test fixes for hardened runners by akshaydeo · Pull Request #3780 · maximhq/bifrost

akshaydeo · 2026-05-26T21:41:34Z

Summary

Weaviate's Docker healthcheck was unreliable in CI environments because it runs inside the container, which doesn't reflect host-level reachability. This PR removes the Docker-native healthcheck for Weaviate and replaces it with explicit host-side readiness polling in each test script.

Changes

Removed the healthcheck block from the Weaviate service in docker-compose.yml
Added a host-side readiness loop in test-api-integrations.sh, test-bifrost-http.sh, and test-e2e-ui.sh that polls http://localhost:9000/v1/.well-known/ready via curl with a 60-second timeout before proceeding with tests

Type of change

Affected areas

How to test

Run any of the affected CI test scripts locally with Docker Compose and verify that the Weaviate readiness check passes before tests proceed:

bash .github/workflows/scripts/test-bifrost-http.sh
bash .github/workflows/scripts/test-api-integrations.sh
bash .github/workflows/scripts/test-e2e-ui.sh

Expected output should include ✅ Weaviate ready (Xs) before test execution begins. If Weaviate does not become reachable within 60 seconds, the script exits with ❌ Weaviate failed readiness check within 60s.

Screenshots/Recordings

N/A

Breaking changes

Yes
No

Related issues

N/A

Security considerations

No security implications. This change only affects CI readiness polling logic.

Checklist

I read docs/contributing/README.md and followed the guidelines
I added/updated tests where appropriate
I updated documentation where needed
I verified builds succeed (Go and UI)
I verified the CI pipeline passes locally if applicable

CLAassistant · 2026-05-26T21:41:41Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

coderabbitai · 2026-05-26T21:41:43Z

Warning

Review limit reached

@akshaydeo, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 10 minutes and 2 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5ee39e78-87b2-4828-b49e-774dd7b5dc1f

📥 Commits

Reviewing files that changed from the base of the PR and between c4aee27 and 68b88c6.

📒 Files selected for processing (4)

.github/workflows/configs/docker-compose.yml
.github/workflows/scripts/test-api-integrations.sh
.github/workflows/scripts/test-bifrost-http.sh
.github/workflows/scripts/test-e2e-ui.sh

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch 05-27-test_fixes_for_hardened_runners

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

akshaydeo · 2026-05-26T21:41:46Z

test fixes for hardened runners #3780 👈 (View in Graphite)
dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

greptile-apps · 2026-05-26T21:43:36Z

Confidence Score: 4/5

Safe to merge; the changes are confined to CI infrastructure and the logic is correct

The same 18-line readiness block is copy-pasted verbatim into all three test scripts. Any future tweak (e.g. a longer timeout, a different port, or a more robust check) must be applied in three places. The Weaviate service also no longer has a Docker-level healthcheck, so docker compose ps and any tooling that inspects health status will silently show no health data for it. Neither issue affects the current correctness of the tests, but they increase maintenance surface.

The three test scripts and docker-compose.yml are worth a second look together — the removed healthcheck and the three identical readiness blocks are tightly coupled, and a future change to one without the others could silently break CI.

Important Files Changed

Filename	Overview
.github/workflows/configs/docker-compose.yml	Removed Docker-native healthcheck from the Weaviate service; readiness is now handled externally via shell scripts
.github/workflows/scripts/test-api-integrations.sh	Added explicit host-side curl polling loop for Weaviate readiness after the Docker-services-ready gate
.github/workflows/scripts/test-bifrost-http.sh	Identical Weaviate readiness block added; no other changes
.github/workflows/scripts/test-e2e-ui.sh	Identical Weaviate readiness block added; no other changes

_{Reviews (1): Last reviewed commit: "test fixes for hardened runners" | Re-trigger Greptile}

