ci: add refresh-fixtures workflow for contract snapshot auto-update

Provides a manual workflow_dispatch trigger to fetch live responses from
openboot.dev and open a PR updating fixtures/config-v1.json. Validates
the updated fixture against the schema before opening the PR, so a
breaking API change surfaces immediately rather than silently drifting.

snapshot-v1.json is intentionally skipped — it is CLI-generated and must
be updated manually when the snapshot format changes.

Author: fullstackjam

.github/workflows/refresh-fixtures.yml

@@ -0,0 +1,110 @@
+name: Refresh Fixtures
+
+# Run on demand to update contract fixtures from the live API.
+# Use this after intentionally changing the API format so fixtures stay
+# in sync with the schema and real server responses.
+
+on:
+  workflow_dispatch:
+    inputs:
+      api_url:
+        description: 'API base URL (defaults to https://openboot.dev)'
+        required: false
+        default: 'https://openboot.dev'
+
+jobs:
+  refresh:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install dependencies
+        run: pip install jsonschema requests
+
+      - name: Fetch live responses and update fixtures
+        env:
+          API_URL: ${{ inputs.api_url }}
+        run: |
+          python3 - <<'EOF'
+          import json, os, sys, urllib.request
+
+          api_url = os.environ.get('API_URL', 'https://openboot.dev').rstrip('/')
+
+          def fetch(url):
+              with urllib.request.urlopen(url, timeout=15) as r:
+                  return json.loads(r.read())
+
+          updates = []
+
+          # Fetch a real config response for config-v1.json fixture
+          # Use the openbootdotdev/default config which should always exist
+          try:
+              config = fetch(f'{api_url}/openbootdotdev/default/config')
+              with open('fixtures/config-v1.json', 'w') as f:
+                  json.dump(config, f, indent=2)
+                  f.write('\n')
+              updates.append('fixtures/config-v1.json')
+              print(f'  ✓ Updated fixtures/config-v1.json from {api_url}')
+          except Exception as e:
+              print(f'  ✗ Could not fetch config: {e}', file=sys.stderr)
+              sys.exit(1)
+
+          # snapshot-v1.json is a CLI-generated file, not a live API response.
+          # It is intentionally not auto-refreshed here — update it manually
+          # when the snapshot format changes (run: openboot snapshot --json).
+          print('  - Skipping snapshot-v1.json (CLI-generated, update manually)')
+
+          print(f'\nUpdated: {updates}')
+          EOF
+
+      - name: Validate updated fixtures still match schemas
+        run: |
+          python3 -c "
+          import json, jsonschema, sys
+
+          checks = [
+            ('schemas/remote-config.json', 'fixtures/config-v1.json'),
+            ('schemas/snapshot.json', 'fixtures/snapshot-v1.json'),
+          ]
+
+          failed = 0
+          for schema_path, fixture_path in checks:
+            schema = json.load(open(schema_path))
+            data = json.load(open(fixture_path))
+            try:
+              jsonschema.validate(data, schema)
+              print(f'  ✓ {fixture_path} matches {schema_path}')
+            except jsonschema.ValidationError as e:
+              print(f'  ✗ {fixture_path}: {e.message}')
+              failed += 1
+
+          if failed:
+            print()
+            print('Schema validation failed — the live response no longer matches the schema.')
+            print('Update the schema in schemas/ before merging.')
+          sys.exit(1 if failed else 0)
+          "
+
+      - name: Open PR with updated fixtures
+        uses: peter-evans/create-pull-request@v6
+        with:
+          commit-message: "chore: refresh contract fixtures from live API"
+          title: "chore: refresh contract fixtures"
+          body: |
+            Auto-generated by the **Refresh Fixtures** workflow.
+
+            Fetched live responses from `${{ inputs.api_url }}` and updated
+            `fixtures/config-v1.json`.
+
+            Review the diff to confirm the changes are intentional. Once
+            merged, the contract CI will re-validate both consumer repos.
+          branch: chore/refresh-fixtures
+          delete-branch: true
+          labels: "contract,automated"