smart-tests-cli 2.15.0__tar.gz → 2.15.1__tar.gz

{smart_tests_cli-2.15.0 → smart_tests_cli-2.15.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: smart-tests-cli
-Version: 2.15.0
+Version: 2.15.1
 Summary: Smart Tests CLI
 Author-email: CloudBees <support@cloudbees.com>
 License: Apache Software License v2

{smart_tests_cli-2.15.0 → smart_tests_cli-2.15.1}/smart_tests/commands/verify.py

@@ -18,7 +18,7 @@ from .. import args4p
 from ..app import Application
 from ..utils.authentication import ensure_org_workspace, get_oidc_token, get_org_workspace
 from ..utils.commands import Command
-from ..utils.env_keys import OIDC_TOKEN_KEY, ORGANIZATION_KEY, TOKEN_KEY, WORKSPACE_KEY
+from ..utils.env_keys import GITHUB_OIDC_KEY, LEGACY_GITHUB_OIDC_KEY, OIDC_TOKEN_KEY, ORGANIZATION_KEY, TOKEN_KEY, WORKSPACE_KEY
 from ..utils.http_client import DEFAULT_GET_TIMEOUT, _HttpClient
 from ..utils.java import get_java_command
 from ..utils.smart_tests_client import SmartTestsClient
@@ -204,20 +204,27 @@ def verify_oidc(app_instance: Application):
     Credential-free OIDC bootstrap. Presents the pipeline's OIDC id-token to Intake's
     /intake/oidc/verify endpoint and translates the 200/403/401 contract into CLI behavior:
 
-      - 200: the subject is registered. Print `export` lines (org/workspace/oidc-token) so the
-             pipeline can `eval "$(smart-tests verify --oidc)"` and authenticate subsequent
-             commands with the same token. Exit 0.
+      - 200: the subject is registered. Print `export` lines (org/workspace, plus the OIDC token
+             when it is a fixed pass-through value) so the pipeline can
+             `eval "$(smart-tests verify --oidc)"` and authenticate subsequent commands. Exit 0.
       - 403: the token verified but its subject isn't registered to any workspace yet. Show the
              normalized `sub` so the user can register it from the WebApp settings. Exit 1.
       - 401: the token is missing/expired/invalid. Exit 1.
     '''
     tracking_client = TrackingClient(Command.VERIFY, app=app_instance)
 
-    token = get_oidc_token()
-    if not token:
-        msg = (f"OIDC authentication requires the {OIDC_TOKEN_KEY} environment variable to hold the "
-               "pipeline's OIDC id-token. In Jenkins, bind an id-token credential to this variable; "
-               "see the OIDC pipeline-authentication setup guide.")
+    # authentication_headers() supplies the bearer for the request below; here we only confirm an OIDC
+    # flow is configured (fail fast) and decide whether the token can be echoed back. A pass-through
+    # token (SMART_TESTS_OIDC_TOKEN, e.g. a Jenkins-bound credential) is a fixed value we re-export;
+    # the GitHub flows mint a short-lived token per request, so exporting one here would only leave a
+    # stale value behind.
+    passthrough_token = get_oidc_token()
+    github_oidc_configured = os.getenv(GITHUB_OIDC_KEY) or os.getenv(LEGACY_GITHUB_OIDC_KEY)
+    if not passthrough_token and not github_oidc_configured:
+        msg = (f"OIDC authentication requires an OIDC flow to be configured: set {OIDC_TOKEN_KEY} to "
+               "the pipeline's OIDC id-token (e.g. a Jenkins-bound credential), or set "
+               f"{GITHUB_OIDC_KEY}=1 in GitHub Actions to fetch one automatically. "
+               "See the OIDC pipeline-authentication setup guide.")
         click.secho(msg, fg='red', err=True)
         tracking_client.send_error_event(
             event_name=Tracking.ErrorEvent.USER_ERROR,
@@ -296,11 +303,13 @@ def verify_oidc(app_instance: Application):
 
