Repository navigation
Release 1.36.0 — Admin UI CDN outage fix + A2A prod auth + sign-in/identity (DEV→main) - #2663
Merged
Merged
Conversation
feat(signin): move SAP ID to top of provider list
…s progress (#2651) Users who already have an SAP ID but sign in with a non-matching social provider resolve to a separate Users row; their progress, completions, and Devtoberfest points don't carry over (root cause of #2651). Add a static warning above the provider buttons steering SAP-ID holders to Continue with SAP ID. Content-only, no JS.
…2651 feat(signin): warn SAP-ID holders a mismatched social login forks progress #2651
…ource-hash drift The #672 no-revert guard rejects any publish whose source-markdown hash matches an ABANDONED prior version. This also blocks the legitimate drift-clearing republish when a slug's current upstream markdown hashes back to a pre-churn version — e.g. a trailing-whitespace strip that returns the source to an earlier byte-identical state. Such a slug is stuck: /content/source-hashes keeps the churned hash, so the scheduled content-drift check fails on it every run, and neither delta nor --force can push the clean hash (both run the server-side guard). The only override is publish-content.ts's --allow-revert (slug-paired), which until now lived ONLY in the workstation path — colliding with the 'never publish from a workstation' rule. This threads it through the canonical rebuild-content.yml: - new boolean input 'allow-revert' (default false) - threaded as --allow-revert ONLY when effective_mode == 'slug-targeted' (guarantees PUBLISH_SLUG is set; resolveAllowRevertSlugs throws without a slug), so it can never blanket-override a full/catalog rebuild Repro: devtoberfest2026-abap-week2-validation (server 5ecfcc…, clean upstream 186fe5… is a prior/abandoned hash → guard-rejected on every slug-targeted republish).
feat(rebuild-content): add allow-revert input to clear #672-guarded source-hash drift
…only degrade (#2649) The route-scoped IAS auth middleware for POST /a2a resolved IAS and XSUAA in a single xsenv.getServices() call keyed by hardcoded instance names. In prod the XSUAA instance is 'xsuaa-imsprod' (dev: 'tutorials-xsuaa'), so the name miss threw out of the combined call and degraded /a2a to a full anonymous pass-through — taking IAS-only M2M (the surface's real purpose) down with it. DEV worked, prod /a2a returned 401 on valid IAS client-credentials tokens while prod /mcp-auth (same IAS app) accepted them. Fix: - Resolve IAS alone (required). A missing/renamed XSUAA binding can no longer take IAS auth down. - Resolve XSUAA independently by service LABEL ('xsuaa'), with the dev instance name as a fallback. If absent, proceed IAS-only (log .info, NOT pass-through). - XSUAA fallback remains wired when present (hybrid acceptance of human XSUAA bearers during the token-source cutover — do NOT remove until Central Joule consumers confirm cutover). Also: - docs/developers/operations/ias-setup.md: M2M (client_credentials) runbook on the shared tutorials-identity IAS app — canonical cf update-service grant config, the two-condition explanation (instance grant + per-space binding resolution), verify snippet, cf-target-drift warning. - mta-mcp.yaml: correct stale comments that claimed public-client:true / credential-type:NONE yields a secretless binding — the broker still issues a credential-type:SECRET binding, which the M2M flow relies on. - test/unit/a2a/ias-auth-mw.test.js: regression coverage for the three binding-resolution branches (XSUAA by label when name differs; IAS-only when no XSUAA; pass-through when IAS missing).
1.136.0 was purged from the UI5 CDN (versions removed 1yr after EOM), 404ing the admin-shell bootstrap and taking the whole Admin UI down in PROD. 1.148 is the current LTS (maintained through Q3/2027+). - admin-shell + display-app CDN loader URLs -> 1.148.12 (exact live patch) - all 32 ui5.yaml framework.version -> 1.148.12 (ui5 build resolves this) - all 53 manifest.json minUI5Version floors -> 1.148.0 Verified: ui5 build of admin-shell succeeds; dist/index.html loads 1.148.12.
fix(admin): UI5 CDN pin 1.136.0 → 1.148.12 — PROD Admin UI outage
…son)
Collapse the ~85 hardcoded UI5 version strings behind one file,
app/admin-shell/ui5-version.json, driving:
- the 2 CDN bootstrap URLs (admin-shell + display-app index.html,
now GENERATED from index.template.html)
- the 32 ui5.yaml framework.version values (admin + admin-shell)
- the admin-shell manifest.template.json minUI5Version floor
scripts/apply-ui5-version.cjs is both the generator (prebuild hook,
`npm run apply:ui5-version`) and the CI drift guard (`--check`,
registered as check-ui5-version in run-static-guards.ts; auto-fixable).
A bump is now a one-line edit; CI fails any consumer that drifts.
Motivation: on 2026-10 SAP purged 1.136.0 from the CDN and the
admin-shell bootstrap 404'd, taking the whole Admin UI down in PROD
(fixed in #2658). This prevents a recurrence from a missed edit.
feat(admin): single source of truth for SAPUI5 version
…CatGameAwards on merge (#2651)
- docs: wrap bare <your app> placeholder in backticks so VitePress/Vue stops parsing it as an unclosed HTML tag (ias-setup.md:198 build error). - test: seed a ContentCurrent row in semantic-search-handler.test.js so the #2631 servability gate (filterServableSlugs) does not drop the only seeded tutorial. Fixture was missed when #2631 added the gate.
…unit fix(ci): unbreak Docs Deploy + unit tests
…ile job pick same canonical row (#2651)
…er-2651 fix(identity): resolve + reconcile duplicate Users rows — cat-game counter/leaderboard desync (#2651)
fix(a2a): resolve prod /a2a 401 — label-based XSUAA resolution + IAS-only degrade (#2649)
Bump deploy version 1.35.0 -> 1.36.0 (.deploy/mta.yaml) for the DEV->main promotion and update the user-facing What's New digest (hugo/data/whats_new.json) with the 10 PRs merged since the 1.35.0 release cutoff (2026-10-04T22:06Z). Headline items in this train: - PROD Admin UI outage fixed + prevented recurrence: repinned SAPUI5 off a purged CDN version onto current LTS (#2658), and collapsed the version to a single source of truth with a CI drift gate (#2659). - A2A production auth fixed: label-based XSUAA resolution so IAS-only M2M clients stop 401'ing (#2657). - Sign-in / identity: SAP ID moved to top of provider list (#2652), mismatched social-login warning (#2653), and the duplicate-Users resolver fix that unforks Devtoberfest points/leaderboard (#2661). - Reliability: unbroke Docs Deploy + a unit-test flake (#2660); content-rebuild allow-revert input to clear #672-guarded source-hash drift (#2655/#2656). - Includes the 1.35.0 promotion PR (#2648) swept in just after its own cutoff. whats_new.json is the committed changelog source; srv/whats-new-data/ is rebuilt at build time and stays gitignored (not committed here).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release 1.36.0 — DEV → main promotion
Promotes the current DEV release train to
mainfor the PROD blue-green deploy.27 commits / ~8 PRs since 1.35.0 (which transported to PROD 2026-10-04).
Prepared with the
whats-newskill (cutoff2026-10-04T22:06Z, 10 PRs digested intohugo/data/whats_new.json) +.deploy/mta.yamlbump 1.35.0 → 1.36.0.Headline: PROD Admin UI outage fixed + hardened
1.136.0was removed from the UI5 CDN, 404'ing the admin-shell bootstrap and taking the entire Admin UI down in PROD. Repinned to current LTS1.148.12.app/admin-shell/ui5-version.jsonwith a CI drift gate, so a future bump can't silently break PROD.A2A production auth
/a2a401 (fix(a2a): resolve prod /a2a 401 — label-based XSUAA resolution + IAS-only degrade (#2649) #2657) — label-based XSUAA resolution + IAS-only degrade, so IAS M2M client-credential tokens authenticate (prod XSUAA instance isxsuaa-imsprod, nottutorials-xsuaa).Sign-in / identity
/signin(feat(signin): warn SAP-ID holders a mismatched social login forks progress #2651 #2653) — warns SAP ID holders that a different provider forks their profile.user.attr.email; Tier-3 matching now reads it, so the same human stops getting a secondUsersrow (unforks Devtoberfest cat-game points + leaderboard).Reliability
rebuild-contentallow-revertinput to clear publish-content can regress live content with stale local cache; need staleness guard #672-guarded source-hash drift (feat(rebuild-content): add allow-revert input to clear #672-guarded source-hash drift #2655/feat(rebuild-content): add allow-revert input to clear #672-guarded source-hash drift #2656).Verification
tutorials-imsmtar 1.35.0 + MCP MTAtutorials-mcp1.0.0, all 4 apps 1/1, srv + mcp-srv/health200 (2026-10-05).Deploy note
PROD is blue-green via the deploy-mta chain; the MCP MTA (
mta-mcp.yaml,deploy/mcp-prod.mtaext) is a separate deploy after the main MTA.