CodeRifts for GitLab — a decision on every merge request

# .gitlab-ci.yml
# Request only. Branch on execution_action. Verify the receipt before CONTINUE is permission.
# This example no longer teaches POST /api/v1/diff as the gate.
stages:
  - test

api-contract-check:
  stage: test
  image: alpine:latest
  before_script:
    - apk add --no-cache curl jq git nodejs
  script:
    - |
      git fetch origin "$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
      OLD=$(git show "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME:api/openapi.yaml")
      NEW=$(cat api/openapi.yaml)
      RESULT=$(jq -n --arg o "$OLD" --arg n "$NEW" \
        '{preflight_mode:"authorize",context:{operation:"merge"},artifacts:[{id:"api",type:"openapi",before:$o,after:$n}]}' \
        | curl -sf -X POST https://app.coderifts.com/api/v1/preflight \
            -H "Authorization: Bearer $CODERIFTS_API_KEY" \
            -H "Content-Type: application/json" -d @-)
      echo "$RESULT" | jq '{execution_action,decision,chain_receipt}'
      ACTION=$(echo "$RESULT" | jq -r '.execution_action // empty')
      if [ "$ACTION" != "CONTINUE" ]; then
        echo "halt: execution_action=$ACTION"
        exit 1
      fi
      RECEIPT=$(echo "$RESULT" | jq -r '.chain_receipt // empty')
      test -n "$RECEIPT"
      git clone -q --depth 1 https://github.com/coderifts/receipt-verifier
      node receipt-verifier/cli.js "$RECEIPT"
  rules:
    - if: $CI_MERGE_REQUEST_IID
      changes:
        - "api/**/*.yaml"
        - "api/**/*.json"