     # Emit eval-able export lines so the pipeline can hydrate its environment:
     #   eval "$(smart-tests verify --oidc)"
-    # Subsequent commands then read org/workspace from these vars and present the same OIDC token
-    # (kept in SMART_TESTS_OIDC_TOKEN) as their bearer.
+    # Subsequent commands read org/workspace from these vars. For a pass-through token we also
+    # re-export it as the bearer; the GitHub flows re-mint a fresh short-lived token per request in
+    # authentication_headers(), so exporting one here would only leave a stale value behind.
     click.echo(f'export {ORGANIZATION_KEY}={_shell_quote(org)}')
     click.echo(f'export {WORKSPACE_KEY}={_shell_quote(workspace)}')
-    click.echo(f'export {OIDC_TOKEN_KEY}={_shell_quote(token)}')
+    if passthrough_token:
+        click.echo(f'export {OIDC_TOKEN_KEY}={_shell_quote(passthrough_token)}')
     click.secho(
         f"OIDC authentication verified for organization {org!r}, workspace {workspace!r}" + emoji(" \U0001f389"),
         fg='green', err=True)

smart_tests_cli-2.15.1/smart_tests/utils/authentication.py

@@ -0,0 +1,155 @@
+import os
+from typing import Optional, Tuple
+from urllib.parse import quote
+
+import click
+import requests
+
+import smart_tests.args4p.typer as typer
+
+from .env_keys import (GITHUB_OIDC_KEY, LEGACY_GITHUB_OIDC_KEY, OIDC_AUDIENCE_KEY,
+                       OIDC_TOKEN_KEY, ORGANIZATION_KEY, WORKSPACE_KEY, get_token)
+
+# Default audience Intake expects in an OIDC id-token (launchableinc.intake.oidc.audience).
+DEFAULT_OIDC_AUDIENCE = "https://app.cloudbees.io/smart-tests"
+# Header the CLI sends to opt into Intake's deprecated GitHub Actions OIDC path. Absent it, a
+# GitHub-issued token is verified through the generic OIDC path. Mirrors RESTAuthConverter.
+LEGACY_GITHUB_OIDC_HEADER = "GitHub-OIDC-Legacy"
+
+# authentication_headers() runs on every API request, so guard the legacy deprecation notice to
+# print at most once per process instead of once per request.
+_legacy_oidc_warning_shown = False
+
+
+def get_org_workspace():
+    '''
+    Returns (org,ws) tuple from LAUNCHABLE_TOKEN, or (None,None) if not found.
+    Use ensure_org_workspace() if this is supposed to be an error condition
+    '''
+    token = get_token()
+    if token:
+        try:
+            _, user, _ = token.split(":", 2)
+            org, workspace = user.split("/", 1)
+            return org, workspace
+        except ValueError:
+            click.secho("Invalid value in LAUNCHABLE_TOKEN environment variable.", fg="red")
+            raise typer.Exit(1)
+
+    return os.getenv(ORGANIZATION_KEY), os.getenv(WORKSPACE_KEY)
+
+
+def ensure_org_workspace() -> Tuple[str, str]:
+    org, workspace = get_org_workspace()
+    if org is None or workspace is None:
+        click.secho(
+            "Could not identify Smart Tests organization/workspace. "
+            "Please confirm if you set SMART_TESTS_TOKEN "
+            "(or LAUNCHABLE_TOKEN for backward compatibility) or SMART_TESTS_ORGANIZATION and "
+            "SMART_TESTS_WORKSPACE environment variables", fg='red', err=True)
+        raise typer.Exit(1)
+    return org, workspace
+
+
+def get_oidc_token():
+    '''
+    Returns the CI-issued OIDC id-token (e.g. a Jenkins-minted RS256 JWT) from the environment,
+    or None if not set. This is the same token `smart-tests verify --oidc` exchanges for an
+    org/workspace, and the one subsequent workspace-scoped calls present as their bearer.
+    '''
+    return os.getenv(OIDC_TOKEN_KEY)
+
+
+def authentication_headers():
+    token = get_token()
+    if token:
+        return {'Authorization': f'Bearer {token}'}
+
+    # A pipeline that authenticated via `verify --oidc` carries no SMART_TESTS_TOKEN; it presents
+    # its OIDC id-token directly. Intake routes this by `iss` (RESTAuthVerifier) to the generic OIDC
+    # verifier, so subsequent workspace-scoped calls authenticate with the same JWT.
+    oidc_token = get_oidc_token()
+    if oidc_token:
+        return {'Authorization': f'Bearer {oidc_token}'}
+
