Push your spec from CI

# .github/workflows/publish-openapi-to-confluence.yml
#
# Uploads the OpenAPI spec to a Confluence page whenever it changes on main.
# Repository secrets to create (Settings > Secrets and variables > Actions):
#   CONFLUENCE_BASE_URL   e.g. https://your-site.atlassian.net   (no /wiki)
#   CONFLUENCE_EMAIL
#   CONFLUENCE_API_TOKEN
name: Publish OpenAPI spec to Confluence

on:
  push:
    branches: [main]
    paths:
      - openapi/openapi.yaml   # keep in sync with SPEC_PATH below
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: publish-openapi-to-confluence
  cancel-in-progress: false

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Upload spec as Confluence attachment
        env:
          CONFLUENCE_BASE_URL: ${{ secrets.CONFLUENCE_BASE_URL }}
          CONFLUENCE_EMAIL: ${{ secrets.CONFLUENCE_EMAIL }}
          CONFLUENCE_API_TOKEN: ${{ secrets.CONFLUENCE_API_TOKEN }}
          PAGE_ID: "123456789"                 # <- your page ID
          SPEC_PATH: openapi/openapi.yaml      # <- path in the repo
          COMMENT: "Updated from GitHub Actions (${{ github.sha }})"
        run: |
          set -eu
          NAME="${ATTACHMENT_NAME:-$(basename "$SPEC_PATH")}"
          RESPONSE_FILE="$(mktemp)"
          # Credentials are passed to curl on stdin so they never appear in
          # the process list. GitHub also masks secrets in logs.
          HTTP_CODE="$(
            printf 'user = "%s:%s"\n' "$CONFLUENCE_EMAIL" "$CONFLUENCE_API_TOKEN" |
            curl --silent --show-error --config - \
              --request PUT \
              --header 'X-Atlassian-Token: nocheck' \
              --form "file=@${SPEC_PATH};filename=${NAME}" \
              --form 'minorEdit=true' \
              --form-string "comment=${COMMENT}" \
              --output "$RESPONSE_FILE" \
              --write-out '%{http_code}' \
              "${CONFLUENCE_BASE_URL%/}/wiki/rest/api/content/${PAGE_ID}/child/attachment"
          )"
          case "$HTTP_CODE" in
            2??) echo "Uploaded ${NAME} to page ${PAGE_ID} (HTTP ${HTTP_CODE})." ;;
            *)   echo "Upload failed: HTTP ${HTTP_CODE}" >&2; cat "$RESPONSE_FILE" >&2; exit 1 ;;
          esac

# .gitlab-ci.yml (add this job to your pipeline)
#
# Uploads the OpenAPI spec to a Confluence page whenever it changes on the
# default branch.
# CI/CD variables to create (Settings > CI/CD > Variables), all "Masked"
# and, if you can, "Protected":
#   CONFLUENCE_BASE_URL   e.g. https://your-site.atlassian.net   (no /wiki)
#   CONFLUENCE_EMAIL
#   CONFLUENCE_API_TOKEN
#   PAGE_ID               numeric Confluence page ID
# GitLab only masks values of 8+ characters with no spaces; the API token
# qualifies. Do not enable `set -x` or `CI_DEBUG_TRACE`, which would print it.

publish-openapi-to-confluence:
  stage: deploy
  image:
    name: curlimages/curl:8.10.1
    entrypoint: [""]
  variables:
    SPEC_PATH: openapi/openapi.yaml        # <- path in the repo
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      changes:
        - openapi/openapi.yaml             # keep in sync with SPEC_PATH
  script:
    - |
      set -eu
      NAME="${ATTACHMENT_NAME:-$(basename "$SPEC_PATH")}"
      COMMENT="Updated from GitLab CI (${CI_COMMIT_SHORT_SHA})"
      RESPONSE_FILE="$(mktemp)"
      # Credentials are passed to curl on stdin so they never appear in
      # the process list or the job log.
      HTTP_CODE="$(
        printf 'user = "%s:%s"\n' "$CONFLUENCE_EMAIL" "$CONFLUENCE_API_TOKEN" |
        curl --silent --show-error --config - \
          --request PUT \
          --header 'X-Atlassian-Token: nocheck' \
          --form "file=@${SPEC_PATH};filename=${NAME}" \
          --form 'minorEdit=true' \
          --form-string "comment=${COMMENT}" \
          --output "$RESPONSE_FILE" \
          --write-out '%{http_code}' \
          "${CONFLUENCE_BASE_URL%/}/wiki/rest/api/content/${PAGE_ID}/child/attachment"
      )"
      case "$HTTP_CODE" in
        2??) echo "Uploaded ${NAME} to page ${PAGE_ID} (HTTP ${HTTP_CODE})." ;;
        *)   echo "Upload failed: HTTP ${HTTP_CODE}" >&2; cat "$RESPONSE_FILE" >&2; exit 1 ;;
      esac

