Repository navigation
ci: one command tests a release on the OpenID Foundation's hosted suite before production - #526
Draft
PiquelChips wants to merge 1 commit into
Draft
PiquelChips wants to merge 1 commit into
PiquelChips wants to merge 1 commit into
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
PiquelChips
force-pushed
the
ci/conformance-release
branch
from
November 13, 2026 22:30
681ed85 to
31602d2
Compare
PiquelChips
marked this pull request as draft
November 13, 2026 22:31
…uite `just conformance release` promotes staging's current release into a new public `conformance` environment, runs the hosted suite at www.certification.openid.net against it with that commit's plans and expectations, stops the environment whatever happens, and, if every result matched, offers to promote the same deployment to production. piquelctl asks before each promotion. The driver takes the suite's address and API token, and runs the back-channel logout plan whenever auth can reach the suite.
PiquelChips
force-pushed
the
ci/conformance-release
branch
from
November 13, 2026 22:31
31602d2 to
de1be60
Compare
PiquelChips
added
standards
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The local conformance run (#519) uses the OpenID Foundation's suite, but on our own deployment of it, against a local auth. The official setup, where certification happens, is their hosted suite, and it can only reach a public auth. Staging is on the tailnet, and testing production would leave test clients and accounts there and only catch problems after a release.
Now
just conformance releasemakes testing a release one command:plans.jsonandexpected.jsonfrom the commit it was built from.conformanceenvironment, public athttps://auth-conformance.sourceorigin.dev. piquelctl asks first.The environment is declared in
infra/piqueld.toml(promoted from staging, flat hostnames under*.sourceorigin.dev, the admin dashboard on the tailnet, no sign-in providers). The driver takes the hosted suite's API token throughCONFORMANCE_SUITE_TOKEN.just conformanceandjust conformance <url>work as before.Before the first run: merge this so piqueld creates the environment, and grant it the Resend key once (
piquelctl app secret sourceorigin access resend-dev --environments staging,conformance --previews). The tests/conformance README and the promotion procedure document it.I checked the hosted suite accepts the token, and reran the local mode. The release flow itself can only run once the environment exists, after merge.
Stacked on #519.
Note
Written by Claude Opus 5.5 in Claude Code (via T3 Code)