23592475437
70%

Ran 26 Mar 2026 11:48AM UTC

Jobs 1

Files 584

Run time 2min

Badge

Embed ▾

Committed 26 Mar 2026 11:42AM UTC coverage: 65.279% (-0.003%) from 65.282%

Build # 23592475437

Build Type

push

github

Committed by

web-flow

Commit Message

Fall through to well-known discovery when resource metadata auth fails (#4371)

When a server returns resource_metadata in its WWW-Authenticate header,
Priority 3 (RFC 9728) would hard-return on any failure, preventing
Priorities 4 and 5 from running. For servers like Sourcegraph and
Deepsearch whose authorization_servers list contains path-based URLs
(e.g. /.api/mcp/deepsearch), RFC 8414 tenant extraction generates
/.well-known/oauth-authorization-server/.api/mcp/deepsearch — an
endpoint those servers don't serve. Validation fails, Priority 3
errors, and auth is broken despite Priorities 4/5 being able to
derive the correct root-domain issuer.

Fix by capturing the error from tryDiscoverFromResourceMetadata and
only returning on success; failures now log at DEBUG and fall through
to well-known probing (Priority 4) and URL-derived issuer (Priority 5),
restoring the behaviour that existed before 6cad0b59.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Coverage Stats

52057 of 79746 relevant lines covered (65.28%)

65.24 hits per line

Coverage Regressions

Lines	Coverage	∆	File
2	82.62	-0.26%	pkg/vmcp/composer/workflow_engine.go
2	51.71	-0.19%	pkg/workloads/manager.go

Jobs

ID	Job ID	Ran	Files	Coverage
1	23592475437.1	26 Mar 2026 11:48AM UTC	584	65.28	GitHub Action Run

stacklok / toolhive / 23592475437
70%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 23592475437

stacklok / toolhive / 23592475437 70%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 23592475437

stacklok / toolhive / 23592475437
70%

README BADGES
x