docs(governance): concept + schema + guides + changelog (ADR-048 PR12) #59
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: OpenAPI Drift Check | |
| # Runs two guards via scripts/check-openapi-drift.mjs: | |
| # 1. Staff-surface leak — fails if /v1/admin/* appears in customer docs | |
| # (openapi.json path, or /v1/admin/ reference in any MDX/docs.json). | |
| # /v1/admin/* is permanently Mnemom-staff-only; customer org-admin | |
| # routes live under /v1/orgs/{org_id}/*. | |
| # 2. OpenAPI drift — fails if routes in mnemom-api (+ reputation, risk) | |
| # diverge from api-reference/openapi.json. Step 8 of the docs drift | |
| # audit (docs-audit/code-bugs.md + 04-generator-options.md). | |
| # | |
| # Triggers: | |
| # - pull_request to main (any docs change that could leak /v1/admin/ | |
| # into the customer surface, or any change that might add/remove a | |
| # customer route in openapi.json) | |
| # - schedule daily (catches drift introduced by mnemom-api changes | |
| # that didn't trigger a docs PR) | |
| # - workflow_dispatch (manual trigger) | |
| on: | |
| pull_request: | |
| branches: ["main"] | |
| paths: | |
| - "api-reference/**" | |
| - "docs.json" | |
| - "**/*.mdx" | |
| - "scripts/check-openapi-drift.mjs" | |
| - ".github/workflows/openapi-drift-check.yml" | |
| schedule: | |
| - cron: "30 6 * * *" # daily, 30 min after mintlify-ci | |
| workflow_dispatch: | |
| jobs: | |
| check-drift: | |
| name: Detect openapi.json vs mnemom-api route drift | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout docs | |
| uses: actions/checkout@v6 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "22.x" | |
| - name: Preflight — check PAT is configured | |
| id: preflight | |
| run: | | |
| if [ -z "${{ secrets.MNEMOM_API_READ_TOKEN }}" ]; then | |
| echo "::warning::MNEMOM_API_READ_TOKEN secret is not set. Drift check skipped." | |
| echo "Set a read-only PAT for mnemom/mnemom-api in repo secrets to enable this guard." | |
| echo "skip=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "skip=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Checkout mnemom-api (private) via read-only PAT | |
| if: steps.preflight.outputs.skip == 'false' | |
| uses: actions/checkout@v6 | |
| with: | |
| repository: mnemom/mnemom-api | |
| ref: main | |
| path: mnemom-api | |
| token: ${{ secrets.MNEMOM_API_READ_TOKEN }} | |
| - name: Checkout mnemom-reputation (private) via read-only PAT | |
| if: steps.preflight.outputs.skip == 'false' | |
| uses: actions/checkout@v6 | |
| with: | |
| repository: mnemom/mnemom-reputation | |
| ref: main | |
| path: mnemom-reputation | |
| token: ${{ secrets.MNEMOM_API_READ_TOKEN }} | |
| continue-on-error: true | |
| - name: Checkout mnemom-risk (private) via read-only PAT | |
| if: steps.preflight.outputs.skip == 'false' | |
| uses: actions/checkout@v6 | |
| with: | |
| repository: mnemom/mnemom-risk | |
| ref: main | |
| path: mnemom-risk | |
| token: ${{ secrets.MNEMOM_API_READ_TOKEN }} | |
| continue-on-error: true | |
| - name: Check for drift | |
| if: steps.preflight.outputs.skip == 'false' | |
| run: | | |
| # Include reputation + risk worker sources if they were checked out; | |
| # fall back to mnemom-api only if the optional checkouts failed. | |
| sources="mnemom-api/src/index.ts" | |
| [ -f mnemom-reputation/server/src/index.ts ] && sources="$sources mnemom-reputation/server/src/index.ts" | |
| [ -f mnemom-risk/server/src/index.ts ] && sources="$sources mnemom-risk/server/src/index.ts" | |
| node scripts/check-openapi-drift.mjs $sources |