Skip to content

Conversation

Copy link

Copilot AI commented Jan 14, 2026

The linter enforces that error messages must start with "failed to" followed by the action that failed. Line 639 in pkg/api/authn.go used the pattern "bearer authentication failed" which violates this rule.

Changes

  • Updated error message in bearer authentication handler from "bearer authentication failed" to "failed to authenticate with bearer token"

This aligns with the existing error message pattern used throughout the codebase:

// Before
ctlr.Log.Error().Msg("bearer authentication failed")

// After  
ctlr.Log.Error().Msg("failed to authenticate with bearer token")

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Copilot AI and others added 5 commits January 14, 2026 21:15
- Add BearerOIDCConfig to configuration for OIDC workload auth
- Implement OIDCBearerAuthorizer for validating OIDC ID tokens
- Update bearerAuthHandler to support both traditional and OIDC bearer auth
- Add claim mapping support for extracting username from OIDC tokens
- Support multiple audiences for token validation
- Extract groups from token claims for authorization

Co-authored-by: rchincha <[email protected]>
- Add unit tests for OIDCBearerAuthorizer
- Test configuration validation
- Test token authentication with various scenarios
- Test custom claim mapping
- Test multiple audiences support
- Test token expiry and invalid tokens
- All tests passing

Co-authored-by: rchincha <[email protected]>
- Add comprehensive README explaining OIDC workload identity
- Add example configuration file
- Document configuration options and usage
- Include examples for Kubernetes, Flux CD, and GitHub Actions
- Add troubleshooting guide and security considerations

Co-authored-by: rchincha <[email protected]>
- Use NewBearerAuthorizer constructor instead of manual initialization
- Remove unused CreateOAuth2Config helper function
- Remove unnecessary sleep calls from tests (faster and more reliable)
- Remove unused oauth2 import

Co-authored-by: rchincha <[email protected]>
- Standardize terminology: use 'OIDC claims' consistently
- Clarify audience verification comment
- Improve error handling when no bearer method is configured
- Fix Authorization header case in documentation (Bearer not bearer)

Co-authored-by: rchincha <[email protected]>
Copilot AI changed the title [WIP] Fix issue with data synchronization in Zot Add OIDC workload identity authentication for secret-less workload access Jan 14, 2026
Copilot AI requested a review from rchincha January 14, 2026 21:27
@codecov
Copy link

codecov bot commented Jan 14, 2026

Codecov Report

❌ Patch coverage is 67.32026% with 50 lines in your changes missing coverage. Please review.
✅ Project coverage is 91.43%. Comparing base (708adf6) to head (3218241).
⚠️ Report is 4 commits behind head on main.

Files with missing lines Patch % Lines
pkg/api/authn.go 48.21% 27 Missing and 2 partials ⚠️
pkg/api/bearer_oidc.go 76.66% 17 Missing and 4 partials ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #3705      +/-   ##
==========================================
- Coverage   91.58%   91.43%   -0.16%     
==========================================
  Files         186      187       +1     
  Lines       26499    26619     +120     
==========================================
+ Hits        24270    24339      +69     
- Misses       1444     1487      +43     
- Partials      785      793       +8     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot AI and others added 2 commits January 15, 2026 17:53
The modcheck target was blocking local development by requiring all
go.mod and go.sum changes to be committed before building. This change:

- Removes modcheck from build target dependencies (binary, binary-minimal,
  binary-debug, cli, bench, exporter-minimal)
- Keeps modcheck as a standalone target for CI validation
- Adds explicit modcheck step to golangci-lint workflow for CI validation
- Allows developers to build locally without committing dependency changes
- CI still validates that go.mod and go.sum are properly maintained

This resolves the issue where developers couldn't build after making code
changes that required dependency updates until they committed the go.mod
and go.sum changes first.

Co-authored-by: rchincha <[email protected]>
Copilot AI changed the title Add OIDC workload identity authentication for secret-less workload access Remove modcheck from build dependencies to unblock local development Jan 15, 2026
Copilot AI changed the title Remove modcheck from build dependencies to unblock local development Fix CI linting failures in OIDC bearer authentication code Jan 15, 2026
The "sub" string in bearer_oidc.go is the standard OIDC claim name
defined by the specification and should remain as a literal.

The "test-user" string in bearer_oidc_test.go is test fixture data
that doesn't benefit from being extracted to a constant.

Both warnings are suppressed with //nolint:goconst directives.

Co-authored-by: rchincha <[email protected]>
Copilot AI changed the title Fix CI linting failures in OIDC bearer authentication code Suppress goconst linter warnings with nolint directives Jan 15, 2026
Remove explanatory text after //nolint:goconst directives to be
consistent with the rest of the codebase. The codebase pattern is to
use just //nolint:goconst without additional comments.

This matches the style used in controller_test.go and other test files
throughout the project.

Co-authored-by: rchincha <[email protected]>
Copilot AI changed the title Suppress goconst linter warnings with nolint directives Remove explanatory text from nolint directives to match codebase style Jan 15, 2026
Update error message on line 639 from "bearer authentication failed"
to "failed to authenticate with bearer token" to comply with the
project's error message format requirement.

The linter enforces that error messages should start with "failed to"
followed by the action that failed, which is the pattern used
throughout the codebase.

Co-authored-by: rchincha <[email protected]>
Copilot AI changed the title Remove explanatory text from nolint directives to match codebase style Fix error message format to comply with linter requirements Jan 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants