31064576372
70%

Ran 06 Aug 2026 02:12AM UTC

Jobs 1

Files 870

Run time 2min

Badge

Embed ▾

Committed 06 Aug 2026 02:04AM UTC coverage: 69.904% (-0.05%) from 69.955%

Build # 31064576372

Build Type

push

github

Committed by

web-flow

Commit Message

Pass CA-aware HTTP client to JWKS registration (#6220)

The TokenValidator attaches its CA-aware HTTP client (custom CA
bundle, private-IP policy, auth token) only at the httprc client
level. jwx v3.1.0 changed Cache.Register to inject jwx's own default
client as a resource-level option when the caller does not supply
one, and httprc gives the resource-level client precedence at fetch
time. On jwx >= 3.1.0 every JWKS fetch would therefore silently
bypass the CA-aware client and fail TLS verification against issuers
using a private CA.

Pass the client per-resource at Register time instead. This is a
no-op on the current jwx v3.0.13 pin and keeps JWKS fetches on the
correct client across the upgrade. The existing TLS-with-custom-CA
tests in token_test.go act as the regression canary.

Fixes #6219

Co-authored-by: Dan Barr <6922515+danbarr@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Coverage Stats

82948 of 118660 relevant lines covered (69.9%)

98.09 hits per line

Coverage Regressions

Lines	Coverage	∆	File
59	62.08	-4.64%	pkg/workloads/manager.go
5	0.0	-100.0%	pkg/workloads/sysproc_unix.go
4	57.75	-0.3%	pkg/container/docker/client.go
3	96.63	-0.44%	pkg/authz/authorizers/cedar/core.go
2	93.94	-6.06%	pkg/foreach/foreach.go

Jobs

ID	Job ID	Ran	Files	Coverage
1	31064576372.1	06 Aug 2026 02:12AM UTC	870	69.9	GitHub Action Run

stacklok / toolhive / 31064576372
70%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 31064576372

stacklok / toolhive / 31064576372 70%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 31064576372

stacklok / toolhive / 31064576372
70%

README BADGES
x