test: add Provin consumer compatibility to auth CI - #26
Merged
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
The new test-provin Makefile target installs auth.utils without --frozen-lockfile, which is inconsistent with the repo’s other pinned dependency installs and reduces CI determinism.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds a dedicated Provin consumer compatibility check to the auth CI so the pinned downstream provin-line/auth source is exercised against the same pinned candidate Provider/Verifier (and utils) revisions used by the existing Bearer E2E workflow, without publishing any artifacts.
Changes:
- Introduces
make test-provinto clone pinned repos, build candidate packages, and run the Provin compatibility script. - Adds
tests/provin/run.mjsplus documentation to pack candidate artifacts, override downstream dependencies, and run build/typecheck/tests + generated-instance smoke checks. - Extends the GitHub Actions E2E workflow with a separate
provin-compatibilityjob.
File summaries
| File | Description |
|---|---|
tests/provin/run.mjs |
Packs candidate packages into tarballs, rewrites Provin’s pnpm.overrides, runs workspace checks, generates composition roots, and smokes instances. |
tests/provin/README.md |
Documents what make test-provin covers and the disposable nature of the checkout. |
Makefile |
Adds pinned UTILS_REV/PROVIN_REV plus setup-provin/test-provin targets to run the new suite. |
docs/internal-adoption.md |
Links internal adoption docs to the new Provin compatibility check. |
.github/workflows/e2e.yml |
Adds a new CI job to run make test-provin alongside the existing E2E job. |
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
3 tasks
y1o1
added a commit
that referenced
this pull request
Sep 14, 2026
…cks are its own #26 added a CI job that packs the pinned provider and verifier builds and runs provin-line/auth's source, DID grant, collectors and generated composition roots against them, pinned here as PROVIN_REV. That puts one named consumer inside the auth family's release gate: every documented BREAKING change turns the release-cut pin PR red until that consumer catches up, as the v0.10.0 verifier cut did (Provin's tests held evaluate() unawaited). The auth family is independent of any consumer. What it owes one is generic extension points — custom grants, collectors, module wiring — and those are tested in the component repos and by this repository's E2E without naming a consumer. Checking that a particular consumer builds against a new auth release, and adapting it, belongs to that consumer's repository. Removes the provin-compatibility job, PROVIN_REV and the setup-provin / test-provin targets, tests/provin, and the paragraph in docs/internal-adoption.md that pointed at it. test-e2e is unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The generic Bearer E2E suite did not exercise Provin's DID grant, custom collectors or generated composition roots. Add a separate CI job that packs the pinned Provider/Verifier builds and tests the actual pinned Provin source against those artifacts.
make test-provincovers consumer build/typecheck/tests, real DID issuance and policy allow/deny, generated app configuration/build/startup, and tampered DID-signature rejection. Direct and transitive upstream dependencies are replaced in a disposable checkout; no release or publish is performed. This requires the Provin compatibility fixes in provin-line/auth#20.Validation: local candidate-package tests and generated Provider/Verifier smoke pass; issuer/audience rejection and non-Owner subject denial pass. The existing 39-test Bearer E2E remains a separate required job. Consumer deployment pins/configuration still require deliberate application adoption, documented in the test README.