feat: complete published registry contracts and gated SRO ingestion

.gitea/workflows/ci-cd.yml

@@ -36,12 +36,24 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Setup Node for Orval
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - name: Setup contract toolchain
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.9
+
       - name: Run quality gate
         run: |
           set -euo pipefail
           ci_image="mostovik-backend-ci:${GITHUB_RUN_ID:-local}-${GITHUB_RUN_ATTEMPT:-1}"
           ci_builder="mostovik-backend-ci-${GITHUB_RUN_ID:-local}-${GITHUB_RUN_ATTEMPT:-1}"
+          ci_container="mostovik-contract-ci-${GITHUB_RUN_ID:-local}-${GITHUB_RUN_ATTEMPT:-1}"
           cleanup() {
+            docker rm --force "${ci_container}" >/dev/null 2>&1 || true
             docker image rm --force "${ci_image}" >/dev/null 2>&1 || true
             docker buildx rm "${ci_builder}" >/dev/null 2>&1 || true
           }
@@ -59,14 +71,15 @@ jobs:
             --load \
             .
 
-          tar --exclude=.git --exclude=.venv --exclude=.ruff_cache -cf - . \
-            | docker run --rm -i \
+          mkdir -p .openapi-build
+          tar --exclude=.git --exclude=.venv --exclude=.ruff_cache --exclude=node_modules -cf - . \
+            | docker run --name "${ci_container}" -i \
                 --env DJANGO_SETTINGS_MODULE=settings.test \
                 --env SECRET_KEY=test-secret-key-for-ci \
                 "${ci_image}" \
                 bash -c '
                   set -euo pipefail
-                  mkdir -p /workspace
+                  mkdir -p /workspace /openapi-build
                   tar -xf - -C /workspace
                   cd /workspace
                   export PATH="/app/.venv/bin:${PATH}"
@@ -75,7 +88,20 @@ jobs:
                   ruff format src --check
                   python -m pytest tests --ignore=tests/test_api_inventory_e2e.py -q
                   python -m pytest tests/test_api_inventory_e2e.py -q
+                  OPENAPI_RUNTIME_FIXTURES=/openapi-build/fixtures.json python -m pytest tests/apps/organizations/test_openapi_runtime_fixtures.py -q
+                  python src/manage.py generate_swagger /openapi-build/swagger.json --overwrite --format=json --settings=settings.test
                 '
+          docker cp "${ci_container}:/openapi-build/." .openapi-build
+
+      - name: Verify canonical OpenAPI and generated client
+        working-directory: tools/openapi
+        run: |
+          set -euo pipefail
+          bun install --frozen-lockfile --ignore-scripts
+          bun build.mjs ../../.openapi-build/swagger.json --check
+          bun run apigen
+          bun run type-check
+          bun run contract-check ../../.openapi-build/fixtures.json
 
   build:
     name: Build linux/amd64 release images