From 5a7bb3f8b17bf5ee114a5ae6047a6d4ff360f5d5 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Fri, 11 Sep 2026 21:44:45 -0500 Subject: [PATCH 1/4] test(DEN-3828): certify explicit alias cardinality peers --- .github/workflows/api-docs-peer-authorities.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/api-docs-peer-authorities.yml b/.github/workflows/api-docs-peer-authorities.yml index 116c82f..457ba9d 100644 --- a/.github/workflows/api-docs-peer-authorities.yml +++ b/.github/workflows/api-docs-peer-authorities.yml @@ -38,7 +38,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: ORESoftware/api-docs - ref: f6bc8771365ee79cf72d53d640ea5c296b0e2dd1 + ref: af09dc3b14d2ff1f8cd8f0d9acb7803fddaca048 path: subject persist-credentials: false show-progress: false @@ -48,7 +48,7 @@ jobs: shell: bash run: | set -euo pipefail - test "$(git -C subject rev-parse HEAD)" = "f6bc8771365ee79cf72d53d640ea5c296b0e2dd1" + test "$(git -C subject rev-parse HEAD)" = "af09dc3b14d2ff1f8cd8f0d9acb7803fddaca048" - name: Check out canonical TJSV uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 From 4a4cd06baa4affe36b1df4c044452f52368c63f3 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Fri, 11 Sep 2026 21:45:23 -0500 Subject: [PATCH 2/4] test(DEN-3828): prove TypeSpec alias cardinality survives transpilation --- .github/workflows/api-docs-cardinality.yml | 116 +++++++++++++++++++++ 1 file changed, 116 insertions(+) create mode 100644 .github/workflows/api-docs-cardinality.yml diff --git a/.github/workflows/api-docs-cardinality.yml b/.github/workflows/api-docs-cardinality.yml new file mode 100644 index 0000000..18fe390 --- /dev/null +++ b/.github/workflows/api-docs-cardinality.yml @@ -0,0 +1,116 @@ +name: api-docs discovery cardinality canary + +on: + pull_request: + paths: + - ".github/workflows/api-docs-cardinality.yml" + - ".github/workflows/api-docs-peer-authorities.yml" + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: api-docs-cardinality-${{ github.ref }} + cancel-in-progress: true + +env: + API_DOCS_SHA: af09dc3b14d2ff1f8cd8f0d9acb7803fddaca048 + TJSV_SHA: 93dd73cb246a09b0a1c62d7192cc62ca6ecbe405 + +jobs: + cardinality: + runs-on: ubuntu-24.04 + timeout-minutes: 20 + steps: + - name: Check out exact canary head + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ github.event.pull_request.head.sha || github.sha }} + persist-credentials: false + fetch-depth: 1 + + - name: Check out exact API Docs candidate + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: ORESoftware/api-docs + ref: ${{ env.API_DOCS_SHA }} + path: subject + persist-credentials: false + fetch-depth: 1 + + - name: Check out canonical TJSV + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: ORESoftware/typespec-json-schema-validator + ref: ${{ env.TJSV_SHA }} + path: tjsv + persist-credentials: false + fetch-depth: 1 + + - name: Verify immutable source identities + shell: bash + run: | + set -euo pipefail + test "$(git -C subject rev-parse HEAD)" = "$API_DOCS_SHA" + test "$(git -C tjsv rev-parse HEAD)" = "$TJSV_SHA" + grep -F '@minItems(4)' subject/idl/typespec/docs-discovery.tsp + grep -F '@maxItems(4)' subject/idl/typespec/docs-discovery.tsp + jq -e '."$defs".DocsDiscoveryManifest.properties.aliases.minItems == 4 and ."$defs".DocsDiscoveryManifest.properties.aliases.maxItems == 4' \ + subject/json-schema/docs-discovery.schema.json + + - name: Install Node 22.23.1 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: "22.23.1" + package-manager-cache: false + + - name: Install immutable TJSV compiler and emitter + working-directory: tjsv + shell: bash + run: | + set -euo pipefail + npm ci --ignore-scripts --no-audit --no-fund + npm rebuild @oresoftware/f2e --foreground-scripts + node bin/typespec-json-schema-validator.mjs doctor --quiet + + - name: Compile TypeSpec and compare against independently authored JSON Schema + shell: bash + run: | + set -euo pipefail + out="$RUNNER_TEMP/docs-discovery-cardinality" + mkdir -p "$out/generated" + node tjsv/bin/typespec-json-schema-validator.mjs check \ + --typespec=subject/idl/typespec/docs-discovery.tsp \ + --schema=subject/json-schema/docs-discovery.schema.json \ + --report="$out/report.json" \ + --contract-ir="$out/contract-ir.json" \ + --output-dir="$out/generated" \ + --bundle-id=docs-discovery.typespec.generated.schema.json \ + --max-findings=100 \ + --max-probes=96 \ + --quiet + + generated="$out/generated/docs-discovery.typespec.generated.schema.json" + test -s "$generated" + jq -e '."