test(api): bind OpenAPI bytes to release provenance

[seonghobae]

Objective

Advance issue #315 with a path-disjoint release-provenance contract for the repository-owned buyer OpenAPI. A protected release must be able to bind the exact schema bytes to one exact source revision instead of treating an unversioned path or PR narrative as release evidence.

Test-first state

Protected main was directly resolved at 55d7ae8647208e301f282350f076eeddaba61d11. This Draft starts intentionally RED at exact test-only head df510d46b8f2f6507de03b541c826a3d47012926, directly based on that baseline.

scripts/test_openapi_release_provenance.py requires a deterministic canonical JSON record containing the fixed repository OpenAPI path, byte-exact SHA-256, byte length, and a canonical lowercase 40-hex source revision. It also requires controlled rejection of missing, symlinked, oversized contract files and ambiguous source revisions. The production helper does not exist at this head, so Buyer-readiness script discovery is expected to fail at the missing-module boundary.

Scope

New deterministic release-provenance helper plus focused script tests only. It does not modify the OpenAPI schema owned by #316/#337, the breaking-change checker in #381, runtime version negotiation in #379, controllers, DTOs, generated clients, naruon source, release workflows, signing infrastructure, SBOM generation, or canonical documentation owned by #305. It creates no claim that provenance is shipped until this slice integrates and a release pipeline consumes its output.

Acceptance

Observe exact-head RED -> add the smallest standard-library implementation -> exact-head buyer-readiness/full CI verification -> Security/SAST/fuzz where emitted -> current reviews/threads/live-base refetch. Keep Draft until the unchanged exact implementation head is GREEN. Qualifying independent non-author approval remains a separate protected-merge gate.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 5 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3d67b26f-086c-4797-908e-d9b133b36ef9

📥 Commits

Reviewing files that changed from the base of the PR and between 55d7ae8 and 3836ca2.

📒 Files selected for processing (2)

• scripts/openapi_release_provenance.py
• scripts/test_openapi_release_provenance.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}