stacklok / toolhive / 33157044852

70%

Build Type

push

github

Committed by web-flow

Commit Message

Trust private CAs for RFC 8693 trusted issuers (#6437)

* Regenerate OpenAPI docs for upstream CA fields

The new CAFilePath fields on the authserver upstream run-configs are part
of the generated API surface, so the committed spec no longer matched what
swag produces and the docgen check failed.

Regenerating also drops the package qualification from 21 schema keys
(authserver, tokenexchange, ratelimit/types, audit, operator v1beta1).
swag qualifies a key only when it sees the same package name twice, and
the added fields shift which packages it double-counts. No API change --
the renames and their $ref updates account for nearly all of the diff.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Collapse swag enum repeats of any count

The dedupe-enums workaround only recognized an exactly doubled enum array,
but swag's repeat count varies by machine -- this branch's docs were
generated on one that tripled them, so the arrays survived untouched and
the docgen check still failed against CI's deduped output.

Match any whole-number repeat instead of only 2x, and collapse the three
affected arrays in the generated spec.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Add trusted issuer CA bundle support

Fixes #6429

* Include actorMatcher in trusted issuer validation

buildTrustedIssuerConfigs omitted ActorMatcher while its controllerutil
twin copied it, so the CRD-time validator always compiled an empty matcher.
A malformed CEL expression therefore passed admission and only surfaced
when the auth server failed to start, as a CrashLoopBackOff rather than a
status condition.

* Assert the JWKS fetch stage, not the x509 cause

The negative CA bundle test asserted the error contained "x509", but jwx's
httprc layer does not propagate that cause: the registration fails as
"resource registered but not ready" once the fetch times out. Assert on the
stage that failed instead, which together with the success case stil... (continued)

Coverage Stats

88 of 111 new or added lines in 10 files covered. (79.28%)

20 existing lines in 9 files now uncovered.

76167 of 109389 relevant lines covered (69.63%)

91.38 hits per line