38281118091
70%
main: 70%

Ran 12 Oct 2026 04:59PM UTC

Jobs 1

Files 19

Run time 1min

Badge

Embed ▾

Committed 12 Oct 2026 04:57PM UTC coverage: 70.41%. Remained the same

Build # 38281118091

Build Type

Pull #113

github

Committed by

bassosimone

Commit Message

fix(openapi.yaml): use CREDENTIALS_PROJECT

While staging and sandbox use the same project for deploying
the autojoin API and for credentials, production is configured
differently and uses two projects:

1. `mlab-oti` as the project with the token exchange endpoint

2. `mlab-autojoin` as the project with the autojoin API

The original motivation for this split is to manage the autojoined
machines as a separate cloud project, while using a single, central
endpoint for exchanging tokens.

Yet, the current `openapi.yaml` uses `{{PROJECT}}` as opposed to
`{{CREDENTIALS_PROJECT}}` in the `x-google-jwks_uri` definition and,
in turn, this leads to the following URL being used in prod:

```
https://auth.mlab-autojoin.measurementlab.net/.well-known/jwks.json
```

The `auth.mlab-autojoin.measurementlab.net` domain does not exist,
which prevents the ESP from validating JWTs.

Spotted while working on upgrading `byos-debian` to use `v0.5.0`
of the `m-lab/autojoin/cmd/register` client. The symptom is
that JWT validation fails with this error:

```
JWT validation failed: Unable to fetch verification key
```

Pull Request Pull Request #113: fix(openapi.yaml): use CREDENTIALS_PROJECT

Coverage Stats

1254 of 1781 relevant lines covered (70.41%)

0.78 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	0 - 38281118091.1	12 Oct 2026 04:59PM UTC	19	70.41	GitHub Action Run

m-lab / autojoin / 38281118091
70%
main: 70%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 38281118091

m-lab / autojoin / 38281118091 70% main: 70%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 38281118091

m-lab / autojoin / 38281118091
70%
main: 70%

README BADGES
x