+    # Generic GitHub Actions OIDC: fetch the id-token minted for the Smart Tests audience and present
+    # it like any other OIDC token. Intake routes by `iss` to the generic verifier and matches the
+    # normalized `repo:OWNER/REPO` subject against trusted_oidc_subjects. The audience is required
+    # here because the generic path enforces `aud` for GitHub's issuer.
+    if os.getenv(GITHUB_OIDC_KEY):
+        id_token = _fetch_github_id_token(audience=_expected_oidc_audience())
+        return {'Authorization': f'Bearer {id_token}'}
+
+    # Deprecated legacy GitHub Actions OIDC: Intake matches the `repository` claim against
+    # trusted_github_repositories. The legacy path never checks `aud`, so no audience is requested.
+    # The header tells Intake to take the legacy branch; without it the token would be verified
+    # through the generic path.
+    if os.getenv(LEGACY_GITHUB_OIDC_KEY):
+        global _legacy_oidc_warning_shown
+        if not _legacy_oidc_warning_shown:
+            _legacy_oidc_warning_shown = True
+            click.secho(
+                f"{LEGACY_GITHUB_OIDC_KEY} enables the deprecated GitHub Actions OIDC flow. Migrate "
+                f"by registering your repository as a Trusted OIDC subject and switching to "
+                f"{GITHUB_OIDC_KEY}=1. See "
+                "https://docs.cloudbees.com/docs/cloudbees-smart-tests/latest/send-data-to-smart-tests/set-up-smart-tests/migration-to-github-oidc-auth",  # noqa: E501
+                fg='yellow', err=True)
+        id_token = _fetch_github_id_token()
+        return {
+            'Authorization': f'Bearer {id_token}',
+            LEGACY_GITHUB_OIDC_HEADER: '1',
+        }
+
+    if os.getenv('GITHUB_ACTIONS'):
+        headers = {
+            'GitHub-Actions': os.environ['GITHUB_ACTIONS'],
+            'GitHub-Run-Id': os.environ['GITHUB_RUN_ID'],
+            'GitHub-Repository': os.environ['GITHUB_REPOSITORY'],
+            'GitHub-Workflow': os.environ['GITHUB_WORKFLOW'],
+            'GitHub-Run-Number': os.environ['GITHUB_RUN_NUMBER'],
+            'GitHub-Event-Name': os.environ['GITHUB_EVENT_NAME'],
+            'GitHub-Sha': os.environ['GITHUB_SHA'],
+        }
+
+        # GITHUB_PR_HEAD_SHA might not exist
+        pr_head_sha = os.getenv('GITHUB_PR_HEAD_SHA')
+        if pr_head_sha:
+            headers['GitHub-Pr-Head-Sha'] = pr_head_sha
+
+        return headers
+    return {}
+
+
+def _expected_oidc_audience() -> str:
+    '''Audience the GitHub id-token must carry for Intake's generic OIDC path to accept it.'''
+    return os.getenv(OIDC_AUDIENCE_KEY) or DEFAULT_OIDC_AUDIENCE
+
+
+def _fetch_github_id_token(audience: Optional[str] = None) -> str:
+    '''
+    Retrieve a GitHub Actions OIDC id-token via the runner's token endpoint.
+
+    Requires the `id-token: write` workflow permission, which populates ACTIONS_ID_TOKEN_REQUEST_URL
+    and ACTIONS_ID_TOKEN_REQUEST_TOKEN. When `audience` is given it is requested so the token's `aud`
+    claim matches what Intake expects (the generic OIDC path enforces it); the legacy path omits it.
+    '''
+    req_url = os.getenv('ACTIONS_ID_TOKEN_REQUEST_URL')
+    rt_token = os.getenv('ACTIONS_ID_TOKEN_REQUEST_TOKEN')
+    if not req_url or not rt_token:
+        click.secho(
+            "GitHub Actions OIDC tokens cannot be retrieved."
+            "Confirm that you have added necessary permissions following "
+            "https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers#adding-permissions-settings",  # noqa: E501
+            fg='red', err=True)
+        raise typer.Exit(1)
+    if audience:
+        sep = '&' if '?' in req_url else '?'
+        req_url = f"{req_url}{sep}audience={quote(audience, safe='')}"
+    r = requests.get(req_url,
+                     headers={
+                         'Authorization': f'Bearer {rt_token}',
+                         'Accept': 'application/json; api-version=2.0',
+                         'Content-Type': 'application/json',
+                     })
+    r.raise_for_status()
+    return r.json()['value']

