chore: add workflow to run tests against different runtimes#150
Open
frederikprijck wants to merge 6 commits into
Open
chore: add workflow to run tests against different runtimes#150frederikprijck wants to merge 6 commits into
frederikprijck wants to merge 6 commits into
Conversation
frederikprijck
force-pushed
the
chore/runtimes-ci
branch
3 times, most recently
from
fc9a4a4 to
8e265fe
Compare
frederikprijck
force-pushed
the
chore/runtimes-ci
branch
from
8e265fe to
adb1df5
Compare
gyaneshgouraw-okta
previously approved these changes
Mar 11, 2026
…racters The expected jose error messages contain regex metacharacters (parentheses, quotes) that were interpolated raw into a RegExp, so "(JSON Web Key)" was parsed as a capture group and never matched the literal Deno error. Replace the RegExp with a substring check against the accepted messages.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (3)
📝 WalkthroughWalkthroughThis PR adds multi-runtime test support and CI: Cloudflare Workers worker-test infra and instantiation tests across three packages, Bun and Deno CI workflows, a DPoP error-message constant with broadened test matching, and Node core import specifier fixes. ChangesMulti-Runtime Compatibility Testing
🎯 3 (Moderate) | ⏱️ ~20 minutes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
packages/auth0-api-js/src/dpop-api.ts (1)
54-54: 💤 Low value
String.rawis unnecessary here.The template literal doesn't contain backslashes or template variables, so
String.rawserves no purpose. A regular string literal would be clearer.✨ Suggested simplification
- HEADER_PARAMETER_MUST_BE_PUBLIC_KEY: String.raw`"jwk" (JSON Web Key) Header Parameter must be a public key`, + HEADER_PARAMETER_MUST_BE_PUBLIC_KEY: '"jwk" (JSON Web Key) Header Parameter must be a public key',🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/auth0-api-js/src/dpop-api.ts` at line 54, The constant HEADER_PARAMETER_MUST_BE_PUBLIC_KEY currently uses String.raw with a plain template literal; replace String.raw`"jwk" (JSON Web Key) Header Parameter must be a public key` with a normal string literal (e.g. "\"jwk\" (JSON Web Key) Header Parameter must be a public key") to remove the unnecessary String.raw wrapper in the declaration of HEADER_PARAMETER_MUST_BE_PUBLIC_KEY in dpop-api.ts.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/runtime-bun.yml:
- Around line 22-25: Update the workflow steps that use actions/checkout and
oven-sh/setup-bun to pin to immutable SHAs and disable credential persistence:
replace usages of "actions/checkout@v4" with the specific
actions/checkout@<commit-SHA> and set the checkout step's input
persist-credentials: false, and replace "oven-sh/setup-bun@v2" with
oven-sh/setup-bun@<commit-SHA>; apply the same changes to both jobs/steps that
reference actions/checkout and oven-sh/setup-bun so all checkout/setup-bun
invocations are SHA-pinned and checkout does not persist credentials.
In @.github/workflows/runtime-deno.yml:
- Around line 23-31: Pin the mutable action tags and disable checkout credential
persistence: replace actions/checkout@v4, denoland/setup-deno@v2, and
actions/setup-node@v5 with their corresponding commit SHAs (use the specific
commit refs for each action) and add with: persist-credentials: false to the
actions/checkout step(s); update the checkout steps in both jobs test_core and
test to include persist-credentials: false so the GITHUB_TOKEN is not stored in
git config.
In @.github/workflows/runtime-workers.yml:
- Around line 23-26: The workflow uses actions/checkout@v4 and
actions/setup-node@v5 without pinning or disabling credential persistence;
update both occurrences of the checkout step to pin to the specific commit SHAs
for actions/checkout and actions/setup-node and add persist-credentials: false
to the actions/checkout steps so the default checkout token is not retained;
ensure you update both job blocks where actions/checkout and actions/setup-node
appear (the checkout step and the setup-node step) and verify the SHA pins
reference the corresponding repository commit SHAs for those actions.
