From e3c15ecc3c815bd476d43395038f515c8bc3d8e0 Mon Sep 17 00:00:00 2001 From: yoshi49535 Date: Mon, 14 Sep 2026 15:44:34 +0900 Subject: [PATCH] =?UTF-8?q?test:=20drop=20the=20Provin=20compatibility=20j?= =?UTF-8?q?ob=20=E2=80=94=20a=20downstream=20consumer's=20checks=20are=20i?= =?UTF-8?q?ts=20own?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #26 added a CI job that packs the pinned provider and verifier builds and runs provin-line/auth's source, DID grant, collectors and generated composition roots against them, pinned here as PROVIN_REV. That puts one named consumer inside the auth family's release gate: every documented BREAKING change turns the release-cut pin PR red until that consumer catches up, as the v0.10.0 verifier cut did (Provin's tests held evaluate() unawaited). The auth family is independent of any consumer. What it owes one is generic extension points — custom grants, collectors, module wiring — and those are tested in the component repos and by this repository's E2E without naming a consumer. Checking that a particular consumer builds against a new auth release, and adapting it, belongs to that consumer's repository. Removes the provin-compatibility job, PROVIN_REV and the setup-provin / test-provin targets, tests/provin, and the paragraph in docs/internal-adoption.md that pointed at it. test-e2e is unchanged. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/e2e.yml | 18 --------- Makefile | 13 ------- docs/internal-adoption.md | 5 --- tests/provin/README.md | 19 ---------- tests/provin/run.mjs | 77 --------------------------------------- 5 files changed, 132 deletions(-) delete mode 100644 tests/provin/README.md delete mode 100644 tests/provin/run.mjs diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index e45b933..cbbcf82 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -7,24 +7,6 @@ on: workflow_dispatch: jobs: - provin-compatibility: - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 - with: - node-version: "24" - - name: Enable pnpm via corepack - run: | - npm install -g corepack --force - corepack enable - corepack prepare pnpm@10.29.3 --activate - - name: Clone dependencies over HTTPS - run: git config --global url."https://github.com/".insteadOf "git@github.com:" - - name: Test pinned Provin source against the candidate auth packages - run: make test-provin - test-e2e: runs-on: ubuntu-latest timeout-minutes: 30 diff --git a/Makefile b/Makefile index 6a2c706..84f9d45 100644 --- a/Makefile +++ b/Makefile @@ -2,7 +2,6 @@ PROVIDER_REV := 4c44adfbf8e780863c1d7c22bf0129a86bdc62d9 PROXY_REV := 9fc0dab66bcbb74c189c2b17812cf50851b9d2f2 VERIFIER_REV := cc982b795efc8807712b3db9ef596182a3bfd815 -PROVIN_REV := abb14d9ff971e88261447dd255863301f22c3a7c define clone_or_pull @if [ -d "$(1)/.git" ]; then \ @@ -24,18 +23,6 @@ setup: .PHONY: pull pull: setup -# Exercise the actual downstream DID grant and policy extensions before release. -.PHONY: setup-provin test-provin -setup-provin: - $(call clone_or_pull,repos/auth.provider,git@github.com:o3co/auth.provider.git,$(PROVIDER_REV)) - $(call clone_or_pull,repos/auth.policy-verifier,git@github.com:o3co/auth.policy-verifier.git,$(VERIFIER_REV)) - $(call clone_or_pull,repos/provin.auth,git@github.com:provin-line/auth.git,$(PROVIN_REV)) - -test-provin: setup-provin - cd repos/auth.provider && pnpm install --frozen-lockfile && pnpm --filter @o3co/auth-provider-oauth... run build - cd repos/auth.policy-verifier && pnpm install --frozen-lockfile && pnpm --filter @o3co/auth.policy-verifier.server... --filter @o3co/auth.policy-verifier.builtins... run build - node tests/provin/run.mjs - .PHONY: status status: @for dir in repos/auth.provider repos/auth.proxy repos/auth.policy-verifier; do \ diff --git a/docs/internal-adoption.md b/docs/internal-adoption.md index fc7424a..eee170f 100644 --- a/docs/internal-adoption.md +++ b/docs/internal-adoption.md @@ -1,10 +1,5 @@ # Internal adoption baseline -The actual Provin consumer also has a separate -[compatibility check](../tests/provin/README.md): `make test-provin`. It tests -the pinned downstream DID extensions and generated composition roots against -candidate auth packages without publishing a release. - Start with ordinary Bearer access tokens, the provider's real login and PKCE authorization-code flow, and signature-verifying policy evaluation. The E2E also covers session-grant issuance and an optional validation proxy. Component diff --git a/tests/provin/README.md b/tests/provin/README.md deleted file mode 100644 index 26372b9..0000000 --- a/tests/provin/README.md +++ /dev/null @@ -1,19 +0,0 @@ -# Provin consumer compatibility - -`make test-provin` tests actual `provin-line/auth` source pinned in the Makefile -against the candidate Provider/Verifier