keycloak-tests

The strongest finding is an authentication bypass: the tests, logs, and counters indicate requests may be authorized without successful identity-provider verification, including acceptance of an unsigned token when the provider is unreachable. This is a severe security risk, although the visible evidence does not establish malicious intent. The service-token code itself appears conventional; its endpoint and secret handling should be verified against configuration.

No evidence of malware or deliberate exfiltration appears in the shown code. However, the fragment documents hardcoded credentials that include production-shared secrets, and it runs pull-request code on a corporate-network self-hosted runner. Treat the credentials as exposed, rotate/revoke them, and avoid running untrusted pull-request code on a runner with sensitive network access.