@hensapir

* removes from_memory for APIs * docker scout fixes (#3900) * test fixes for hardened runners (#3780) * fix: SGL provider - send Authorization header on streaming requests (#3307) * [fix]: SGL provider - send Authorization header on streaming requests The streaming entry points (ChatCompletionStream, TextCompletionStream) passed nil for the authHeader parameter to the shared OpenAI streaming helpers, so no Authorization header was attached to outbound streaming requests. SGLang servers configured with --api-key always require the header and returned 401 on streaming while non-streaming requests worked. The non-streaming OpenAI helper takes the Key directly and builds the header itself; the streaming helper requires the caller to build it. Mirror the vLLM pattern (core/providers/vllm/vllm.go) and construct the auth header from key.Value when set. Affected packages: - core/providers/sgl/sgl.go - build authHeader for both streaming paths - core/providers/sgl/chat_test.go - regression tests asserting the Authorization header reaches the upstream on chat and text streams - core/changelog.md - changelog entry * [fix]: SGL streaming tests - cancel drain goroutine on test completion The drain goroutines spawned to consume streamChan in TestChatCompletionStream_SetsAuthorizationHeader and TestTextCompletionStream_SetsAuthorizationHeader had no cancellation path: if the streaming pipeline failed to close the channel (e.g. on a test timeout), the goroutines would leak into the test process. Replace the inline `go func() { for range streamChan {} }()` with a shared drainStream helper that selects on both the channel and a `done` channel closed via t.Cleanup, so the goroutine always exits when the test completes regardless of channel state. Addresses Greptile review feedback on PR #3307. --------- Co-authored-by: Akshay Deo <akshay@akshaydeo.com> * ollama streaming auth header (#3906) ## Summary Adds Bearer token authentication support to the Ollama provider's streaming endpoints. Previously, the streaming methods for text completion and chat completion always passed `nil` for the auth header, meaning API keys configured for Ollama were silently ignored during streaming requests. ## Issues Closes #3905 ## Changes - When a non-empty key value is present, a `Bearer` token `Authorization` header is now constructed and passed to the OpenAI-compatible streaming handlers for both `TextCompletionStream` and `ChatCompletionStream` - If no key is configured, the auth header remains `nil`, preserving backward compatibility with unauthenticated local Ollama instances ## Type of change - [x] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [ ] Core (Go) - [ ] Transports (HTTP) - [x] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [ ] Docs ## How to test Configure an Ollama provider with an API key (e.g., when using a hosted or authenticated Ollama instance) and issue a streaming chat or text completion request. Verify the `Authorization: Bearer <key>` header is included in the outgoing request. ```sh go test ./core/providers/ollama/... ``` ## Breaking changes - [ ] Yes - [x] No ## Related issues ## Security considerations API keys are now correctly forwarded as Bearer tokens in streaming requests to Ollama. Ensure keys are stored and retrieved securely via the existing key management mechanism, as they will now be included in outbound HTTP headers for streaming calls. ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable  ## Summary by CodeRabbit * **Bug Fixes** * Ollama streaming requests now support authentication via bearer tokens for both text and chat completions, enabling proper token-based authentication when API keys are provided.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/maximhq/bifrost/pull/3906?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)   * 1.5.7 changelogs (#3907) This release (core v1.5.15, framework v1.3.15) fixes missing `Authorization` header forwarding on streaming requests for the Ollama and SGL providers, ensuring authenticated requests behave correctly during streaming. - Ollama streaming text and chat completion requests now correctly forward the configured API key as an `Authorization: Bearer` header (#3906) - SGL provider now sends the `Authorization` header on streaming requests (#3307) (thanks [@hensapir](https://github.com/hensapir)!) - Governance and Logging APIs: removed the `from_memory` query parameter; virtual key and config list APIs now return consistent DB-backed results, with VK names batch-fetched in a single query (#3903) - Bumped core to v1.5.15, framework to v1.3.15, transports to v1.5.7, and all dependent plugins to their respective patch versions - [x] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI - [x] Core (Go) - [x] Transports (HTTP) - [x] Providers/Integrations - [x] Plugins - [ ] UI (React) - [ ] Docs Validate that Ollama and SGL streaming requests include the `Authorization: Bearer` header when an API key is configured. ```sh go version go test ./... ``` Configure an Ollama or SGL provider with an API key and issue a streaming chat or text completion request. Inspect outbound request headers to confirm `Authorization: Bearer <key>` is present. - [ ] Yes - [x] No Closes #3906 Closes #3307 Closes #3903 These fixes ensure that API keys configured for Ollama and SGL providers are correctly forwarded on streaming requests. Previously, the `Authorization` header was silently dropped on streaming paths, meaning requests could reach upstream providers without authentication credentials. - [x] I read `docs/contributing/README.md` and followed the guidelines - [x] I added/updated tests where appropriate - [x] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [x] I verified the CI pipeline passes locally if applicable  * **Bug Fixes** * Fixed authorization header handling for Ollama streaming requests. * Fixed authorization header forwarding for SGL provider streaming requests. * Improved consistency in virtual key and configuration list API responses by removing unnecessary query parameters. * **Chores** * Updated component versions across the platform.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/maximhq/bifrost/pull/3907?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)   * changelogs (#3909) ## Summary Remediates Docker Scout CVE findings by upgrading transitive `golang.org/x` dependencies and removing the standalone GNU `wget` package from Alpine runtime images, replacing it with the built-in busybox `wget` applet. ## Changes - Bumped `golang.org/x` transitive dependencies (`crypto`, `net`, `sys`, `text`, `term`) across all modules to clear 20 Docker Scout advisories (severity up to 10.0), verified clean with `govulncheck` - Removed standalone `wget` package from Alpine runtime images in `Dockerfile` and `Dockerfile.local`, eliminating CVE-2025-69194 (CVSS 8.8) - Updated `HEALTHCHECK` command from `wget --no-verbose --tries=1` to `wget -q` to use busybox-compatible flags with no functional change in behavior ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [x] Chore/CI ## Affected areas - [x] Core (Go) - [x] Transports (HTTP) - [ ] Providers/Integrations - [x] Plugins - [ ] UI (React) - [ ] Docs ## How to test ```sh # Verify no vulnerabilities remain govulncheck ./... # Build Docker image and confirm wget healthcheck works docker build -f transports/Dockerfile -t gateway-test . docker run --rm gateway-test ``` ## Breaking changes - [ ] Yes - [x] No ## Related issues Closes #3900 ## Security considerations - Clears 20 Docker Scout CVE advisories on `golang.org/x` packages, with severities up to 10.0 - Removes CVE-2025-69194 (CVSS 8.8) by eliminating the standalone GNU `wget` package; busybox `wget` is used instead and is not affected by this CVE ## Checklist - [x] I read `docs/contributing/README.md` and followed the guidelines - [x] I added/updated tests where appropriate - [x] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [x] I verified the CI pipeline passes locally if applicable --------- Co-authored-by: Hen Sapir <hen@sapir.me>