{smart_tests_cli-2.15.0 → smart_tests_cli-2.15.1}/smart_tests/utils/env_keys.py

@@ -9,6 +9,16 @@ OIDC_TOKEN_KEY = "SMART_TESTS_OIDC_TOKEN"
 ORGANIZATION_KEY = "SMART_TESTS_ORGANIZATION"
 WORKSPACE_KEY = "SMART_TESTS_WORKSPACE"
 BASE_URL_KEY = "SMART_TESTS_BASE_URL"
+# Opt in to the generic GitHub Actions OIDC flow: the CLI fetches the GitHub id-token and presents
+# it like any other OIDC token. Intake verifies it against trusted_oidc_subjects (self-serve in the
+# webapp) instead of the deprecated trusted_github_repositories path. See authentication_headers().
+GITHUB_OIDC_KEY = "SMART_TESTS_GITHUB_OIDC_TOKEN_AUTH"
+# Deprecated opt in to the legacy GitHub Actions OIDC flow (repository-claim matching). Kept working
+# for backward compatibility; when set, the CLI signals Intake to use the legacy path via a header.
+LEGACY_GITHUB_OIDC_KEY = "EXPERIMENTAL_GITHUB_OIDC_TOKEN_AUTH"
+# Audience the GitHub id-token must be minted for so the generic OIDC path's aud check passes.
+# Overridable for non-production Intake environments.
+OIDC_AUDIENCE_KEY = "SMART_TESTS_OIDC_AUDIENCE"
 SKIP_TIMEOUT_RETRY = "SMART_TESTS_SKIP_TIMEOUT_RETRY"
 COMMIT_TIMEOUT = "SMART_TESTS_COMMIT_TIMEOUT"
 SKIP_CERT_VERIFICATION = "SMART_TESTS_SKIP_CERT_VERIFICATION"

{smart_tests_cli-2.15.0 → smart_tests_cli-2.15.1}/smart_tests/utils/java.py

@@ -48,6 +48,12 @@ def junit5_nested_class_path_builder(
     Note: Launchable allows $ in test paths. But we decided to remove it in this case
           because $ in the class name is not a common case.
 
+    Separately, when a @Nested class carries an explicit @DisplayName, Surefire (>= ~3.5.x)
+    drops the outer class name from the `classname` attribute entirely and reports just the
+    @DisplayName value (e.g. classname="addFollowList", with no dot and no $). In that case we
+    fall back to the enclosing <testsuite name="..."> attribute, which is always the outer
+    class's fully-qualified name.
+
     Args:
         default_path_builder: The original path builder function to wrap
 
@@ -56,6 +62,17 @@ def junit5_nested_class_path_builder(
     """
     def path_builder(case: TestCase, suite: TestSuite, report_file: str) -> TestPath:
         test_path = default_path_builder(case, suite, report_file)
-        return [{**item, "name": item["name"].split("$")[0]} if item["type"] == "class" else item for item in test_path]
+
+        def fix_class(item):
+            if item["type"] != "class":
+                return item
+            name = item["name"]
+            if "." not in name:
+                suite_name = suite._elem.attrib.get("name")
+                if suite_name and "." in suite_name:
+                    name = suite_name
+            return {**item, "name": name.split("$")[0]}
+
+        return [fix_class(item) for item in test_path]
 
     return path_builder

{smart_tests_cli-2.15.0 → smart_tests_cli-2.15.1}/smart_tests_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: smart-tests-cli
-Version: 2.15.0
+Version: 2.15.1
 Summary: Smart Tests CLI
 Author-email: CloudBees <support@cloudbees.com>
 License: Apache Software License v2

{smart_tests_cli-2.15.0 → smart_tests_cli-2.15.1}/smart_tests_cli.egg-info/SOURCES.txt

@@ -546,6 +546,7 @@ tests/data/karma/subset_result.json
 tests/data/maven/createdFile_1.lst
 tests/data/maven/createdFile_2.lst
 tests/data/maven/list.lst
+tests/data/maven/record_test_nested_displayname_result.json
 tests/data/maven/record_test_result.json
 tests/data/maven/subset_by_absolute_time_result.json
 tests/data/maven/subset_by_confidence_result.json
@@ -563,6 +564,7 @@ tests/data/maven/reports/TEST-1.xml
 tests/data/maven/reports/TEST-2.xml
 tests/data/maven/reports/TEST-nested.xml
 tests/data/maven/reports/dummy.xml
+tests/data/maven/reports-nested-displayname/TEST-nested-displayname.xml
 tests/data/minitest/TEST-Admin_UserTest.xml
 tests/data/minitest/TEST-Admin_UserTest_ChildlenTest.xml
 tests/data/minitest/TEST-UserControllerTest.xml

