects breaking, changelog and pr-comment. Reported by Zachariah Mithani (AploSec). See GHSA-6h8r-wgc5-q3xv.

v0.1.19

oasdiff v1.34.0: security checks and one finding per shared-schema change

Every action now runs oasdiff v1.34.0.

• Security changes are judged by who can call the endpoint. Securing an operation that had no security requirement, directly or through a top-level security it inherits, now fails breaking. Replacing or narrowing the top-level security list is reported on each operation that inherits it, at the operation's levels, instead of once at info. Changing how a security scheme sends credentials (its type, an API key's name or location, the HTTP scheme, the OpenID Connect URL) is breaking too.
• A change in a shared schema is reported once per check, naming the schema, listing the first three properties it applies to and counting all of them, so large specs produce far fewer annotations.
• More accurate verdicts for removing a whole enum, date or time to date-time, and readOnly / writeOnly flips, and faster comparisons of large specs.

When you upgrade, expect some findings to change once: shared-schema findings carry the schema detail in their text, and top-level security findings move to the operations that inherit the list. Review decisions or err-ignore lines tied to the old findings may need updating.

No changes to the actions themselves. oasdiff/oasdiff-action/*@v0 now points at this release.

v0.1.18

oasdiff v1.33.0: recursive schemas, fast and deterministic

Every action now runs oasdiff v1.33.0, which reworks how recursive schemas are compared. A workflow on a spec whose schemas reference each other in cycles no longer runs until the job times out, with or without flatten-allof, and the structured diff of such a spec is the same on every run.

Two consequences when you upgrade: a change inside a recursive schema is now reported once per entry into the cycle rather than once for every path through it, so those comparisons produce far fewer annotations; and the circularRef field is gone again from diff json/yaml output, where cyclic mismatches now appear as ordinary field-level diffs.

No changes to the actions themselves. oasdiff/oasdiff-action/*@v0 now points at this release.

v0.1.17

oasdiff v1.32.1: fixes the hang on cyclic schemas

Every action now runs oasdiff v1.32.1, which fixes the v1.32.0 hang on specs whose schemas reference each other in cycles (oasdiff #1252). A workflow on such a spec no longer runs until the job times out. Recursive schemas are handled as in v1.31.0 again, so the circularRef field of diff json/yaml output is back and the non-determinism of oasdiff #1230 is back until the next release; everything else from v1.32.0 is kept.

No changes to the actions themselves. oasdiff/oasdiff-action/*@v0 now points at this release.

v0.1.16

What's Changed

• ci: lint every shell surface with shellcheck and actionlint by @​reuvenharrison in oasdiff/oasdiff-action#204
• bump: oasdiff v1.32.0 by @​reuvenharrison in oasdiff/oasdiff-action#205

Full Changelog: oasdiff/oasdiff-action@v0.1.15...v0.1.16

v0.1.15

Highlights

Upgraded to oasdiff v1.31.0

... (truncated)

Commits

• 9ce3a29 Merge pull request #209 from oasdiff/bump/oasdiff-v1.34.1
• 8689364 bump: oasdiff v1.34.1
• 514e22e Merge pull request #208 from oasdiff/bump/oasdiff-v1.34.0
• d3eb1b4 test: expect per-operation anonymous-access findings from oasdiff v1.34.0
• a1b1c28 bump: oasdiff v1.34.0
• b9325c9 Merge pull request #207 from oasdiff/bump/oasdiff-v1.33.0
• d68100f bump: oasdiff v1.33.0
• 5e81b5c Merge pull request #206 from oasdiff/bump/oasdiff-v1.32.1
• a39a6df bump: oasdiff v1.32.1
• 95200b7 bump: oasdiff v1.32.0 (#205)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 29c6a8f4-f4c6-40f3-9e51-cd0d27797685

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}