feat(ci): auto-update openapi.json when API v2 files change

[ThyMinimalDev]

What does this PR do?

Adds a CI workflow that automatically keeps openapi.json up-to-date when API v2 input/output files are modified.

Currently, the openapi.json is only generated when running API v2 in dev mode. When PRs modify API v2 files without regenerating the OpenAPI spec, the documentation becomes outdated. This PR adds a CI step that:

1. Generates the openapi.json file when API v2 related files are modified
2. Compares the generated file with the committed version
3. Automatically commits and pushes the updated file if it differs
4. For PRs from forks (where we can't push), fails with clear instructions

The check runs when any of these paths are modified (using existing has-api-v2-changes detection):

• apps/api/v2/**
• packages/platform-*/**
• packages/trpc/**
• packages/prisma/schema.prisma

Mandatory Tasks (DO NOT REMOVE)

• I have self-reviewed the code (A decent size PR without self-review might be rejected).
• I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. N/A - CI workflow change only.
• I confirm automated tests are in place that prove my fix is effective or that my feature works. N/A - CI workflow will be tested on first PR with API v2 changes.

How should this be tested?

1. Create a test PR that modifies an API v2 input/output file (e.g., a DTO in apps/api/v2/src/)
2. Without running yarn generate-swagger, the CI should automatically commit the updated openapi.json
3. For PRs from forks, the CI should fail with instructions to manually run yarn generate-swagger

Important for reviewers

• Verify vars.CI_NODE_ENV: The swagger generation only writes the file when NODE_ENV=development. Please confirm that CI_NODE_ENV is set to development in GitHub Actions variables, otherwise this check will always pass (false positive).
• The workflow uses [skip ci] in the auto-commit message to prevent infinite CI loops.
• Fork PRs cannot be auto-updated (no push access), so they fall back to failing with instructions.

Checklist

• I have read the contributing guide
• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have checked if my changes generate no new warnings

---

Link to Devin run: https://app.devin.ai/sessions/20427f8676304f1583ed712b5a28f0aa
Requested by: @ThyMinimalDev

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name=".github/workflows/pr.yml">

<violation number="1" location=".github/workflows/pr.yml:500">
P2: `check-openapi-json` failures are only enforced when `has-files-requiring-all-checks` is true, but that filter excludes `docs/**`. For docs-only API v2 changes, the OpenAPI check can fail without blocking the required job. Consider enforcing `check-openapi-json` whenever `has-api-v2-changes` is true (outside the `has-files-requiring-all-checks` gate), or include docs in the gate so failures always block merges.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: check-openapi-json failures are only enforced when has-files-requiring-all-checks is true, but that filter excludes docs/**. For docs-only API v2 changes, the OpenAPI check can fail without blocking the required job. Consider enforcing check-openapi-json whenever has-api-v2-changes is true (outside the has-files-requiring-all-checks gate), or include docs in the gate so failures always block merges.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/pr.yml, line 500:

<comment>`check-openapi-json` failures are only enforced when `has-files-requiring-all-checks` is true, but that filter excludes `docs/**`. For docs-only API v2 changes, the OpenAPI check can fail without blocking the required job. Consider enforcing `check-openapi-json` whenever `has-api-v2-changes` is true (outside the `has-files-requiring-all-checks` gate), or include docs in the gate so failures always block merges.</comment>

<file context>
@@ -489,6 +497,7 @@ jobs:
             needs.unit-test.result != 'success' ||
             needs.api-v2-unit-test.result != 'success' ||
             (needs.prepare.outputs.has-api-v2-changes == 'true' && needs.check-api-v2-breaking-changes.result != 'success') ||
+            (needs.prepare.outputs.has-api-v2-changes == 'true' && needs.check-openapi-json.result != 'success') ||
             (needs.prepare.outputs.has-prisma-changes == 'true' && needs.check-prisma-migrations.result != 'success') ||
               needs.build.result != 'success' ||
</file context>

[github-actions]

Devin AI is addressing Cubic AI's review feedback

New feedback has been sent to the existing Devin session.

View Devin Session

---

✅ No changes pushed

[keithwillcode]

This should use the “cache-checkout” action we have