fix: 💚 Fix cpex build

[evaline-ju]

Summary

Main CI build has had issues today starting from https://github.com/rossoctl/cortex/actions/runs/33778911495/job/100727467181 , praxis updates are included in #855

Summary by CodeRabbit

• Chores
  • Updated internal module dependencies to support application functionality.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: f3611a43-499d-4ce5-9a97-ba19c54e1478

📥 Commits

Reviewing files that changed from the base of the PR and between 1119f9a and c905c06.

⛔ Files ignored due to path filters (1)

• authbridge/cmd/authbridge-cpex/go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• authbridge/cmd/authbridge-cpex/go.mod

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The authbridge-cpex Go module adds indirect requirements for three Tidwall packages: gjson, match, and pretty.

Changes

Go module dependency update

Layer / File(s)	Summary
Dependency declarations authbridge/cmd/authbridge-cpex/go.mod	Adds indirect requirements for github.com/tidwall/gjson v1.18.0, github.com/tidwall/match v1.1.1, and github.com/tidwall/pretty v1.2.1.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to c905c

This updates indirect Go dependencies for the cpex module. The dependency declarations and checksums are consistent, with no current merge-readiness risk identified.

Suggested reviewers: araujof, huang195

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary change: fixing the authbridge-cpex build. It is concise and related to the dependency updates in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.13.2)

level=error msg="Running error: context loading failed: no go files to analyze: running go mod tidy may solve the problem"

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[huang195]

Correct and minimal fix. I traced the requirement rather than taking the tidy output on faith:

• gjson is genuinely needed: cmd/authbridge-cpex/main.go imports authlib/pipeline, and authlib/pipeline/snapshot.go imports github.com/tidwall/gjson. match and pretty are gjson's own transitive deps. With GOWORK=off in the cpex Dockerfile and the default -mod=readonly, the missing require is a hard build failure — matches the symptom.
• sjson is correctly absent. This was my first suspicion, since authlib requires both gjson and sjson directly and cmd/authbridge-proxy/cmd/authbridge-envoy each carry all four indirects. It does not apply here: sjson's only non-test importer in authlib is plugins/toolprune, and cpex's main.go registers nine plugins with toolprune not among them. authlib/plugins/cpex/cmf_body_test.go does import sjson, but tests of dependency modules fall outside all under module-graph pruning, so tidy correctly omits it.
• Checksums check out. All seven added go.sum lines are byte-identical to the corresponding entries already in authbridge/authlib/go.sum, and the versions match the proxy/envoy pins exactly (gjson v1.18.0, match v1.1.1, pretty v1.2.1). The lone pretty v1.2.0/go.mod line is ordinary module-graph bookkeeping, not a second version being pulled in.

No blocking issues. Two suggestions below, both about the blast radius rather than this diff: the same gap exists one directory over in cmd/authbridge-praxis, and no check on this PR actually exercises the cpex module graph.

Author: evaline-ju (MEMBER — maintainer)
Areas reviewed: Go module manifests (go.mod/go.sum), CI coverage
Agent/IDE config (.claude/.vscode): none
Commits: 1 commit, all signed-off: yes
CI status: passing (but see the coverage note — none of it builds cpex)

[huang195]

suggestion: worth closing the hole that let this reach main, because nothing on this PR verifies the fix.

authbridge-cpex appears in exactly one workflow — build.yaml — which triggers only on v* tags, pushes to main, and workflow_dispatch. ci.yaml's Go matrix is [authbridge-proxy, authbridge-envoy]. So every green check here comes from jobs that never resolve the cpex module graph, and the next time authlib gains a dependency this breaks again the same way.

A full cpex build in ci.yaml is genuinely awkward (CGO plus libcpex_ffi.a from the pinned CPEX tarball), but the failure class here is module-graph drift, not compilation — so it can be caught without building anything:

      - name: Verify module graph is tidy
        run: |
          while IFS= read -r -d '' mod; do
            (cd "$(dirname "$mod")" && go mod tidy -diff)
          done < <(find authbridge -name go.mod -not -path '*/demos/*' -print0 | sort -z)

go mod tidy -diff (Go 1.23+; these modules are on 1.26.5) exits non-zero if go.mod/go.sum would change, needs no CGO and no FFI archive, and covers praxis and the lite-tags module for free.

Note the machinery already exists: dependabot-tidy.yml triggers on pull_request and runs go mod tidy across every authbridge/**/go.mod via that same find, but is gated if: github.actor == 'dependabot[bot]' — which is why the tidy check on this PR reads skipping. Ungating a read-only (-diff) variant for all PRs is probably the smallest change that closes the loop.

[evaline-ju]

follow-up issue filed #863, keeping this PR scoped to just fix

[huang195]

suggestion: cmd/authbridge-praxis appears to have the identical gap, and this PR leaves it broken.

The chain is the same one that broke cpex:

• cmd/authbridge-praxis/go.mod:37 has replace github.com/rossoctl/cortex/authbridge/authlib => ../../authlib, so it builds against local authlib despite the pinned pseudo-version above it.
• cmd/authbridge-praxis/main.go imports authlib/praxis; authlib/praxis/praxis.go and authlib/praxis/policy.go both import authlib/pipeline; pipeline/snapshot.go imports gjson.
• cmd/authbridge-praxis/go.mod and go.sum contain no tidwall entries at all.
• Its Dockerfile sets ENV GOWORK=off before go build, so the workspace can't paper over the missing require the way go build from authbridge/ does locally.

Nobody noticed because praxis is in neither the ci.yaml matrix nor the build.yaml image matrix, so it is built nowhere in CI.

I verified this by reading imports rather than running the praxis image build, so please sanity-check before acting. Either add the same three indirects to cmd/authbridge-praxis/go.mod/go.sum while you're here, or file a follow-up — the go mod tidy -diff gate in my other comment would surface it automatically.

[evaline-ju]

I see these changes in flight on #855 so I purposely left this 😄