{smart_tests_cli-2.15.0 → smart_tests_cli-2.15.1}/smart_tests_cli.egg-info/scm_file_list.json

@@ -539,7 +539,9 @@
     "tests/data/maven/java/test/src/java/com/example/sample_app_maven/AppTest.java",
     "tests/data/maven/java/test/src/java/com/launchableinc/rocket_car_maven/e2e/E2ETest.java",
     "tests/data/maven/list.lst",
+    "tests/data/maven/record_test_nested_displayname_result.json",
     "tests/data/maven/record_test_result.json",
+    "tests/data/maven/reports-nested-displayname/TEST-nested-displayname.xml",
     "tests/data/maven/reports/TEST-1.xml",
     "tests/data/maven/reports/TEST-2.xml",
     "tests/data/maven/reports/TEST-nested.xml",

smart_tests_cli-2.15.1/smart_tests_cli.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "2.15.1",
+  "distance": 0,
+  "node": "ga228846b9d3b9fa01d2612f6094402c40af16362",
+  "dirty": false,
+  "branch": "main",
+  "node_date": "2026-09-29"
+}

{smart_tests_cli-2.15.0 → smart_tests_cli-2.15.1}/src/main/java/com/launchableinc/ingest/commits/GitHubIdTokenAuthenticator.java

@@ -6,6 +6,9 @@ import com.google.common.base.Strings;
 import com.google.common.collect.ImmutableList;
 import java.io.IOException;
 import java.io.UncheckedIOException;
+import java.io.UnsupportedEncodingException;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
 import org.apache.http.Header;
 import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.client.methods.HttpGet;
@@ -15,10 +18,29 @@ import org.apache.http.message.BasicHeader;
 import org.kohsuke.args4j.CmdLineException;
 
 public class GitHubIdTokenAuthenticator implements Authenticator {
+  // Default audience Intake expects in an OIDC id-token (launchableinc.intake.oidc.audience).
+  // Mirrors the Python CLI's DEFAULT_OIDC_AUDIENCE.
+  static final String DEFAULT_OIDC_AUDIENCE = "https://app.cloudbees.io/smart-tests";
+  // Header the CLI sends to opt into Intake's deprecated GitHub Actions OIDC path. Absent it, a
+  // GitHub-issued token is verified through the generic OIDC path. Mirrors RESTAuthConverter.
+  static final String LEGACY_GITHUB_OIDC_HEADER = "GitHub-OIDC-Legacy";
+
   private static final ObjectMapper objectMapper = new ObjectMapper();
   private final String idToken;
+  private final boolean legacy;
 
-  public GitHubIdTokenAuthenticator() throws CmdLineException {
+  /**
+   * Retrieves a GitHub Actions OIDC id-token via the runner's token endpoint.
+   *
+   * @param audience When non-empty, requested so the token's {@code aud} claim matches what
+   *     Intake's generic OIDC path enforces. Pass {@code null}/empty for the legacy path, which
+   *     never checks {@code aud}.
+   * @param legacy When true, signals Intake to take the deprecated GitHub Actions OIDC path via the
+   *     {@link #LEGACY_GITHUB_OIDC_HEADER} header; without it the token is verified through the
+   *     generic path.
+   */
+  public GitHubIdTokenAuthenticator(String audience, boolean legacy) throws CmdLineException {
+    this.legacy = legacy;
     String reqUrl = System.getenv("ACTIONS_ID_TOKEN_REQUEST_URL");
     String rtToken = System.getenv("ACTIONS_ID_TOKEN_REQUEST_TOKEN");
     if (Strings.isNullOrEmpty(reqUrl) || Strings.isNullOrEmpty(rtToken)) {
@@ -28,6 +50,11 @@ public class GitHubIdTokenAuthenticator implements Authenticator {
               + "https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers#adding-permissions-settings");
     }
 
+    if (!Strings.isNullOrEmpty(audience)) {
+      String sep = reqUrl.contains("?") ? "&" : "?";
+      reqUrl = reqUrl + sep + "audience=" + encode(audience);
+    }
+
     HttpGet request = new HttpGet(reqUrl);
     request.setHeader("Authorization", "Bearer " + rtToken);
     request.setHeader("Accept", "applicaiton/json; api-version=2.0");
@@ -49,7 +76,21 @@ public class GitHubIdTokenAuthenticator implements Authenticator {
 
