You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Skip certificate trust preparation for HTTP-only Aspire test resources - #7618
The shared Aspire AppHost can time out before its HTTP resources start on Ubuntu. Disable custom certificate trust preparation for its nginx container and API project, matching the crashed-executable probes: neither resource needs custom CA trust, and the API receives HTTP requests and exports OTLP over HTTP.
In the original attempt of run 41928218765, both shared resources remained unknown throughout StartAsync, while the probes with CertificateTrustScope.None completed. The later resource-removal fixture also started successfully. The missing parameter is intentional coverage and also appears in successful runs; Aspire initializes it without waiting for resolution. Certificate preparation is an unnecessary startup dependency for these HTTP-only resources. This change removes it without extending the timeout, retrying startup, or weakening readiness, telemetry, or crashed-process assertions. The intermittent Ubuntu failure was not reproduced locally, so CI must confirm the mitigation there.
The engine-test harness also records child PID, exit code (or explicitly unavailable), and expected TRX path, preserving the original exception as the inner exception when child execution fails. This collects evidence for #7607 after the previous macOS culture-test child exited without captured output; it does not claim to fix that separate failure.
Validation: dotnet test --project tests/TUnit.Aspire.Tests/TUnit.Aspire.Tests.csproj --framework net10.0 passed all 180 tests on macOS with SDK 10.0.403 (baseline: 180 passed; changed: 180 passed). git diff --check passed. No shipped API changes.
Hosted validation on current head 4915a0e8761334546b77ff807ccccc34b22dd568: all checks passed, including Ubuntu Aspire (180/180 tests, net10.0, SDK 10.0.403), macOS pipeline, and Ubuntu/Windows Engine tests and AOT. Ubuntu pipeline evidence. The modified Engine.Tests project was built locally; Engine.Tests execution was left to CI per repository guidance.
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 9fdfb479-b516-457a-8db5-068acd111912
Commits
Reviewing files that changed from the base of the PR and between ba75eb4 and 4915a0e.
Files selected for processing: 1
tests/TUnit.Engine.Tests/InvokableTestBase.cs
No actionable comments were generated in the recent review.
Walkthrough
The Aspire test AppHost imports the certificate trust configuration API and sets the nginx container and API service certificate trust scopes to None. A comment states that these HTTP-only resources do not need custom CA trust bundles.
Changes: Aspire resource trust configuration
Layer / File(s)
Summary
Set HTTP resource trust scopes tests/TUnit.Aspire.Tests.AppHost/Program.cs
The nginx container and API service now set CertificateTrustScope.None. A comment notes that these HTTP-only resources do not need custom CA trust bundles.
thomhurst/TUnit#7555: The issue describes an Ubuntu Aspire startup stall with a certificate-authority setup log. This change disables certificate trust preparation for the nginx and API resources, but does not change the crashed-executable probe.
Possibly related PRs
thomhurst/TUnit#7566: This PR applies the same CertificateTrustScope.None configuration to the shared nginx and API resources that PR #7566 applied to the crashed Aspire probe.
thomhurst/TUnit#7251: This PR uses the CertificateTrustScope API provided by the Aspire AppHost version updated in PR #7251.
Merge Risk: Minimal · previous review ba75e
No actionable merge-blocking risk is identified in this configuration change.
Pre-merge checks: 4 · 1
Failed checks: 1 inconclusive
Check name
Status
Explanation
Resolution
Linked Issues check
Issue #7616 requires reliable shared Aspire startup on Ubuntu without extending the timeout or weakening assertions. The PR applies CertificateTrustScope.None to nginx-no-healthcheck and `api-serv…
Provide successful Ubuntu CI evidence for the shared Aspire fixture with SDK 10.0.403 and net10.0, or provide equivalent evidence that confirms startup completes without timeout changes or assertion changes.
Passed checks: 4 passed
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title names the main change: certificate trust preparation is skipped for the HTTP-only Aspire test resources. The raw summary shows the nginx container and API service now set CertificateTrustSco…
Out of Scope Changes check
The whole-PR diff changes only tests/TUnit.Aspire.Tests.AppHost/Program.cs. The import, comment, and CertificateTrustScope.None settings directly support issue #7616 by removing custom certificate…
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Full details: Title check
Explanation
The title names the main change: certificate trust preparation is skipped for the HTTP-only Aspire test resources. The raw summary shows the nginx container and API service now set CertificateTrustScope.None, and the PR objectives confirm this is the mitigation for the Ubuntu startup failure. The title is specific, concise, and accurate, with no file lists, emojis, or vague terms.
Full details: Out of Scope Changes check
Explanation
The whole-PR diff changes only tests/TUnit.Aspire.Tests.AppHost/Program.cs. The import, comment, and CertificateTrustScope.None settings directly support issue #7616 by removing custom certificate trust preparation for the two HTTP-only resources. No unrelated implementation, timeout change, retry, readiness change, telemetry change, or assertion weakening is present.
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files.
Full details: Linked Issues check
Explanation
Issue #7616 requires reliable shared Aspire startup on Ubuntu without extending the timeout or weakening assertions. The PR applies CertificateTrustScope.None to nginx-no-healthcheck and api-service, which directly removes the reported custom certificate preparation dependency. The reported macOS validation passed all 180 tests. The PR states that Ubuntu did not reproduce the failure, so reliable startup on the target Ubuntu environment is not established by the available evidence.
Resolution
Provide successful Ubuntu CI evidence for the shared Aspire fixture with SDK 10.0.403 and net10.0, or provide equivalent evidence that confirms startup completes without timeout changes or assertion changes.
Finishing Touches
Generate docstrings
Commit to this branch
Create a new PR
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit hops past nginx’s door, No custom CA bundles needed more. The API sets trust to None, The AppHost configures both as one. Soft paws leave a tidy trace, While HTTP resources take their place.
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 71825601-5116-4aea-8690-c20ac0ebf869
Commits
Reviewing files that changed from the base of the PR and between e640e4c and ba75eb4.
Files selected for processing: 1
tests/TUnit.Aspire.Tests.AppHost/Program.cs
Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 4 remain after this review.
The change is small and consistent with the existing crashed-executable probes, which already use CertificateTrustScope.None. Both resources only handle HTTP, so dropping custom CA trust preparation removes a startup dependency without weakening any assertions or timeouts. The using Aspire.Hosting.ApplicationModel; import is needed for the enum.
Notes:
The PR says the Ubuntu failure was not reproduced locally, so this is a mitigation, not a confirmed fix. CI needs to pass repeatedly on Ubuntu before Closes #7616 is fully justified. If it recurs, look at DCP startup or the unresolved my-secret parameter instead.
If other test AppHosts or fixtures add HTTP-only resources, they would likely need the same setting. A small helper or shared comment could avoid repeating it, but that isn't worth doing for two call sites.
Both required reviewers approved head ba75eb4 with no blocking findings, and there are no review threads. The startup change remains a mitigation whose Ubuntu validation must come from CI; no helper is warranted for these two call sites. Marking ready to run CI. Auto-merge must wait for the Claude review triggered by promotion.
Two-line change in the test AppHost: WithCertificateTrustScope(CertificateTrustScope.None) on the nginx container and the API project. It matches the existing crashed-executable probes, and both resources are HTTP-only, so skipping CA trust preparation removes a startup dependency without touching timeouts, readiness, or assertions. The added using is needed for the enum.
Notes:
The PR says the Ubuntu failure wasn't reproduced locally, so this is a mitigation. Closes #7616 should be backed by repeated green Ubuntu CI runs. If the timeout recurs, look at DCP startup or the unresolved my-secret parameter next.
A shared helper for the two call sites isn't worth it.
Run 41949899257 completed successfully; both required reviewers approved ba75eb4 without blockers. Ubuntu .NET CI passed, including the Aspire fixture. The remaining failure in run 41949898636 is macOS Reflection: Bug7126CultureInvariantDisplayNameTests(de-DE) exited after 153ms with no TRX or captured output. Its diagnostic artifact contains only two successful sibling culture sessions, not the failed child. This matches the early-child failure under investigation in #7607; an unchanged-head rerun is not justified by the available evidence.
