Skip to content

fix(test): give the scoped-access-key test a timeout it can actually meet - #1311

Closed
SandyChapman wants to merge 1 commit into
mainfrom
fix-scoped-access-key-timeout/schapman
Closed

fix(test): give the scoped-access-key test a timeout it can actually meet#1311
SandyChapman wants to merge 1 commit into
mainfrom
fix-scoped-access-key-timeout/schapman

Conversation

@SandyChapman

@SandyChapman SandyChapman commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

Summary

test_scoped_access_keys.py::test_scoped_access_key_created_by_auth_service_authenticates_platform_requests fails roughly half of all integration runs, reported as worker gwN crashed while running .... It is not a crash — it is the suite-wide --timeout=120 firing on a test that legitimately takes about two minutes.

Evidence

Durations from --durations=25 on runs where it passed, against the 120s limit:

commit result duration
88698368 success 119.92s
095b1991 success 117.81s
4c3bef54 success 108.28s
ed68cbb1 success 89.47s
7 others failure no duration — never finished

Every pass is under 120s; every failure reports no duration. Whether a run passes is decided by runner load.

Why it looked like a crash

pytest-timeout's thread method calls os._exit(1). That is not a signal, so faulthandler never runs — which is why a per-worker faulthandler dump captured the test-entry trail and no traceback. Its own stack dump goes to the worker's captured stdout, which xdist does not forward. Both channels dark, for different reasons, leaving only node down: Not properly terminated.

Changes

pytest.mark.timeout(600) on the test, alongside its existing xdist_group. Verified the marker overrides the command-line value by running under --timeout=5 and watching it pass.

Type of Change

  • CI, build, or test infrastructure

Quality Gates

  • Existing tests cover changed behavior — justification: the change is a timeout ceiling on one existing test; the test's assertions are untouched.
  • Documentation not applicable — justification: no user-visible behavior changes.

Verification

  • Pull request title follows the repository's Conventional Commit format
  • Every commit includes an appropriate Signed-off-by: trailer
  • Targeted tests pass, or tests are marked not applicable above
  • No secrets, API keys, or credentials are included
  • uv run pre-commit run -a passes — three hooks fail on this machine (Helm Docs, uv lock, UI lint-staged, the last on a missing local pnpm shim). None touch this file.

Targeted validation: passes locally in 65.58s under --timeout=120, and in 18.88s under --timeout=5, confirming the marker takes precedence.

Follow-up

Making the test cheaper is worth doing separately — bundle_cache_seconds=0 forces a policy reload on every authorization call. That changes what the test exercises, so it should not ride along with stopping the bleeding.

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Tests
    • Updated scoped access key integration tests to run in a dedicated test group.
    • Increased the test timeout to improve reliability for longer-running test scenarios.

…meet

This test has been failing roughly half of all integration runs, reported as
`worker gwN crashed while running ...`. It is not a crash. It is the suite-wide
`--timeout=120` firing on a test that legitimately takes about two minutes.

Durations recorded on runs where it passed: 89.47s, 108.28s, 117.81s, and
119.92s — the last with 0.08s to spare. Every failing run reports no duration at
all, because the test never finished. The distribution straddles the limit, so
whether a given run passes is decided by how loaded the runner is.

It reads as a crash because of how the kill lands. pytest-timeout's thread
method calls `os._exit(1)`, which is not a signal, so faulthandler never runs and
writes nothing. Its own stack dump goes to the worker's captured stdout, which
xdist does not forward. Both diagnostic channels are dark for different reasons,
leaving the controller with only `node down: Not properly terminated`.

The cost comes from standing up a full auth-enabled platform in-process and
driving the entire access-key lifecycle through it. That is worth doing in an
integration test, so raise the ceiling for this test rather than trim what it
covers. Verified the marker overrides the command-line value by running under
`--timeout=5` and watching it pass.

Making the test cheaper is worth doing separately — `bundle_cache_seconds=0`
forces a policy reload on every authorization call — but that is a behavioural
change to what the test exercises, and this failure should stop now.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Sandy Chapman <schapman@nvidia.com>
@SandyChapman
SandyChapman requested review from a team as code owners August 14, 2026 10:46
@github-actions github-actions Bot added the fix label Aug 14, 2026
@coderabbitai

coderabbitai Bot commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 709e7ddc-6df0-4e1a-85d8-4226ba11d01e

📥 Commits

Reviewing files that changed from the base of the PR and between 88404a2 and 85425f2.

📒 Files selected for processing (1)
  • services/core/auth/tests/integration/test_scoped_access_keys.py

📝 Walkthrough

Walkthrough

The scoped access key integration tests now run in the auth_scoped_access_keys xdist group with a 600-second timeout. Existing test behavior remains unchanged.

Changes

Auth integration test execution

Layer / File(s) Summary
Configure test grouping and timeout
services/core/auth/tests/integration/test_scoped_access_keys.py
The module retains its xdist group marker and adds a 600-second timeout marker with runtime documentation.

Suggested reviewers: a2bondar, aahunt-nv, ajaythorve

Merge Risk: ⚪ Minimal · up to 85425

This change gives a slow integration test enough time to complete without altering production behavior or test assertions, so no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main change: increasing the scoped-access-key test timeout.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix-scoped-access-key-timeout/schapman

Comment @coderabbitai help to get the list of available commands.

@github-actions

Copy link
Copy Markdown
Contributor
Suite Lines Covered Line Rate Branch Rate
Unit Tests 33352/42114 79.2% 64.1%
Integration Tests 19472/39913 48.8% 21.0%

@SandyChapman

Copy link
Copy Markdown
Contributor Author

Superseded by the cost fix now in #1290. Both fixes were verified against CI and each confirmed the diagnosis independently — this one by running the test at 129.26s, over the old 120s limit, and passing only because the ceiling was raised. That made it the causal proof, but #1290's approach removes the cost rather than accommodating it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant