From 808a05c8187b174c89b7b956d8869421ad1d7792 Mon Sep 17 00:00:00 2001 From: Tiankai Ma Date: Wed, 23 Sep 2026 19:10:15 +0800 Subject: [PATCH 1/2] fix(openapi): avoid provenance-only consumer sync PRs --- .github/workflows/openapi-sync.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/openapi-sync.yml b/.github/workflows/openapi-sync.yml index 3cdb7d4..d7ddb30 100644 --- a/.github/workflows/openapi-sync.yml +++ b/.github/workflows/openapi-sync.yml @@ -70,8 +70,15 @@ jobs: - name: Sync contract and generated client run: | - make sync-openapi OPENAPI_SERVER_DIR=.openapi-server SERVER_COMMIT=${{ steps.server.outputs.sha }} - make check-openapi-sync OPENAPI_SERVER_DIR=.openapi-server + test "$(git -C .openapi-server rev-parse HEAD)" = "${{ steps.server.outputs.sha }}" + if ./scripts/openapi-contract verify >/dev/null 2>&1 \ + && ./scripts/openapi-contract verify-reachable .openapi-server >/dev/null 2>&1 \ + && cmp -s .openapi-server/public/openapi.generated.json api/openapi.json; then + echo "Server contract is unchanged; preserving the existing provenance pin." >> "$GITHUB_STEP_SUMMARY" + else + make sync-openapi OPENAPI_SERVER_DIR=.openapi-server SERVER_COMMIT=${{ steps.server.outputs.sha }} + make check-openapi-sync OPENAPI_SERVER_DIR=.openapi-server + fi make generate - name: Build, test, and vet From c9e191bd5a16932cf2635e255717f0c8bf2045d0 Mon Sep 17 00:00:00 2001 From: Tiankai Ma Date: Wed, 23 Sep 2026 21:18:39 +0800 Subject: [PATCH 2/2] ci(openapi): drop immediate dispatch trigger --- .github/workflows/openapi-sync.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/workflows/openapi-sync.yml b/.github/workflows/openapi-sync.yml index d7ddb30..f508b83 100644 --- a/.github/workflows/openapi-sync.yml +++ b/.github/workflows/openapi-sync.yml @@ -9,8 +9,6 @@ on: description: Exact Life-USTC/server commit SHA (defaults to current main) required: false type: string - repository_dispatch: - types: [openapi-updated] permissions: contents: write @@ -29,10 +27,9 @@ jobs: - name: Resolve immutable server commit id: server env: - DISPATCH_SHA: ${{ github.event.client_payload.server_sha }} INPUT_SHA: ${{ inputs.server_sha }} run: | - explicit="${INPUT_SHA:-${DISPATCH_SHA:-}}" + explicit="${INPUT_SHA:-}" if [[ -n "$explicit" ]]; then if [[ ! "$explicit" =~ ^[0-9a-f]{40}$ ]]; then echo "Explicit server_sha must be an exact 40-character lowercase commit SHA" >&2