feat(materials): add OPENAPI_SPEC, ASYNCAPI_SPEC, GRAPHQL_SPEC material types

[javirln]

OpenAPI and AsyncAPI crafters validate specs against embedded JSON Schemas (with cascade version detection and noStrictValidation support). GraphQL crafter parses SDL using gqlparser. All three extract metadata annotations and support both JSON and YAML formats where applicable.

[cubic-dev-ai]

6 issues found across 42 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="internal/schemavalidators/external_schemas/openapi/openapi-3.1.schema.json">

<violation number="1" location="internal/schemavalidators/external_schemas/openapi/openapi-3.1.schema.json:967">
P1: The Link Object schema uses `body` instead of the OpenAPI-defined `server` property, causing incorrect validation behavior.</violation>
</file>

<file name="pkg/attestation/crafter/materials/asyncapi.go">

<violation number="1" location="pkg/attestation/crafter/materials/asyncapi.go:127">
P2: Selecting the first protocol from a map is non-deterministic; the annotated protocol can change between runs for the same AsyncAPI document.</violation>
</file>

<file name="pkg/attestation/crafter/materials/openapi.go">

<violation number="1" location="pkg/attestation/crafter/materials/openapi.go:108">
P2: `injectAnnotations` overwrites existing material annotations, removing metadata set earlier (such as `chainloop.material.size`).</violation>
</file>

<file name="pkg/attestation/crafter/materials/graphql_test.go">

<violation number="1" location="pkg/attestation/crafter/materials/graphql_test.go:115">
P2: Assertions in subtests are bound to the parent `*testing.T`; create assertion helpers per subtest (or pass `t` directly) so failures are attributed to the correct case.</violation>
</file>

<file name="pkg/attestation/crafter/materials/graphql.go">

<violation number="1" location="pkg/attestation/crafter/materials/graphql.go:76">
P2: Do not reinitialize `m.Annotations` here; it clears metadata set earlier (e.g., material size).</violation>
</file>

<file name="internal/schemavalidators/external_schemas/openapi/openapi-3.0.schema.json">

<violation number="1" location="internal/schemavalidators/external_schemas/openapi/openapi-3.0.schema.json:421">
P2: Link schema is missing the requirement that at least one of `operationId` or `operationRef` must be present, so invalid Link objects can pass validation.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[jiparis]

looks good, thanks. check those Cubic reviews just in case.