stacklok / stacklok/mecatl

fix(authn): restore OIDC standalone module hygiene

Open
#849 0 comments 0 reactions 1 assignee View on GitHub

@jhrozek is already working on this.

Since Aug 29, 2026.

Dominant language
Go
Stars
152
Forks
16
Avg merge
14h 48m
Merged PRs (30d)
536

Description

Problem

task test runs an OIDC standalone-hygiene gate with GOWORK=off, but CI does not run the equivalent gate. The local gate fails because authn/oidc/fixture_test.go imports the root-only package github.com/stacklok/mecatl/internal/adapter/server.

With the workspace enabled, the import resolves and the ordinary OIDC CI tests pass. With GOWORK=off, an external consumer of the opt-in authn/oidc module cannot import root internal/..., so both go mod tidy and go test ./... fail.

Regression source

The import was introduced by commit b7ca4a6359e44b4f7418efc2cbf89dcdbfcf11f4 in #796:

Expected behavior

  • cd authn/oidc && GOWORK=off go mod tidy succeeds.
  • cd authn/oidc && GOWORK=off go test ./... succeeds.
  • CI enforces the same OIDC standalone gate as local task test.

Suggested repair

Keep the OIDC-module test limited to OIDC construction/JWKS behavior. Move or retain the HTTP middleware 503 assertion in the root server test suite, where internal/adapter/server belongs. Do not add a root-module requirement or replace directive to the OIDC module.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.