From 5bcc06896d1a444257442037e3e593f104520c5d Mon Sep 17 00:00:00 2001 From: Thomas Kosiewski Date: Fri, 25 Sep 2026 08:42:09 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=A4=96=20ci:=20require=20connection=20ref?= =?UTF-8?q?used=20in=20the=20E2E=20MCP=20port=20check?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The E2E step "Verify aggregated API authentication and authorization" passed its port 8090 check on any curl failure, including a timeout or an empty pod IP (which probes "http://:8090"). It now requires a non-empty pod IP and curl exit 7 (connection refused); any other exit code, success included, fails with the code in the message. Also reword the TestReleaseAndImageChannels comment: both workflows now set GORELEASER_CHANNEL, and the templates must still render when it is unset. Signed-off-by: Thomas Kosiewski --- _Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `xhigh`_ Change-Id: I26ed39993c768cd4bca288ea4048ad895a4f7775 --- .github/workflows/ci.yaml | 9 +++++++-- hack/main_publish_test.go | 6 +++--- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 81d451e0..f0660711 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -410,8 +410,13 @@ jobs: test "$(code "-H \"Authorization: Bearer \$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)\" $list")" = 403 test "$(code "$api/healthz")" = 200 pod_ip=$(kubectl -n coder-system get pod -l app=coder-k8s -o jsonpath='{.items[0].status.podIP}') - if probe "curl -s --max-time 5 http://$pod_ip:8090/healthz"; then - echo "MCP must not listen on the pod network" >&2 + test -n "$pod_ip" || { echo "could not read the coder-k8s pod IP" >&2; exit 1; } + # MCP must not listen on the pod network: only "connection refused" (curl exit 7) passes. + # Any other result, including success or a timeout (28), fails. + mcp_rc=0 + probe "curl -s --max-time 5 http://$pod_ip:8090/healthz" || mcp_rc=$? + if [ "$mcp_rc" -ne 7 ]; then + echo "MCP port check: want connection refused (curl exit 7) from $pod_ip:8090, got exit $mcp_rc" >&2 exit 1 fi kubectl -n default delete pod e2e-authn-probe --wait=false diff --git a/hack/main_publish_test.go b/hack/main_publish_test.go index efc1a005..e86ac1b1 100644 --- a/hack/main_publish_test.go +++ b/hack/main_publish_test.go @@ -51,9 +51,9 @@ func TestChangelogChannels(t *testing.T) { } } -// The release workflow does not set GORELEASER_CHANNEL, and GoReleaser fails a template that reads a missing -// .Env key ("map has no entry"). Every channel-dependent disable template must render for an unset channel, -// and pick the right pipes per channel. +// Both workflows set GORELEASER_CHANNEL, but GoReleaser fails a template that reads a missing .Env key ("map +// has no entry"), so every channel-dependent disable template must still render when the channel is unset +// (for example, a local run), and pick the right pipes per channel. func TestReleaseAndImageChannels(t *testing.T) { data, err := os.ReadFile("../.goreleaser.yaml") if err != nil {