@hensapir

* removes from_memory for APIs * docker scout fixes (maximhq#3900) * test fixes for hardened runners (maximhq#3780) * fix: SGL provider - send Authorization header on streaming requests (maximhq#3307) * [fix]: SGL provider - send Authorization header on streaming requests The streaming entry points (ChatCompletionStream, TextCompletionStream) passed nil for the authHeader parameter to the shared OpenAI streaming helpers, so no Authorization header was attached to outbound streaming requests. SGLang servers configured with --api-key always require the header and returned 401 on streaming while non-streaming requests worked. The non-streaming OpenAI helper takes the Key directly and builds the header itself; the streaming helper requires the caller to build it. Mirror the vLLM pattern (core/providers/vllm/vllm.go) and construct the auth header from key.Value when set. Affected packages: - core/providers/sgl/sgl.go - build authHeader for both streaming paths - core/providers/sgl/chat_test.go - regression tests asserting the Authorization header reaches the upstream on chat and text streams - core/changelog.md - changelog entry * [fix]: SGL streaming tests - cancel drain goroutine on test completion The drain goroutines spawned to consume streamChan in TestChatCompletionStream_SetsAuthorizationHeader and TestTextCompletionStream_SetsAuthorizationHeader had no cancellation path: if the streaming pipeline failed to close the channel (e.g. on a test timeout), the goroutines would leak into the test process. Replace the inline `go func() { for range streamChan {} }()` with a shared drainStream helper that selects on both the channel and a `done` channel closed via t.Cleanup, so the goroutine always exits when the test completes regardless of channel state. Addresses Greptile review feedback on PR maximhq#3307. --------- Co-authored-by: Akshay Deo <akshay@akshaydeo.com> * ollama streaming auth header (maximhq#3906) ## Summary Adds Bearer token authentication support to the Ollama provider's streaming endpoints. Previously, the streaming methods for text completion and chat completion always passed `nil` for the auth header, meaning API keys configured for Ollama were silently ignored during streaming requests. ## Issues Closes maximhq#3905 ## Changes - When a non-empty key value is present, a `Bearer` token `Authorization` header is now constructed and passed to the OpenAI-compatible streaming handlers for both `TextCompletionStream` and `ChatCompletionStream` - If no key is configured, the auth header remains `nil`, preserving backward compatibility with unauthenticated local Ollama instances ## Type of change - [x] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [ ] Core (Go) - [ ] Transports (HTTP) - [x] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [ ] Docs ## How to test Configure an Ollama provider with an API key (e.g., when using a hosted or authenticated Ollama instance) and issue a streaming chat or text completion request. Verify the `Authorization: Bearer <key>` header is included in the outgoing request. ```sh go test ./core/providers/ollama/... ``` ## Breaking changes - [ ] Yes - [x] No ## Related issues ## Security considerations API keys are now correctly forwarded as Bearer tokens in streaming requests to Ollama. Ensure keys are stored and retrieved securely via the existing key management mechanism, as they will now be included in outbound HTTP headers for streaming calls. ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable  ## Summary by CodeRabbit * **Bug Fixes** * Ollama streaming requests now support authentication via bearer tokens for both text and chat completions, enabling proper token-based authentication when API keys are provided.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/maximhq/bifrost/pull/3906?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)   * 1.5.7 changelogs (maximhq#3907) This release (core v1.5.15, framework v1.3.15) fixes missing `Authorization` header forwarding on streaming requests for the Ollama and SGL providers, ensuring authenticated requests behave correctly during streaming. - Ollama streaming text and chat completion requests now correctly forward the configured API key as an `Authorization: Bearer` header (maximhq#3906) - SGL provider now sends the `Authorization` header on streaming requests (maximhq#3307) (thanks [@hensapir](https://github.com/hensapir)!) - Governance and Logging APIs: removed the `from_memory` query parameter; virtual key and config list APIs now return consistent DB-backed results, with VK names batch-fetched in a single query (maximhq#3903) - Bumped core to v1.5.15, framework to v1.3.15, transports to v1.5.7, and all dependent plugins to their respective patch versions - [x] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI - [x] Core (Go) - [x] Transports (HTTP) - [x] Providers/Integrations - [x] Plugins - [ ] UI (React) - [ ] Docs Validate that Ollama and SGL streaming requests include the `Authorization: Bearer` header when an API key is configured. ```sh go version go test ./... ``` Configure an Ollama or SGL provider with an API key and issue a streaming chat or text completion request. Inspect outbound request headers to confirm `Authorization: Bearer <key>` is present. - [ ] Yes - [x] No Closes maximhq#3906 Closes maximhq#3307 Closes maximhq#3903 These fixes ensure that API keys configured for Ollama and SGL providers are correctly forwarded on streaming requests. Previously, the `Authorization` header was silently dropped on streaming paths, meaning requests could reach upstream providers without authentication credentials. - [x] I read `docs/contributing/README.md` and followed the guidelines - [x] I added/updated tests where appropriate - [x] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [x] I verified the CI pipeline passes locally if applicable  * **Bug Fixes** * Fixed authorization header handling for Ollama streaming requests. * Fixed authorization header forwarding for SGL provider streaming requests. * Improved consistency in virtual key and configuration list API responses by removing unnecessary query parameters. * **Chores** * Updated component versions across the platform.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/maximhq/bifrost/pull/3907?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)   * changelogs (maximhq#3909) ## Summary Remediates Docker Scout CVE findings by upgrading transitive `golang.org/x` dependencies and removing the standalone GNU `wget` package from Alpine runtime images, replacing it with the built-in busybox `wget` applet. ## Changes - Bumped `golang.org/x` transitive dependencies (`crypto`, `net`, `sys`, `text`, `term`) across all modules to clear 20 Docker Scout advisories (severity up to 10.0), verified clean with `govulncheck` - Removed standalone `wget` package from Alpine runtime images in `Dockerfile` and `Dockerfile.local`, eliminating CVE-2025-69194 (CVSS 8.8) - Updated `HEALTHCHECK` command from `wget --no-verbose --tries=1` to `wget -q` to use busybox-compatible flags with no functional change in behavior ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [x] Chore/CI ## Affected areas - [x] Core (Go) - [x] Transports (HTTP) - [ ] Providers/Integrations - [x] Plugins - [ ] UI (React) - [ ] Docs ## How to test ```sh # Verify no vulnerabilities remain govulncheck ./... # Build Docker image and confirm wget healthcheck works docker build -f transports/Dockerfile -t gateway-test . docker run --rm gateway-test ``` ## Breaking changes - [ ] Yes - [x] No ## Related issues Closes maximhq#3900 ## Security considerations - Clears 20 Docker Scout CVE advisories on `golang.org/x` packages, with severities up to 10.0 - Removes CVE-2025-69194 (CVSS 8.8) by eliminating the standalone GNU `wget` package; busybox `wget` is used instead and is not affected by this CVE ## Checklist - [x] I read `docs/contributing/README.md` and followed the guidelines - [x] I added/updated tests where appropriate - [x] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [x] I verified the CI pipeline passes locally if applicable --------- Co-authored-by: Hen Sapir <hen@sapir.me>