revisions used by the Bearer E2E suite. -It packs the five Provider/Verifier packages, overriding every matching direct -and transitive dependency. No npm release or image push is needed. - -It covers workspace build/typecheck/tests, DID issuance and HTTP policy decisions, -then generated composition-root build/typecheck/config tests, service startup and -the generated Provider's valid/tampered DID-signature grant. - -`repos/provin.auth` is disposable: its manifest/lockfile are rewritten and -`instances/` regenerated. Use a fresh checkout for fresh dependency resolution. -Do not use this test checkout for application work. - -The consumer's generated release pins remain unchanged. Deploying the candidate -fixes requires deliberately using the tested artifacts/revisions and updating -configuration. This check does not deploy a Provin node, prove registry ACLs or -exercise a Web/mobile application's login flow. diff --git a/tests/provin/run.mjs b/tests/provin/run.mjs deleted file mode 100644 index c5836ea..0000000 --- a/tests/provin/run.mjs +++ /dev/null @@ -1,77 +0,0 @@ -import { execFileSync } from "node:child_process"; -import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"; -import { resolve } from "node:path"; - -// npm_execpath also lets local callers select an already installed pnpm CLI. -const cli = process.env.npm_execpath; -const root = resolve(import.meta.dirname, "../.."); -const consumer = resolve(root, "repos/provin.auth"); -// Generated workspaces from an earlier run must not enter the source test pass. -rmSync(resolve(consumer, "instances"), { recursive: true, force: true }); -const artifacts = resolve(consumer, ".auth-compatibility"); -mkdirSync(artifacts, { recursive: true }); -function pnpm(cwd, ...args) { - execFileSync(cli ? process.execPath : "pnpm", cli ? [cli, ...args] : args, { - cwd, - stdio: "inherit", - env: { ...process.env, npm_config_manage_package_manager_versions: "false" }, - }); -} - -// Pack the real build output. pnpm pack rewrites workspace:* dependencies; -// overrides then replace every upstream dependency, including transitive ones. -// Directories are relative to the cloned repo root. @o3co/auth.utils is no -// longer packed: Provin's scaffolds stopped emitting it (provin-line/auth#22), -// which was the package's last consumer across the family. -const packages = [ - ["auth.provider", "packages/core"], - ["auth.provider", "packages/oauth"], - ["auth.policy-verifier", "packages/core"], - ["auth.policy-verifier", "packages/builtins"], - ["auth.policy-verifier", "packages/server"], -]; -const manifestPath = resolve(consumer, "package.json"); -const manifest = JSON.parse(readFileSync(manifestPath, "utf8")); -manifest.pnpm ??= {}; -manifest.pnpm.overrides ??= {}; -for (const [repo, directory] of packages) { - const cwd = resolve(root, "repos", repo, directory); - const { name, version } = JSON.parse(readFileSync(resolve(cwd, "package.json"), "utf8")); - pnpm(cwd, "pack", "--pack-destination", artifacts); - const archive = `${name.replace(/^@/, "").replaceAll("/", "-")}-${version}.tgz`; - manifest.pnpm.overrides[name] = `file:./.auth-compatibility/${archive}`; -} -writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`); - -// The consumer's original lock remains the baseline for other dependencies. -// Only this disposable checkout is changed; no package or image is published. -pnpm(consumer, "install", "--no-frozen-lockfile"); -pnpm(consumer, "-r", "run", "build"); -pnpm(consumer, "-r", "--if-present", "run", "typecheck"); -pnpm(consumer, "-r", "run", "test"); - -// Also exercise generated composition roots: their configuration and explicit -// module wiring are a separate contract from the hand-built integration fixture. -const ref = execFileSync("git", ["rev-parse", "HEAD"], { cwd: consumer, encoding: "utf8" }).trim(); -for (const [generator, name] of [ - ["create-provider", "provider"], - ["create-policy-verifier", "policy-verifier"], -]) { - execFileSync(process.execPath, [ - `packages/${generator}/dist/cli.mjs`, name, - "--dplaax-module-ref", ref, "--out", `instances/${name}`, "--no-git-init", - ], { cwd: consumer, stdio: "inherit" }); -} -pnpm(consumer, "install", "--no-frozen-lockfile"); -for (const task of ["build", "typecheck", "test"]) { - pnpm(consumer, "--filter", "./instances/*", "--if-present", "run", task); -} -for (const [name, port, path] of [ - ["provider", "3000", "/_healthcheck"], - ["policy-verifier", "3001", "/healthcheck"], -]) { - execFileSync("bash", ["scripts/smoke-instance.sh", `instances/${name}`, port, path], - { cwd: consumer, stdio: "inherit" }); -} -execFileSync(process.execPath, ["scripts/smoke-did-grant.mjs", "instances/provider", "3100"], - { cwd: consumer, stdio: "inherit" });