stacklok / toolhive / 25560882915
65%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 720
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 64.851% (+0.04%) from 64.815%
25560882915

push

github

web-flow 
Guard RedisStorageConfig CEL rules with has() checks (#5228)

* Guard RedisStorageConfig CEL rules with has() checks

The two XValidation rules on RedisStorageConfig accessed self.addr and
self.clusterMode directly. Both fields are +optional with omitempty, so
when a user submits a sentinel-only config the fields are absent from
the validated object and CEL aborts with "no such key: addr" /
"no such key: clusterMode" before the rule's own logic runs, rejecting
configurations the rules were meant to allow.

Wrap each scalar access in has(...) so the rules see absent fields as
"unset" rather than failing evaluation. Truth tables for sentinel-only,
standalone, cluster, both-set, and neither-set are unchanged.

Regenerate operator manifests and CRD reference docs.

* Add envtest regression test for RedisStorageConfig CEL rules

Cover the six relevant cases of the addr / sentinelConfig / clusterMode
truth table by submitting MCPExternalAuthConfigs to the envtest
apiserver. Three are expected to admit (sentinel-only, standalone,
cluster), three are expected to reject (neither set, both set,
clusterMode without addr).

The sentinel-only case mirrors the github-mcp-demo config that
surfaced this bug. With the previous unguarded rules the apiserver
returned 422 with "no such key: addr"; with the has()-guarded rules
the case admits cleanly.

Tests live in the existing mcp-external-auth integration suite so they
pick up the suite_test.go envtest bootstrap (CRDs loaded from the
generated chart, real apiserver enforcing CEL).

63397 of 97758 relevant lines covered (64.85%)

60.63 hits per line

Jobs
ID Job ID Ran Files Coverage
1 25560882915.1 720
64.85
 GitHub Action Run
Source Files on build 25560882915