From 962d6cf29649d2e641a0ceda69a78e02ef79b019 Mon Sep 17 00:00:00 2001 From: Arne Luenser Date: Thu, 22 Oct 2026 14:07:09 +0200 Subject: [PATCH 1/5] test: adapt cloudx tests to Console V3 and staging API changes The nightly cloudx tests against staging broke on changes outside this repo: - Console V3 renders login with Ory Elements v1. The inputs carry ory/form/node/input/ test IDs, the form is submitted with fetch so a login continuing to consent is answered with 422 browser_location_change_required, and the consent.ory.com cookie banner covers the consent screen's Allow button. - Session-authenticated project creation requires a workspace. - Since Go 1.27, the hydra config type error no longer names the struct field. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01UQhMvbXeT2HENW1Gdm5R9C --- cmd/cloudx/client/command_helper_test.go | 23 ++++++++---- cmd/cloudx/project/update_test.go | 2 +- cmd/cloudx/testhelpers/testhelpers.go | 47 ++++++++++++------------ 3 files changed, 40 insertions(+), 32 deletions(-) diff --git a/cmd/cloudx/client/command_helper_test.go b/cmd/cloudx/client/command_helper_test.go index cb0a3600..77045d65 100644 --- a/cmd/cloudx/client/command_helper_test.go +++ b/cmd/cloudx/client/command_helper_test.go @@ -74,7 +74,7 @@ func TestCommandHelper(t *testing.T) { require.NoError(t, err) require.NotNil(t, defaultWorkspaceAPIKey.Value) - defaultProject, err := authenticated.CreateProject(ctx, randx.MustString(6, randx.AlphaNum), "dev", nil, true) + defaultProject, err := authenticated.CreateProject(ctx, randx.MustString(6, randx.AlphaNum), "dev", &defaultWorkspace.Id, true) require.NoError(t, err) defaultWorkspaceProject, err := authenticated.CreateProject(ctx, randx.MustString(6, randx.AlphaNum), "dev", &defaultWorkspace.Id, false) require.NoError(t, err) @@ -145,9 +145,11 @@ func TestCommandHelper(t *testing.T) { }) t.Run("list of projects", func(t *testing.T) { - p0, err := h.CreateProject(ctx, "p0", "dev", nil, false) + workspace, err := h.CreateWorkspace(ctx, t.Name()) + require.NoError(t, err) + p0, err := h.CreateProject(ctx, "p0", "dev", &workspace.Id, false) require.NoError(t, err) - p1, err := h.CreateProject(ctx, "p1", "dev", nil, false) + p1, err := h.CreateProject(ctx, "p1", "dev", &workspace.Id, false) require.NoError(t, err) projects, err := h.ListProjects(ctx, nil) @@ -220,18 +222,23 @@ func TestCommandHelper(t *testing.T) { project0, err := h.CreateProject(ctx, name0, "dev", &workspace.Id, true) require.NoError(t, err) - project1, err := h.CreateProject(ctx, name1, "dev", nil, false) + project1, err := h.CreateProject(ctx, name1, "dev", &workspace.Id, false) require.NoError(t, err) - project2, err := h.CreateProject(ctx, name2, "dev", nil, false) + project2, err := h.CreateProject(ctx, name2, "dev", &workspace.Id, false) require.NoError(t, err) + // Ory Network rejects session-authenticated project creation without a + // workspace, which is why `ory create project` asks for one. + _, err = h.CreateProject(ctx, "no workspace", "dev", nil, false) + require.ErrorContains(t, err, "A workspace is required to create a project.") + assert.Len(t, stringslice.Unique([]string{project0.Id, project1.Id, project2.Id}), 3) assert.Len(t, stringslice.Unique([]string{project0.Slug, project1.Slug, project2.Slug}), 3) assert.Equal(t, []string{name0, name1, name2}, []string{project0.Name, project1.Name, project2.Name}) - assert.Equal(t, &workspace.Id, project0.WorkspaceId.Get()) - assert.Nil(t, project1.WorkspaceId.Get()) - assert.Nil(t, project2.WorkspaceId.Get()) + for _, p := range []*cloud.Project{project0, project1, project2} { + assert.Equal(t, &workspace.Id, p.WorkspaceId.Get()) + } selectedID, err := h.ProjectID() require.NoError(t, err) diff --git a/cmd/cloudx/project/update_test.go b/cmd/cloudx/project/update_test.go index a26c768c..bfb9bba7 100644 --- a/cmd/cloudx/project/update_test.go +++ b/cmd/cloudx/project/update_test.go @@ -68,7 +68,7 @@ func TestUpdateProject(t *testing.T) { projectFlag: "--project", pathSuccess: "fixtures/update-hydra/json/config.json", pathFailure: "fixtures/update-hydra/fail/config.json", - failureContains: "cannot unmarshal number into Go struct field", + failureContains: "cannot unmarshal number into Go", fixture: fixtureHydraConfig, }, } { diff --git a/cmd/cloudx/testhelpers/testhelpers.go b/cmd/cloudx/testhelpers/testhelpers.go