Skip to content

Commit 859147a

Browse files
ardetrickardetrick
authored
ci: fail on lint warnings and add upstream canary workflow (#175)
Adds -Werror so lint warnings — notably uses of deprecated upstream API — fail compilation; the two current uses of URI helpers deprecated upstream are suppressed with TODOs to migrate to discovery-resolved URIs after the next testcontainers-ory-hydra release. -Werror can be disabled with -PlenientLint=true. Moves the testcontainers-ory-hydra dependency into a version catalog (gradle/libs.versions.toml); a settings-level catalog overwrite lets -PtestcontainersOryHydraVersion select a different published version, which the canary uses for its latest-release jobs. Adds a weekly/manually-dispatched canary workflow building this app against upstream in a {main, latest-release} x {lenient, strict} matrix: main via a Gradle composite build (catches unreleased breaking changes), latest-release via the newest published Maven Central artifact (catches pin drift and validates the artifact users consume). Lenient red means upstream actually breaks this app; strict red with lenient green means new deprecations to migrate. Informational only; does not gate merges.
1 parent dda268d commit 859147a

6 files changed

Lines changed: 147 additions & 1 deletion

File tree

‎.github/workflows/upstream-canary.yml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
# Canary: builds this reference implementation against upstream
2+
# testcontainers-ory-hydra in a matrix of upstream targets and lint modes.
3+
#
4+
# Upstream targets:
5+
# - main: unreleased upstream, substituted via a Gradle composite
6+
# build (--include-build; matched by group:name, the pinned
7+
# version is ignored). Catches breaking changes before they
8+
# are released.
9+
# - latest-release: the newest published artifact from Maven Central,
10+
# selected via -PtestcontainersOryHydraVersion. Catches
11+
# drift between this app's pin and the latest release, and
12+
# exercises the artifact users actually consume.
13+
#
14+
# Lint modes:
15+
# - lenient red = that upstream target actually breaks this app: act now.
16+
# - strict red with lenient green = new deprecation warnings from upstream:
17+
# a migration heads-up, nothing is broken yet.
18+
#
19+
# Informational only — it does not gate merges.
20+
name: Upstream Canary
21+
22+
on:
23+
workflow_dispatch:
24+
schedule:
25+
# Weekly, Monday 09:00 UTC.
26+
- cron: '0 9 * * 1'
27+
28+
permissions:
29+
contents: read
30+
31+
jobs:
32+
canary:
33+
name: canary (${{ matrix.upstream }}, ${{ matrix.lint }})
34+
runs-on: ubuntu-latest
35+
strategy:
36+
fail-fast: false
37+
matrix:
38+
upstream: [main, latest-release]
39+
lint: [lenient, strict]
40+
steps:
41+
- uses: actions/checkout@v7
42+
- name: Check out upstream testcontainers-ory-hydra (main)
43+
if: matrix.upstream == 'main'
44+
uses: actions/checkout@v7
45+
with:
46+
repository: ardetrick/testcontainers-ory-hydra
47+
ref: main
48+
path: upstream-library
49+
- name: Resolve latest upstream release version
50+
if: matrix.upstream == 'latest-release'
51+
id: latest-release
52+
env:
53+
GH_TOKEN: ${{ github.token }}
54+
run: |
55+
TAG=$(gh api repos/ardetrick/testcontainers-ory-hydra/releases/latest --jq .tag_name)
56+
echo "Latest upstream release: $TAG"
57+
echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
58+
- name: Set up JDK 21
59+
uses: actions/setup-java@v5
60+
with:
61+
java-version: '21'
62+
distribution: 'temurin'
63+
cache: 'gradle'
64+
- name: Setup ms-playwright cache
65+
id: setup-ms-playwright-cache
66+
uses: actions/cache@v6
67+
with:
68+
path: /home/runner/.cache/ms-playwright
69+
key: ms-playwright-cache-${{ runner.os }}-${{ hashFiles('reference-app/build.gradle.kts') }}
70+
- name: Install Playwright Dependencies
71+
if: steps.setup-ms-playwright-cache.outputs.cache-hit != 'true'
72+
run: |
73+
./gradlew playwright --args="install-deps" --no-daemon
74+
./gradlew playwright --args="install" --no-daemon
75+
- name: Build against upstream main
76+
if: matrix.upstream == 'main'
77+
env:
78+
PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
79+
run: >
80+
./gradlew build
81+
${{ matrix.lint == 'lenient' && '-PlenientLint=true' || '' }}
82+
--include-build upstream-library --no-daemon
83+
- name: Build against latest upstream release
84+
if: matrix.upstream == 'latest-release'
85+
env:
86+
PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
87+
run: >
88+
./gradlew build
89+
${{ matrix.lint == 'lenient' && '-PlenientLint=true' || '' }}
90+
-PtestcontainersOryHydraVersion=${{ steps.latest-release.outputs.version }}
91+
--no-daemon

‎README.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -333,6 +333,25 @@ Get token (no scopes screen):
333333

