From fdcfc7b881c17596db399bdfad7cd45089265e66 Mon Sep 17 00:00:00 2001
From: Erich Blume <blume.erich@gmail.com>
Date: Sat, 28 Feb 2026 20:09:39 -0800
Subject: [PATCH] C2(authentik-source-build): impl move test-build.nix to card
 docs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the ad-hoc test harness out of the repo and into the Mikado card
documentation where it belongs — it's a testing recipe, not shipped code.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 containers/authentik/test-build.nix           | 11 ---------
 .../authentik-api-client-generation.md        | 24 +++++++++++++++++++
 2 files changed, 24 insertions(+), 11 deletions(-)
 delete mode 100644 containers/authentik/test-build.nix

diff --git a/containers/authentik/test-build.nix b/containers/authentik/test-build.nix
deleted file mode 100644
index bb8f904..0000000
--- a/containers/authentik/test-build.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-# Test harness for building authentik components on ringtail
-# Usage: nix-build test-build.nix -A client-go --extra-experimental-features 'nix-command flakes'
-let
-  pkgs = (builtins.getFlake "nixpkgs").legacyPackages.x86_64-linux;
-  sources = import ./sources.nix { inherit pkgs; };
-in
-{
-  client-go = import ./client-go.nix { inherit pkgs sources; };
-  client-ts = import ./client-ts.nix { inherit pkgs sources; };
-  api-go-vendor-hook = import ./api-go-vendor-hook.nix { inherit pkgs sources; };
-}
diff --git a/docs/how-to/authentik/authentik-api-client-generation.md b/docs/how-to/authentik/authentik-api-client-generation.md
index 933ffe9..8b6d465 100644
--- a/docs/how-to/authentik/authentik-api-client-generation.md
+++ b/docs/how-to/authentik/authentik-api-client-generation.md
@@ -34,6 +34,30 @@ Both clients are generated from the same `schema.yml` OpenAPI spec in the main a
 - TypeScript client replaces `web/node_modules/@goauthentik/api/` in the web UI build
 - The nixpkgs derivation patches the generated Go client (`client-go-config.patch`) — check if still needed
 
+## Testing on Ringtail
+
+Use this ad-hoc `test-build.nix` harness (not committed to the repo):
+
+```nix
+# test-build.nix
+let
+  pkgs = (builtins.getFlake "nixpkgs").legacyPackages.x86_64-linux;
+  sources = import ./sources.nix { inherit pkgs; };
+in
+{
+  client-go = import ./client-go.nix { inherit pkgs sources; };
+  client-ts = import ./client-ts.nix { inherit pkgs sources; };
+  api-go-vendor-hook = import ./api-go-vendor-hook.nix { inherit pkgs sources; };
+}
+```
+
+```fish
+set tmpdir (ssh ringtail 'mktemp -d /tmp/authentik-test.XXXXXX')
+scp containers/authentik/*.nix ringtail:$tmpdir/
+ssh ringtail "cd $tmpdir && nix-build test-build.nix -A client-go --extra-experimental-features 'nix-command flakes'"
+ssh ringtail "rm -rf $tmpdir"
+```
+
 ## Related
 
 - [[build-authentik-from-source]] — Parent goal