fix(authn): restore OIDC standalone module hygiene
@jhrozek is already working on this.
Since Aug 29, 2026.
- Dominant language
- Go
- Stars
- 152
- Forks
- 16
- Avg merge
- 14h 48m
- Merged PRs (30d)
- 536
Description
Problem
task test runs an OIDC standalone-hygiene gate with GOWORK=off, but CI does not run the equivalent gate. The local gate fails because authn/oidc/fixture_test.go imports the root-only package github.com/stacklok/mecatl/internal/adapter/server.
With the workspace enabled, the import resolves and the ordinary OIDC CI tests pass. With GOWORK=off, an external consumer of the opt-in authn/oidc module cannot import root internal/..., so both go mod tidy and go test ./... fail.
Regression source
The import was introduced by commit b7ca4a6359e44b4f7418efc2cbf89dcdbfcf11f4 in #796:
- PR: https://github.com/stacklok/mecatl/pull/796
- Commit: https://github.com/stacklok/mecatl/commit/b7ca4a6359e44b4f7418efc2cbf89dcdbfcf11f4
Expected behavior
cd authn/oidc && GOWORK=off go mod tidysucceeds.cd authn/oidc && GOWORK=off go test ./...succeeds.- CI enforces the same OIDC standalone gate as local
task test.
Suggested repair
Keep the OIDC-module test limited to OIDC construction/JWKS behavior. Move or retain the HTTP middleware 503 assertion in the root server test suite, where internal/adapter/server belongs. Do not add a root-module requirement or replace directive to the OIDC module.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.