Pushed 4915a0e to record PID, exit code (or explicitly unavailable), expected TRX path, and the original exception on child failures. This is evidence collection for #7607, not a claimed root-cause fix. Built the modified Engine.Tests project on fresh main with SDK 10.0.403: 0 errors (existing warnings); did not execute Engine.Tests locally. git diff --check passed. Fresh hosted CI and reviews must assess this head before merge; auto-merge is disabled.
AppHost (Program.cs): WithCertificateTrustScope(CertificateTrustScope.None) on the nginx container and the API project removes the certificate-preparation startup dependency. Both resources are HTTP-only, so they don't need custom CA trust. The change is small, scoped to the fixture, and doesn't touch timeouts or readiness assertions. The using Aspire.Hosting.ApplicationModel; import is needed for the enum. The comment links #7616.
InvokableTestBase.cs: The extra diagnostics (process ID, exit code, expected TRX path) are useful. Passing e as the inner exception keeps the original stack trace. commandTask, commandResult and trxPath are all in scope.
Two notes, neither blocking:
The PR says the Ubuntu failure wasn't reproduced locally, so CI over several runs is the only confirmation. If it recurs, the new diagnostics should help narrow it down.
This PR also changes TUnit.Engine.Tests, which isn't mentioned in the title or description. A line in the description would help reviewers.
The earlier wait on run 41949899257 has cleared. Current head 4915a0e has positive Claude and Codex verdicts, no review threads or inline findings, and all CI checks green. Ubuntu run 41953665808 passed all 180 Aspire tests on net10.0 with SDK 10.0.403, satisfying the requested hosted evidence without changing timeouts or assertions. The earlier head also passed Ubuntu CI, as recorded above; this is mitigation evidence, not proof that an intermittent failure can never recur. Updated the description to cover the engine child-process diagnostics and validation, addressing Claude's remaining documentation note. The existing #7607 tracks the separate child-process failure. Proceeding through the merge gate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub Actions
Inactive
The shared Aspire AppHost can time out before its HTTP resources start on Ubuntu. Disable custom certificate trust preparation for its nginx container and API project, matching the crashed-executable probes: neither resource needs custom CA trust, and the API receives HTTP requests and exports OTLP over HTTP.
In the original attempt of run 41928218765, both shared resources remained
unknownthroughoutStartAsync, while the probes withCertificateTrustScope.Nonecompleted. The later resource-removal fixture also started successfully. The missing parameter is intentional coverage and also appears in successful runs; Aspire initializes it without waiting for resolution. Certificate preparation is an unnecessary startup dependency for these HTTP-only resources. This change removes it without extending the timeout, retrying startup, or weakening readiness, telemetry, or crashed-process assertions. The intermittent Ubuntu failure was not reproduced locally, so CI must confirm the mitigation there.The engine-test harness also records child PID, exit code (or explicitly unavailable), and expected TRX path, preserving the original exception as the inner exception when child execution fails. This collects evidence for #7607 after the previous macOS culture-test child exited without captured output; it does not claim to fix that separate failure.
Validation:
dotnet test --project tests/TUnit.Aspire.Tests/TUnit.Aspire.Tests.csproj --framework net10.0passed all 180 tests on macOS with SDK 10.0.403 (baseline: 180 passed; changed: 180 passed).git diff --checkpassed. No shipped API changes.Hosted validation on current head
4915a0e8761334546b77ff807ccccc34b22dd568: all checks passed, including Ubuntu Aspire (180/180 tests, net10.0, SDK 10.0.403), macOS pipeline, and Ubuntu/Windows Engine tests and AOT. Ubuntu pipeline evidence. The modified Engine.Tests project was built locally; Engine.Tests execution was left to CI per repository guidance.Closes #7616
Summary by CodeRabbit