APS-4652 Pin OAS validator Spectral rulesets version

[phowells]

Summary

Pins the OAS validation service’s Spectral rulesets dependency so validator behaviour remains reproducible across image builds.

The validator already pinned @stoplight/spectral-cli to 6.14.2, but the CLI permits any @stoplight/spectral-rulesets version matching >=1. A recent build therefore installed rulesets 1.22.6, which contains a regression that crashes duplicated-entry-in-enum when an OpenAPI example contains a legitimate null value.

Changes

• Pin @stoplight/spectral-rulesets to the last verified working version, 1.22.2.
• Define explicit CLI and rulesets versions in the validator Dockerfile.
• Assert the installed rulesets version during image builds.
• Install and verify the same versions in CI.
• Add a regression test covering a nullable OpenAPI response example.
• Update the validator README with the complete Spectral installation command.

Verification

• GitHub Actions passed all service tests, including the new nullable-example regression test.
• SonarCloud checks passed.
• The multi-architecture validator image was published for linux/amd64 and linux/arm64.
• The branch image was deployed temporarily to DEV and verified to contain:
  • Spectral CLI 6.14.2
  • Spectral rulesets 1.22.2
• The unchanged Widget API OAD subsequently returned HTTP 200 with valid: true and zero validation findings.
• SDX service registration using that OAD completed successfully.

GitHub Actions: https://github.com/bcgov/gwa-api/actions/runs/30408686622

Operational note

The shared DEV workflow considers changes to .github/workflows/dev.yml build-worthy for multiple GWA services. As a result, the branch workflow also produced branch-tagged images for other microservices, but it did not deploy them.

Upstream reference

The failure is associated with the Spectral null-guard regression addressed by:

stoplightio/spectral#2963

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE