[test] Add tests for oidc.fetchToken

[github-actions]

Test Coverage Improvement: oidc.fetchToken

Function Analyzed

• Package: internal/oidc
• Function: fetchToken (method on *Provider)
• Previous Coverage: 93.9%
• New Coverage: 100.0%
• Package Total: 97.1% → 100.0%
• Complexity: High (multiple HTTP interaction branches, 8+ error paths)

Why This Function?

fetchToken was the most complex under-tested function in the codebase. It contains 8 distinct error paths covering URL parsing, HTTP request construction, network I/O, response body reading, JSON parsing, and JWT expiry extraction. Two branches were previously uncovered:

1. http.NewRequestWithContext error path — triggered when fetchToken receives a nil context, which causes net/http to return "net/http: nil Context".
2. io.ReadAll body-read error path — triggered when the server sends valid HTTP 200 headers but then closes the TCP connection before delivering the body. The HTTP client returns a successful Do() (status 200 is received) but the subsequent io.ReadAll(resp.Body) fails with io.ErrUnexpectedEOF because Content-Length declared more bytes than were actually sent.

Tests Added

• ✅ TestProvider_NilContext — passes nil as the context to provider.Token(), exercises the "failed to create OIDC token request" error return in fetchToken
• ✅ TestProvider_BodyReadError — uses http.Hijacker to send a 200 response with Content-Length: 1000 then immediately close the connection, exercising the "failed to read OIDC token response" error return

Coverage Report

Before:
  fetchToken   93.9%
  total:       97.1%

After:
  fetchToken   100.0%
  total:       100.0%

Test Execution

=== RUN   TestProvider_NilContext
--- PASS: TestProvider_NilContext (0.00s)
=== RUN   TestProvider_BodyReadError
--- PASS: TestProvider_BodyReadError (0.00s)
PASS
ok  github.com/github/gh-aw-mcpg/internal/oidc

---

Generated by Test Coverage Improver
Next run will target the next most complex under-tested function

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "proxy.golang.org"

See Network Configuration for more information.

Generated by Test Coverage Improver · 486.3 AIC · ⊞ 7.1K · ◷

[Copilot]

Pull request overview

This PR improves unit test coverage for internal/oidc.Provider.fetchToken, targeting previously uncovered error branches so the internal/oidc package reaches 100% coverage.

Changes:

• Add a test that passes a nil context to exercise the http.NewRequestWithContext error path.
• Add a test that hijacks the HTTP connection and closes it after sending headers to force an io.ReadAll body-read failure.

Show a summary per file

File	Description
internal/oidc/provider_test.go	Adds two new unit tests covering fetchToken error paths (nil context request creation failure; response body read failure).

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 1