Add OpenAPI Specification to Release Assets

[kiblik]

In the future, I would like to add API changes to release notes. As preparation, I would like to release OpenAPI Specifications with each release as assets.

[dryrunsecurity]

Contextual Security Analysis

As DryRun Security performs checks, we’ll summarize them here. You can always dive into the detailed results in the section below for checks.

Status	DryRun Security Check
✅	AI-powered Sensitive Function Check
✅	Configured Sensitive Files Check
✅	AI-powered Sensitive Files Check

Chat with your AI-powered Security Buddy by typing @dryrunsecurity followed by your question into a comment.
Example: @dryrunsecurity What are common security issues with web application cookies?

Install and configure more repositories at DryRun Security

[mtesauro]

@kiblik FYI: I've been working on this from the other side - aka creating way to diff spec files from DefectDojo's API. That's about 80% done and will show changes / breaking changes between any 2 versions of the API spec files.

[mtesauro]

I'm using this library - https://github.com/Tufin/oasdiff and am aiming towards a GH action which runs the tools and produces the needed output

[kiblik]

I'm using this library - https://github.com/Tufin/oasdiff and am aiming towards a GH action which runs the tools and produces the needed output

I was planning to use the exact tool :)
But you still need some base. How did you plan to generate the previous version OpenAPI definition?
My plan was to store it as part of a release and just fetch it during the following release.

[mtesauro]

@kiblik TBH, I was focusing on making the tool do what I wanted it to using two spec files I pulled from locally running instances of DefectDojo.

I think your idea of storing them with a release makes perfect sense to me. Like I said, I'd not thought about that yet but that sounds perfectly fine to me.

[mtesauro]

@kiblik Is this ready to review/approve?

[kiblik]

@kiblik Is this ready to review/approve?

Yes, it is :)

[cneill]

Is there a reason to use this fork over actions/upload-release-asset? I know the official one is archived but I'm a little hesitant to use a random fork here..

[kiblik]

Is there a reason to use this fork over actions/upload-release-asset? I know the official one is archived but I'm a little hesitant to use a random fork here..

As I remember, there is no other reason (only stopped maintenance).
If you prefer, I can run a local test with the original official one.

[kiblik]

Not sure if I'm doing sth wrong but I'm not able to make it work with actions/upload-release-assets

• https://github.com/kiblik/django-DefectDojo/actions/runs/7188225312/job/19577606201
• https://github.com/kiblik/django-DefectDojo/actions/runs/7188488164/job/19578368890

Any help is welcome

[mtesauro]

Approved