Run the dockerised e2e suite with write auth enabled #181

2026-11-02T22:02:02+11:00

unkin-agent commented

2026-11-02 22:02:02 +11:00

Write auth broke buildkit pushes in production because the dockerised e2e suite runs artifactapi with auth disabled, so no real client ever authenticated a publish.

serve a static mock OIDC issuer; TestMain generates the key, writes the JWKS and mints tokens
run the stack with ARTIFACTAPI_AUTH_UPLOADS=true
authenticate each local publish the way its client does (curl Bearer/Basic, docker login, npm, gem, ansible-galaxy)
assert publishes without a token or with a foreign-key token get 401 and anonymous reads still work
add docker CLI, buildx and helm OCI push cases; skip the last two until unkin/artifactapi#180 lands

Write auth broke buildkit pushes in production because the dockerised e2e suite runs artifactapi with auth disabled, so no real client ever authenticated a publish. - serve a static mock OIDC issuer; TestMain generates the key, writes the JWKS and mints tokens - run the stack with ARTIFACTAPI_AUTH_UPLOADS=true - authenticate each local publish the way its client does (curl Bearer/Basic, docker login, npm, gem, ansible-galaxy) - assert publishes without a token or with a foreign-key token get 401 and anonymous reads still work - add docker CLI, buildx and helm OCI push cases; skip the last two until unkin/artifactapi#180 lands

unkin-agent added 1 commit 2026-11-02 22:02:02 +11:00

Run the dockerised e2e suite with write auth enabled

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/build Pipeline was successful

Details

a161c44575

Real clients now authenticate every local publish against a static mock
OIDC issuer, and each type checks unauthenticated publishes are refused
while anonymous reads keep working.

unkin-agent commented

2026-11-02 22:04:33 +11:00

e2e-docker/local_test.go:126 — deb Packages poll rewrite is a test-race fix unrelated to write auth → split into its own PR (or drop; the old getEventually would still fail only on the empty-index race, so it is independent of this change).
nit: e2e-docker/docker_local_test.go:~219, e2e-docker/helm_local_test.go:~76 — t.Skip cites a branch name (benvin/registry-token-oauth-post) that disappears on merge → cite an issue/PR number so the skips are traceable and removable.

- e2e-docker/local_test.go:126 — deb Packages poll rewrite is a test-race fix unrelated to write auth → split into its own PR (or drop; the old getEventually would still fail only on the empty-index race, so it is independent of this change). - nit: e2e-docker/docker_local_test.go:~219, e2e-docker/helm_local_test.go:~76 — t.Skip cites a branch name (benvin/registry-token-oauth-post) that disappears on merge → cite an issue/PR number so the skips are traceable and removable.

unkin-agent added 1 commit 2026-11-02 22:19:27 +11:00

Drop the deb index poll change and cite #180 in registry-token skips

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/build Pipeline was successful

Details

c1571f1960

unkin-agent commented

2026-11-02 22:24:10 +11:00

No findings.

ci/woodpecker/pr/pre-commit Pipeline was successful

Required

Details

ci/woodpecker/pr/test Pipeline was successful

Required

Details

ci/woodpecker/pr/build Pipeline was successful

Required

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin benvin/e2e-oidc-auth:benvin/e2e-oidc-auth

git checkout benvin/e2e-oidc-auth

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/artifactapi#181