ci: regenerate from the committed spec so the drift check is hermetic

Author: ph33nx

.github/workflows/ci.yml

@@ -26,8 +26,13 @@ jobs:
 
       - run: uv sync --locked --all-extras --dev
 
+      # Hermetic: regenerates from the committed spec, so this verifies that the committed
+      # generated code still reproduces from it, with no network dependency. Refreshing the
+      # spec itself is the release workflow's job.
       - name: Codegen drift check
         if: matrix.python == '3.12'
+        env:
+          ROXYAPI_SPEC_FILE: specs/openapi.json
         run: |
           uv run python generate.py
           git diff --exit-code -- specs/openapi.json src/roxy_sdk/factory.py \

generate.py

@@ -7,6 +7,7 @@
 """
 
 import json
+import os
 import shutil
 import subprocess
 import sys
@@ -35,9 +36,22 @@ def _fetch_with_retry(url: str, attempts: int = 5) -> bytes:
     raise RuntimeError("unreachable")
 
 
-def fetch_spec() -> dict:
+def _load_raw_spec() -> bytes:
+    """Read the spec from disk when ROXYAPI_SPEC_FILE is set, fetch it otherwise.
+
+    Reading from a file keeps generation offline and byte-reproducible, which is what the
+    codegen drift check in CI relies on.
+    """
+    spec_file = os.environ.get("ROXYAPI_SPEC_FILE")
+    if spec_file:
+        print(f"Reading OpenAPI spec from {spec_file} (offline, ROXYAPI_SPEC_FILE)")
+        return Path(spec_file).read_bytes()
     print(f"Fetching OpenAPI spec from {SPEC_URL}")
-    spec = json.loads(_fetch_with_retry(SPEC_URL))
+    return _fetch_with_retry(SPEC_URL)
+
+
+def fetch_spec() -> dict:
+    spec = json.loads(_load_raw_spec())
 
     # Patch server URL to absolute prod URL
     if spec.get("servers") and spec["servers"][0].get("url") == "/api/v2":