   @Override
   public ImmutableList<Header> getAuthenticationHeaders() {
-    return ImmutableList.of(new BasicHeader("Authorization", "Bearer " + idToken));
+    ImmutableList.Builder<Header> headers = ImmutableList.builder();
+    headers.add(new BasicHeader("Authorization", "Bearer " + idToken));
+    if (legacy) {
+      headers.add(new BasicHeader(LEGACY_GITHUB_OIDC_HEADER, "1"));
+    }
+    return headers.build();
+  }
+
+  private static String encode(String value) {
+    try {
+      return URLEncoder.encode(value, StandardCharsets.UTF_8.name());
+    } catch (UnsupportedEncodingException e) {
+      // UTF-8 is always supported.
+      throw new AssertionError(e);
+    }
   }
 
   @JsonIgnoreProperties(ignoreUnknown = true)

{smart_tests_cli-2.15.0 → smart_tests_cli-2.15.1}/src/main/java/com/launchableinc/ingest/commits/Main.java

@@ -1,6 +1,7 @@
 package com.launchableinc.ingest.commits;
 
 import com.google.common.annotations.VisibleForTesting;
+import com.google.common.base.Strings;
 import java.io.File;
 import java.io.IOException;
 import java.net.MalformedURLException;
@@ -110,8 +111,26 @@ public class Main {
           this.ws = w;
         }
 
-        if (System.getenv("EXPERIMENTAL_GITHUB_OIDC_TOKEN_AUTH") != null) {
-          authenticator = new GitHubIdTokenAuthenticator();
+        if (!Strings.isNullOrEmpty(System.getenv("SMART_TESTS_GITHUB_OIDC_TOKEN_AUTH"))) {
+          // Generic GitHub Actions OIDC: fetch the id-token minted for the Smart Tests audience and
+          // present it like any other OIDC token. Intake routes by `iss` to the generic verifier
+          // and matches the normalized `repo:OWNER/REPO` subject against trusted_oidc_subjects. The
+          // audience is required because the generic path enforces `aud` for GitHub's issuer.
+          String audience = System.getenv("SMART_TESTS_OIDC_AUDIENCE");
+          if (Strings.isNullOrEmpty(audience)) {
+            audience = GitHubIdTokenAuthenticator.DEFAULT_OIDC_AUDIENCE;
+          }
+          authenticator = new GitHubIdTokenAuthenticator(audience, false);
+        } else if (!Strings.isNullOrEmpty(System.getenv("EXPERIMENTAL_GITHUB_OIDC_TOKEN_AUTH"))) {
+          // Deprecated legacy GitHub Actions OIDC: Intake matches the `repository` claim against
+          // trusted_github_repositories. The legacy path never checks `aud`, so no audience is
+          // requested; the legacy header tells Intake to take the legacy branch.
+          System.err.println(
+              "EXPERIMENTAL_GITHUB_OIDC_TOKEN_AUTH enables the deprecated GitHub Actions OIDC flow."
+                  + " Migrate by registering your repository as a Trusted OIDC subject and switching"
+                  + " to SMART_TESTS_GITHUB_OIDC_TOKEN_AUTH=1. See "
+                  + "https://docs.cloudbees.com/docs/cloudbees-smart-tests/latest/send-data-to-smart-tests/set-up-smart-tests/migration-to-github-oidc-auth");
+          authenticator = new GitHubIdTokenAuthenticator(null, true);
         } else {
           authenticator = new GitHubActionsAuthenticator();
         }

{smart_tests_cli-2.15.0 → smart_tests_cli-2.15.1}/tests/commands/test_verify.py

@@ -179,11 +179,49 @@ class VerifyOidcCommandTest(CliTestCase):
 
     @patch.dict(os.environ, {}, clear=True)
     def test_oidc_missing_token(self):
-        """No OIDC token in the environment → usage error, exit 2."""
+        """No OIDC flow configured → usage error, exit 2."""
         result = self.cli("verify", "--oidc")
         self.assert_exit_code(result, 2)
         self.assertIn("SMART_TESTS_OIDC_TOKEN", result.output)
 