index 523fdc85..bc3619a0 100644 --- a/cmd/cloudx/testhelpers/testhelpers.go +++ b/cmd/cloudx/testhelpers/testhelpers.go @@ -288,6 +288,7 @@ func NewPage(t testing.TB, browser playwright.Browser) playwright.Page { "sst.ory.sh", "www.google.com/pagead", "app.termly.io", + "consent.ory.com", "static.reo.dev", "api.reo.dev", } { @@ -468,24 +469,18 @@ func redactInZip(path, secret string) error { } // submitPasswordForm submits the filled-in login form and fails immediately if -// the server refused the request outright. +// Ory Network did not accept it. // -// This catches the infrastructure-level refusals — 429 when a CI run drives more -// logins from one IP than Ory Network allows, or a 5xx — and it exists because -// the consent screen is the next thing the caller waits for. On a refusal the -// page never leaves the form, so an unchecked failure surfaces 30 seconds later -// as a missing `Allow` button, pointing at the consent screen instead of at the -// reason it never rendered. -// -// A rejected *credential* is not covered here: Ory Network answers that with a -// 303 back to the login page, which is indistinguishable from success at this -// point. The consent wait reports where the browser ended up, which is what -// separates the two. +// It exists because the consent screen is the next thing the caller waits for. +// On a refusal the page never leaves the form, so an unchecked failure surfaces +// 30 seconds later as a missing `Allow` button, pointing at the consent screen +// instead of at the reason it never rendered: rejected credentials (400), 429 +// when a CI run drives more logins from one IP than Ory Network allows, or a 5xx. func submitPasswordForm(t testing.TB, page playwright.Page) { - // The login flow issues exactly one request to this path, and it is this - // submission — the flow itself is created by the login UI, not the browser. - isLoginSubmission := func(url string) bool { - return strings.Contains(url, "/self-service/login") + // The login UI submits the flow with fetch, so this POST is the only request + // to this path; the flow itself was created before the page rendered. + isLoginSubmission := func(r playwright.Response) bool { + return r.Request().Method() == http.MethodPost && strings.Contains(r.URL(), "/self-service/login") } resp, err := page.ExpectResponse(isLoginSubmission, func() error { @@ -493,7 +488,11 @@ func submitPasswordForm(t testing.TB, page playwright.Page) { }) require.NoError(t, err, "the login form was never submitted") - if resp.Status() < http.StatusBadRequest { + // A login that continues at the OAuth2 consent screen is answered with 422 + // browser_location_change_required, the only use of 422 in self-service + // flows. The login UI navigates away on it, which can discard the body + // before it is read, so the status alone has to decide. + if resp.Status() < http.StatusBadRequest || resp.Status() == http.StatusUnprocessableEntity { return } @@ -522,16 +521,18 @@ func PlaywrightAcceptConsentBrowserHook(t testing.TB, page playwright.Page, emai _, err := page.Goto(uri) require.NoError(t, err) - if err := page.Locator(`[data-testid="node/input/identifier"] input`).WaitFor(); err == nil { - // we need to log in first + // The password field renders on a first login and when reconfirming an + // existing session, but only the first login asks for the identifier. + passwordInput := page.Locator(`[data-testid="ory/form/node/input/password"]`) + require.NoError(t, passwordInput.WaitFor()) + identifierInput := page.Locator(`[data-testid="ory/form/node/input/identifier"]`) + if visible, err := identifierInput.IsVisible(); err == nil && visible { t.Logf("logging in") - require.NoError(t, page.Locator(`[data-testid="node/input/identifier"] input`).Fill(email)) - require.NoError(t, page.Locator(`[data-testid="node/input/password"] input`).Fill(password)) + require.NoError(t, identifierInput.Fill(email)) } else { - // reconfirm password t.Logf("reconfirming password") - require.NoError(t, page.Locator(`[data-testid="node/input/password"] input`).Fill(password)) } + require.NoError(t, passwordInput.Fill(password)) submitPasswordForm(t, page) // we wait here for the button +1s because there is some console bug that can lead to form submissions before the form action is correctly set From d35cf35cb5fd093598671dd166dbe6e306623fb2 