spec-drift.yml

name: Spec drift

on:
  schedule:
    - cron: '17 6 * * *'
  workflow_dispatch:

jobs:
  drift:
    name: Regenerate schema and run smoke tests
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      issues: write
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 20
          cache: npm
      - run: npm ci
      - run: npm run regenerate

      # Everything below must run even when the build fails. A regeneration
      # that no longer compiles is exactly the signal worth surfacing, and
      # this step used to be fatal — so a breaking upstream change produced no
      # PR, no smoke run and no issue. It went unnoticed for months.
      - name: Build against the regenerated schema
        id: build
        continue-on-error: true
        run: npm run build

      - name: Run live smoke tests
        id: smoke
        if: steps.build.outcome == 'success'
        continue-on-error: true
        run: npm run test:live

      # The PR must not be opened with GITHUB_TOKEN. GitHub does not start
      # workflow runs from GITHUB_TOKEN-raised events, so a PR opened that way
      # never gets its required checks and can never be merged, however good
      # the diff is. Both drift PRs sat blocked for days on exactly that.
      #
      # workflow_dispatch is documented as an exception to the no-runs rule and
      # does start a run — but measured against a real PR, those check runs do
      # not satisfy branch protection even on the right SHA under the right
      # names. A push-event run does. So the push has to come from an identity
      # that is not GITHUB_TOKEN, and this app is that identity.
      - name: Mint an installation token for the drift bot
        id: app-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.DRIFT_APP_ID }}
          private-key: ${{ secrets.DRIFT_APP_PRIVATE_KEY }}

      - name: Open PR if schema changed
        uses: peter-evans/create-pull-request@v8
        with:
          token: ${{ steps.app-token.outputs.token }}
          # BOTH GENERATED FILES. `npm run regenerate` writes the schema and the
          # daily column list; committing only the schema meant the next field
          # upstream added would be typed and not exported, the CSV would silently
          # drop it again, and the Python SDK -- which derives its columns at
          # runtime -- would pick it up, so the two headers would diverge with
          # nothing red anywhere.
          add-paths: |
            src/_generated/schema.ts
            src/_generated/dailyColumns.ts
          branch: automated/spec-drift
          commit-message: 'chore: regenerate schema from upstream spec'
          title: 'chore: regenerate schema from upstream spec'
          body: |
            Automated schema regeneration from the `api.themeparks.wiki` OpenAPI spec.

            - build: ${{ steps.build.outcome }}
            - live smoke tests: ${{ steps.smoke.outcome || 'skipped (build failed)' }}

            A build failure here means the upstream contract changed in a way
            this client cannot absorb automatically. Do not merge until it is
            green.
          labels: automated, spec-drift

      - name: Open issue if the regenerated schema does not build
        if: steps.build.outcome == 'failure'
        uses: JasonEtco/create-an-issue@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          filename: .github/DRIFT_BUILD_FAILURE.md
          update_existing: true

      - name: Open issue if smoke tests failed
        if: steps.smoke.outcome == 'failure'
        uses: JasonEtco/create-an-issue@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          filename: .github/SMOKE_FAILURE.md
          update_existing: true

      # The job itself must go red when the build did, or a silent failure is
      # just a green tick with a stale PR behind it.
      - name: Fail the run if the regenerated schema does not build
        if: steps.build.outcome == 'failure'
        run: |
          echo "::error::Regenerated schema does not build — upstream contract changed."
          exit 1