$defs".DocsDiscoveryManifest.properties.aliases.minItems == 4 and ."$defs".DocsDiscoveryManifest.properties.aliases.maxItems == 4' "$generated" + jq -e ' + .status == "passed" and + .zeroUnexplainedFindings == true and + .authorities.precedence == "none" and + .authorities.typespec.authority == "independently-authored" and + .authorities.jsonSchema.authority == "independently-authored" and + .authorities.typespec.generatedJsonSchemaRole == "comparison-evidence-only" and + .coverage.typespecGeneratedJsonSchemaComparison == true and + .coverage.differentialInstanceValidation == true and + .differential.summary.probesEvaluated > 0 and + .differential.summary.divergences == 0 + ' "$out/report.json" + jq -e '.status == "passed" and .admissible == true and .editableAuthority == false' "$out/contract-ir.json" + + - name: Prove candidate sources stayed read-only + shell: bash + run: | + set -euo pipefail + git -C subject diff --exit-code -- . + git -C tjsv diff --exit-code -- . From f6223fb62451bff60d29f0c607f808242efacb5e Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Fri, 11 Sep 2026 21:49:06 -0500 Subject: [PATCH 3/4] test(DEN-3828): repin emitted cardinality bridge --- .github/workflows/api-docs-cardinality.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/api-docs-cardinality.yml b/.github/workflows/api-docs-cardinality.yml index 18fe390..2b10f6c 100644 --- a/.github/workflows/api-docs-cardinality.yml +++ b/.github/workflows/api-docs-cardinality.yml @@ -15,7 +15,7 @@ concurrency: cancel-in-progress: true env: - API_DOCS_SHA: af09dc3b14d2ff1f8cd8f0d9acb7803fddaca048 + API_DOCS_SHA: f6efa12a3ce5a01713464df6168082c289d85716 TJSV_SHA: 93dd73cb246a09b0a1c62d7192cc62ca6ecbe405 jobs: @@ -54,8 +54,8 @@ jobs: set -euo pipefail test "$(git -C subject rev-parse HEAD)" = "$API_DOCS_SHA" test "$(git -C tjsv rev-parse HEAD)" = "$TJSV_SHA" - grep -F '@minItems(4)' subject/idl/typespec/docs-discovery.tsp - grep -F '@maxItems(4)' subject/idl/typespec/docs-discovery.tsp + grep -F '@TypeSpec.JsonSchema.extension("minItems", 4)' subject/idl/typespec/docs-discovery.tsp + grep -F '@TypeSpec.JsonSchema.extension("maxItems", 4)' subject/idl/typespec/docs-discovery.tsp jq -e '."$defs".DocsDiscoveryManifest.properties.aliases.minItems == 4 and ."$defs".DocsDiscoveryManifest.properties.aliases.maxItems == 4' \ subject/json-schema/docs-discovery.schema.json From e4c72bd421f63dc6a8decb4062948fab38c7ddc1 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Fri, 11 Sep 2026 21:49:25 -0500 Subject: [PATCH 4/4] test(DEN-3828): certify tuple cardinality via JSON-Schema witness extensions --- .github/workflows/api-docs-peer-authorities.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/api-docs-peer-authorities.yml b/.github/workflows/api-docs-peer-authorities.yml index 457ba9d..2434e9e 100644 --- a/.github/workflows/api-docs-peer-authorities.yml +++ b/.github/workflows/api-docs-peer-authorities.yml @@ -38,7 +38,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: ORESoftware/api-docs - ref: af09dc3b14d2ff1f8cd8f0d9acb7803fddaca048 + ref: f6efa12a3ce5a01713464df6168082c289d85716 path: subject persist-credentials: false show-progress: false @@ -48,7 +48,7 @@ jobs: shell: bash run: | set -euo pipefail - test "$(git -C subject rev-parse HEAD)" = "af09dc3b14d2ff1f8cd8f0d9acb7803fddaca048" + test "$(git -C subject rev-parse HEAD)" = "f6efa12a3ce5a01713464df6168082c289d85716" - name: Check out canonical TJSV uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1