From 4115adf9702cec3eb80cc5aebea81a18fd575f6d Mon Sep 17 00:00:00 2001
From: Patrick Weber <56127805+pattaweb@users.noreply.github.com>
Date: Tue, 11 Aug 2026 08:44:17 +0200
Subject: [PATCH 1/3] Pin GitHub Actions to immutable SHAs

---
 .github/workflows/openapi.yml | 72 +++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)

diff --git a/.github/workflows/openapi.yml b/.github/workflows/openapi.yml
index e3a4648..178fb7f 100644
--- a/.github/workflows/openapi.yml
+++ b/.github/workflows/openapi.yml
@@ -1,5 +1,77 @@
 name: Validate OpenAPI
 
+on:
+  push:
+    paths:
+      - openapi.yaml
+      - .redocly.yaml
+      - .github/workflows/openapi.yml
+  pull_request:
+    paths:
+      - openapi.yaml
+      - .redocly.yaml
+      - .github/workflows/openapi.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+
+      - name: Lint with Redocly
+        run: >-
+          docker run --rm
+          -v "$PWD:/spec"
+          redocly/cli:2.43.1
+          lint /spec/openapi.yaml
+          --config /spec/.redocly.yaml
+
+      - name: Validate with OpenAPI Generator
+        run: >-
+          docker run --rm
+          -v "$PWD:/local"
+          openapitools/openapi-generator-cli:v7.22.0
+          validate -i /local/openapi.yaml
+
+      - name: Smoke-test TypeScript client generation
+        run: >-
+          docker run --rm
+          -v "$PWD:/local"
+          -v "${{ runner.temp }}:/generated"
+          openapitools/openapi-generator-cli:v7.22.0
+          generate
+          -i /local/openapi.yaml
+          -g typescript-fetch
+          -o /generated/typescript-fetch
+
+      - name: Compile generated TypeScript client
+        run: >-
+          docker run --rm
+          -v "${{ runner.temp }}/typescript-fetch:/client"
+          -w /client
+          node:24-alpine
+          npx --yes -p typescript@5.9.3
+          tsc --noEmit --target ES2020 --module commonjs --strict index.ts
+
+      - name: Smoke-test Postman conversion
+        run: >-
+          docker run --rm
+          -v "$PWD:/work"
+          -v "${{ runner.temp }}:/generated"
+          -w /work
+          node:24-alpine
+          npx --yes openapi-to-postmanv2@6.3.1
+          -s openapi.yaml
+          -o /generated/zammad.postman_collection.json
+          -p
+          -O folderStrategy=Tags,includeAuthInfoInExample=true
+name: Validate OpenAPI
+
 on:
   push:
     paths:

From eebcd595aeec1cc860eb1c24b20de6536d045739 Mon Sep 17 00:00:00 2001
From: Patrick Weber <56127805+pattaweb@users.noreply.github.com>
Date: Tue, 11 Aug 2026 08:45:20 +0200
Subject: [PATCH 2/3] Fix workflow after web editor replacement

Removed the OpenAPI validation and generation workflow from GitHub Actions.
---
 .github/workflows/openapi.yml | 72 -----------------------------------
 1 file changed, 72 deletions(-)

diff --git a/.github/workflows/openapi.yml b/.github/workflows/openapi.yml
index 178fb7f..be111d5 100644
--- a/.github/workflows/openapi.yml
+++ b/.github/workflows/openapi.yml
@@ -70,75 +70,3 @@ jobs:
           -o /generated/zammad.postman_collection.json
           -p
           -O folderStrategy=Tags,includeAuthInfoInExample=true
-name: Validate OpenAPI
-
-on:
-  push:
-    paths:
-      - openapi.yaml
-      - .redocly.yaml
-      - .github/workflows/openapi.yml
-  pull_request:
-    paths:
-      - openapi.yaml
-      - .redocly.yaml
-      - .github/workflows/openapi.yml
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  validate:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v6
-
-      - name: Lint with Redocly
-        run: >-
-          docker run --rm
-          -v "$PWD:/spec"
-          redocly/cli:2.43.1
-          lint /spec/openapi.yaml
-          --config /spec/.redocly.yaml
-
-      - name: Validate with OpenAPI Generator
-        run: >-
-          docker run --rm
-          -v "$PWD:/local"
-          openapitools/openapi-generator-cli:v7.22.0
-          validate -i /local/openapi.yaml
-
-      - name: Smoke-test TypeScript client generation
-        run: >-
-          docker run --rm
-          -v "$PWD:/local"
-          -v "${{ runner.temp }}:/generated"
-          openapitools/openapi-generator-cli:v7.22.0
-          generate
-          -i /local/openapi.yaml
-          -g typescript-fetch
-          -o /generated/typescript-fetch
-
-      - name: Compile generated TypeScript client
-        run: >-
-          docker run --rm
-          -v "${{ runner.temp }}/typescript-fetch:/client"
-          -w /client
-          node:24-alpine
-          npx --yes -p typescript@5.9.3
-          tsc --noEmit --target ES2020 --module commonjs --strict index.ts
-
-      - name: Smoke-test Postman conversion
-        run: >-
-          docker run --rm
-          -v "$PWD:/work"
-          -v "${{ runner.temp }}:/generated"
-          -w /work
-          node:24-alpine
-          npx --yes openapi-to-postmanv2@6.3.1
-          -s openapi.yaml
-          -o /generated/zammad.postman_collection.json
-          -p
-          -O folderStrategy=Tags,includeAuthInfoInExample=true

From a9974b9cf8b5c530868b7ec70daa52e9cdc14bfb Mon Sep 17 00:00:00 2001
From: Patrick Weber <56127805+pattaweb@users.noreply.github.com>
Date: Tue, 11 Aug 2026 08:47:31 +0200
Subject: [PATCH 3/3] Use the checkout v6 commit SHA

---
 .github/workflows/openapi.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/openapi.yml b/.github/workflows/openapi.yml
index be111d5..d85d290 100644
--- a/.github/workflows/openapi.yml
+++ b/.github/workflows/openapi.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Lint with Redocly
         run: >-