ci: wire npm run test:openapi into build-check.yml

.changeset/ci-openapi-freshness-gate.md

@@ -0,0 +1,4 @@
+---
+---
+
+CI: wire `npm run test:openapi` into `.github/workflows/build-check.yml` so the OpenAPI freshness gate fails its own PR instead of letting drift accumulate. The script (`tsx scripts/generate-openapi.ts && git diff --exit-code static/openapi/registry.yaml`) already existed in `package.json` and ran inside the umbrella `npm run test`, but `build-check.yml` cherry-picks specific test scripts and never invoked it. Result: Zod-schema PRs were landing without regenerating `static/openapi/registry.yaml`, and drift would only get swept up opportunistically (e.g. #4515 absorbed ~340 lines). No source schemas change — this is workflow-only. Closes #4516.

.github/workflows/build-check.yml

@@ -44,6 +44,18 @@ jobs:
       - name: Validate schemas
         run: npm run test:schemas && npm run test:json-schema && npm run test:extension-schemas && npm run test:composed
 
+      - name: OpenAPI freshness (static/openapi/registry.yaml regenerated from Zod source)
+        # generate-openapi.ts transitively imports auth middleware which
+        # constructs WorkOS at module load. CI doesn't ship those secrets
+        # and doesn't need them — the script never makes a network call.
+        # Dummy values just satisfy constructor validation.
+        env:
+          WORKOS_API_KEY: sk_dummy_ci_only
+          WORKOS_CLIENT_ID: client_dummy_ci_only
+          STRIPE_SECRET_KEY: sk_dummy_ci_only
+          RESEND_API_KEY: re_dummy_ci_only
+        run: npm run test:openapi
+
       - name: Fetch 3.0.x for error-code drift comparison
         if: github.ref != 'refs/heads/3.0.x' && github.base_ref != '3.0.x'
         run: git fetch --depth=1 origin 3.0.x:refs/remotes/origin/3.0.x