Conformance suite as a CI gate
Odudu fails the build if it stops speaking OpenID Connect correctly.
Context
An identity provider is trusted only if it follows the protocol exactly, on every release.
A conformance badge earned once says nothing about the next change.
Options considered
| Option | For | Against |
|---|---|---|
| Run the suite by hand before releases (rejected) | No pipeline cost. | Easy to skip, and a regression reaches users first. |
| Rely on unit tests for the protocol (rejected) | Fast. | The tests encode one reading of the specification, not the certification suite's. |
| Run the OpenID Foundation suite in CI (chosen) | A protocol regression fails the build, like a broken unit test. | A slower pipeline, and the suite needs a running server to talk to. |
Decision
The OpenID Foundation conformance suite (Config OP) runs in CI for Odudu.
Consequences
Better
- Odudu passes the suite on every change that reaches the main branch.
- A change that breaks the protocol is found before anyone signs in with it.
Harder
- CI takes longer and needs a server for the suite to run against.