@hensapir

* removes from_memory for APIs * docker scout fixes (maximhq#3900) * test fixes for hardened runners (maximhq#3780) * fix: SGL provider - send Authorization header on streaming requests (maximhq#3307) * [fix]: SGL provider - send Authorization header on streaming requests The streaming entry points (ChatCompletionStream, TextCompletionStream) passed nil for the authHeader parameter to the shared OpenAI streaming helpers, so no Authorization header was attached to outbound streaming requests. SGLang servers configured with --api-key always require the header and returned 401 on streaming while non-streaming requests worked. The non-streaming OpenAI helper takes the Key directly and builds the header itself; the streaming helper requires the caller to build it. Mirror the vLLM pattern (core/providers/vllm/vllm.go) and construct the auth header from key.Value when set. Affected packages: - core/providers/sgl/sgl.go - build authHeader for both streaming paths - core/providers/sgl/chat_test.go - regression tests asserting the Authorization header reaches the upstream on chat and text streams - core/changelog.md - changelog entry * [fix]: SGL streaming tests - cancel drain goroutine on test completion The drain goroutines spawned to consume streamChan in TestChatCompletionStream_SetsAuthorizationHeader and TestTextCompletionStream_SetsAuthorizationHeader had no cancellation path: if the streaming pipeline failed to close the channel (e.g. on a test timeout), the goroutines would leak into the test process. Replace the inline `go func() { for range streamChan {} }()` with a shared drainStream helper that selects on both the channel and a `done` channel closed via t.Cleanup, so the goroutine always exits when the test completes regardless of channel state. Addresses Greptile review feedback on PR maximhq#3307. --------- Co-authored-by: Akshay Deo <akshay@akshaydeo.com> * ollama streaming auth header (maximhq#3906) ## Summary Adds Bearer token authentication support to the Ollama provider's streaming endpoints. Previously, the streaming methods for text completion and chat completion always passed `nil` for the auth header, meaning API keys configured for Ollama were silently ignored during streaming requests. ## Issues Closes maximhq#3905 ## Changes - When a non-empty key value is present, a `Bearer` token `Authorization` header is now constructed and passed to the OpenAI-compatible streaming handlers for both `TextCompletionStream` and `ChatCompletionStream` - If no key is configured, the auth header remains `nil`, preserving backward compatibility with unauthenticated local Ollama instances ## Type of change - [x] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [ ] Core (Go) - [ ] Transports (HTTP) - [x] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [ ] Docs ## How to test Configure an Ollama provider with an API key (e.g., when using a hosted or authenticated Ollama instance) and issue a streaming chat or text completion request. Verify the `Authorization: Bearer <key>` header is included in the outgoing request. ```sh go test ./core/providers/ollama/... ``` ## Breaking changes - [ ] Yes - [x] No ## Related issues ## Security considerations API keys are now correctly forwarded as Bearer tokens in streaming requests to Ollama. Ensure keys are stored and retrieved securely via the existing key management mechanism, as they will now be included in outbound HTTP headers for streaming calls. ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable  ## Summary by CodeRabbit * **Bug Fixes** * Ollama streaming requests now support authentication via bearer tokens for both text and chat completions, enabling proper token-based authentication when API keys are provided.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/maximhq/bifrost/pull/3906?