GraphQL Client Operation Regression Gate

A private, deterministic Apify Actor that checks actual named client operations against inline before/after GraphQL SDL. It separates defects already present in the baseline from operations made invalid by the candidate schema, validates bounded variable cases independently against both versions, and emits source-hashed JSON, SARIF 2.1.0, JUnit XML, and Markdown evidence.

It is intentionally not a schema-diff clone and never contacts or executes a GraphQL endpoint. It does not run resolvers, custom directives, customer code, commands, URLs, or suggested fixes. Validation uses the official MIT-licensed graphql (graphql-js) package pinned to 17.0.2.

Input and result

Supply beforeSdl, afterSdl, at least one { path, source } document, and optionally named variable cases. Paths are safe virtual labels; no source file is opened. Cross-file fragments work because all named documents are parsed into one bounded corpus while their original Source objects retain exact line/column locations. Every GraphQL NAME token is limited to 256 characters before schema or document parsing, and variable-case operationName references use the same limit.

The authoritative status is:

• REGRESSIONS_FOUND: at least one operation was valid before but invalid after.
• BASELINE_INVALID: no new regression exists, but at least one operation or variable case was already invalid before. This is never reported as compatible.
• PASS: every operation and applicable variable case is valid in both schemas.

NOT_RUNTIME_VALIDATED means a variable case reaches a custom scalar whose application-specific coercion cannot be reproduced from SDL. It is not treated as proof of runtime validity. The product makes no claim about resolver behavior, response values, performance, directives with application code, or runtime equivalence.

Useful regression findings are a successful analysis result and are saved normally. A missing Actor INPUT writes only an honest OUTPUT error with code INVALID_INPUT and returns normally; it creates no report, dataset item, or billing event. Malformed supplied input remains fatal and produces no dataset/OUTPUT report with a nonzero process exit.

Local use

npm_config_cache=.npm-cache npm ci --ignore-scripts
npm run typecheck
npm test
npm run build
node dist/main.js --input examples/input.json --output-dir /tmp/graphql-gate-output

The CLI exits 2 for REGRESSIONS_FOUND, 0 for PASS or baseline-only results, and 1 for fatal malformed input. It writes only four fixed report names under the explicitly supplied output directory. Actor runs instead read INPUT and write one default-dataset item plus OUTPUT, REPORT.JSON, REPORT.SARIF, REPORT.JUNIT.XML, and REPORT.MD.

For the deterministic container-only smoke path:

docker build -t graphql-client-operation-regression-gate:local .
docker run --rm --network none -e AUTOMATON_CONTAINER_SMOKE=1 graphql-client-operation-regression-gate:local

The smoke switch is the only route to its in-memory fixture and makes no storage or network request. No deployment, publishing, billing mutation, scheduling, webhook, proxy, credentials, or paid API is part of this repository.

Privacy and rights

Only submit schemas and client documents you have the right to process. Inputs and generated reports are retained according to the Apify storage settings of the account running this private Actor. Source bodies and raw variable/argument values are not returned; SHA-256 hashes and exact safe source locations are. Credential-like input is refused, but this is defense in depth rather than a general-purpose secret scanner.

See REQUIREMENTS.md, SECURITY_REVIEW.md, QA_REPORT.md, and SUPPORT.md.