+    gh_id_token = "gh-header.gh-payload.gh-signature"
+    gh_oidc_env = {
+        "SMART_TESTS_GITHUB_OIDC_TOKEN_AUTH": "1",
+        "SMART_TESTS_BASE_URL": base_url,
+        "ACTIONS_ID_TOKEN_REQUEST_URL": "http://gh-oidc.local/token",
+        "ACTIONS_ID_TOKEN_REQUEST_TOKEN": "runner-rt-token",
+    }
+
+    @responses.activate
+    @patch.dict(os.environ, gh_oidc_env, clear=True)
+    def test_oidc_github_generic_no_token_export(self):
+        """GitHub generic flow (no SMART_TESTS_OIDC_TOKEN): the CLI fetches a fresh id-token, presents
+        it as the bearer, and on 200 exports org/workspace but NOT the short-lived token."""
+        responses.add(
+            responses.GET,
+            "http://gh-oidc.local/token",
+            json={"value": self.gh_id_token},
+            status=200,
+        )
+        responses.add(
+            responses.POST,
+            self.oidc_verify_url,
+            json={"organization": "acme", "workspace": "prod"},
+            status=200,
+        )
+
+        result = self.cli("verify", "--oidc")
+        self.assert_success(result)
+
+        self.assertIn("export SMART_TESTS_ORGANIZATION='acme'", result.output)
+        self.assertIn("export SMART_TESTS_WORKSPACE='prod'", result.output)
+        # The GitHub token is minted per request, so it must not be exported for reuse.
+        self.assertNotIn("export SMART_TESTS_OIDC_TOKEN", result.output)
+
+        # The fetched GitHub id-token is the bearer presented to the verify endpoint.
+        verify_call = next(c for c in responses.calls if "/oidc/verify" in c.request.url)
+        self.assertEqual(verify_call.request.headers["Authorization"], f"Bearer {self.gh_id_token}")
+
 
 def _make_jwt(claims: dict) -> str:
     """Build an unsigned-looking JWT (header.payload.signature) with the given claims payload."""

smart_tests_cli-2.15.1/tests/data/maven/record_test_nested_displayname_result.json

@@ -0,0 +1,27 @@
+{
+    "events": [
+        {
+            "type": "case",
+            "testPath": [
+                {
+                    "type": "class",
+                    "name": "com.example.sample_app_maven.NestedDisplayNameTest"
+                },
+                {
+                    "type": "testcase",
+                    "name": "methodIsCalled"
+                }
+            ],
+            "duration": 0.001,
+            "status": 1,
+            "stdout": "",
+            "stderr": "",
+            "data": null
+        }
+    ],
+    "testRunner": "maven",
+    "group": "",
+    "noBuild": false,
+    "flavors": [],
+    "testSuite": ""
+}

smart_tests_cli-2.15.1/tests/data/maven/reports-nested-displayname/TEST-nested-displayname.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<testsuite xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="https://maven.apache.org/surefire/maven-surefire-plugin/xsd/surefire-test-report.xsd" name="com.example.sample_app_maven.NestedDisplayNameTest" time="0.001" tests="1" errors="0" skipped="0" failures="0">
+  <testcase name="methodIsCalled" classname="addFollowList" time="0.001" />
+</testsuite>

{smart_tests_cli-2.15.0 → smart_tests_cli-2.15.1}/tests/test_runners/test_maven.py

@@ -4,8 +4,12 @@ import tempfile
 from unittest import mock
 
 import responses  # type: ignore
+from junitparser import JUnitXml  # type: ignore
 
+from smart_tests.commands.record.case_event import CaseEvent
 from smart_tests.test_runners import maven
+from smart_tests.testpath import FilePathNormalizer
+from smart_tests.utils.java import junit5_nested_class_path_builder
 from tests.cli_test_case import CliTestCase
 
 
@@ -106,47 +110,52 @@ class MavenTest(CliTestCase):
         self.assert_success(result)
         self.assert_record_tests_payload("record_test_result.json")
 
