Fix common base path detection to match only complete path segments

[Copilot]

Purpose

When running bal openapi align on specs with paths like /v2/organizations and /v2.1/organizations/{id}/accounts, the base path detection incorrectly matches /v2 as a prefix of /v2.1/... due to character-level startsWith() matching. This causes paths to become .1/organizations/... (missing leading /).

Related: ballerina-platform/ballerina-library#8574

Goals

Ensure common base path extraction only matches complete path segments, not partial segment prefixes.

Approach

Two changes in OASModifier.java:

• Added startsWithPathSegment() - Validates prefix matches at segment boundaries (followed by / or exact match)
• Changed removeCommonPath() to use substring() - Prevents incorrect replacement when path contains repeated segments like /api/api/test

// Before: /v2.1/orgs → matches /v2 prefix → becomes .1/orgs
if (nonParameterizedPath.startsWith(commonPath)) { ... }

// After: /v2.1/orgs does NOT match /v2 (different segment)
if (startsWithPathSegment(nonParameterizedPath, commonPath)) { ... }

User stories

N/A

Release note

Fixed an issue where bal openapi align would corrupt paths when the API had similar version prefixes (e.g., /v2/ and /v2.1/), causing paths to lose their leading slash.

Documentation

N/A - Bug fix with no API changes

Training

N/A

Certification

N/A - Bug fix

Marketing

N/A

Automation tests

• Unit tests
  • Added testBasePathWithVersionMismatch() in OASModifierTests.java with test spec basepath_version_mismatch.yaml
• Integration tests
  • N/A

Security checks

• Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines? yes
• Ran FindSecurityBugs plugin and verified report? yes (CodeQL - no alerts)
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets? yes

Samples

N/A

Related PRs

N/A

Migrations (if applicable)

N/A

Test environment

Java 17

Learning

N/A

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• maven.wso2.org
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED -Xmx4096M -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant -cp /home/REDACTED/.gradle/wrapper/dists/gradle-8.11.1-bin/bpt9gzteqjrbo1mjrsomdt32c/gradle-8.11.1/lib/gradle-daemon-main-8.11.1.jar (dns block)
• testng.org
  • Triggering command: /opt/hostedtoolcache/CodeQL/2.23.9/x64/codeql/tools/linux64/java/bin/java /opt/hostedtoolcache/CodeQL/2.23.9/x64/codeql/tools/linux64/java/bin/java -jar /opt/hostedtoolcache/CodeQL/2.23.9/x64/codeql/xml/tools/xml-extractor.jar --fileList=/home/REDACTED/work/openapi-tools/.codeql-scratch/dbs/java/working/files-to-index16067121267421666683.list --sourceArchiveDir=/home/REDACTED/work/openapi-tools/.codeql-scratch/dbs/java/src --outputDir=/home/REDACTED/work/openapi-tools/.codeql-scratch/dbs/java/trap/java -j ACCEPT (dns block)
• www.puppycrawl.com
  • Triggering command: /opt/hostedtoolcache/CodeQL/2.23.9/x64/codeql/tools/linux64/java/bin/java /opt/hostedtoolcache/CodeQL/2.23.9/x64/codeql/tools/linux64/java/bin/java -jar /opt/hostedtoolcache/CodeQL/2.23.9/x64/codeql/xml/tools/xml-extractor.jar --fileList=/home/REDACTED/work/openapi-tools/.codeql-scratch/dbs/java/working/files-to-index16067121267421666683.list --sourceArchiveDir=/home/REDACTED/work/openapi-tools/.codeql-scratch/dbs/java/src --outputDir=/home/REDACTED/work/openapi-tools/.codeql-scratch/dbs/java/trap/java -j ACCEPT (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud