Skip to content

docs(sdkclient): drop build-ladder references from comments #94

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
robbycochran merged 1 commit into from
Aug 22, 2026
Merged

docs(sdkclient): drop build-ladder references from comments #94

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion internal/openshell/sdkclient/auth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,8 @@ func planConnection(cfg *gw.Config, env EnvLookup) (connPlan, error) {
plan.branch = branchDefault
plan.tls = nil
} else {
// TODO(PR8): audience/scopes unverified — needs OIDC gateway
// Service-account client-credentials. The live dial is untested —
// no OIDC gateway is available to verify audience/scopes against.
plan.branch = branchSAOIDC
plan.tls = nil
}
Expand Down
20 changes: 10 additions & 10 deletions internal/openshell/sdkclient/client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@
// OpenShell Go SDK. It translates between the harness-owned internal/openshell
// vocabulary and the SDK, keeping every SDK type behind the firewall.
//
// S3 has landed: translate (errors.go) and provider mapping (provider.go) are
// in place, and dial covers all branches (mTLS verified against a live gateway;
// default and SA-OIDC selected and compiled but unverified).
// It dials via mTLS, an unauthenticated default, and service-account OIDC. The
// mTLS path is verified against a live gateway; the SA-OIDC path is untested
// end-to-end (no OIDC gateway is available in this environment).
package sdkclient

import (
Expand Down Expand Up @@ -42,8 +42,8 @@ type client struct {
// New constructs an openshell.Client for the given target: it loads the
// CLI-managed gateway config, resolves the dial plan via planConnection, and
// executes it via dial. Only the mTLS branch is verified against a live
// gateway; the default and SA-OIDC branches compile and are selected but the
// SA-OIDC path is UNVERIFIED (no OIDC gateway available).
// gateway; the SA-OIDC branch is untested end-to-end (no OIDC gateway
// available).
func New(ctx context.Context, t openshell.Target) (openshell.Client, error) {
cfg, err := gateway.LoadConfig(t.Gateway)
if err != nil {
Expand All @@ -69,7 +69,7 @@ func New(ctx context.Context, t openshell.Target) (openshell.Client, error) {
}

// NewFromClient wraps an existing SDK client (or the SDK fake) bound to a
// workspace. It is the injection seam used by white-box tests and, in S4, by
// workspace. It is the injection seam used by white-box tests and by
// internal/testutil. Empty workspace defaults to defaultWorkspace.
func NewFromClient(raw v1.ClientInterface, workspace string) openshell.Client {
if workspace == "" {
Expand Down Expand Up @@ -136,10 +136,10 @@ func clientCredentials(ctx context.Context, p connPlan) (*oauth2.Token, error) {
// deadline, every grant — eager and refresh — gets its own bounded
// oidcGrantTimeout so a stalled token endpoint can never block indefinitely.
//
// UNVERIFIED (no OIDC gateway; see specs findings): this path is exercised only
// for branch selection and compilation. TODO(PR8): audience/scopes unverified —
// needs an OIDC gateway. On any failure it returns a wrapped sentinel, never
// panics, and never places the client secret into an error message.
// Untested end-to-end: no OIDC gateway is available in this environment, so
// this path is exercised only for branch selection and compilation, and its
// audience/scopes are unverified. On any failure it returns a wrapped sentinel,
// never panics, and never places the client secret into an error message.
func dialSAOIDC(ctx context.Context, p connPlan) (v1.ClientInterface, error) {
eagerCtx, cancel := context.WithTimeout(ctx, oidcGrantTimeout)
defer cancel()
Expand Down
6 changes: 3 additions & 3 deletions internal/openshell/sdkclient/health_e2e_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,8 @@ import (
"github.com/stackrox/harness-openshell/internal/openshell/sdkclient"
)

// TestHealthE2E is the S1 kill-gate: it proves an mTLS Health().Check succeeds
// from within the harness module (not a /tmp spike) against a real gateway.
// TestHealthE2E proves an mTLS Health().Check succeeds from within the harness
// module against a real gateway.
//
// It is skipped unless HARNESS_E2E_GATEWAY names a registered openshell gateway
// (the local mTLS dev gateway is "openshell"). Optional HARNESS_E2E_WORKSPACE
Expand All @@ -21,7 +21,7 @@ import (
func TestHealthE2E(t *testing.T) {
gw := os.Getenv("HARNESS_E2E_GATEWAY")
if gw == "" {
t.Skip("set HARNESS_E2E_GATEWAY to a registered mTLS gateway to run the S1 kill-gate")
t.Skip("set HARNESS_E2E_GATEWAY to a registered mTLS gateway to run this end-to-end check")
}

ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
Expand Down
Loading