Repository navigation
Conversation
Add team-scoped application, permission, role and access management; persistent approval/operation workflows; Keycloak connector profiles; isolated disabled-client provisioning; variant-3 Angular dashboard; manual tests, setup helpers, roadmap and review documentation. Executed evidence: 32 frontend utility tests and 241 structural checks. Full C#/Angular builds and live PostgreSQL/Keycloak acceptance remain unverified. This is not a completed enterprise roadmap or production release. Preserve the original license and add no CI workflows.
IAM activation gate, live role-recipient deletion guard, revocation fairness, OIDC dev proxy, regression test sources and manual verification documentation. Full build/Keycloak integration not yet verified; see docs/review.md.
…tract verification Introduce GitHub Actions with read-only permissions, ephemeral PostgreSQL and Keycloak services, full Release build, xUnit and TRX skip verification, Angular/Playwright browser tests, and role/audience integration checks. Explicit reproducible lockfile gate remains red until real dependencies are resolved and checked in. Publish test diagnostics, not production data. Document untested FGAP, BFF/MFA and operations gates; no deployment.
… test identity Store the immutable application identifier in Session instead of capturing the primary constructor parameter in both a property initializer and methods. Populate mandatory profile fields in the disposable Keycloak user so the password-grant token contract can execute with current user-profile checks.
Remove strict analyzer failures in PostgreSQL integration tests; make Keycloak's userinfo validation use a password-grant token with an explicit openid scope.
…ntities Add a Development-only loopback HTTP smoke harness with real database migrations, seeded applications, session/CSRF contract, application registration and two isolated management subjects. The test explicitly does not verify production OIDC or MFA. Run as a .NET CI step.
Use request_http as the helper name so stdlib http.cookiejar.CookieJar remains accessible when exercising live ASP.NET endpoints.
Use two delegated Keycloak service accounts, no realm-admin roles, user policies and client resource scope permissions in the admin-permissions client. Assert own-client role creation and reject foreign client role creation, foreign client reads, arbitrary client creation and realm configuration mutations. Do not claim full end-to-end IAM coverage.
…P test evidence Update roadmap, README, CI guide and test documentation based on real GitHub Actions results. Document two-account FGAP client isolation while retaining open full target-user/group, BFF-OIDC/MFA and production gates. Use locked NuGet restore once genuine lockfiles are committed; keep strict reproducibility failure until that work is completed.
Cenn0
force-pushed
the
ci/automated-verification
branch
from
October 16, 2026 16:21
333a0af to
4c4747f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Neue GitHub Actions CI
main, Pushes aufmain, manuelle Auslösung; ausschließlichcontents: readund keine Produktionssecrets..NET 10: Restore/Release-Build, xUnit und echte PostgreSQL-18-Integration. TRX wird auf fehlende oder übersprungene DB-Tests überprüft.Angular 22: Node 24, Unit-Tests, Produktionsbuild, Playwright Desktop/Mobile und npm-Produktiv-Audit.Keycloak 26.8.1: isolierter Testserver, zwei Clients mit separaten Rollen/Composite-Rollen, Benutzer-/Gruppenmappings, Login-Client mit eingeschränktem Scope, JWT-Audience und Token-Ausschluss fremder Clientrechte sowie Negativtest für unprivilegierten Service Account.docs/ci.md, aktualisierte README/Roadmap.Ehrliche Abgrenzung
Die erstmaligen GitHub-Jobläufe stehen aus; der lokale Container besitzt weder .NET noch Angular 22 noch Keycloak. Ein grüner Keycloak-Contract-Job beweist keine echte delegierte FGAP-v2-Minimalrechte-Isolation; ebenso fehlen vollständiges BFF/OIDC/MFA-End-to-End und Betriebs-/Pentests. Sie bleiben dokumentierte Release-Gates. Keine automatische Veröffentlichung oder Deployments.
Erwartete erste Ergebnisse
Der Lockfile-Gate wird bewusst bis zum Check-in aufgelöster Lockfiles scheitern. Weitere Jobs sollen reale Fehler melden, die vor einer Abnahme behoben werden müssen. Das ist keine behauptete Produktionsfreigabe.