This is an automated email from the ASF dual-hosted git repository.
juzhiyuan pushed a commit to branch release/3.17
in repository https://gitbox.apache.org/repos/asf/apisix.git
The following commit(s) were added to refs/heads/release/3.17 by this push:
new e71c32a75e ci: stabilize historical branch environments (#14094)
e71c32a75e is described below
commit e71c32a75e38eec52636b96fefc1e2d3d66400ab
Author: Traky Deng <[email protected]>
AuthorDate: Tue Oct 27 22:11:57 2026 +0800
ci: stabilize historical branch environments (#14094)
---
.github/workflows/build.yml | 2 +-
.github/workflows/check-changelog.yml | 2 +-
.github/workflows/cli.yml | 2 +-
.github/workflows/close-unresponded.yml | 2 +-
.github/workflows/code-lint.yml | 4 ++--
.github/workflows/doc-lint.yml | 4 ++--
.github/workflows/docker-standalone.yml | 2 +-
.github/workflows/kubernetes-ci.yml | 2 +-
.github/workflows/license-checker.yml | 2 +-
.github/workflows/link-check.yml | 2 +-
.github/workflows/lint.yml | 4 ++--
.github/workflows/push-dev-image-on-commit.yml | 2 +-
.github/workflows/redhat-ci.yaml | 2 +-
.github/workflows/semantic.yml | 2 +-
.github/workflows/source-install.yml | 2 +-
.github/workflows/stale.yml | 2 +-
.github/workflows/tars-ci.yml | 2 +-
.github/workflows/update-labels.yml | 6 +++---
ci/common.sh | 5 ++++-
docker/debian-dev/Dockerfile | 4 ++--
t/lib/server.lua | 14 +++++++++++++
t/plugin/openid-connect.t | 28 +++++++++++++-------------
t/xrpc/prometheus.t | 9 +++++++++
t/xrpc/redis.t | 7 ++++++-
24 files changed, 72 insertions(+), 41 deletions(-)
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f600c983fa..cdfa79c5bc 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -25,7 +25,7 @@ jobs:
fail-fast: false
matrix:
platform:
- - ubuntu-latest
+ - ubuntu-24.04
os_name:
- linux_openresty
test_dir:
diff --git a/.github/workflows/check-changelog.yml
b/.github/workflows/check-changelog.yml
index 08d19b6391..2ee9b3d788 100644
--- a/.github/workflows/check-changelog.yml
+++ b/.github/workflows/check-changelog.yml
@@ -12,7 +12,7 @@ permissions:
jobs:
check-changelog:
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #
v6.0.2
with:
diff --git a/.github/workflows/cli.yml b/.github/workflows/cli.yml
index 5995ae0f4b..61404176c0 100644
--- a/.github/workflows/cli.yml
+++ b/.github/workflows/cli.yml
@@ -25,7 +25,7 @@ jobs:
fail-fast: false
matrix:
platform:
- - ubuntu-latest
+ - ubuntu-24.04
job_name:
- linux_apisix_current_luarocks
- linux_apisix_current_luarocks_in_customed_nginx
diff --git a/.github/workflows/close-unresponded.yml
b/.github/workflows/close-unresponded.yml
index c4e01ea7c0..d9a9ec7dcf 100644
--- a/.github/workflows/close-unresponded.yml
+++ b/.github/workflows/close-unresponded.yml
@@ -13,7 +13,7 @@ jobs:
permissions:
issues: write # for actions/stale to close stale issues
name: Prune Unresponded
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 10
steps:
diff --git a/.github/workflows/code-lint.yml b/.github/workflows/code-lint.yml
index bec199a8f2..c19de44674 100644
--- a/.github/workflows/code-lint.yml
+++ b/.github/workflows/code-lint.yml
@@ -12,7 +12,7 @@ permissions:
jobs:
lint:
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 10
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -32,7 +32,7 @@ jobs:
make lint
sc-lint:
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 5
steps:
- name: Checkout code
diff --git a/.github/workflows/doc-lint.yml b/.github/workflows/doc-lint.yml
index cab05f92c4..f03b64559a 100644
--- a/.github/workflows/doc-lint.yml
+++ b/.github/workflows/doc-lint.yml
@@ -19,7 +19,7 @@ permissions:
jobs:
markdownlint:
name: 🍇 Markdown
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 1
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #
v6.0.2
@@ -46,7 +46,7 @@ jobs:
Chinse-Copywriting-lint:
name: Chinese Copywriting
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 1
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #
v6.0.2
diff --git a/.github/workflows/docker-standalone.yml
b/.github/workflows/docker-standalone.yml
index 9201c77a8b..675618ca33 100644
--- a/.github/workflows/docker-standalone.yml
+++ b/.github/workflows/docker-standalone.yml
@@ -27,7 +27,7 @@ permissions:
jobs:
docker-test:
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 30
steps:
diff --git a/.github/workflows/kubernetes-ci.yml
b/.github/workflows/kubernetes-ci.yml
index f78d4ed77b..c02c9ce811 100644
--- a/.github/workflows/kubernetes-ci.yml
+++ b/.github/workflows/kubernetes-ci.yml
@@ -25,7 +25,7 @@ jobs:
fail-fast: false
matrix:
platform:
- - ubuntu-latest
+ - ubuntu-24.04
os_name:
- linux_openresty
diff --git a/.github/workflows/license-checker.yml
b/.github/workflows/license-checker.yml
index 565ebb3f68..8e7eb3c3ce 100644
--- a/.github/workflows/license-checker.yml
+++ b/.github/workflows/license-checker.yml
@@ -29,7 +29,7 @@ permissions:
jobs:
check-license:
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 3
steps:
diff --git a/.github/workflows/link-check.yml b/.github/workflows/link-check.yml
index a0f128e776..3f32892dd1 100644
--- a/.github/workflows/link-check.yml
+++ b/.github/workflows/link-check.yml
@@ -29,7 +29,7 @@ concurrency:
jobs:
check-links:
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #
v6.0.2
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 7eb237c8c8..1610a616aa 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -8,7 +8,7 @@ permissions:
jobs:
misc:
name: misc checker
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
steps:
- name: Check out code.
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #
v6.0.2
@@ -25,7 +25,7 @@ jobs:
bash ./utils/check-plugins-code.sh
ci-eclint:
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 5
steps:
diff --git a/.github/workflows/push-dev-image-on-commit.yml
b/.github/workflows/push-dev-image-on-commit.yml
index 741dd68129..4a281c4d5e 100644
--- a/.github/workflows/push-dev-image-on-commit.yml
+++ b/.github/workflows/push-dev-image-on-commit.yml
@@ -96,7 +96,7 @@ jobs:
merge-tags:
needs: build-test-push
if: github.ref == 'refs/heads/master'
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
steps:
- name: Login to Docker Hub
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 #
v4.0.0
diff --git a/.github/workflows/redhat-ci.yaml b/.github/workflows/redhat-ci.yaml
index a1a1b76eb2..0edf24f96d 100644
--- a/.github/workflows/redhat-ci.yaml
+++ b/.github/workflows/redhat-ci.yaml
@@ -18,7 +18,7 @@ permissions:
jobs:
test_apisix:
name: run ci on redhat ubi
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 90
strategy:
fail-fast: false
diff --git a/.github/workflows/semantic.yml b/.github/workflows/semantic.yml
index af77520e36..e0749c92f4 100644
--- a/.github/workflows/semantic.yml
+++ b/.github/workflows/semantic.yml
@@ -14,7 +14,7 @@ permissions:
jobs:
main:
name: Validate PR title
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
steps:
- name: Check out repository code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #
v6.0.2
diff --git a/.github/workflows/source-install.yml
b/.github/workflows/source-install.yml
index 023aa5886a..c6fdb41ee8 100644
--- a/.github/workflows/source-install.yml
+++ b/.github/workflows/source-install.yml
@@ -25,7 +25,7 @@ jobs:
fail-fast: false
matrix:
platform:
- - ubuntu-latest
+ - ubuntu-24.04
os_platform:
- ubuntu
- redhat
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index f7e5948063..4d2e1405df 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -14,7 +14,7 @@ jobs:
issues: write # for actions/stale to close stale issues
pull-requests: write # for actions/stale to close stale PRs
name: Prune Stale
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 10
steps:
diff --git a/.github/workflows/tars-ci.yml b/.github/workflows/tars-ci.yml
index d0eebb9215..8096adadb5 100644
--- a/.github/workflows/tars-ci.yml
+++ b/.github/workflows/tars-ci.yml
@@ -25,7 +25,7 @@ jobs:
fail-fast: false
matrix:
platform:
- - ubuntu-latest
+ - ubuntu-24.04
os_name:
- linux_openresty
diff --git a/.github/workflows/update-labels.yml
b/.github/workflows/update-labels.yml
index 1c46a99525..03df34729e 100644
--- a/.github/workflows/update-labels.yml
+++ b/.github/workflows/update-labels.yml
@@ -12,7 +12,7 @@ on:
jobs:
issue_commented:
if: github.event.issue && !github.event.issue.pull_request &&
