From 36c506918d0ed5f0b2f4a57ab4bb8f9ae029ee7a Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 19 Sep 2026 12:18:08 +1000 Subject: [PATCH] Declare the vault service port and bound integration HTTP calls --- .woodpecker/integration.yaml | 4 ++++ integration_test.go | 12 ++++++++++-- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/.woodpecker/integration.yaml b/.woodpecker/integration.yaml index 0c95c91..0af9cc9 100644 --- a/.woodpecker/integration.yaml +++ b/.woodpecker/integration.yaml @@ -6,6 +6,10 @@ when: services: - name: vault image: hashicorp/vault:1.20 + # The kubernetes backend builds the Service from this list; without it the + # service resolves but carries no port. + ports: + - 8200 environment: # Throwaway dev-mode server; this token grants nothing outside this pod. VAULT_DEV_ROOT_TOKEN_ID: dev-root-token diff --git a/integration_test.go b/integration_test.go index 48a5733..9524cf3 100644 --- a/integration_test.go +++ b/integration_test.go @@ -50,6 +50,10 @@ func itVaultToken() string { return "root" } +// Every call is bounded so an unreachable server fails the suite instead of +// hanging a CI step on a blackholed connect. +var itClient = &http.Client{Timeout: 15 * time.Second} + func itWaitForVault(t *testing.T) { t.Helper() @@ -57,7 +61,11 @@ func itWaitForVault(t *testing.T) { url := itVaultAddr() + "/v1/sys/health?standbyok=true" var last error for time.Now().Before(deadline) { - resp, err := http.Get(url) // #nosec G107 + req, err := http.NewRequest(http.MethodGet, url, nil) + if err != nil { + t.Fatalf("building health request: %v", err) + } + resp, err := itClient.Do(req) if err == nil { _ = resp.Body.Close() if resp.StatusCode == http.StatusOK { @@ -91,7 +99,7 @@ func itVaultAPI(t *testing.T, method, path string, body any) map[string]any { req.Header.Set("X-Vault-Token", itVaultToken()) req.Header.Set("Content-Type", "application/json") - resp, err := http.DefaultClient.Do(req) + resp, err := itClient.Do(req) if err != nil { t.Fatalf("%s %s: %v", method, path, err) }