stacklok / toolhive / 23864539872
65%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 598
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 65.484% (-0.1%) from 65.611%
23864539872

push

github

web-flow 
Wire MCPOIDCConfig into MCPServer controller (#4481)

* Wire MCPOIDCConfig into MCPServer controller

Enable MCPServer to reference shared MCPOIDCConfig resources for OIDC
authentication via a new `oidcConfigRef` field, deprecating the inline
`oidcConfig` approach. This reduces configuration duplication and enables
centralized OIDC provider management.

Key changes:
- Add `oidcConfigRef` field to MCPServerSpec with CEL mutual exclusion
  against the legacy `oidcConfig` field
- Extend the OIDC resolver with `ResolveFromConfigRef` to merge shared
  provider config with per-server audience/scopes overrides
- Add `handleOIDCConfig` to MCPServer controller for validation, hash
  tracking, status conditions, and ReferencingServers updates
- Wire MCPOIDCConfig watches into MCPServer controller for change
  propagation
- Add deletion protection in MCPOIDCConfig controller when servers
  still reference the config
- Add reference tracking (ReferencingServers) via MCPServer watches
- Regenerate CRDs and RBAC manifests

Closes #4253
Closes #4248

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Address review feedback from @claude

- Fix watch handler to enqueue MCPOIDCConfigs that still list a server
  in ReferencingServers, covering the case where a server removes its
  oidcConfigRef (previously only the currently-referenced config was
  enqueued, leaving stale entries)
- Eliminate redundant OIDC resolution in createRunConfigFromMCPServer
  by resolving once and using the result for both RunConfig options and
  embedded auth server config (previously AddOIDCConfigRefOptions called
  ResolveFromConfigRef internally, then it was called again)
- Remove now-unused AddOIDCConfigRefOptions helper

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add integration tests for MCPOIDCConfig + MCPServer interaction

Add envtest integration tests covering the cross-resource interaction
between MCPServer and MCPOIDCConfig, replac... (continued)

181 of 402 new or added lines in 7 files covered. (45.02%)

49 existing lines in 9 files now uncovered.

53766 of 82106 relevant lines covered (65.48%)

62.07 hits per line

Uncovered Changes

Lines Coverage ∆ File
93
56.34
 -1.45% cmd/thv-operator/controllers/mcpserver_controller.go
49
56.36
 -16.05% cmd/thv-operator/controllers/mcpoidcconfig_controller.go
34
54.05
 -45.95% cmd/thv-operator/pkg/controllerutil/oidc_volumes.go
30
69.17
 -5.01% cmd/thv-operator/controllers/mcpserver_runconfig.go
11
24.36
 -4.0% cmd/thv-operator/pkg/oidc/mocks/mock_resolver.go
2
93.85
 -2.38% cmd/thv-operator/pkg/controllerutil/oidc.go
2
97.37
 -0.16% cmd/thv-operator/pkg/oidc/resolver.go

Coverage Regressions

Lines Coverage ∆ File
14
74.44
 -5.19% pkg/client/config.go
11
68.42
 -14.47% pkg/client/discovery.go
8
23.56
 -4.6% pkg/client/manager.go
6
76.15
 -5.5% pkg/secrets/keyring/keyctl_linux.go
5
82.81
 0.0% pkg/vmcp/composer/workflow_engine.go
2
73.2
 -0.65% pkg/runner/config.go
1
56.36
 -16.05% cmd/thv-operator/controllers/mcpoidcconfig_controller.go
1
56.34
 -1.45% cmd/thv-operator/controllers/mcpserver_controller.go
1
69.17
 -5.01% cmd/thv-operator/controllers/mcpserver_runconfig.go
Jobs
ID Job ID Ran Files Coverage
1 23864539872.1 598
65.48
 GitHub Action Run
Source Files on build 23864539872