Need ability to get credentials for automated testing about traceability-interop HOT 7 CLOSED

Keeping open until at least one other party beyond mesur have implemented this.
Transmute will make an attempt on this soon.

from traceability-interop.

If I understand everything correctly, we are talking about requiring providers to provide an endpoint implementing RFC 6749 client credentials grant and to honor access tokens issued by said endpoint. Automated testing will require both the endpoint (not sensitive) and the client credentials (sensitive) for each provider.

I am inclined to agree that GitHub Encrypted Secrets is probably the way to go. I would like to propose the use of gpg to encrypt secrets in transit when submitting new values to editors, but am open to other suggestions.

Should I be placing the documentation for this in the top-level README.md of this repo?

from traceability-interop.

+1 top level README.md would be the right place

from traceability-interop.

@brownoxford working on proof of context this week.

from traceability-interop.

We can close this when Ci is operating in a secure setup and tests are passing.

from traceability-interop.

This initial PR sets the framework for providing the necessary configuration to fetch a client credentials grant token, next steps include:

• Create CI workflow that sets client_secret environment variables before running postman tests
• Refactor postman tests to begin using bearer token
• Generate additional postman tests to ensure that endpoints fail if bearer token is missing/invalid

from traceability-interop.

We support this now.

from traceability-interop.