The failing Precheck / Release (x64) / ./ci/do_ci.sh release.test_only job was caused by an oauth2 integration test leaving an active downstream request open on an expected failure path. The failure surfaced in OauthUseRefreshTokenDisabled.FailRefreshTokenFlow under IPv6_GoogleGrpc_CbcEncryption.

• Root cause

  • doRefreshTokenFlow(..., expect_failure = true) returned immediately after confirming the OAuth upstream request failed.
  • The test did not drain the downstream response or close the test connections, so HttpIntegrationTest teardown hit numActiveRequests() == 1.

• Change

  • Handle the expected-failure branch like the successful branch with explicit response completion and connection cleanup.
  • Assert the downstream response is the expected redirect before returning.

• Effect

  • The test now fully closes the request lifecycle in the refresh-token-disabled path, avoiding teardown failures in release test runs.

waitForOAuth2Response(token_secret, expect_failure);
if (expect_failure) {
  response->waitForHeaders();
  EXPECT_EQ("302", response->headers().getStatusValue());
  RELEASE_ASSERT(response->waitForEndStream(), "unexpected timeout");
  cleanup();
  return;
}