This page describes how this repository’s own tests run.

Layout

deployment

QuarkusUnitTest classes against the Dev Service: beans, global interceptors, health (up, down, disabled), TLS misconfiguration, API key enforcement, Dev Service seeding and its failure modes, and the Dev UI JSON-RPC service.

runtime

Plain unit tests of the client against in-process gRPC servers.

security/deployment

QuarkusUnitTest classes for quarkus-topaz-security against the Dev Service: the route policy in both modes, @TopazAuthorize, @TopazCheck, the @PermissionsAllowed bridge, startup validation and Topaz-down denials.

security/no-rest-tests

An application without quarkus-rest: it builds, and the topaz route policy enforces on a reactive route.

zanzibar/deployment

QuarkusUnitTest classes for quarkus-topaz-zanzibar against the Dev Service: the relationship manager, the quarkus-zanzibar filter and its Topaz-down behaviour.

integration-tests

The todo application, including endpoints secured by the route policy and the interceptors, and the quarkus-zanzibar annotated /fga/todos endpoints. TodoResourceTest, SecuredTodoResourceTest and FgaTodoResourceTest (@QuarkusTest) run with Surefire; their *IT subclasses (TodoResourceIT, SecuredTodoResourceIT, FgaTodoResourceIT) run the same tests with Failsafe against the native executable and are skipped unless -Dnative is given.

Running locally

Tests that start Topaz need a container runtime. With rootless Podman:

DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock TESTCONTAINERS_RYUK_DISABLED=true \
JAVA_HOME=/path/to/jdk-25 mvn -T 4 verify

  • Java 25 runs the build; the code targets release 21.

  • Add -Pdocs to also build this documentation.

  • Add -ntp when the local repository is cold. A @QuarkusTest fork can deadlock while the Quarkus bootstrap downloads an artifact and prints the download line through surefire’s captured output (quarkus#57751); -ntp turns that output off, and the Quarkus bootstrap honours it inside the fork.

A native run adds the mandatory native-image arguments:

DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock TESTCONTAINERS_RYUK_DISABLED=true \
JAVA_HOME=/path/to/jdk-25 mvn -pl integration-tests -am verify -Dnative \
    -Dquarkus.native.container-build=true \
    -Dquarkus.native.additional-build-args=-J-XX:TieredStopAtLevel=1,--parallelism=8

To check against an older Topaz, override the Dev Service image:

mvn -pl deployment -am test -Dquarkus.topaz.devservices.image-name=ghcr.io/aserto-dev/topaz:0.33.21

CI

GitHub Actions runs mvn -B -ntp -T 4 verify, the native integration tests, and the deployment tests against the previous Topaz release. GitHub runners have Docker, so the Podman variables are not set there. Every command passes -ntp because the runners start with an empty local repository, which is exactly the condition for the deadlock above; without it the @QuarkusTest modules hung until the job’s six-hour limit on the ubuntu-26.04 runner image.