+    def _build_path_builder(self):
+        """Builds the same wrapped path_builder that maven.py's record_tests wires up."""
+        default_path_builder = CaseEvent.default_path_builder(FilePathNormalizer())
+        return junit5_nested_class_path_builder(default_path_builder)
+
+    def _class_path_for_first_case(self, report_path):
+        path_builder = self._build_path_builder()
+        xml = JUnitXml.fromfile(str(self.test_files_dir.joinpath(report_path)))
+        suite = next(iter(xml))
+        case = next(iter(suite))
+        test_path = path_builder(case, suite, str(report_path))
+        return next(item["name"] for item in test_path if item["type"] == "class")
+
+    def test_junit5_nested_class_path_builder_strips_dollar_suffix(self):
+        """@Nested class WITHOUT @DisplayName: Surefire keeps "Outer$Inner" as classname."""
+        class_name = self._class_path_for_first_case('reports/TEST-nested.xml')
+        self.assertEqual(class_name, "com.example.sample_app_maven.NestedTest")
+        self.assertNotIn("$", class_name)
+
+    def test_junit5_nested_class_path_builder_falls_back_to_suite_name(self):
+        """@Nested class WITH @DisplayName: Surefire (>= ~3.5.x) drops the outer class from
+        `classname` entirely (e.g. classname="addFollowList"). We must fall back to the
+        enclosing <testsuite name="..."> attribute, which is always the outer class FQCN."""
+        class_name = self._class_path_for_first_case('reports-nested-displayname/TEST-nested-displayname.xml')
+        self.assertEqual(class_name, "com.example.sample_app_maven.NestedDisplayNameTest")
+        self.assertNotIn("$", class_name)
+        self.assertNotEqual(class_name, "addFollowList")
+
     @responses.activate
     @mock.patch.dict(os.environ, {"SMART_TESTS_TOKEN": CliTestCase.smart_tests_token})
     def test_record_test_maven_with_nested_class(self):
         """Verify that class names containing $ (inner class marker) are processed correctly during test recording"""
-        # Test the path_builder function directly by extracting it from the maven module
-        from unittest import TestCase as UnitTestCase
-        from unittest import TestSuite as UnitTestSuite
-
-        # Extract the implementation from maven.py directly
-        # This gets the implementation without going through the CLI/Click command
-        def create_custom_path_builder(default_path_builder):
-            def path_builder(case, suite, report_file):
-                test_path = default_path_builder(case, suite, report_file)
-                return [{**item, "name": item["name"].split("$")[0]} if item["type"] == "class" else item for item in test_path]
-            return path_builder
-
-        # Mock the default path builder that would return a class with $ in it
-        def default_path_builder(case, suite, report_file):
-            return [{"type": "class", "name": "com.launchableinc.rocket_car_maven.NestedTest$InnerClass"}]
-
-        # Create our custom path builder function
-        custom_path_builder = create_custom_path_builder(default_path_builder)
-
-        # Test it directly with dummy inputs
-        test_case = UnitTestCase()
-        test_suite = UnitTestSuite()
-        report_file = "TEST-nested.xml"
-
-        # Call the path_builder
-        result_path = custom_path_builder(test_case, test_suite, report_file)
-
-        # Verify the result - it should remove everything after $
-        self.assertEqual(result_path[0]["name"], "com.launchableinc.rocket_car_maven.NestedTest")
-        self.assertNotIn("$", result_path[0]["name"])
-
-        # Now run the actual CLI command to ensure integration works
         result = self.cli('record', 'tests', 'maven', '--session', self.session,
-                          str(self.test_files_dir) + "/maven/reports/TEST-1.xml",
-                          str(self.test_files_dir) + "/maven/reports/TEST-2.xml",
-                          str(self.test_files_dir) + "/maven/reports/TEST-nested.xml")
+                          str(self.test_files_dir.joinpath('reports/TEST-1.xml')),
+                          str(self.test_files_dir.joinpath('reports/TEST-2.xml')),
+                          str(self.test_files_dir.joinpath('reports/TEST-nested.xml')))
+        self.assert_success(result)
+
+    @responses.activate
+    @mock.patch.dict(os.environ, {"SMART_TESTS_TOKEN": CliTestCase.smart_tests_token})
+    def test_record_test_maven_with_nested_displayname_class(self):
+        """Verify the bare-@DisplayName-as-classname bug (no dot, no $) is corrected end-to-end."""
+        result = self.cli('record', 'tests', 'maven', '--session', self.session,
+                          str(self.test_files_dir.joinpath('reports-nested-displayname/TEST-nested-displayname.xml')))
         self.assert_success(result)
+        self.assert_record_tests_payload("record_test_nested_displayname_result.json")
 
     @responses.activate
     @mock.patch.dict(os.environ, {"SMART_TESTS_TOKEN": CliTestCase.smart_tests_token})