cc-ci

recipe-maintainers/cc-ci

Fork 0

Commit Graph

Author	SHA1	Message	Date
autonomic-bot	874bfbb915	feat(2): Q3.1 partial — lasuite-docs PARITY + health_check + auth_required (Q2.4 still passes) - tests/lasuite-docs/PARITY.md: parity table for health_check.py (ported); oidc_login.py + upload_conversion.py documented as Q3.1 follow-up needing OIDC env wiring; ≥2 recipe-specific tests rationale (test_oidc_with_keycloak + test_auth_required). - tests/lasuite-docs/functional/test_health_check.py: parity port of recipe-info/lasuite-docs/tests/health_check.py — HTTP 200/301/302 from root. - tests/lasuite-docs/functional/test_auth_required.py: NEW recipe-specific — GET /api/v1.0/users/me/ asserts 401/403 (auth required). Non-vacuous: distinguishes correctly-wired OIDC gate from anonymous access (200), missing route (404), broken (5xx). The Q2.4 acceptance test (test_oidc_with_keycloak.py) continues to verify the dep resolver + SSO harness against the per-run keycloak dep (F2-5 fix verified cold; see ccci-f25-verify.log). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-28 09:21:00 +01:00
autonomic-bot	9e88741864	feat(2): Q2.4 acceptance — lasuite-docs + keycloak dep + OIDC password grant (cold green) - tests/lasuite-docs/recipe_meta.py: DEPS = ['keycloak'] declares the SSO provider dep. Orchestrator deploys a per-run keycloak BEFORE lasuite-docs (Q2.3 dep resolver) and tears it down AFTER in finally. - tests/lasuite-docs/functional/test_oidc_with_keycloak.py: Q2 gate acceptance test. - Asserts deps_apps['keycloak'] is the per-run dep domain. - Calls harness.sso.setup_keycloak_realm to create realm/client/test-user idempotently. - GET /.well-known/openid-configuration; asserts issuer = https://<kc>/realms/lasuite-docs. - harness.sso.oidc_password_grant: password-grant flow; asserts the JWT iss/azp/typ/exp. - Non-vacuous: each step uses real per-run-generated creds (class-B per §4.4-B), would fail on broken admin API / token endpoint / wrong claims. Cold-verifiable on cc-ci (log /root/ccci-q24-lasuite-keycloak.log): RECIPE=lasuite-docs STAGES=install,custom cc-ci-run runner/run_recipe_ci.py ===== DEPS: ['keycloak'] ===== dep: deploying keycloak -> keyc-c12afe.ci.commoninternet.net dep: keycloak ready @ keyc-c12afe.ci.commoninternet.net ===== TIER: install ===== 2 PASS (generic + cc-ci overlay) ===== TIER: custom ===== 1 PASS (test_oidc_password_grant_against_dep_keycloak) ===== DEPS teardown ===== ===== RUN SUMMARY ===== deploy-count = 2 (expect 2) # 1 parent + 1 dep Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-28 08:08:11 +01:00

Author

SHA1

Message

Date

autonomic-bot

874bfbb915

feat(2): Q3.1 partial — lasuite-docs PARITY + health_check + auth_required (Q2.4 still passes)

- tests/lasuite-docs/PARITY.md: parity table for health_check.py (ported);
  oidc_login.py + upload_conversion.py documented as Q3.1 follow-up needing OIDC env wiring;
  ≥2 recipe-specific tests rationale (test_oidc_with_keycloak + test_auth_required).
- tests/lasuite-docs/functional/test_health_check.py: parity port of
  recipe-info/lasuite-docs/tests/health_check.py — HTTP 200/301/302 from root.
- tests/lasuite-docs/functional/test_auth_required.py: NEW recipe-specific —
  GET /api/v1.0/users/me/ asserts 401/403 (auth required). Non-vacuous: distinguishes
  correctly-wired OIDC gate from anonymous access (200), missing route (404), broken (5xx).

The Q2.4 acceptance test (test_oidc_with_keycloak.py) continues to verify the dep resolver +
SSO harness against the per-run keycloak dep (F2-5 fix verified cold; see ccci-f25-verify.log).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-28 09:21:00 +01:00

autonomic-bot

9e88741864

feat(2): Q2.4 acceptance — lasuite-docs + keycloak dep + OIDC password grant (cold green)

- tests/lasuite-docs/recipe_meta.py: DEPS = ['keycloak'] declares the SSO provider dep.
  Orchestrator deploys a per-run keycloak BEFORE lasuite-docs (Q2.3 dep resolver) and tears it
  down AFTER in finally.
- tests/lasuite-docs/functional/test_oidc_with_keycloak.py: Q2 gate acceptance test.
  - Asserts deps_apps['keycloak'] is the per-run dep domain.
  - Calls harness.sso.setup_keycloak_realm to create realm/client/test-user idempotently.
  - GET /.well-known/openid-configuration; asserts issuer = https://<kc>/realms/lasuite-docs.
  - harness.sso.oidc_password_grant: password-grant flow; asserts the JWT iss/azp/typ/exp.
  - Non-vacuous: each step uses real per-run-generated creds (class-B per §4.4-B), would fail
    on broken admin API / token endpoint / wrong claims.

Cold-verifiable on cc-ci (log /root/ccci-q24-lasuite-keycloak.log):
  RECIPE=lasuite-docs STAGES=install,custom cc-ci-run runner/run_recipe_ci.py
  ===== DEPS: ['keycloak'] =====
    dep: deploying keycloak -> keyc-c12afe.ci.commoninternet.net
    dep: keycloak ready @ keyc-c12afe.ci.commoninternet.net
  ===== TIER: install =====   2 PASS (generic + cc-ci overlay)
  ===== TIER: custom =====    1 PASS (test_oidc_password_grant_against_dep_keycloak)
  ===== DEPS teardown =====
  ===== RUN SUMMARY =====
  deploy-count = 2 (expect 2)   # 1 parent + 1 dep

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-28 08:08:11 +01:00

2 Commits