github.event.comment.user.login == github.event.issue.user.login &&
contains(github.event.issue.labels.*.name, 'wait for update') &&
!contains(github.event.issue.labels.*.name, 'user responded')
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
steps:
- name: update labels when user responds
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
v8.0.0
@@ -33,7 +33,7 @@ jobs:
pr_commented:
if: github.event.issue && github.event.issue.pull_request &&
github.event.comment.user.login == github.event.issue.user.login &&
(contains(github.event.issue.labels.*.name, 'wait for update') ||
contains(github.event.issue.labels.*.name, 'discuss') ||
contains(github.event.issue.labels.*.name, 'need test cases')) &&
!contains(github.event.issue.labels.*.name, 'user responded')
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
steps:
- name: update label when user responds
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
v8.0.0
@@ -48,7 +48,7 @@ jobs:
pr_review_commented:
if: github.event.pull_request && github.event.comment.user.login ==
github.event.pull_request.user.login &&
(contains(github.event.pull_request.labels.*.name, 'wait for update') ||
contains(github.event.pull_request.labels.*.name, 'discuss') ||
contains(github.event.issue.labels.*.name, 'need test cases')) &&
!contains(github.event.pull_request.labels.*.name, 'user responded')
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
steps:
- name: update label when user responds
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
v8.0.0
diff --git a/ci/common.sh b/ci/common.sh
index b99819b5e4..8d13ce3403 100644
--- a/ci/common.sh
+++ b/ci/common.sh
@@ -108,7 +108,10 @@ install_nodejs () {
export PNPM_HOME="/pnpm"
export PATH="$PNPM_HOME:$PATH"
corepack enable pnpm
- pnpm setup
+ # Pin the pnpm used outside t/, which has its own packageManager pin.
+ # pnpm 12 rejects setup under sudo, while these maintenance branches run
+ # this installer through sudo in CI. Keep the last version known to work.
+ corepack prepare [email protected] --activate
}
install_brotli () {
diff --git a/docker/debian-dev/Dockerfile b/docker/debian-dev/Dockerfile
index 25358c8deb..aaad460996 100644
--- a/docker/debian-dev/Dockerfile
+++ b/docker/debian-dev/Dockerfile
@@ -14,7 +14,7 @@
# See the License for the specific language governing permissions and
# limitations under the License.
#
-FROM debian:bullseye-slim AS build
+FROM debian/eol:bullseye AS build
ARG ENABLE_PROXY=false
ARG CODE_PATH
@@ -49,7 +49,7 @@ RUN set -x \
&& cp -r deps ${ENV_INST_LUADIR} \
&& make install
-FROM debian:bullseye-slim
+FROM debian/eol:bullseye
ARG ENTRYPOINT_PATH=./docker-entrypoint.sh
ARG INSTALL_BROTLI=./install-brotli.sh
diff --git a/t/lib/server.lua b/t/lib/server.lua
index 88b8e603ef..d933478cdc 100644
--- a/t/lib/server.lua
+++ b/t/lib/server.lua
@@ -496,6 +496,20 @@ function _M._well_known_openid_configuration()
ngx.say(openid_data)
end
+-- Same discovery document but advertising an end_session_endpoint, so the
+-- openid-connect logout flow can be exercised without reaching a live
provider.
+function _M._well_known_openid_configuration_with_end_session()
+ local t = require("lib.test_admin")
+ local openid_data =
json_decode(t.read_file("t/plugin/openid-connect/configuration.json"))
+ if not openid_data then
+ ngx.status = 500
+ ngx.say("failed to decode openid discovery fixture")
+ return
+ end
+ openid_data.end_session_endpoint = "https://samples.auth0.com/v2/logout";
+ ngx.say(json_encode(openid_data))
+end
+
function _M.google_logging_token()
local args = ngx.req.get_uri_args()
local args_token_type = args.token_type or "Bearer"
diff --git a/t/plugin/openid-connect.t b/t/plugin/openid-connect.t
index 7f8ebe961c..312104c678 100644
--- a/t/plugin/openid-connect.t
+++ b/t/plugin/openid-connect.t
@@ -1384,9 +1384,10 @@ x-userinfo: ey.*
"openid-connect": {
"client_id":
"kbyuFDidLLm280LIwVFiazOqjO3ty8KH",
"client_secret":
"60Op4HFM0I8ajz0WdiStAbziZ-VFQttXuxixHHs2R7r7-CW8GR79l-mmLqMhc-Sa",
- "discovery":
"https://samples.auth0.com/.well-known/openid-configuration";,
+ "discovery":
"http://127.0.0.1:1980/.well-known/openid-configuration";,