# bitbucket-pipelines.yml
#
# Uploads the OpenAPI spec to a Confluence page whenever it changes on main.
# Repository variables to create (Repository settings > Pipelines >
# Repository variables). Mark CONFLUENCE_API_TOKEN as "Secured":
#   CONFLUENCE_BASE_URL   e.g. https://your-site.atlassian.net   (no /wiki)
#   CONFLUENCE_EMAIL
#   CONFLUENCE_API_TOKEN  (Secured)
#   PAGE_ID               numeric Confluence page ID

image: atlassian/default-image:4

pipelines:
  branches:
    main:
      - step:
          name: Publish OpenAPI spec to Confluence
          condition:
            changesets:
              includePaths:
                - "openapi/openapi.yaml"   # keep in sync with SPEC_PATH below
          script:
            - export SPEC_PATH="openapi/openapi.yaml"   # <- path in the repo
            - export COMMENT="Updated from Bitbucket Pipelines (${BITBUCKET_COMMIT})"
            - |
              set -eu
              NAME="${ATTACHMENT_NAME:-$(basename "$SPEC_PATH")}"
              RESPONSE_FILE="$(mktemp)"
              # Credentials are passed to curl on stdin so they never appear
              # in the process list or the build log.
              HTTP_CODE="$(
                printf 'user = "%s:%s"\n' "$CONFLUENCE_EMAIL" "$CONFLUENCE_API_TOKEN" |
                curl --silent --show-error --config - \
                  --request PUT \
                  --header 'X-Atlassian-Token: nocheck' \
                  --form "file=@${SPEC_PATH};filename=${NAME}" \
                  --form 'minorEdit=true' \
                  --form-string "comment=${COMMENT}" \
                  --output "$RESPONSE_FILE" \
                  --write-out '%{http_code}' \
                  "${CONFLUENCE_BASE_URL%/}/wiki/rest/api/content/${PAGE_ID}/child/attachment"
              )"
              case "$HTTP_CODE" in
                2??) echo "Uploaded ${NAME} to page ${PAGE_ID} (HTTP ${HTTP_CODE})." ;;
                *)   echo "Upload failed: HTTP ${HTTP_CODE}" >&2; cat "$RESPONSE_FILE" >&2; exit 1 ;;
              esac

#!/bin/sh
# Upload an OpenAPI spec to a Confluence Cloud page as an attachment.
# PUT creates the attachment, or adds a new version if one with the same
# file name already exists on the page.
#
# Required environment variables:
#   CONFLUENCE_BASE_URL   e.g. https://your-site.atlassian.net   (no /wiki)
#   CONFLUENCE_EMAIL      Atlassian account email that owns the token
#   CONFLUENCE_API_TOKEN  Atlassian API token (keep it in a secret store)
#   PAGE_ID               numeric ID of the Confluence page
#   SPEC_PATH             path to the spec file, e.g. openapi/openapi.yaml
# Optional:
#   ATTACHMENT_NAME       file name on the page (default: basename of SPEC_PATH)
#   COMMENT               version comment (default: "Updated from CI")
#
# Do not add `set -x`: it would print the token.

set -eu

: "${CONFLUENCE_BASE_URL:?CONFLUENCE_BASE_URL is not set}"
: "${CONFLUENCE_EMAIL:?CONFLUENCE_EMAIL is not set}"
: "${CONFLUENCE_API_TOKEN:?CONFLUENCE_API_TOKEN is not set}"
: "${PAGE_ID:?PAGE_ID is not set}"
: "${SPEC_PATH:?SPEC_PATH is not set}"

if [ ! -f "$SPEC_PATH" ]; then
  echo "Spec file not found: $SPEC_PATH" >&2
  exit 1
fi

BASE_URL="${CONFLUENCE_BASE_URL%/}"
NAME="${ATTACHMENT_NAME:-$(basename "$SPEC_PATH")}"
COMMENT="${COMMENT:-Updated from CI}"
RESPONSE_FILE="$(mktemp)"
trap 'rm -f "$RESPONSE_FILE"' EXIT

# Credentials go to curl on stdin (printf is a shell builtin), so they never
# appear in the process list or in any log output.
HTTP_CODE="$(
  printf 'user = "%s:%s"\n' "$CONFLUENCE_EMAIL" "$CONFLUENCE_API_TOKEN" |
  curl --silent --show-error --config - \
    --request PUT \
    --header 'X-Atlassian-Token: nocheck' \
    --form "file=@${SPEC_PATH};filename=${NAME}" \
    --form 'minorEdit=true' \
    --form-string "comment=${COMMENT}" \
    --output "$RESPONSE_FILE" \
    --write-out '%{http_code}' \
    "${BASE_URL}/wiki/rest/api/content/${PAGE_ID}/child/attachment"
)"

case "$HTTP_CODE" in
  2??)
    echo "Uploaded ${NAME} to page ${PAGE_ID} (HTTP ${HTTP_CODE})."
    ;;
  *)
    echo "Upload failed: HTTP ${HTTP_CODE}" >&2
    cat "$RESPONSE_FILE" >&2
    echo >&2
    exit 1
    ;;
esac