334334
![get token](docs/images/remember-me/5-after-login-submit-second-time.png)
335335

336+
## Building against a different testcontainers-ory-hydra version
337+
338+
The `testcontainersOryHydraVersion` Gradle property overrides the version pinned in
339+
`gradle/libs.versions.toml`:
340+
341+
```
342+
./gradlew build -PtestcontainersOryHydraVersion=0.0.6
343+
```
344+
345+
This property is relied on by the [upstream canary workflow](.github/workflows/upstream-canary.yml)
346+
in this repository and by the pre-release compatibility workflow in
347+
[testcontainers-ory-hydra](https://github.com/ardetrick/testcontainers-ory-hydra), so keep it
348+
intact when refactoring the build. To build against an unreleased *checkout* of the library
349+
instead, use a Gradle composite build:
350+
351+
```
352+
./gradlew build --include-build ../testcontainers-ory-hydra
353+
```
354+
336355
## Task List
337356

338357
- [ ] Add a fancier UI

‎gradle/libs.versions.toml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
[versions]
2+
# Default pin. CI overrides this via -PtestcontainersOryHydraVersion (see settings.gradle.kts);
3+
# do not inline this version back into build.gradle.kts.
4+
testcontainersOryHydra = "0.0.5"
5+
6+
[libraries]
7+
testcontainers-ory-hydra = { module = "com.ardetrick.testcontainers:testcontainers-ory-hydra", version.ref = "testcontainersOryHydra" }

‎reference-app/build.gradle.kts‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ dependencies {
1111
implementation("org.springframework.session:spring-session-core")
1212
implementation("sh.ory.hydra:hydra-client:26.2.0")
1313

14-
testImplementation("com.ardetrick.testcontainers:testcontainers-ory-hydra:0.0.5")
14+
testImplementation(libs.testcontainers.ory.hydra)
1515
testImplementation("com.auth0:java-jwt:4.5.2")
1616
testImplementation("com.microsoft.playwright:playwright:1.61.0")
1717
testImplementation("org.springframework.boot:spring-boot-starter-test")
@@ -24,6 +24,13 @@ tasks.withType<Test> {
2424

2525
tasks.withType<JavaCompile> {
2626
options.compilerArgs.add("-Xlint")
27+
// -Werror fails the build on any lint warning — notably uses of deprecated/for-removal
28+
// upstream API. Intentional exceptions are marked with @SuppressWarnings at the call site.
29+
// The upstream canary's lenient job disables it (-PlenientLint=true) so that new upstream
30+
// deprecations read as a migration heads-up there, not as a break.
31+
if (!providers.gradleProperty("lenientLint").map(String::toBoolean).getOrElse(false)) {
32+
options.compilerArgs.add("-Werror")
33+
}
2734
}
2835

2936
// A way to run Playwright CLI commands using the Java source dependency.

‎reference-app/src/test/java/com/ardetrick/oryhydrareference/OryHydraReferenceApplicationFunctionalTests.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,9 @@ private OAuth2Client createOAuthClient() throws ApiException {
156156
* @link <a href="https://www.ory.sh/docs/reference/api#tag/wellknown/operation/discoverJsonWebKeys"/>
157157
*/
158158
@Test
159+
// TODO: after upgrading past testcontainers-ory-hydra 0.0.5, resolve jwks_uri from the
160+
// discovery document (getOpenIdDiscoveryUri()) and drop this suppression.
161+
@SuppressWarnings("removal")
159162
void requestToJwksUriReturns200() throws IOException, InterruptedException {
160163
val request = HttpRequest.newBuilder(dockerComposeEnvironment.getPublicJwksUri())
161164
.build();
@@ -195,6 +198,9 @@ public void loginInvalidCredentials() {
195198
assertThat(page.content()).contains("invalid credentials try again");
196199
}
197200

201+
// TODO: after upgrading past testcontainers-ory-hydra 0.0.5, resolve authorization_endpoint
202+
// from the discovery document (getOpenIdDiscoveryUri()) and drop this suppression.
203+
@SuppressWarnings("removal")
198204
private URI getUriToInitiateFlow() {
199205
try {
200206
return new URIBuilder(dockerComposeEnvironment.getOAuth2AuthUri())

‎settings.gradle.kts‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,19 @@ plugins {
55
rootProject.name = "ory-hydra-reference"
66

77
include("reference-app")
8+
9+
dependencyResolutionManagement {
10+
versionCatalogs {
11+
create("libs") {
12+
// Overwrites the catalog's testcontainersOryHydra version:
13+
// ./gradlew build -PtestcontainersOryHydraVersion=<version>
14+
// Relied on by .github/workflows/upstream-canary.yml in this repo AND by the
15+
// reference-app-compat workflow in ardetrick/testcontainers-ory-hydra — do not
16+
// remove without updating both.
17+
val override = providers.gradleProperty("testcontainersOryHydraVersion")
18+
if (override.isPresent) {
19+
version("testcontainersOryHydra", override.get())
20+
}
21+
}
22+
}
23+
}

0 commit comments

Comments
 (0)