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)   * 1.5.7 changelogs (maximhq#3907) This release (core v1.5.15, framework v1.3.15) fixes missing `Authorization` header forwarding on streaming requests for the Ollama and SGL providers, ensuring authenticated requests behave correctly during streaming. - Ollama streaming text and chat completion requests now correctly forward the configured API key as an `Authorization: Bearer` header (maximhq#3906) - SGL provider now sends the `Authorization` header on streaming requests (maximhq#3307) (thanks [@hensapir](https://github.com/hensapir)!) - Governance and Logging APIs: removed the `from_memory` query parameter; virtual key and config list APIs now return consistent DB-backed results, with VK names batch-fetched in a single query (maximhq#3903) - Bumped core to v1.5.15, framework to v1.3.15, transports to v1.5.7, and all dependent plugins to their respective patch versions - [x] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI - [x] Core (Go) - [x] Transports (HTTP) - [x] Providers/Integrations - [x] Plugins - [ ] UI (React) - [ ] Docs Validate that Ollama and SGL streaming requests include the `Authorization: Bearer` header when an API key is configured. ```sh go version go test ./... ``` Configure an Ollama or SGL provider with an API key and issue a streaming chat or text completion request. Inspect outbound request headers to confirm `Authorization: Bearer <key>` is present. - [ ] Yes - [x] No Closes maximhq#3906 Closes maximhq#3307 Closes maximhq#3903 These fixes ensure that API keys configured for Ollama and SGL providers are correctly forwarded on streaming requests. Previously, the `Authorization` header was silently dropped on streaming paths, meaning requests could reach upstream providers without authentication credentials. - [x] I read `docs/contributing/README.md` and followed the guidelines - [x] I added/updated tests where appropriate - [x] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [x] I verified the CI pipeline passes locally if applicable  * **Bug Fixes** * Fixed authorization header handling for Ollama streaming requests. * Fixed authorization header forwarding for SGL provider streaming requests. * Improved consistency in virtual key and configuration list API responses by removing unnecessary query parameters. * **Chores** * Updated component versions across the platform.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/maximhq/bifrost/pull/3907?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)   * changelogs (maximhq#3909) ## Summary Remediates Docker Scout CVE findings by upgrading transitive `golang.org/x` dependencies and removing the standalone GNU `wget` package from Alpine runtime images, replacing it with the built-in busybox `wget` applet. ## Changes - Bumped `golang.org/x` transitive dependencies (`crypto`, `net`, `sys`, `text`, `term`) across all modules to clear 20 Docker Scout advisories (severity up to 10.0), verified clean with `govulncheck` - Removed standalone `wget` package from Alpine runtime images in `Dockerfile` and `Dockerfile.local`, eliminating CVE-2025-69194 (CVSS 8.8) - Updated `HEALTHCHECK` command from `wget --no-verbose --tries=1` to `wget -q` to use busybox-compatible flags with no functional change in behavior ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [x] Chore/CI ## Affected areas - [x] Core (Go) - [x] Transports (HTTP) - [ ] Providers/Integrations - [x] Plugins - [ ] UI (React) - [ ] Docs ## How to test ```sh # Verify no vulnerabilities remain govulncheck ./... # Build Docker image and confirm wget healthcheck works docker build -f transports/Dockerfile -t gateway-test . docker run --rm gateway-test ``` ## Breaking changes - [ ] Yes - [x] No ## Related issues Closes maximhq#3900 ## Security considerations - Clears 20 Docker Scout CVE advisories on `golang.org/x` packages, with severities up to 10.0 - Removes CVE-2025-69194 (CVSS 8.8) by eliminating the standalone GNU `wget` package; busybox `wget` is used instead and is not affected by this CVE ## Checklist - [x] I read `docs/contributing/README.md` and followed the guidelines - [x] I added/updated tests where appropriate - [x] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [x] I verified the CI pipeline passes locally if applicable --------- Co-authored-by: Hen Sapir <hen@sapir.me>

