[dodeja]

Cause

generate_postman.yml ran on every push that touched docs/openapi.json, including PR branches that merge main. openapi-to-postmanv2 gives each item and response a random UUID and fills example values with Math.random. Two runs on the same spec differed in 316 lines. So the collection always changed, and the bot always committed it with [skip ci]. That commit became the PR head, and required checks never reported on it.

Fix

• tools/generate-postman.mjs wraps the converter with the same options. It seeds the faker's random source and derives each item and response ID from its folder and request names. The same spec now gives a byte-identical file. A request keeps its ID when only its body changes.
• openapi-to-postmanv2 is now an exact root devDependency (6.3.0, the version the workflow already installed), so npm ci installs it.
• The workflow commits only on pushes to main. A GITHUB_TOKEN push starts no new run, so [skip ci] is gone. Pull requests that change the generator, its test, the workflow, or the lockfile run generation and tests without committing.
• tools/postman-generation.test.mjs checks that two runs are identical and match the committed file, and that all 453 item and response IDs are unique.
• AGENTS.md, the docs-writing checklist, and the Claude workflow prompt use node tools/generate-postman.mjs.
• The second commit regenerates the collection once with the new generator. Only IDs and faked example values change.

Verification

• Ran node tools/generate-postman.mjs twice in separate processes, then compared the outputs with cmp. They are identical. --check passes on the committed file.
• Generating twice in one process gives identical output.
• Compared with the old file, the structure is the same apart from IDs and example values.
• node --test tools/postman-generation.test.mjs passes 5 of 5 tests.
• vp run check, vp run test, and npm run check:agent-trust pass.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Confidence Score: 4/5

Fix the fixed ID count before merging so ordinary spec changes do not stop automatic collection updates.

Findings

1.  Spec changes stop collection updates ▶

Fix with agent prompt

### Issue 1
tools/postman-generation.test.mjs:90
Adding or removing an endpoint or response changes the number of generated IDs, so `assert.equal(ids.length, 453)` fails even when every ID is unique. On a spec-only push to `main`, this stops the workflow before the bot can commit the updated collection. Replace the fixed count with checks that allow the spec to grow while still checking that the expected entries have unique IDs.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Adds a generator that seeds example values and derives stable IDs from request and response names.

• The Postman generator produces the same collection from the same spec.
• CI checks Postman generation changes and commits collections only on main.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Matching push to main or pull request] --> B[Install dependencies]
  B --> C[Generate collection]
  C --> D[Run generation tests]
  D --> E{Tests pass?}
  E -->|No| F[Stop without committing]
  E -->|Yes| G{Push to main?}
  G -->|Yes| H[Commit and push changed collection]
  G -->|No| I[Finish without writing to branch]

Loading

_{Reviews (1) · Last reviewed commit: "chore: regenerate the Postman collection..." · Reviewed by Greptile}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
api	Ready	Preview	Oct 19, 2026 5:17am UTC

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T05:22:33.675666Z	a73ee70	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Shadow risk calibration

Signal	Result	Authority
Path classifier	risk:high	Deterministic advisory policy
heuristic fallback	risk-shadow:high	Shadow only

Calibration result: agreement.

Shadow risk never blocks or enables merge. Keep it in observation mode until roughly 50 pull requests have human-reviewed labels, then calibrate before considering any policy use.

[greptile-apps]

Spec changes stop collection updates

Adding or removing an endpoint or response changes the number of generated IDs, so assert.equal(ids.length, 453) fails even when every ID is unique. On a spec-only push to main, this stops the workflow before the bot can commit the updated collection. Replace the fixed count with checks that allow the spec to grow while still checking that the expected entries have unique IDs.

Prompt To Fix With AI

This is a comment left during a code review.
Path: tools/postman-generation.test.mjs
Line: 90

Comment:
**Spec changes stop collection updates**

Adding or removing an endpoint or response changes the number of generated IDs, so `assert.equal(ids.length, 453)` fails even when every ID is unique. On a spec-only push to `main`, this stops the workflow before the bot can commit the updated collection. Replace the fixed count with checks that allow the spec to grow while still checking that the expected entries have unique IDs.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[chatgpt-codex-connector]

💡 Codex Review

API/.github/workflows/generate_postman.yml

Line 67 in a73ee70

git push origin HEAD:${{ github.ref_name }}

Dispatch deployment after pushing the generated collection

When a main-branch OpenAPI change does not already include the regenerated collection, deploy_postman.yml runs for the original push and checks out that stale SHA, while this bot push uses GITHUB_TOKEN and therefore does not trigger another workflow run, as the preceding comment acknowledges and GitHub documents. Consequently, the newly committed collection is never published to Postman; dispatch the deployment after this successful push or perform deployment in this workflow.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Derive the expected ID count from the generated tree

When a legitimate OpenAPI change adds or removes a request, folder, or response, generation changes the number of IDs, so the main-only workflow fails here before its commit step and leaves the collection stale. Count all traversed entries dynamically and compare that count with ids.length rather than pinning the current generated size of 453.

AGENTS.md reference: AGENTS.md:L30-L36

Useful? React with 👍 / 👎.