Repository navigation
CI never runs the Azure signer oracle #48
Description
Activity
Loop triage —
bug/ready-for-agent(confidence: high)Confirmed the report: nothing in CI runs the Azure signer oracle.
test/azure-oracle.node.tsis exposed only aspackage.json:60"test:azure-oracle": "tsx test/azure-oracle.node.ts"; a search of.github/finds no reference to it..github/workflows/ci.ymlrunspnpm lintandpnpm test:ci:coverage.test:ci:coverageisvitest run --browser.headless --coverage, and the oracle is not a vitest spec — so the Azure SharedKey/SAS signer has no CI coverage while the AWS/COS/OBS oracles (all vitest specs) do.- The oracle is CI-safe and already passes:
pnpm test:azure-oraclereturns exit0in ~1.4s locally. It uses a fixed 32-byte key, pins the clock withFixedDate, and mocks the request object; there is no network call and no credential read from the environment, and it exits non-zero when any check fails.
Actionable by the loop without a workflow change: the CI Test job invokes
pnpm test:ci:coverage, so chaining the oracle into that script (e.g.tsx test/azure-oracle.node.ts && vitest run --browser.headless --coverage) makes CI fail whenever the oracle fails.tsxis already a devDependency and is used bypnpm serve, which the same job runs. This is the enforceable form of AGENTS.md's “never change a signer without the oracles passing”, and it is what issue #42's “re-run the oracle to confirm byte-identity” argument needs.Labeling
ready-for-agentand leavingbugin place.Loop bugfix — PR opened for this.
The Azure SharedKey/SAS oracle is now enforced in CI:
package.jsonchainspnpm test:azure-oracleinto bothtest:ciandtest:ci:coverage, and CI's Test job runspnpm test:ci:coverage. A broken Azure signer now fails the step instead of merging green. No.github/workflows/**change was needed (the job token cannot push those), and the oracle/signers are untouched.Verified locally: the exact CI command exits 0 with the oracle output, and a temporarily forced oracle failure aborts the chain with exit 1.
pnpm lint,pnpm fmt:check,pnpm check:types,pnpm test:ci:coverageandpnpm buildall pass.- added 2 commits that reference this issue
on Sep 15, 2026
AGENTS.mdrequires every signer to stay byte-identical to its official SDK, and the oracles are what enforce that. Three of the four are covered; one is not:test/aws-signature.spec.tspnpm test:ciruns ittest/cos-signature.spec.tstest/obs-signature.spec.tstest/azure-oracle.node.tspnpm test:azure-oracle) that no workflow invokes.github/workflows/ci.ymlrunspnpm lintandpnpm test:ci:coverage, and the Azure oracle is not a vitest spec, so nothing in CI touches the Azure SharedKey/SAS signer. A PR that breaks Azure signature compatibility merges green.Why this matters more than a missing test usually would:
fast-xml-parseradvisory is reachable only throughcos-js-sdk-v5, and the argument for widening the override is "re-run the oracle to confirm byte-identity". Doing that without CI coverage means the next dependency bump can silently break it again.Expected: a PR against
mainfails CI when the Azure oracle fails.Notes for whoever implements it:
FixedDate), and mocks the request object. It just needstsx, which the repo already uses forpnpm serve.AGENTS.mdsays never to change a signer without these passing; the point of this issue is to make that enforceable rather than a convention.