test fixes for hardened runners

68b88c6

akshaydeo marked this pull request as ready for review May 26, 2026 21:41

akshaydeo requested a review from a team as a code owner May 26, 2026 21:41

akshaydeo merged commit f56c4b9 into dev May 30, 2026
14 of 15 checks passed

akshaydeo deleted the 05-27-test_fixes_for_hardened_runners branch May 30, 2026 12:48

akshaydeo added a commit that referenced this pull request May 30, 2026

test fixes for hardened runners (#3780)

725a359

Navigation Menu

test fixes for hardened runners - #3780

test fixes for hardened runners#3780
akshaydeo merged 1 commit into
devfrom
05-27-test_fixes_for_hardened_runners

akshaydeo commented May 26, 2026 •

edited

Loading

Uh oh!

CLAassistant commented May 26, 2026

Uh oh!

coderabbitai Bot commented May 26, 2026 •

edited

Loading

Review limit reached

Uh oh!

akshaydeo commented May 26, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented May 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

akshaydeo commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Type of change

Affected areas

How to test

Screenshots/Recordings

Breaking changes

Related issues

Security considerations

Checklist

Uh oh!

CLAassistant commented May 26, 2026

Uh oh!

coderabbitai Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

akshaydeo commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented May 26, 2026

Confidence Score: 4/5

Important Files Changed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

akshaydeo commented May 26, 2026 •

edited

Loading

coderabbitai Bot commented May 26, 2026 •

edited

Loading

akshaydeo commented May 26, 2026 •

edited

Loading