"redirect_uri": "https://iresty.com";,
"post_logout_redirect_uri":
"https://iresty.com";,
+ "ssl_verify": false,
"scope": "openid profile",
"session": {
"secret":
"jwcE5v3pM9VhqLxmxFOH9uZaLo8u7KQK"
@@ -1414,8 +1415,7 @@ passed
-=== TEST 36: Check whether auth0 can redirect normally using
post_logout_redirect_uri configuration
---- custom_trusted_cert: /etc/ssl/certs/ca-certificates.crt
+=== TEST 36: Redirect to post_logout_redirect_uri when provider has no
end_session_endpoint
--- config
location /t {
content_by_lua_block {
@@ -1424,9 +1424,9 @@ passed
local uri = "http://127.0.0.1:"; .. ngx.var.server_port .. "/logout"
local res, err = httpc:request_uri(uri, {method = "GET"})
ngx.status = res.status
- local location = res.headers['Location']
- if location and string.find(location, 'https://iresty.com') ~= -1
and
- string.find(location,
'post_logout_redirect_uri=https://iresty.com') ~= -1 then
+ local location = ngx.unescape_uri(res.headers['Location'] or "")
+ if location:find('https://iresty.com', 1, true) and
+ location:find('post_logout_redirect_uri=https://iresty.com',
1, true) then
ngx.say(true)
end
}
@@ -1447,11 +1447,12 @@ true
ngx.HTTP_PUT,
[[{ "plugins": {
"openid-connect": {
- "client_id":
"942299072001-vhduu1uljmdhhbbp7g22m3qsmo246a75.apps.googleusercontent.com",
- "client_secret":
"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",
- "discovery":
"https://accounts.google.com/.well-known/openid-configuration";,
+ "client_id":
"kbyuFDidLLm280LIwVFiazOqjO3ty8KH",
+ "client_secret":
"60Op4HFM0I8ajz0WdiStAbziZ-VFQttXuxixHHs2R7r7-CW8GR79l-mmLqMhc-Sa",
+ "discovery":
"http://127.0.0.1:1980/.well-known/openid-configuration-with-end-session";,
"redirect_uri": "https://iresty.com";,
"post_logout_redirect_uri":
"https://iresty.com";,
+ "ssl_verify": false,
"scope": "openid profile",
"session": {
"secret":
"jwcE5v3pM9VhqLxmxFOH9uZaLo8u7KQK"
@@ -1479,8 +1480,7 @@ passed
-=== TEST 38: Check whether google can redirect normally using
post_logout_redirect_uri configuration
---- custom_trusted_cert: /etc/ssl/certs/ca-certificates.crt
+=== TEST 38: Redirect to end_session_endpoint with post_logout_redirect_uri
when provider exposes it
--- config
location /t {
content_by_lua_block {
@@ -1489,9 +1489,9 @@ passed
local uri = "http://127.0.0.1:"; .. ngx.var.server_port .. "/logout"
local res, err = httpc:request_uri(uri, {method = "GET"})
ngx.status = res.status
- local location = res.headers['Location']
- if location and string.find(location, 'https://iresty.com') ~= -1
and
- string.find(location,
'post_logout_redirect_uri=https://iresty.com') ~= -1 then
+ local location = ngx.unescape_uri(res.headers['Location'] or "")
+ if location:find('https://samples.auth0.com/v2/logout', 1, true)
and
+ location:find('post_logout_redirect_uri=https://iresty.com',
1, true) then
ngx.say(true)
end
}
diff --git a/t/xrpc/prometheus.t b/t/xrpc/prometheus.t
index cc267ac6c0..c589719228 100644
--- a/t/xrpc/prometheus.t
+++ b/t/xrpc/prometheus.t
@@ -145,9 +145,18 @@ passed
ngx.say("failed to get animals: ", err)
return
end
+
+ -- metrics are accumulated in a per-worker counter and flushed
+ -- to the shared dict by an ngx.timer.every(1, ...); once this
+ -- block ends, the only remaining flush is the premature timer
+ -- run when the HUP reload retires the stream worker, which races
+ -- with (and can lose to) the next block's scrape. Wait for a
+ -- regular flush before the block ends instead.
+ ngx.sleep(2)
}
}
--- response_body
+--- timeout: 5
--- stream_conf_enable
diff --git a/t/xrpc/redis.t b/t/xrpc/redis.t
index f9cff50a76..18447472b2 100644
--- a/t/xrpc/redis.t
+++ b/t/xrpc/redis.t
@@ -242,7 +242,12 @@ hget animals: bark
local begin = tonumber(results[3])
for j = 1, 4 do
local incred = results[3 + j]
- if incred ~= results[2 + j] + 1 then
+ -- on a fresh redis the first pipeline's GET returns
+ -- ngx.null (the counter doesn't exist yet), skip the
+ -- comparison for it instead of doing arithmetic on a
+ -- userdata value
+ local prev = tonumber(results[2 + j])
+ if prev and incred ~= prev + 1 then
ngx.log(ngx.ERR, cjson.encode(results))
end
end
