ci: Run flagsmith-private test suites inline on 0.9.0

.github/workflows/api-deploy-production-ecs.yml

@@ -45,7 +45,7 @@ jobs:
         run: |
           echo "https://${{ secrets.GH_PRIVATE_ACCESS_TOKEN }}:@github.com" > ${HOME}/.git-credentials
           git config --global credential.helper store
-          make install-packages opts="--extra private --extra auth-controller"
+          make install-packages opts="--extra private"
           rm -rf ${HOME}/.git-credentials
 
       - name: Generate MCP schema

.github/workflows/api-tests-with-private-packages.yml

@@ -56,7 +56,7 @@ jobs:
         run: |
           echo "https://${{ secrets.GH_PRIVATE_ACCESS_TOKEN }}:@github.com" > ${HOME}/.git-credentials
           git config --global credential.helper store
-          make install-packages opts="--extra dev --extra private --extra auth-controller"
+          make install-packages opts="--extra dev --extra private"
           make integrate-private-tests
           rm -rf ${HOME}/.git-credentials
 

Dockerfile

@@ -107,7 +107,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
 FROM build-python AS build-python-private
 
 # Authenticate git with token and install private Python dependencies
-ARG EXTRAS="--extra private --extra auth-controller --extra ldap --extra licensing"
+ARG EXTRAS="--extra private"
 RUN --mount=type=secret,id=github_private_cloud_token \
   --mount=type=secret,id=codeartifact_token \
   --mount=type=cache,target=/root/.cache/uv \
@@ -176,7 +176,7 @@ RUN --mount=type=secret,id=codeartifact_token \
   --mount=type=cache,target=/root/.cache/uv \
   UV_INDEX_FLAGSMITH_PYPI_PRODUCTION_USERNAME=aws \
   UV_INDEX_FLAGSMITH_PYPI_PRODUCTION_PASSWORD="$(cat /run/secrets/codeartifact_token)" \
-  make install-packages opts='--extra dev --extra private --extra auth-controller --extra ldap --extra licensing' && \
+  make install-packages opts='--extra dev --extra private' && \
   make integrate-private-tests && \
   git config --global --unset credential.helper && \
   rm -f ${HOME}/.git-credentials

api/.gitignore

@@ -9,5 +9,15 @@ static/*
 saml/
 features/workflows/logic/
 
+# flagsmith-private test suites integrated via `make integrate-private-tests`
+/flagsmith-private/
+/tests/rbac_tests/
+/tests/workflow_tests/
+/tests/auth_controller_tests/
+/tests/saml_integration_tests/
+/tests/licensing_integration_tests/
+/tests/ldap_integration_tests/
+/tests/saml_unit_tests/
+
 # Unit test coverage
 .coverage

api/Makefile

@@ -149,16 +149,24 @@ generate-grafana-client-types:
 		--wrap-string-literal \
 		--special-field-name-prefix=
 
+# scim and release_pipelines_logic are deliberately not pulled here: scim's
+# compliance tests need an SCIM_SERVICE_PROVIDER config that conflicts with Core
+# API's own scim tests (django-scim2 caches it globally), and release_pipelines
+# has an order-dependent assertion that only holds in isolation. Both run in
+# flagsmith-private's own CI.
+# TODO https://github.com/Flagsmith/flagsmith-private/issues/177
 .PHONY: integrate-private-tests
 integrate-private-tests:
 	$(eval FLAGSMITH_PRIVATE_REVISION := v$(shell uv run python -c 'import importlib.metadata; print(importlib.metadata.version("flagsmith-private"))'))
-	$(eval AUTH_CONTROLLER_REVISION := $(shell uv run python -c 'import tomllib; d=tomllib.load(open("pyproject.toml","rb")); s=d.get("tool",{}).get("uv",{}).get("sources",{}).get("auth-controller",{}); print(s.get("tag") or s.get("rev") or "")'))
-
-	git clone https://github.com/Flagsmith/flagsmith-private --depth 1 --branch ${FLAGSMITH_PRIVATE_REVISION} \
-		&& mv ./flagsmith-private/integration_tests/rbac tests/rbac_tests \
-		&& mv ./flagsmith-private/integration_tests/workflows_logic tests/workflow_tests
-	git clone https://github.com/flagsmith/flagsmith-auth-controller --depth 1 --branch ${AUTH_CONTROLLER_REVISION} && mv ./flagsmith-auth-controller/tests tests/auth_controller_tests
-	rm -rf ./flagsmith-private ./flagsmith-auth-controller
+	git clone https://github.com/Flagsmith/flagsmith-private --depth 1 --branch ${FLAGSMITH_PRIVATE_REVISION}
+	mv ./flagsmith-private/integration_tests/rbac tests/rbac_tests
+	mv ./flagsmith-private/integration_tests/workflows_logic tests/workflow_tests
+	mv ./flagsmith-private/integration_tests/auth_controller tests/auth_controller_tests
+	mv ./flagsmith-private/integration_tests/saml tests/saml_integration_tests
+	mv ./flagsmith-private/integration_tests/licensing tests/licensing_integration_tests
+	mv ./flagsmith-private/integration_tests/flagsmith_ldap tests/ldap_integration_tests
+	mv ./flagsmith-private/unit_tests/saml tests/saml_unit_tests
+	rm -rf ./flagsmith-private
 
 .PHONY: generate-docs
 generate-docs: generate-flagsmith-sdk-openapi

api/pyproject.toml

@@ -94,20 +94,8 @@ dependencies = [
 # without a PEP 517 `[build-system]` table, so setuptools fallback drops
 # them from the built wheel. We re-declare those transitive deps here so
 # the resolution matches what poetry produced on main.
-auth-controller = [
-    "auth-controller",
-    "django-multiselectfield>=1.0.1,<2",
-]
 private = [
-    "flagsmith-private>=0.7.0,<1",
-]
-ldap = [
-    "flagsmith-ldap",
-    "django-python3-ldap>=0.15.6,<1",
-]
-licensing = [
-    "licensing",
-    "cryptography>=44.0.1",
+    "flagsmith-private>=0.9.0,<1",
 ]
 dev = [
     "django-test-migrations>=1.2.0,<2.0.0",
@@ -174,9 +162,6 @@ url = "https://flagsmith-production-084060095745.d.codeartifact.eu-west-2.amazon
 explicit = true
 
 [tool.uv.sources]
-auth-controller = { git = "https://github.com/flagsmith/flagsmith-auth-controller", tag = "v0.2.0" }
-flagsmith-ldap = { git = "https://github.com/flagsmith/flagsmith-ldap", tag = "v0.1.2" }
-licensing = { git = "https://github.com/flagsmith/licensing", tag = "v0.3.0" }
 flagsmith-private = { index = "flagsmith-pypi-production" }
 clickhouse-driver = { git = "https://github.com/Flagsmith/clickhouse-driver", branch = "newjson" }