---
Nitpick comments:
In `@packages/auth0-api-js/src/dpop-api.ts`:
- Line 54: The constant HEADER_PARAMETER_MUST_BE_PUBLIC_KEY currently uses
String.raw with a plain template literal; replace String.raw`"jwk" (JSON Web
Key) Header Parameter must be a public key` with a normal string literal (e.g.
"\"jwk\" (JSON Web Key) Header Parameter must be a public key") to remove the
unnecessary String.raw wrapper in the declaration of
HEADER_PARAMETER_MUST_BE_PUBLIC_KEY in dpop-api.ts.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 08443907-dcfb-464d-9a23-8a1f3330a77b
📒 Files selected for processing (19)
.github/workflows/runtime-bun.yml.github/workflows/runtime-deno.yml.github/workflows/runtime-workers.ymlpackages/auth0-api-js/package.jsonpackages/auth0-api-js/src/dpop-api.spec.tspackages/auth0-api-js/src/dpop-api.tspackages/auth0-api-js/src/index.workers.spec.tspackages/auth0-api-js/vitest.config.workers.tspackages/auth0-api-js/wrangler.tomlpackages/auth0-auth-js/package.jsonpackages/auth0-auth-js/src/index.workers.spec.tspackages/auth0-auth-js/tsup.config.tspackages/auth0-auth-js/vitest.config.tspackages/auth0-auth-js/vitest.config.workers.tspackages/auth0-auth-js/wrangler.tomlpackages/auth0-server-js/package.jsonpackages/auth0-server-js/src/index.workers.spec.tspackages/auth0-server-js/vitest.config.workers.tspackages/auth0-server-js/wrangler.toml
…lity Deno rejects the bare "fs" specifier in the bundled vitest config with 'Import "fs" not a dependency'. Use the explicit node: prefix so the config loads under Deno as well as Node.
Piyush-85
reviewed
Jun 4, 2026
| - name: Install dependencies | ||
| run: npm install | ||
|
|
||
| - name: Build |
There was a problem hiding this comment.
Can we rename these Build steps to "Build auth0-auth-js" and "Build ${{ matrix.package }}". Would be easy to figure out what failed.
Piyush-85
reviewed
Jun 4, 2026
| - name: Install dependencies | ||
| run: npm install | ||
|
|
||
| - name: Build |
There was a problem hiding this comment.
Can be applied here as well https://github.com/auth0/auth0-auth-js/pull/150/changes#r3355535181
Piyush-85
reviewed
Jun 4, 2026
| "vitest": "^3.0.5" | ||
| "vitest": "^3.0.5", | ||
| "@cloudflare/vitest-pool-workers": "^0.12.0", | ||
| "wrangler": "^4.71.0" |
There was a problem hiding this comment.
Should we consider updating these packages to latest version !!
Piyush-85
reviewed
Jun 4, 2026
| const packageJson = JSON.parse(readFileSync('./package.json', 'utf-8')); | ||
|
|
||
| export default defineConfig({ | ||
| test: { |
There was a problem hiding this comment.
Should we consider adding exclude: ['src/**/*.workers.spec.ts'], as of today we don't have worker specific apis but later this can fail.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR adds CI workflows to verify runtime compatibility across Bun, Deno, and Cloudflare Workers for all three packages (auth0-auth-js, auth0-server-js, auth0-api-js).
New workflows
Per-package changes
Each package (
auth0-auth-js,auth0-server-js,auth0-api-js) received:test:workersscript that runs Vitest with the Workers-specific configvitest.config.workers.tsusing the@cloudflare/vitest-pool-workerspoolwrangler.tomlwith nodejs_compat enabledsrc/index.workers.spec.tssmoke test that verifies the main client can be instantiated in a Workers environment@cloudflare/vitest-pool-workersand wrangler added as dev dependenciesBecause we need to refactor our tests to properly run on Cloudflare Workers, we are adding just the smoke test in this PR, but I have a follow up with a PR that refactors the tests to run on Cloudflare Workers.
Cross-runtime fixes
fsimports tonode:fsin auth0-auth-js to align with explicit Node.js built-in conventions required by some runtimes.auth0-api-jsto handle a different error thrown byjoseon Deno and Cloudflare Workers when private key material is present in thejwkheader parameter.References
#148
Checklist
Summary by CodeRabbit
New Features
Tests