feat: source location tracking for all breaking change checks

[reuvenharrison]

Summary

• Adds precise source location (file, line, column) to every breaking change reported by oasdiff
• Each Change now carries BaseSource and RevisionSource with the exact position in the base and revision spec files
• When origin tracking is enabled via openapi3.IncludeOrigin = true, all 93 checkers report locations
• --format githubactions uses RevisionSource for inline annotations with file/line/col precision
• Depends on kin-openapi#1128 for file path propagation
• Closes Provide source code lines when reporting breaking changes #574

Changes

New types and interfaces

• checker.Source struct with File, Line, Column fields
• CommonChange.BaseSource / RevisionSource fields on all change types
• GetBaseSource() / GetRevisionSource() methods on the Change interface
• WithSources() builder method on ApiChange, ComponentChange, SecurityChange

Checker updates (93 files)

• Every NewApiChange(...) call chains .WithSources(baseSource, revisionSource)
• operationSources() helper computes sources from operation pairs
• Sources only populated when origin tracking is enabled (backward compatible)

Source precision tiers

Tier 1 — Sub-object Origin:

• SchemaSources() — source pair from schema Origins
• ParameterSources() — source pair from parameter Origins
• ResponseSources() — source pair from response Origins

Tier 2 — Field-level Origin:

• SchemaFieldSources() — source pair from a specific field within schema Origins (e.g., type: line)
• ParameterFieldSources() — source pair from a specific field within parameter Origins
• OperationFieldSources() — source pair from a specific field within operation Origins

Tier 3 — Sequence item Origin:

• NewSourceFromSequenceItem() — source from a specific item in a sequence field (e.g., a particular enum value)
• SchemaDeletedItemSources() / SchemaAddedItemSources() — source pair for deleted/added sequence items

Nil convention for missing side

• Added items: baseSource = nil (didn't exist in base)
• Deleted items: revisionSource = nil (doesn't exist in revision)
• "Set" changes (field goes from unset to set): baseSource = nil
• "Unset" changes (field goes from set to unset): revisionSource = nil
• NewSourceFromField returns nil when the field doesn't exist in Origin (no fallback to parent)
• NewSourceFromSequenceItem returns nil when the item isn't found

GitHub Actions formatter migration

• --format githubactions now uses GetRevisionSource() for file=, line=, col= annotation parameters
• Annotations with RevisionSource appear inline on PR diffs at the exact line of the change
• Falls back to operation source file (no line/col) when RevisionSource is nil
• Removal-type changes (revisionSource = nil) emit ::error title=...::message without file= — they appear in the Actions log but not inline on the diff, since the removed element only exists in the base file which cannot be referenced by GitHub annotations
• HTTP URLs in source paths are filtered (annotations require local file paths)
• Dropped endLine/endColumn parameters (never populated)

Other formatter updates

• JSON and YAML formatters include baseSource/revisionSource in output

Infrastructure

• diff.go: passes both base and revision operation sources
• diff/security_schemes.go: added Base/Revision fields for component-level source tracking
• go.mod: uses oasdiff/kin-openapi fork with origin file tracking
• yaml3 feat/origin-enhancements: sequence field keys now tracked in origin.Fields (in addition to items in origin.Sequences)

Known limitations

No source locations

• Global security changes (api-global-security-*) — spec-root-level changes with no operation context; SecurityRequirementsDiff does not store original objects needed for Origins.
• Operation security changes (api-security-*) — security is a complex array-of-objects not tracked at field level in Origin; pointing to the operation line would be misleading.

No per-item sequence precision

• x-extensible-enum checkers (check_request_parameter_x_extensible_enum_value_removed.go, check_request_property_x_extensible_enum_value_removed.go) — x-extensible-enum is an extension, not tracked in Origin.Sequences. Uses schema/parameter-level sources.
• list-of-types checkers (check_request_parameter_list_of_types_changed.go, check_request_property_list_of_types_changed.go, check_response_property_list_of_types_changed.go) — reports aggregated diffs (joined string of all added/deleted types), not per-item. Uses field-level sources.
• response required property updated (check_response_required_property_updated.go) — iterates property schemas via CheckDeletedPropertiesDiff/CheckAddedPropertiesDiff, not required list items. Already uses propertySource which points to the property schema itself.

Removal-type changes and GitHub annotations

• GitHub Actions ::error file=,line= annotations can only reference lines in the head (revision) commit. There is no mechanism to annotate a line in the base file before a change.
• Removal-type breaking changes (endpoint removed, property removed, etc.) only have a BaseSource — the removed element doesn't exist in the revision file.
• These changes emit ::error without file= so they appear in the Actions log and checks summary, but not inline on the PR diff.
• For inline annotation of removals, the PR Review API with side: LEFT can comment on deleted lines in the diff — this is a separate, richer mechanism suitable for a paid tier.

Other

• Origin key matching is case-sensitive. Origin tracks YAML keys as literally written. If a YAML file uses readonly instead of the canonical readOnly, the source lookup won't match. This matches the OpenAPI specification which requires camelCase field names.

Test plan

• 4 new source tracking tests covering all checker patterns
• 14 existing source tracking tests for add/remove checkers
• 6 tests for sub-object and field-level source helpers
• Formatter tests updated to use RevisionSource instead of deprecated fields
• Full test suite passes
• go vet clean
• Backward compatible - no sources populated when IncludeOrigin is false

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

❌ Patch coverage is 84.72776% with 115 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.25%. Comparing base (9ee0f2b) to head (0327c53).

Files with missing lines	Patch %	Lines
checker/source.go	78.32%	31 Missing and 13 partials ⚠️
checker/check_request_property_min_set.go	14.28%	4 Missing and 2 partials ⚠️
checker/check_request_property_min_updated.go	44.44%	3 Missing and 2 partials ⚠️
checker/check_response_status_updated.go	68.75%	3 Missing and 2 partials ⚠️
...cker/check_request_property_min_items_increased.go	42.85%	3 Missing and 1 partial ⚠️
checker/check_request_property_min_items_set.go	0.00%	4 Missing ⚠️
checker/check_response_property_max_increased.go	0.00%	4 Missing ⚠️
checker/check_response_property_min_decreased.go	0.00%	4 Missing ⚠️
checker/check_response_property_min_items_unset.go	0.00%	4 Missing ⚠️
checker/security_change.go	0.00%	4 Missing ⚠️
... and 17 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #752      +/-   ##
==========================================
- Coverage   89.55%   89.25%   -0.30%     
==========================================
  Files         239      240       +1     
  Lines       12154    12627     +473     
==========================================
+ Hits        10884    11270     +386     
- Misses        840      903      +63     
- Partials      430      454      +24     

Flag	Coverage Δ
unittests	89.25% <84.72%> (-0.30%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.