This is an automated email from the ASF dual-hosted git repository. jungm pushed a commit to branch ee11 in repository https://gitbox.apache.org/repos/asf/tomee-tck.git
commit b48237fd6087e2af99f9e6ca94bc3c81a4cce12d Author: Markus Jung <[email protected]> AuthorDate: Sun Jul 19 12:13:34 2026 +0200 Wire security-old into CI and document the faces browser constraint Add the security-old JavaTest runner to the standalone branch list on the plain 240-minute default; its one-off old-tck source build plus ~83 tests stay well under the faces-old sizing. Its report lands in target/securityreport/**, already matched by the target/*report archive glob, and it emits no TEST-*.xml, so no glob change is needed. The modern faces reactor stays workstation-only: its old-tck-selenium modules drive Chrome through Selenium, and the ASF ubuntu && ephemeral agents ship no browser binary. Replace the vague "once its baseline is confirmed" wording with the actual constraint. --- Jenkinsfile | 22 ++++++++++++++++------ KNOWN_ISSUES.md | 44 ++++++++++++++++++++++++++------------------ 2 files changed, 42 insertions(+), 24 deletions(-) diff --git a/Jenkinsfile b/Jenkinsfile index 4804a7c..a750ca6 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -148,11 +148,17 @@ from xml.etree import ElementTree // reports live inside the extracted TCK module targets (one level // deep for security/authentication, two for the faces reactor's // per-submodule layout), which the recursive tck/** globs below - // ingest. The faces-old runner drives the legacy - // JavaTest half of the Faces TCK; its report lands in the - // target/*report glob and a red JavaTest run fails the Maven build. - // The modern faces reactor joins once its baseline is confirmed; - // see runner-standalone/README.md and KNOWN_ISSUES.md. + // ingest. The faces-old and security-old runners drive the legacy + // JavaTest halves of the Faces and Security TCKs; each provisions and + // starts its own TomEE (security-old also a Derby network server and + // an in-process UnboundID LDAP server on 11389), builds its old-tck + // bundle from source on the first run, and lands its JavaTest report + // in the target/*report glob so a red run fails the Maven build. + // The modern faces reactor stays workstation-only: its + // old-tck-selenium modules drive Chrome through Selenium, and the ASF + // 'ubuntu && ephemeral' agents ship no browser binary (a JDK-tools + // agent, not a docker-image agent that could bundle one). + // See runner-standalone/README.md and KNOWN_ISSUES.md. def standaloneBranch = { String id, int timeoutMinutes -> { stage("standalone - ${id}") { @@ -182,7 +188,11 @@ from xml.etree import ElementTree } } } - for (id in ['annotations', 'di', 'el', 'concurrency', 'data', 'servlet', 'pages', 'rest', 'validation', 'websocket', 'jsonp', 'jsonb', 'debugging', 'persistence', 'transactions', 'cdi', 'cdi-ee', 'security', 'authentication']) { + // security-old shares the plain 240-minute default: even with the + // one-off old-tck source build it runs only ~83 JavaTest tests + // (~65 client classes), far below the faces-old sizing that earns + // the extended timeout below. + for (id in ['annotations', 'di', 'el', 'concurrency', 'data', 'servlet', 'pages', 'rest', 'validation', 'websocket', 'jsonp', 'jsonb', 'debugging', 'persistence', 'transactions', 'cdi', 'cdi-ee', 'security', 'security-old', 'authentication']) { branches["standalone - ${id}"] = standaloneBranch(id, 240) } // ~5,400 JavaTest tests plus an old-tck source build and a diff --git a/KNOWN_ISSUES.md b/KNOWN_ISSUES.md index 257c732..37ccc2c 100644 --- a/KNOWN_ISSUES.md +++ b/KNOWN_ISSUES.md @@ -258,15 +258,20 @@ Need triage/fixes in the upstream projects TomEE ships. Not product bugs — gaps in this repository's coverage. -- **Modern faces reactor not in CI**: the `faces` runner (modern Arquillian - modules, the Chrome/Selenium `old-tck-selenium` modules, and the signature - test) runs locally via `run-standalone-suite.sh`; it joins the Jenkins - branch list once its baseline and exclusion wiring have a verified green - run. The `faces-old` JavaTest half runs in CI. -- **Security `security-old` not in CI**: the `security-old` runner (the - reactor's legacy JavaTest `com.sun.ts.tests.securityapi` suite) runs - locally via `run-standalone-suite.sh` and is green with the reviewed - exclusion; it joins the Jenkins branch list once its baseline has settled. +- **Modern faces reactor stays workstation-only**: the `faces` runner (modern + Arquillian modules, the signature test, and the Chrome/Selenium + `old-tck-selenium` modules) is green with `exclusions/faces.txt`, but its + `old-tck-selenium` modules drive a real Chrome through Selenium. The TCK's + `BaseITNG`/`ChromeDevtoolsDriver` runs headless by default (`--headless=new`, + `--no-sandbox`) and lets Selenium Manager resolve `chromedriver`, but Selenium + Manager still needs a Chrome/Chromium browser binary on the machine. The ASF + `ubuntu && ephemeral` agents the Jenkinsfile targets are JDK-tools agents with + no browser installed; ASF's own pattern for browser-driven CI is to run inside + a Docker image that bundles the browser (e.g. `apache/incubator-kie-tools`), + which this pipeline does not use. So `faces` runs locally via + `run-standalone-suite.sh`; only a browser on the build agent (or a + browser-bundling container image) would let it join CI. The `faces-old` + JavaTest half needs no browser and runs in CI. ## What CI runs @@ -275,14 +280,17 @@ Platform catalog on Plume plus `persistence-javatest` on the webprofile ZIP, and the standalone suites `annotations`, `di`, `el`, `concurrency`, `data`, `servlet`, `pages`, `rest`, `validation`, `websocket`, `jsonp`, `jsonb`, `debugging`, `persistence`, `transactions`, `cdi`, `cdi-ee`, `security`, -`authentication`, `faces-old` — all with default exclusions, all expected -green. Each runner fails its own build on a red result through a -`verify-tck-result` step: the JavaTest runners (`faces-old`, `transactions`) -check the harness exit code, and the invoker-driven source reactors -(`security`, `authentication`, `faces`) aggregate the inner surefire/failsafe -reports and fail on any failure, error, or module that built but never ran -its tests. The `junit`/archive globs also +`security-old`, `authentication`, `faces-old` — all with default exclusions, +all expected green. Each runner fails its own build on a red result through a +`verify-tck-result` step: the JavaTest runners (`faces-old`, `security-old`, +`transactions`) check the harness exit code, and the invoker-driven source +reactors (`security`, `authentication`, `faces`) aggregate the inner +surefire/failsafe reports and fail on any failure, error, or module that built +but never ran its tests. The `junit`/archive globs also ingest the surefire/failsafe reports inside the extracted TCK reactors that the source-reactor runners drive through the Maven invoker, plus the -JavaTest report directories. The modern `faces` reactor joins once its -baseline has a verified green run. +JavaTest report directories (`security-old` and `faces-old` write theirs to +`target/securityreport/**` and `target/facesreport/**`, matched by the +`target/*report/**` archive glob). The modern `faces` reactor stays +workstation-only because its `old-tck-selenium` modules need a browser the ASF +agents do not provide (see Harness work remaining).
