Skip to content

fix(plugin-auth)!: the OAuth register door refuses an application type the provider does not judge with 400 INVALID_REQUEST, where it registered it as web #35547

fix(plugin-auth)!: the OAuth register door refuses an application type the provider does not judge with 400 INVALID_REQUEST, where it registered it as web

fix(plugin-auth)!: the OAuth register door refuses an application type the provider does not judge with 400 INVALID_REQUEST, where it registered it as web #35547

Triggered via pull request October 21, 2026 04:36
Status Failure
Total duration 1m 35s
Artifacts –

pr-automation.yml

on: pull_request
Check PR Size
0s
Check PR Size
Check Changeset
1m 32s
Check Changeset
Auto Label
0s
Auto Label
Fit to window
Zoom out
Zoom in

Annotations

3 errors and 2 notices
Check Changeset
Process completed with exit code 1.
Check Changeset: .changeset/24773-oauth-form-types.md#L0
.changeset/24773-oauth-form-types.md exists on the merge base and was not added by this PR, so changing or deleting it silently replaces somebody else's release note (#17712). Two things produce this refusal and their remedies are OPPOSITE, so read which one you are before you act. COLLISION -- you and another PR drew the same changeset filename, and yours overwrote theirs. Remedy: rename yours; restore theirs from base. DELIBERATE CORRECTION -- your change may have made this PENDING release note false, and you rewrote it in the same stroke. Remedy: do NOT restore it -- say so on the PR and get it confirmed; restoring it from the base would put the false sentence back.
Check Changeset: .changeset/24773-oauth-application-type.md#L0
.changeset/24773-oauth-application-type.md exists on the merge base and was not added by this PR, so changing or deleting it silently replaces somebody else's release note (#17712). Two things produce this refusal and their remedies are OPPOSITE, so read which one you are before you act. COLLISION -- you and another PR drew the same changeset filename, and yours overwrote theirs. Remedy: rename yours; restore theirs from base. DELIBERATE CORRECTION -- your change may have made this PENDING release note false, and you rewrote it in the same stroke. Remedy: do NOT restore it -- say so on the PR and get it confirmed; restoring it from the base would put the false sentence back.
Check Changeset: .changeset/24773-oauth-type-refusal.md#L0
ADR-0087 exemption (no-migration-prescription): No metadata moves: no spec key, authorable spelling, object definition or stored shape is added, removed, renamed or re-shaped, and no exported declaration is removed or narrowed, so there is nothing for `objectstack migrate meta` to rewrite. What changes is the answer one runtime REST door gives a caller whose request body names an application type the OAuth provider has no counterpart for; the remedy is a different value in that request, never a rewrite of a package source or a stored row. The Console form that posts to this door already offers only Web and Native, and `sys_oauth_application` rows are not touched. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id is named or touched (not registered or already-registered); and nothing exported is removed or narrowed (not runtime-interface-only, type-surface-only or runtime-export-retired).
Check Changeset
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"