ci: verify committed models match regeneration from the pinned UCP spec (#62)

* ci: verify committed models match regeneration from the pinned UCP spec

The Tests workflow installs the committed generated models and runs the
unit suite, but never executes the generation pipeline itself
(generate_models.sh + preprocess_schemas.py + postprocess_models.py
end-to-end). A defect in the pipeline's wiring stays invisible as long
as the committed models are fine, and models edited or left stale
without regeneration are equally invisible.

This is not hypothetical: with the floating
datamodel-code-generator>=0.50.0 bound, the 0.72.0 release (2026-08-03)
mis-resolves the spec's remote $refs (HTTP 404 on a doubled path),
generation emits incomplete models, postprocess_models.py exits 1 -- and
CI stays green because it only ever tests the committed artifacts.

Add a model-drift job that regenerates the models against the pinned
UCP spec version for this SDK line (0.4.x -> 2026-04-08, per the README
compatibility table), normalizes file endings the way pre-commit does,
and fails if the result is not byte-identical to the committed models.
This catches a broken generator and uncommitted regeneration in one
check, without changing the release flow of committing generated
artifacts.

Pin the codegen toolchain (datamodel-code-generator==0.71.0,
ruff==0.16.1) so regeneration is reproducible; 0.71.0 + ruff 0.16.1
reproduce the committed models byte-for-byte after end-of-file
normalization.

* ci: pin github actions to commit hashes in tests.yml

* ci: upgrade and pin actions to latest versions in tests.yml

---------

Co-authored-by: damaz91 <federico.damato91@gmail.com>

Author: vishkaty

.github/workflows/tests.yml

@@ -33,12 +33,48 @@ jobs:
         python-version: ["3.10", "3.11", "3.12"]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install package (generated-model tests import it)
         run: pip install -e .
       - name: Run preprocessing tests
         run: python -m unittest discover -s tests -p "test_*.py"
+
+  model-drift:
+    name: Generated models match the pinned UCP spec
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Install uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          enable-cache: true
+      - name: Regenerate models from the pinned spec version
+        # SDK 0.4.x targets UCP 2026-04-08 (see the README compatibility
+        # table). Bump this pin together with the SDK version line.
+        run: ./generate_models.sh 2026-04-08
+      - name: Normalize file endings (as pre-commit's end-of-file-fixer does)
+        run: |
+          python3 - <<'PY'
+          from pathlib import Path
+
+          for path in Path("src/ucp_sdk/models/schemas").rglob("*.py"):
+              text = path.read_text(encoding="utf-8")
+              fixed = text.rstrip("\n") + "\n" if text.strip() else ""
+              if fixed != text:
+                  path.write_text(fixed, encoding="utf-8")
+          PY
+      - name: Fail if regeneration does not reproduce the committed models
+        run: |
+          git add -A -- src/ucp_sdk/models/schemas
+          if ! git diff --cached --quiet -- src/ucp_sdk/models/schemas; then
+            echo "::error::Committed models differ from regeneration against the pinned UCP spec. Either the generation pipeline is broken, or the models were edited without regenerating. Run ./generate_models.sh 2026-04-08 and commit the result."
+            git --no-pager diff --cached --stat -- src/ucp_sdk/models/schemas
+            git --no-pager diff --cached -- src/ucp_sdk/models/schemas
+            exit 1
+          fi
+          echo "Committed models match regeneration."

pyproject.toml

@@ -27,7 +27,14 @@ dependencies = [
 
 [dependency-groups]
 dev = [
-    "datamodel-code-generator[http,ruff]>=0.50.0",
+    # Exact pins: the model-drift CI job regenerates the models against the
+    # pinned UCP spec and asserts byte-identical output, so the codegen
+    # toolchain must resolve reproducibly. (The floating ">=0.50.0" bound
+    # broke on 2026-08-03: datamodel-code-generator 0.72.0 mis-resolves the
+    # spec's remote $refs and emits incomplete models.) Bump these pins and
+    # regenerate the models in the same PR.
+    "datamodel-code-generator[http]==0.71.0",
+    "ruff==0.16.1",
 ]
 
 [build-system]