Reusable Schemathesis conformance workflow #119

What to build

A reusable workflow that fuzzes a service against its own OpenAPI spec and fails when the running API does not behave the way the contract claims.

On a pull request it fuzzes read-only operations only, against the service booted in its existing integration-test tier. That keeps the gate fast, deterministic and free of write side-effects. The full suite including mutations runs on a schedule and files an issue rather than blocking a merge, because property-based fuzzing of write paths against a real database is where flakiness comes from — and a flaky gate gets ignored.

Run the tool from its container image so no Python toolchain enters a consuming repository, JVM or Go.

Acceptance criteria

• The pull-request path fuzzes reads only and performs no writes
• The scheduled path covers mutations and reports without blocking merges
• No Python is added to a consuming repository's toolchain
• The gate is demonstrated to fail against a deliberately non-conforming build

Blocked by

None — can start immediately.

Note (2026-10-01)

Go + Vue, contract-first, is now the estate standard for new services (JorisJonkers-dev/workspace#107). This workflow must serve the Go services too: JorisJonkers-dev/estate-dashboard and the services in JorisJonkers-dev/delivery.