From 9234f05fb546dc351f13efe8fe3354aea1c6356d Mon Sep 17 00:00:00 2001 From: Matthew Jackson Date: Sat, 8 Aug 2026 16:00:58 -0700 Subject: [PATCH 1/2] ci: make public-hygiene-lint green The public-hygiene gate flags text in customer-readable files that describes how the software was BUILT rather than what it DOES. Every hit in this repo is rewritten to state the behaviour or the invariant; no allow markers are added, so the gate keeps its teeth. --- .github/scripts/next-version.sh | 2 +- .github/workflows/release-selftest.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/scripts/next-version.sh b/.github/scripts/next-version.sh index 27fce0e..a0c3758 100755 --- a/.github/scripts/next-version.sh +++ b/.github/scripts/next-version.sh @@ -2,7 +2,7 @@ # next-version.sh — compute THIS repo's next release tag for release-on-upstream.yml. # # Single source of truth for the version math, exercised in CI by release-selftest.yml so the -# release automation can't silently rot (guard #135.8). Prints "v.." to stdout. +# release automation can't silently rot. Prints "v.." to stdout. # # Inputs (env, all optional): # INPUT_VERSION explicit version to cut (leading "v" tolerated) -> used verbatim. diff --git a/.github/workflows/release-selftest.yml b/.github/workflows/release-selftest.yml index a6aafb6..9cfa502 100644 --- a/.github/workflows/release-selftest.yml +++ b/.github/workflows/release-selftest.yml @@ -1,4 +1,4 @@ -# CI self-test for the release-on-upstream version-compute logic (guard #135.8). +# CI self-test for the release-on-upstream version-compute logic. # Runs the REAL .github/scripts/next-version.sh against synthetic repos and asserts it produces a # valid next version for BOTH the has-prior-tag and no-prior-tag cases — WITHOUT publishing anything. # This is what keeps the release automation from silently rotting before the fleet fan-out is armed. From d2595f66ada380dace46d1ec2b528f55feaf3b4e Mon Sep 17 00:00:00 2001 From: matthew Date: Sat, 8 Aug 2026 19:15:08 -0700 Subject: [PATCH 2/2] tests: the e2e fixture config could not boot busbar 1.5.3 busbar 1.5.3 retired two config surfaces this fixture still used: `auth.methods:` and INLINE module entries under `auth.admin_auth:`. An identity provider is now defined ONCE under `identity-providers:` -- `browser_login` and `settings` hanging off that single definition -- and referenced elsewhere by bare name. A config still carrying the old shape is not merely deprecated: core recognises it as a 1.x config and refuses to start, so the fixture described a gateway that could never come up. All the test could report was the symptom, a long way from the cause: test github_*_flow ... FAILED panicked at tests/e2e.rs: busbar exited early during health poll: exit status: 1 Reproduced by rendering this fixture's own YAML and feeding it to a `busbar` built from the core branch CI tests against: [error] config.yaml: this looks like a busbar 1.x config; run `busbar --migrate-config ` and review the flagged items. 1.x markers found: - `auth.methods:` (retired 1.5.3 -> the matching `identity-providers:` definition (browser_login + settings are per-provider)) - `auth.admin_auth:` carries INLINE module entries (retired 1.5.3 -> define the provider once under `identity-providers:` and reference it by bare name) The replacement shape is core's own `--migrate-config` output for the previous fixture, confirmed by re-validating: the 1.x gate is cleared and the only remaining complaint is that the github plugin is not in the plugins directory, which is precisely what this test puts there. --- busbar-auth-github-plugin/tests/e2e.rs | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/busbar-auth-github-plugin/tests/e2e.rs b/busbar-auth-github-plugin/tests/e2e.rs index 22b406b..14e2380 100644 --- a/busbar-auth-github-plugin/tests/e2e.rs +++ b/busbar-auth-github-plugin/tests/e2e.rs @@ -277,6 +277,18 @@ fn github_get_flow_mints_key_via_core_executed_hops() { ) .unwrap(); + // busbar 1.5.3 retired both `auth.methods:` and INLINE entries under `auth.admin_auth:`: an + // identity provider is now defined ONCE under `identity-providers:` (its `browser_login` and + // `settings` hanging off that one definition) and referenced elsewhere by bare name. A config + // still carrying the old shape is not merely deprecated — core recognises it as a 1.x config + // and refuses to start at all, so this fixture described a gateway that could never boot and + // the test failed a long way from the cause, as `busbar exited early during health poll: exit + // status: 1`. The shape below is what core's own `--migrate-config` produces for the previous + // fixture, then confirmed by feeding the rendered YAML back through `busbar --validate`. + // + // Note `token_base` sits under `settings:`, NOT under `browser_login:` where the migrator puts + // it; the migrator's own output is rejected by `--validate` with "unknown field `token_base`". + // That is a core bug, not a choice made here. let config = work.join("config.yaml"); std::fs::write( &config, @@ -284,11 +296,14 @@ fn github_get_flow_mints_key_via_core_executed_hops() { "listen: \"127.0.0.1:{data_port}\"\n\ public_url: \"https://gate.busbar.e2e\"\n\ auth:\n key_ttl: \"7d\"\n signing_key: {{ file: \"{signing}\" }}\n chain:\n - keys\n\ - \x20 admin_auth:\n - admin-tokens: {{ token: {{ env: BUSBAR_ADMIN_TOKEN }} }}\n\ - \x20 methods:\n github:\n browser_login:\n client_id: \"Iv1.e2eclient\"\n\ - \x20 client_secret: {{ env: BUSBAR_GH_CLIENT_SECRET }}\n\ - \x20 token_base: \"{wm}\"\n api_base: \"{wm}\"\n authorize_base: \"{wm}\"\n\ + \x20 admin_auth: [admin-tokens]\n\ \x20 role_bindings:\n github:\n \"github:org/testorg\":\n group: eng-team\n\ + identity-providers:\n\ + \x20 admin-tokens: {{ module: admin-tokens, token: {{ env: BUSBAR_ADMIN_TOKEN }} }}\n\ + \x20 github:\n module: github\n\ + \x20 settings:\n token_base: \"{wm}\"\n api_base: \"{wm}\"\n authorize_base: \"{wm}\"\n\ + \x20 browser_login:\n client_id: \"Iv1.e2eclient\"\n\ + \x20 client_secret: {{ env: BUSBAR_GH_CLIENT_SECRET }}\n\ plugins:\n enabled: true\n dir: {plugins}\n trust:\n allow_unsigned: true\n\ groups:\n eng-team:\n limits:\n - {{ requests: 1000000, per: day }}\n\ \x20 child_default:\n limits:\n - {{ budget: 5000, per: month }}\n - {{ requests: 1000, per: day }}\n\