Mon Sep 17 00:00:00 2001 From: Arne Luenser Date: Thu, 22 Oct 2026 14:16:42 +0200 Subject: [PATCH 2/5] chore: bump Go to 1.27 golangci-lint supports Go 1.27 from v2.13.0, so the pin moves to v2.15.0. Its install script comes from golangci-lint.run: the script on the repository's abandoned master branch also matches the .sbom.json line in the checksums of every release since v2.12.2 and rejects the tarball. The newer staticcheck flags rs/cors' deprecated AllowOriginRequestFunc. The function never looks at the request, so AllowOriginFunc replaces it with the same behavior. There is no golang:1.27 image on Alpine 3.22, and the CGO build has to run on the musl it was linked against, so both stages of Dockerfile-build move to Alpine 3.24. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01UQhMvbXeT2HENW1Gdm5R9C --- .docker/Dockerfile-build | 4 ++-- Makefile | 4 ++-- cmd/cloudx/proxy/helpers.go | 8 ++++---- go.mod | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.docker/Dockerfile-build b/.docker/Dockerfile-build index 48239eeb..48c77839 100644 --- a/.docker/Dockerfile-build +++ b/.docker/Dockerfile-build @@ -1,4 +1,4 @@ -FROM golang:1.26-alpine3.22 AS builder +FROM golang:1.27-alpine3.24 AS builder RUN apk -U --no-cache add build-base git gcc bash @@ -15,7 +15,7 @@ ADD . . RUN CGO_CFLAGS="-D_LARGEFILE64_SOURCE" go build -tags sqlite,json1 -o /usr/bin/ory -FROM alpine:3.22 +FROM alpine:3.24 RUN apk add -U --no-cache ca-certificates bash RUN apk upgrade --no-cache libssl3 libcrypto3 diff --git a/Makefile b/Makefile index 42e296f1..8865a8d4 100644 --- a/Makefile +++ b/Makefile @@ -3,7 +3,7 @@ SHELL=/bin/bash -o pipefail export PATH := .bin:${PATH} export PWD := $(shell pwd) -GOLANGCI_LINT_VERSION = 2.11.4 +GOLANGCI_LINT_VERSION = 2.15.0 .bin/clidoc: Makefile go.mod cmd go build -tags nodev -o .bin/clidoc ./cmd/clidoc/. @@ -16,7 +16,7 @@ docs/cli: .bin/clidoc go build -o .bin/cli github.com/ory/cli .bin/golangci-lint-$(GOLANGCI_LINT_VERSION): - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b .bin v$(GOLANGCI_LINT_VERSION) + curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b .bin v$(GOLANGCI_LINT_VERSION) mv .bin/golangci-lint .bin/golangci-lint-$(GOLANGCI_LINT_VERSION) .bin/licenses: Makefile diff --git a/cmd/cloudx/proxy/helpers.go b/cmd/cloudx/proxy/helpers.go index 4752ebc8..80c7ad11 100644 --- a/cmd/cloudx/proxy/helpers.go +++ b/cmd/cloudx/proxy/helpers.go @@ -325,9 +325,9 @@ func reqMiddleware(conf *config, oryURL *url.URL, apiKey, rateLimitName, rateLim // re-adds, so both must be derived from here — tests build the handler from // this function rather than restating the options. func corsOptions(conf *config) (cors.Options, error) { - var originFunc func(r *http.Request, origin string) bool + var originFunc func(origin string) bool if len(conf.corsOrigins) == 0 { - originFunc = func(r *http.Request, origin string) bool { + originFunc = func(origin string) bool { return true } } @@ -338,8 +338,8 @@ func corsOptions(conf *config) (cors.Options, error) { } return cors.Options{ - AllowedOrigins: corsOrigins, - AllowOriginRequestFunc: originFunc, + AllowedOrigins: corsOrigins, + AllowOriginFunc: originFunc, // HEAD is CORS-safelisted, so browsers send it without a preflight, but // corsx.CORSDefaultAllowedMethods omits it. For a method it does not // allow, rs/cors adds no Access-Control-Allow-Origin at all — and since diff --git a/go.mod b/go.mod index e1623b14..6dec8576 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/ory/cli -go 1.26 +go 1.27 replace github.com/gorilla/sessions => github.com/ory/sessions v1.2.2-0.20220110165800-b09c17334dc2 From 1c2821f3217eaece9869ed2b7e62e2835cc99c98 Mon Sep 17 00:00:00 2001 From: Arne Luenser Date: Thu, 22 Oct 2026 14:22:10 +0200 Subject: [PATCH 3/5] test: keep client tests within the workspace project quota A free workspace holds two development projects, so with every project now in a workspace, the third one in a workspace fails with 402 quota_exceeded. SelectProjectWorkspace creates its project in a workspace of its own, which it then selects, and CreateProject creates two projects instead of three. GET /projects lists only projects shared with the identity directly, never workspace projects, so the ListProjects case for it has nothing to list once projects cannot be created outside a workspace. The workspace case covers sessions and workspace and project API keys. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01UQhMvbXeT2HENW1Gdm5R9C --- cmd/cloudx/client/command_helper_test.go | 45 ++++++------------------ 1 file changed, 10 insertions(+), 35 deletions(-) diff --git a/cmd/cloudx/client/command_helper_test.go b/cmd/cloudx/client/command_helper_test.go index 77045d65..a8fc4443 100644 --- a/cmd/cloudx/client/command_helper_test.go +++ b/cmd/cloudx/client/command_helper_test.go @@ -89,7 +89,9 @@ func TestCommandHelper(t *testing.T) { t.Parallel() h, err := client.NewCommandHelper(ctx) require.NoError(t, err) - otherProject, err := h.CreateProject(ctx, "other project", "dev", &defaultWorkspace.Id, false) + otherWorkspace, err := h.CreateWorkspace(ctx, "other workspace") + require.NoError(t, err) + otherProject, err := h.CreateProject(ctx, "other project", "dev", &otherWorkspace.Id, false) require.NoError(t, err) t.Run("can change the selected project and workspace", func(t *testing.T) { @@ -102,7 +104,7 @@ func TestCommandHelper(t *testing.T) { require.Equal(t, current, defaultProject.Id) require.NoError(t, h.SelectProject(otherProject.Id)) - require.NoError(t, h.SelectWorkspace(defaultWorkspace.Id)) + require.NoError(t, h.SelectWorkspace(otherWorkspace.Id)) actualProject, err := h.ProjectID() require.NoError(t, err) @@ -110,7 +112,7 @@ func TestCommandHelper(t *testing.T) { actualWorkspace := h.WorkspaceID() require.NotNil(t, actualWorkspace) - assert.Equal(t, defaultWorkspace.Id, *actualWorkspace) + assert.Equal(t, otherWorkspace.Id, *actualWorkspace) // check if persistent across instances h, err = client.NewCommandHelper(ctx) @@ -144,31 +146,6 @@ func TestCommandHelper(t *testing.T) { require.Empty(t, projects) }) - t.Run("list of projects", func(t *testing.T) { - workspace, err := h.CreateWorkspace(ctx, t.Name()) - require.NoError(t, err) - p0, err := h.CreateProject(ctx, "p0", "dev", &workspace.Id, false) - require.NoError(t, err) - p1, err := h.CreateProject(ctx, "p1", "dev", &workspace.Id, false) - require.NoError(t, err) - - projects, err := h.ListProjects(ctx, nil) - require.NoError(t, err) - require.Len(t, projects, 2) - assert.ElementsMatch(t, []string{p0.Id, p1.Id}, []string{projects[0].Id, projects[1].Id}) - - pjKey, err := authenticated.CreateProjectAPIKey(ctx, p0.Id, "test key", 0) - require.NoError(t, err) - - pjKeyH, err := client.NewCommandHelper(ctx, client.WithProjectAPIKey(*pjKey.Value)) - require.NoError(t, err) - - projects, err = pjKeyH.ListProjects(ctx, nil) - require.NoError(t, err) - require.Len(t, projects, 1) - assert.Equal(t, p0.Id, projects[0].Id) - }) - t.Run("list of workspace projects", func(t *testing.T) { workspace, err := h.CreateWorkspace(ctx, t.Name()) require.NoError(t, err) @@ -218,25 +195,23 @@ func TestCommandHelper(t *testing.T) { name0 := "new project name0" name1 := "new project name1" - name2 := "new project name2" + // A free workspace holds two development projects. project0, err := h.CreateProject(ctx, name0, "dev", &workspace.Id, true) require.NoError(t, err) project1, err := h.CreateProject(ctx, name1, "dev", &workspace.Id, false) require.NoError(t, err) - project2, err := h.CreateProject(ctx, name2, "dev", &workspace.Id, false) - require.NoError(t, err) // Ory Network rejects session-authenticated project creation without a // workspace, which is why `ory create project` asks for one. _, err = h.CreateProject(ctx, "no workspace", "dev", nil, false) require.ErrorContains(t, err, "A workspace is required to create a project.") - assert.Len(t, stringslice.Unique([]string{project0.Id, project1.Id, project2.Id}), 3) - assert.Len(t, stringslice.Unique([]string{project0.Slug, project1.Slug, project2.Slug}), 3) - assert.Equal(t, []string{name0, name1, name2}, []string{project0.Name, project1.Name, project2.Name}) + assert.Len(t, stringslice.Unique([]string{project0.Id, project1.Id}), 2) + assert.Len(t, stringslice.Unique([]string{project0.Slug, project1.Slug}), 2) + assert.Equal(t, []string{name0, name1}, []string{project0.Name, project1.Name}) - for _, p := range []*cloud.Project{project0, project1, project2} { + for _, p := range []*cloud.Project{project0, project1} { assert.Equal(t, &workspace.Id, p.WorkspaceId.Get()) } From a2fc280049568128d4a6e51191ec338ee80d93b8 Mon Sep 17 00:00:00 2001 From: Arne Luenser Date: Thu, 22 Oct 2026 14:22:11 +0200 Subject: [PATCH 4/5] fix: bump golang.org/x/net to v0.60.0 Fixes GO-2026-6612 (critical), which fails the image vulnerability scan. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01UQhMvbXeT2HENW1Gdm5R9C --- go.mod | 12 ++++++------ go.sum | 24 ++++++++++++------------ 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/go.mod b/go.mod index 6dec8576..f7c48fc1 100644 --- a/go.mod +++ b/go.mod @@ -37,7 +37,7 @@ require ( github.com/tidwall/sjson v1.2.5 github.com/urfave/negroni v1.0.0 golang.org/x/oauth2 v0.36.0 - golang.org/x/text v0.41.0 + golang.org/x/text v0.42.0 gopkg.in/yaml.v2 v2.4.0 ) @@ -153,12 +153,12 @@ require ( go.opentelemetry.io/otel/trace v1.45.0 // indirect go.opentelemetry.io/proto/otlp v1.11.0 // indirect go.yaml.in/yaml/v2 v2.4.4 // indirect - golang.org/x/crypto v0.55.0 // indirect + golang.org/x/crypto v0.57.0 // indirect golang.org/x/exp v0.0.0-20260813180055-c1d0aacb2297 // indirect - golang.org/x/mod v0.39.0 // indirect - golang.org/x/net v0.58.0 // indirect - golang.org/x/sync v0.22.0 // indirect - golang.org/x/sys v0.47.0 // indirect + golang.org/x/mod v0.41.0 // indirect + golang.org/x/net v0.60.0 // indirect + golang.org/x/sync v0.23.0 // indirect + golang.org/x/sys v0.48.0 // indirect golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5 // indirect golang.org/x/tools v0.49.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260818201246-1b0934165a6f // indirect diff --git a/go.sum b/go.sum index 17f94df3..68ca844d 100644 --- a/go.sum +++ b/go.sum @@ -742,8 +742,8 @@ golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU= golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs= -golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= -golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= +golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= +golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -778,8 +778,8 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= -golang.org/x/mod v0.39.0 h1:UF5zwQdCRRUpHfyPwr7d4UrGiVeldIsogtzWVnczL74= -golang.org/x/mod v0.39.0/go.mod h1:bvIbwjQ0HUFFf5AKukeeYQG4ZBUG9yxQbR9aEweIwYY= +golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= +golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -813,8 +813,8 @@ golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.0.0-20170912212905-13449ad91cb2/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -836,8 +836,8 @@ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= -golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= +golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -876,8 +876,8 @@ golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= -golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= +golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5 h1:ZUSxONxc981v7AW7QUg+I9WwZzSTTJ019ENBYr5pV/Q= golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5/go.mod h1:LVehoXe41cL5SCVQilsV7Gg6BNG+Js6P9PhSbYTIUkQ= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= @@ -896,8 +896,8 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= -golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= -golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= +golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= +golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= golang.org/x/time v0.0.0-20170424234030-8be79e1e0910/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= From b5d13642d436994890325936221a7180eae39144 Mon Sep 17 00:00:00 2001 From: Arne Luenser Date: Thu, 22 Oct 2026 14:33:57 +0200 Subject: [PATCH 5/5] ci: disable the docs job ory/docs only accepts changes to master through pull requests, so the direct push in ory/ci/docs/cli-next is rejected, and ORY_BOT_PAT no longer authenticates. The job stays defined so it can be re-enabled once the action publishes through a pull request. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01UQhMvbXeT2HENW1Gdm5R9C --- .github/workflows/ci.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 8fc59065..67f8349c 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -54,6 +54,9 @@ jobs: docs: name: Generate docs + # Disabled: ory/docs only accepts changes to master through pull requests, + # and ory/ci/docs/cli-next pushes directly. Re-enable once it opens one. + if: false runs-on: ubuntu-latest steps: - uses: ory/ci/docs/cli-next@master