Fix OpenAPI spec key reordering on incremental builds by Pepo48 · Pull Request #48371 · keycloak/keycloak

Pepo48 · 2026-04-22T13:50:07Z

Incremental builds and test runs (via -am) only reach the test phase, which is before prepare-package, so no stale META-INF copy exists on the classpath. The only edge case is mvn package/install without clean followed by an incremental build - we could solve it fully by adding a maven-clean-plugin execution to remove stale META-INF/openapi.* before generation, but I am not sure whether we want/need to do so. I guess it's not a practical concern since these commands are typically run with clean.

So this small change should be sufficient for all the more standard scenarios.

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-04-22T14:50:42Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.RPInitiatedFrontChannelLogoutTest#testFrontChannelLogoutWithoutSessionRequired

Keycloak CI - Forms IT (firefox)

org.openqa.selenium.TimeoutException: 
Navigation timed out after 10000 ms
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1010-azure', java.version: '25.0.2'
Driver info: org.openqa.selenium.firefox.FirefoxDriver
...

Report flaky test

vmuzikar

LGTM, thanks.

keycloak-github-bot · 2026-04-22T15:40:55Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.RPInitiatedFrontChannelLogoutTest#testFrontChannelLogoutWithoutSessionRequired

Keycloak CI - Forms IT (firefox)

org.openqa.selenium.TimeoutException: 
Navigation timed out after 10000 ms
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1010-azure', java.version: '25.0.2'
Driver info: org.openqa.selenium.firefox.FirefoxDriver
...

Report flaky test

keycloak-github-bot

Unreported flaky test detected, please review

vmuzikar · 2026-04-22T16:57:15Z

Seems the test failures might be related?

Pepo48 · 2026-04-22T17:11:21Z

@vmuzikar yes, they are, after the change the spec wasn't on the classpath when admin-cli tests needed it. I haven't realized that due to the recent v2 CLI changes, it needs to have the spec available earlier.

Let me provide the other workaround using maven-clean-plugin I mentioned in the description, until this gets merged: smallrye/smallrye-open-api#2544

Edit: the smallrye-open-api issue has been already merged, so we need to wait for the release to consume it.
The proper fix on our side will require just to add <enableStandardStaticFiles>false</enableStandardStaticFiles> to the plugin config (and revert the workaround in this PR).

Edit2: it will be part of 4.3.1 release.

Closes: keycloak#48366 Signed-off-by: Peter Zaoral <[email protected]>

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-04-22T18:19:27Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.RPInitiatedFrontChannelLogoutTest#testFrontChannelLogoutWithoutSessionRequired

Keycloak CI - Forms IT (firefox)

org.openqa.selenium.TimeoutException: 
Navigation timed out after 10000 ms
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1010-azure', java.version: '25.0.2'
Driver info: org.openqa.selenium.firefox.FirefoxDriver
...

Report flaky test

org.keycloak.testsuite.model.singleUseObject.SingleUseObjectModelTest#testCluster

Keycloak CI - Store Model Tests

java.lang.AssertionError: 
threads didn't terminate in time: [main (RUNNABLE):
	at [email protected]/sun.management.ThreadImpl.dumpThreads0(Native Method)
	at [email protected]/sun.management.ThreadImpl.dumpAllThreads(ThreadImpl.java:505)
	at [email protected]/sun.management.ThreadImpl.dumpAllThreads(ThreadImpl.java:493)
...

Report flaky test

org.keycloak.testsuite.model.user.UserModelTest#testAddRemoveUserConcurrent

Keycloak CI - Store Model Tests

org.infinispan.commons.IllegalLifecycleStateException: ISPN000323: realms is in 'TERMINATED' state and so it does not accept new invocations. Either restart it or recreate the cache container.
	at org.infinispan.cache.impl.SimpleCacheImpl.getDataContainer(SimpleCacheImpl.java:1314)
	at org.infinispan.cache.impl.SimpleCacheImpl$EntrySetBase.<init>(SimpleCacheImpl.java:1724)
	at org.infinispan.cache.impl.SimpleCacheImpl$EntrySet.<init>(SimpleCacheImpl.java:1784)
	at org.infinispan.cache.impl.SimpleCacheImpl.entrySet(SimpleCacheImpl.java:605)
...

Report flaky test

Closes: keycloak#48366 Signed-off-by: Peter Zaoral <[email protected]>

Pepo48 · 2026-04-23T07:15:58Z

@vmuzikar jfyi 4.3.1 was already released 😊.

I dug a bit deeper as I knew that using enableStandardStaticFiles is not a fix at its core on their end. With the property set to false we're just skipping the merge phase (that isn't useful for our particular use case) but that does not fix the reordering issue. I could find the issue and fix it. But then I noticed that they already did something very similar in 4.3.1 - it already, in a similar fashion to what I tried, fixes the reordering thanks to the populateSchemaObject refactoring in PR #2490.

What it means for us, we don't need a workaround and we don't even need the now exposed property. All we need is the bump to freshly released version.

To have enableStandardStaticFiles set to false is still useful for our use case, as I implied above. Per my understanding the merge phase is mean for the cases, when you have some handwritten parts in the spec and you want to merge them with the annotation generated spec. In our case, the spec is fully generated, so with the property set, we can save a little bit of processing I guess.

