Five steps carry almost all the value.
Validate the definition against the specification, so a malformed contract never reaches anyone.
Lint it against your ruleset, with the results posted into the pull request where they will be read.
Diff it against the previous version to detect breaking changes, and fail — or require an explicit acknowledgement — when one appears. This is the step most teams do not have and the one that prevents the most consumer pain.
Contract-test the deployed API against the definition. Call it for real and assert that responses validate against the schemas. This is what catches drift between what you promised and what you ship.
Publish the artifacts: the definition to your catalog, the documentation, the collection, the mock, the SDK. If publishing is a manual step somebody does when they remember, everything downstream is stale.
When I measured real pipelines in the wild, most stopped at “linter turned on, default rules,” treating the green check as the whole of governance. The pipeline is the visible fingerprint of governance rather than governance itself — but if the visible part is thin, the invisible conversations almost certainly have not happened either.
