test(ofrep): adopt the OpenFeature Provider TCK

providers/ofrep/README.md

@@ -72,3 +72,39 @@ Given below are the supported configurations:
 | proxySelector      | ProxySelector  | ProxySelector.getDefault() | The proxy selector used by HTTP Client.
 | executor      | Executor  | Thread Pool of size 5 | The executor used by HTTP Client.
 
+
+## Provider conformance (TCK)
+
+This provider adopts the [OpenFeature Provider TCK](../../tools/tck/README.md) as a single suite,
+`OfrepTest`, in `src/test/java/.../ofrep/tck/`. **Read that class before changing it.** It records
+which capabilities are declared, which are withheld and why — several are withheld because OFREP puts
+the decision on the server rather than in the provider, which is a fact about the protocol and not a
+defect — and every known deviation. Because OFREP is a protocol rather than a vendor, the backend
+under test is simply something that speaks it: the suite reuses the unmodified `flagd-testbed` image
+and its launchpad control API.
+
+```bash
+# once, if tools/tck is not in your local repository yet
+mvn -pl tools/tck -am -DskipTests install
+
+mvn -Ptck -pl providers/ofrep test
+```
+
+Do not add `-am` to the run itself; the TCK README says why.
+
+The suite is Docker-gated and excluded from the default build by
+`<testExclusions>**/tck/*.java</testExclusions>` in this module's POM, and the `tck` profile above is
+the only thing that undoes it — this module has no `e2e` profile, so the `-Pe2e` that CI activates on
+every push changes nothing here. The exclusion was missing until recently, which meant `mvn verify`
+started a Compose stack and ran the suite, red, in every job that touched `providers/ofrep`.
+
+**No CI job runs it**, so a maintainer runs it by hand before merging a change to the provider's
+resolution or error behaviour, and quotes the result in the pull request.
+
+A clean run is **65 scenarios: 46 passing, 17 skipped, 2 failing**, the two failures being flags the
+pinned testbed image does not serve (open-feature/flagd-testbed#392). It is also **intermittently
+flaky** — about half the runs carry one or two extra failures where an evaluation comes back as the
+code default or as `FLAG_NOT_FOUND`, on a scenario that moves from run to run. That is the testbed
+readiness window of open-feature/flagd-testbed#394, not a provider defect and not something to cover
+with a sleep; `OfrepTest`'s javadoc has the detail. Repeat the run before treating an extra failure as
+a regression — anything that reproduces is one.

providers/ofrep/pom.xml

@@ -17,6 +17,21 @@
     <description>OFREP Provider</description>
     <url>https://openfeature.dev</url>
 
+    <properties>
+        <!-- Match any tck version locally; CI resolves it from the reactor -->
+        <tck.version>[0.1.0,)</tck.version>
+        <testcontainers.version>2.0.4</testcontainers.version>
+        <!--
+            The conformance adoption needs a Docker daemon for its Compose stack, so its package is
+            excluded from the default build exactly as providers/flagd excludes its own. The parent
+            POM feeds this property to Surefire's <excludes>; it defines no default, so a module that
+            wants the gate declares it, and one that forgets silently runs a Docker-dependent suite
+            in every job. The whole directory is named rather than a filename pattern inside one:
+            see providers/ofrep/README.md for the policy and how to run the suite.
+        -->
+        <testExclusions>**/tck/*.java</testExclusions>
+    </properties>
+
     <developers>
 		<developer>
 			<id>Rahul-Baradol</id>
@@ -81,5 +96,78 @@
             <version>4.12.0</version>
             <scope>test</scope>
         </dependency>
+
+        <!--
+            OpenFeature Provider TCK. Brings its own Gherkin, step definitions, Compose lifecycle
+            and JUnit Platform suite configuration; the one class under src/test/java/.../ofrep/tck
+            is the whole adoption. Version range so a local reactor build matches whatever is
+            checked out.
+        -->
+        <dependency>
+            <groupId>dev.openfeature.contrib.tools</groupId>
+            <artifactId>tck</artifactId>
+            <version>${tck.version}</version>
+            <scope>test</scope>
+        </dependency>
+
+        <!--
+            Testcontainers, declared here rather than inherited. The TCK compiles against it for
+            ContainerizedProviderTckTest's Compose lifecycle but declares it provided/optional, so
+            that the majority of adopters - which have no backend and never load that class - do not
+            resolve it. A containerised adopter such as this one therefore brings its own, which also
+            means it chooses its own major.
+        -->
+        <dependency>
+            <groupId>org.testcontainers</groupId>
+            <artifactId>testcontainers</artifactId>
+            <version>${testcontainers.version}</version>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
+
+    <profiles>
+        <profile>
+            <!--
+                This profile runs the Provider TCK conformance suite, and nothing else:
+
+                    mvn -Ptck -pl providers/ofrep test
+
+                Do not add `-am`: it pulls tools/tck into the reactor and runs its own suite first,
+                which puts two kinds of failure back on one signal. A one-off
+                `mvn -pl tools/tck -am -DskipTests install` is what it was there for.
+
+                It is a step of its own, not a corner of some wider end-to-end target, because of
+                what a red build says. A conformance run carries failures by design — wherever
+                OfrepTest declares a knownDeviation — so a signal shared with a suite that is
+                expected green ends with somebody silencing the informative half. See Appendix F,
+                "Running the suite in CI".
+
+                Nothing activates this profile in CI, deliberately: the suite is expected to fail
+                today and is run by hand before merge. See providers/ofrep/README.md.
+            -->
+            <id>tck</id>
+            <properties>
+                <!--
+                    Drop the tck directory from the exclusions; the include below is what selects
+                    the suite. Both halves are needed: the include alone leaves the exclusion in
+                    force and runs nothing, and dropping the exclusion alone runs this module's
+                    unit tests alongside the suite.
+                -->
+                <testExclusions></testExclusions>
+            </properties>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-surefire-plugin</artifactId>
+                        <configuration>
+                            <includes>
+                                <include>**/tck/*.java</include>
+                            </includes>
+                        </configuration>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+    </profiles>
 </project>