Contributing

Contributing

# Install dependencies
pnpm install

# Generate type stubs
pnpm run dev:prepare

# Develop with the playground
pnpm run dev

# Build the playground
pnpm run dev:build

# Run ESLint
pnpm run lint

# Run in-process functional handler tests
pnpm test:functional

End-to-end tests

Provider credentials are declared in secretspec.toml. Configure SecretSpec's e2e provider with access to the nuxt-oidc-auth 1Password vault, then run:

pnpm test:e2e:providers:secrets

Generic OIDC does not require provider credentials. Unconfigured cloud providers are skipped. CI reads the same profile and vault with its own read-only OP_SERVICE_ACCOUNT_TOKEN.

Keycloak coverage stays manual and separate from quick CI and provider-matrix runs. Start deterministic fixture, then run dedicated suite:

docker compose -f test/fixtures/keycloak/compose.yaml up -d --wait
pnpm test:e2e:keycloak
docker compose -f test/fixtures/keycloak/compose.yaml down

Fixture imports realm nuxt-oidc-test with local user testuser / p@ssword.

Release gate

Prepare version and changelog without creating a commit, tag, or publication:

git switch -c release/<version>
pnpm release:prepare -- <version> [--from <previous-release-commit>]

For v1.0.0-beta.12, use 63ab0c7 as previous release commit because existing v1.0.0-beta.11 tag does not point to published beta.11 package commit. Review generated changes, commit them with signing enabled, and merge them through pull request.

From clean, up-to-date main, record exact release commit and dispatch Provider E2E:

release_commit=$(git rev-parse HEAD)
gh workflow run e2e-providers.yml --ref main

Confirm workflow run succeeded and its headSha equals $release_commit. Configured online-provider and Dex rows must pass; Apple and PayPal remain excluded. Create and push signed tag only from exact verified commit:

pnpm release:tag -- "$release_commit"

Tagging refuses dirty trees, commits other than origin/main, mismatched provider-test commit, missing changelog entry, existing npm version, or existing/mismatched tag. Existing v1.0.0-beta.11 tag must remain untouched.

Configure npm trusted publishing for GitHub organization/user itpropro, repository nuxt-oidc-auth, workflow filename release.yml, no environment, and allow npm publish. After signed-tag Provider E2E succeeds, dispatch Publish npm release from main with tag name. Workflow requires signed tag, exact origin/main commit, matching changelog/package version, and unpublished npm version. GitHub OIDC publishes without repository npm credentials and npm automatically records provenance.