• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

stacklok / toolhive / 21885824641
62%

Build:
DEFAULT BRANCH: main
Ran 10 Feb 2026 11:12PM UTC
Jobs 1
Files 520
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

10 Feb 2026 11:04PM UTC coverage: 61.518% (+0.07%) from 61.452%
21885824641

push

github

web-flow
Add SigV4 signing middleware for AWS STS token exchange (#3730)

* Add SigV4 signing middleware for AWS STS token exchange

Add an HTTP middleware that converts incoming OIDC bearer tokens into
SigV4-signed AWS requests. The pipeline extracts JWT claims from the
auth context, selects an IAM role via the RoleMapper, calls STS
AssumeRoleWithWebIdentity for temporary credentials, and signs the
outbound request with SigV4.

When a target URL is configured, the middleware clones the request with
the target host for signing purposes but copies only the SigV4 headers
(Authorization, X-Amz-Date, X-Amz-Security-Token) back to the original
request, leaving host rewriting to the reverse proxy. Request bodies are
buffered with a 10 MB size limit and restored for downstream handlers.

Also add GetService() and GetSessionDuration() config helpers, an
ErrAccessDenied sentinel, and clean up the signer's body-close handling
to use defer.

Fixes: #3569

* Move ErrAccessDenied to test file since it is only used in mocks

The ErrAccessDenied sentinel was only referenced in middleware_test.go
to simulate STS access denial. Demote it to an unexported test-local
variable to keep the public error surface honest.

* Validate session name against AWS constraints early in middleware

Call ValidateSessionName() immediately after extracting the session name
from JWT claims, before passing it to ExchangeToken(). This gives
clearer error feedback at the middleware level when the claim value
violates AWS RoleSessionName constraints (length, allowed characters).

ExchangeToken already validates internally, so this is defense-in-depth.

141 of 181 new or added lines in 3 files covered. (77.9%)

2 existing lines in 1 file now uncovered.

42716 of 69437 relevant lines covered (61.52%)

77.63 hits per line

New Missed Lines in Diff

Lines Coverage ∆ File
4
73.33
-26.67% pkg/auth/awssts/config.go
36
78.82
pkg/auth/awssts/middleware.go

Uncovered Existing Lines

Lines Coverage ∆ File
2
71.43
-1.68% pkg/vmcp/k8s/manager.go
Jobs
ID Job ID Ran Files Coverage
1 21885824641.1 10 Feb 2026 11:12PM UTC 520
61.52
GitHub Action Run
Source Files on build 21885824641
  • Tree
  • List 520
  • Changed 5
  • Source Changed 2
  • Coverage Changed 5
Coverage ∆ File Lines Relevant Covered Missed Hits/Line
  • Back to Repo
  • Github Actions Build #21885824641
  • 31966690 on github
  • Prev Build on main (#21884878574)
  • Next Build on main (#21885876010)
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc