chore: enforce explicit API visibility decisions

[Aniruddha-Shriwant]

Description

Adds a Redocly lint rule requiring every added or modified OpenAPI operation to explicitly set x-internal: true or x-internal: false.

The rule rejects missing markers and non-boolean values. During the migration period, enforcement is scoped to changed OpenAPI source files so existing unclassified operations do not block unrelated work. Once all existing operations are reviewed and backfilled, the same rule can be enabled globally.

When it runs

• Locally before commits: a tracked pre-commit hook checks staged OpenAPI source files after one-time setup with git config core.hooksPath .githooks
• In GitHub Actions: the same script checks the complete PR diff for pull requests targeting main
• Manually: run scripts/lint-visibility.sh --staged

Validation

• Unit coverage for true, false, missing, invalid type, and changed-file scoping
• Verified with Redocly CLI 2.19.0
• Confirmed explicitly marked operations pass
• Confirmed changed operations without the marker fail
• Local hook and CI invoke the same lint runner

Repository follow-up

After this workflow lands and produces its first status, add the visibility-lint job to the required status checks for main. Currently only secrets-scan is required by branch protection.

Clickup

app.clickup.com