Repository navigation
Conversation
Moves test:migrate and test:custom over from migration-test-apps. Each run seeds a real provider, exports and imports with this checkout's CLI, checks what landed in Clerk, then undoes it. The folder keeps its own package.json and lockfile so the provider SDKs stay out of the workspace. Dependencies are pinned exactly: better-auth 1.7.17 adds an issuer column the seeders don't create, and B0 fails on it. Format, lint, and typecheck now cover the folder, except data/. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
bun run test:migrate-live and its :all, :custom, and :teardown variants resolve their secrets through op run, so no plaintext keys touch disk. The item sits in the Employee vault until it moves to Shared. OP_VAULT is the one line to change then. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Runs every provider plus the custom sources on Mondays at 09:17 UTC, or one provider on dispatch. Secrets come from the migrate-live environment, which only allows main, so a pushed branch can't edit the workflow to read them. Scheduled failures post to Slack. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if (result.status === "failed") process.exitCode = 1; | ||
| } | ||
|
|
||
| console.log(`\nSeed password: ${seedPassword}`); |
|
|
||
| const total = await clerkClient().users.getCount(); | ||
| console.log(`\nClerk now reports ${total} users.`); | ||
| console.log(`Seed password: ${seedPassword}`); |
| }, | ||
| hmac_sha256: { | ||
| options: { hash: { algorithm: "HMAC_SHA256", key: HMAC_KEY } }, | ||
| hash: () => createHmac("sha256", HMAC_KEY).update(seedPassword).digest(), |
| }, | ||
| md5: { | ||
| options: { hash: { algorithm: "MD5", rounds: 0 } }, | ||
| hash: () => createHash("md5").update(seedPassword).digest(), |
| count += page.users.length; | ||
| } | ||
| console.log(`\nDone. Firebase reports ${count} users.`); | ||
| console.log(`Seed password: ${seedPassword}`); |
|
|
||
| const [{ n }] = await sql<{ n: number }>("select count(*)::int as n from auth.users"); | ||
| console.log(`\nDone. auth.users holds ${n} rows.`); | ||
| console.log(`Seed password: ${seedPassword}`); |
| bcrypt: await bcrypt.hash(seedPassword, 10), | ||
| argon2id: | ||
| "$argon2id$v=19$m=19456,t=2,p=1$bWlncmF0aW9uLXRlc3Qtc2FsdC0xNmI$gBbnEhvXQQCPhOB0CWeS82tBRGEQX2Lxu/aAZhtFEsU", | ||
| unknown: `sha256:${createHash("sha256").update(seedPassword).digest("hex")}`, |
| } | ||
|
|
||
| console.table(summary); | ||
| console.log(`Seed password: ${seedPassword}`); |
| const failures = await pool(users, 4, createUser, progressBar("created")); | ||
| reportFailures(failures); | ||
|
|
||
| console.log(`\nSeed password: ${seedPassword}`); |
| env: TARGET_ENV, | ||
| }); | ||
| const log = (line: string) => { | ||
| console.log(line); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Warning
Do not merge yet.
scripts/run-migrate-live-op.tsreads the test credentials from the 1PasswordEmployeevault, which only I can read. Before merge, move the item toSharedand setOP_VAULTto"Shared".It also needs #594 first: nothing here sets
CLERK_EXPERIMENTAL, so the suite can't reachclerk migrateuntil the gate is gone.Summary
This moves the live end-to-end tests for
clerk migratefrommigration-test-appsintotest/migrate-live/. Each run seeds a real provider (Auth0, Auth.js, Better Auth, Clerk, Firebase, Supabase, WorkOS), exports and imports with this checkout's CLI, checks what landed in Clerk, then undoes it.They never run in PR CI. A weekly workflow runs them from
main, so each Monday tests whatever shipped that week.Changes
test/migrate-live/: thetest:migrateandtest:customsuites, their seeders and graders, and the seed data and answer keys. The folder has its ownpackage.jsonand lockfile so the provider SDKs stay out of the workspace.bun run test:migrate-liveand its:all,:custom, and:teardownvariants run locally throughop run, so no plaintext keys touch disk..github/workflows/migrate-live.ymlruns every provider plus the custom sources on Mondays at 09:17 UTC, or one provider onworkflow_dispatch. Scheduled failures post to Slack throughnotify-failure.yml.data/..claude/rules/migrate-live.mdand a pointer inCONTRIBUTING.md.Dependencies are pinned to exact versions. With caret ranges Bun picked
better-auth1.7.17, which writes anissuercolumn the seeder doesn't create, and the first variation failed.Secrets
The test credentials are environment secrets in a new
migrate-liveGitHub Environment. Its deployment branches are limited tomain.main.clerk/javascriptdoes the same forVERIFY_EVIDENCE_TOKEN.workflow_dispatchright after merge.CLERK_PLATFORM_API_KEY. That would let the PR run the suite before merge, at the cost of the exposure above. Switching means moving the secrets and deleting oneenvironment:line.MIGRATION_LIVE_TESTS_SLACK_WEBHOOK_URL) is a repository secret: the job that callsnotify-failure.ymlcan't use an environment.Every secret is named
MIGRATION_LIVE_TESTS_<ENV_VAR>, the same in 1Password and in Actions.Testing
bun run test:migrate-live -p better-auth -v B0passed against this checkout's CLI: 100 users exported, 100 created, 85 of 85 passwords verified.test:migrate-live:customand-p clerkhaven't run yet. Both import into apool-1Clerk instance that doesn't exist yet.Before merge
pool-1instance, add its two keys to 1Password, and addCLERK_POOL_1_SECRET_KEYandCLERK_POOL_1_APP_IDto the list inscripts/run-migrate-live-op.ts. The workflow already maps them.bun run test:migrate-live:custom.migrate-liveenvironment and set its secrets, plus the Slack webhook repo secret.Shared, setOP_VAULT, and drop the warning and thedo not mergelabel.After merge, a full
workflow_dispatchfrommainis the suite's first CI run.🤖 Generated with Claude Code