I pushed the version bump to the PR as a separate commit to see whether it breaks something else in the CI but during my local testing I couldn't reproduce any of the CLI failures/reordering issues.

Closes: keycloak#48366 Signed-off-by: Peter Zaoral <[email protected]>

Pepo48 · 2026-04-23T09:22:40Z

I just added the final spec structure after the bump to 4.3.1 as a separate commit.

Both changes come from SmallRye PRs between 4.2.4 and 4.3.1, specifically from #2490 and #2502.

shawkins · 2026-04-23T11:11:43Z

      description: Bearer token authentication using a Keycloak access token
 tags:
 - name: Clients (v2)
-  x-smallrye-profile-admin: ""


@Pepo48 does this mean we need to update our usage of these annotations @Extension(name = KeycloakOpenAPI.Profiles.ADMIN, value = "") - for whatever reason the value is null in all of them, and it looks now that will simply get omitted.

@shawkins tl;dr I don't think that annotations need any updating at this point.

My understanding of the change in smallrye-open-api/pull/2490 is prior to the PR, the tag copy leaked into the output as (most likely harmless) x-smallrye-profile-admin: "" and in 4.3.1 the new ExtensionRemovalFilter strips it.

The question rather is, do we even need these annotations? For v2 we have no scanProfiles, so they never had any effect, right? I already tried earlier today to just remove @Extension(name = KeycloakOpenAPI.Profiles.ADMIN, value = "") from ClientsApi.java and nothing happened after the rebuild, the spec was identical. But I didn't want to touch this part unnecessarily as I am not that familiar in this area, so I may be missing something that is evident (my only goal was to get rid of the annoying spec drifts 😊).

The question rather is, do we even need these annotations? For v2 we have no scanProfiles, so they never had any effect, right?

My answer to both is I don't know, so I wanted to check before something was removed.

With #25259 it seems like they were used to just trigger the openapi inclusion, not that anyone was looking for the custom value.

Pepo48 requested review from a team as code owners April 22, 2026 13:50

keycloak-github-bot Bot added team/cloud-native flaky-test labels Apr 22, 2026

This was referenced Apr 22, 2026

Flaky test: org.keycloak.testsuite.model.session.UserSessionProviderModelTest#testStreamsMarshalling #48121

Open

Flaky test: org.keycloak.testsuite.model.session.UserSessionProviderModelTest#testCreateUserSessionsParallel #48120

Open

keycloak-github-bot Bot reviewed Apr 22, 2026

View reviewed changes

vmuzikar previously approved these changes Apr 22, 2026

View reviewed changes

vmuzikar enabled auto-merge (squash) April 22, 2026 15:35

keycloak-github-bot Bot reviewed Apr 22, 2026

View reviewed changes

Fix OpenAPI spec key reordering on incremental builds

fb6660a

Closes: keycloak#48366 Signed-off-by: Peter Zaoral <[email protected]>

Pepo48 dismissed vmuzikar’s stale review via fb6660a April 22, 2026 17:20

Pepo48 force-pushed the issue-48366 branch from 9096048 to fb6660a Compare April 22, 2026 17:20

keycloak-github-bot Bot reviewed Apr 22, 2026

View reviewed changes

Fix OpenAPI spec key reordering on incremental builds

c974745

Closes: keycloak#48366 Signed-off-by: Peter Zaoral <[email protected]>

keycloak-github-bot Bot mentioned this pull request Apr 23, 2026

Flaky test: org.keycloak.testsuite.model.session.AuthenticationSessionTest#testConcurrentAuthenticationSessionsCreation #47990

Open

Fix OpenAPI spec key reordering on incremental builds

6e152dd

Closes: keycloak#48366 Signed-off-by: Peter Zaoral <[email protected]>

Pepo48 requested a review from a team as a code owner April 23, 2026 09:14

keycloak-github-bot Bot added the team/ui label Apr 23, 2026

keycloak-github-bot Bot mentioned this pull request Apr 23, 2026

Flaky test: org.keycloak.testsuite.model.session.UserSessionPersisterProviderTest#testUserRemoved #47833

Open

shawkins reviewed Apr 23, 2026

View reviewed changes

Conversation

Pepo48 commented Apr 22, 2026

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Apr 22, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.RPInitiatedFrontChannelLogoutTest#testFrontChannelLogoutWithoutSessionRequired

Uh oh!

vmuzikar left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Apr 22, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.RPInitiatedFrontChannelLogoutTest#testFrontChannelLogoutWithoutSessionRequired

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

vmuzikar commented Apr 22, 2026

Uh oh!

Pepo48 commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Apr 22, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.RPInitiatedFrontChannelLogoutTest#testFrontChannelLogoutWithoutSessionRequired

org.keycloak.testsuite.model.singleUseObject.SingleUseObjectModelTest#testCluster

org.keycloak.testsuite.model.user.UserModelTest#testAddRemoveUserConcurrent

Uh oh!

Pepo48 commented Apr 23, 2026

Uh oh!

Pepo48 commented Apr 23, 2026

Uh oh!

shawkins Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Pepo48 Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

shawkins Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Pepo48 commented Apr 22, 2026 •

edited

Loading