ppwcode/api-mitigation-test repository overview

⁠API Mitigation Test

This Docker image tests an API against its OpenAPI contract using Schemathesis⁠ and records coverage with TraceCov⁠. Run it in your delivery pipeline to detect regressions, enforce coverage requirements, and retain evidence of the checks performed for each build.

Continuous mitigation assurance means repeating those checks as your API changes and keeping their results reviewable. A passing run describes what was tested; it does not prove that the entire system is vulnerability-free.

⁠🚀 Usage

1. Prepare an isolated API environment with Docker Compose (recommended). Keep one project-owned definition for the API, dependencies, migrations, and mitigation runner. Use your application's supported DBMS and identity provider, and seed representative data and permissions. Tests can change data, so use disposable state and wait for readiness. See the recommended Compose workflow⁠.

2. Commit a test configuration. Supply a matching OpenAPI schema, a URL reachable from the runner, the component version, and a stable configuration ID. Decide which operations and coverage thresholds should gate delivery. See the configuration reference⁠.

3. Provide suitable credentials. Obtain an API access token for a test identity whose claims and application permissions match the scenarios you want to exercise. Pass it as API_MITIGATION_BEARER_TOKEN through the execution environment. The runner does not acquire or refresh tokens. See authentication and environment requirements⁠.

4. Run the tests in CI. Test each relevant change before deployment, using the Docker image, GitHub Action, or Bitbucket pipe. Let a failing verdict fail the pipeline. Collect reports and service logs even when testing fails, then clean up disposable resources. See CI integration examples⁠.

5. Review and retain the evidence. Investigate failures, fix regressions, and use owned, time-limited exceptions only when justified. Archive each build's evidence.sqlite under your project's access and retention rules; temporary CI artifacts are insufficient for durable assurance. See reports, verdicts, and evidence⁠.

⁠🤝 Contributing

Contributions, issues and feature requests are welcome!

Feel free to check the issues page⁠. You can also take a look at the contributing guide⁠.

⁠📝 License

Copyright © 2026 PeopleWare NV⁠.

This project is Apache-2.0⁠ licensed.