ci: regenerate from the committed spec so the drift check is hermetic

Author: ph33nx

.github/workflows/ci.yml

@@ -18,7 +18,12 @@ jobs:
         with:
           go-version: stable
 
+      # Hermetic: regenerates from the committed spec, so this verifies that the committed
+      # generated code still reproduces from it, with no network dependency. Refreshing the
+      # spec itself is the release workflow's job.
       - name: Codegen drift check
+        env:
+          ROXYAPI_SPEC_FILE: specs/openapi.json
         run: |
           go run ./tools/roxygen generate
           git diff --exit-code -- specs/openapi.json roxyapi.gen.go roxy.gen.go \

tools/roxygen/main.go

@@ -74,8 +74,7 @@ func check(err error, msg string) {
 // ─── generate ────────────────────────────────────────────────────────────────
 
 func generate() {
-	fmt.Printf("Fetching OpenAPI spec from %s\n", specURL)
-	raw := fetchSpec()
+	raw := loadSpec()
 
 	dec := json.NewDecoder(bytes.NewReader(raw))
 	dec.UseNumber()
@@ -114,6 +113,20 @@ func generate() {
 	syncDocs()
 }
 
+// loadSpec returns the raw spec bytes, from disk when ROXYAPI_SPEC_FILE is set and from the API
+// otherwise. Reading from a file keeps generation offline and byte-reproducible, which is what the
+// codegen drift check in CI relies on.
+func loadSpec() []byte {
+	if path := os.Getenv("ROXYAPI_SPEC_FILE"); path != "" {
+		fmt.Printf("Reading OpenAPI spec from %s (offline, ROXYAPI_SPEC_FILE)\n", path)
+		raw, err := os.ReadFile(path)
+		check(err, "read spec file")
+		return raw
+	}
+	fmt.Printf("Fetching OpenAPI spec from %s\n", specURL)
+	return fetchSpec()
+}
+
 // fetchSpec retries with exponential backoff: a transient upstream error (e.g. a
 // CDN 520) must not fail the daily release run.
 func fetchSpec() []byte {