ci: improve performance (#5953)

* pipeline runs on ubuntu instead of docker * added Makefile to build zitadel core (backend) and console (frontend) * pipeline runs in parallel where possible * pipeline is split into multiple jobs * removed goreleaser * added command to check if zitadel instance is running
2024-12-04 07:25:08 +00:00 · 2023-07-17 10:08:20 +02:00 · 2023-07-17 10:08:20 +02:00 · 1c354ca977
commit 1c354ca977
parent bcf4bfc585
64 changed files with 12290 additions and 21117 deletions
--- a/.artifacts/zitadel/.gitignore
+++ b/.artifacts/zitadel/.gitignore
@ -1,3 +0,0 @@
-*
-!.gitignore
-!.gitkeep
--- a/.dockerignore
+++ b/.dockerignore
@ -1,6 +1,6 @@
-/.git/
+# .git
 .codecov
-/.github/
+.github
 .gitignore
 .dockerignore
 **/Dockerfile
@ -15,8 +15,14 @@ CONTRIBUTING.md
 LICENSE
 README.md
 SECURITY.md
+**/Dockerfile
+**/*.Dockerfile
 pkg/grpc/*/*.pb.*
 pkg/grpc/*/*.swagger.json
-.goreleaser.yaml
-.artifacts/
+**/.artifacts
+console/.angular
+console/node_modules
+console/src/app/proto/generated/
+console/tmp/
 .vscode
+build/*.Dockerfile
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@ -0,0 +1,92 @@
+name: ZITADEL CI/CD
+
+on: [pull_request, merge_group, workflow_dispatch]
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+
+  core:
+    uses: ./.github/workflows/core.yml
+    with:
+      node_version: '18'
+      buf_version: 'latest'
+      go_version: '1.20'
+    
+  console:
+    uses: ./.github/workflows/console.yml
+    with:
+      node_version: '18'
+      buf_version: 'latest'
+
+  version:
+    uses: ./.github/workflows/version.yml
+    with:
+      semantic_version: '19.0.2'
+      dry_run: true
+
+  compile:
+    needs: [core, console, version]
+    uses: ./.github/workflows/compile.yml
+    with:
+      go_version: '1.20'
+      core_cache_key: ${{ needs.core.outputs.cache_key }}
+      console_cache_key: ${{ needs.console.outputs.cache_key }}
+      core_cache_path: ${{ needs.core.outputs.cache_path }}
+      console_cache_path: ${{ needs.console.outputs.cache_path }}
+      version: ${{ needs.version.outputs.version }}
+
+  core-unit-test:
+    needs: core
+    uses: ./.github/workflows/core-unit-test.yml
+    with:
+      go_version: '1.20'
+      core_cache_key: ${{ needs.core.outputs.cache_key }}
+      core_cache_path: ${{ needs.core.outputs.cache_path }}
+      
+  core-integration-test:
+    needs: core
+    uses: ./.github/workflows/core-integration-test.yml
+    with:
+      go_version: '1.20'
+      core_cache_key: ${{ needs.core.outputs.cache_key }}
+      core_cache_path: ${{ needs.core.outputs.cache_path }}
+  
+  lint:
+    needs: [core, console]
+    uses: ./.github/workflows/lint.yml
+    with:
+      go_version: '1.20'
+      node_version: '18'
+      buf_version: 'latest'
+      go_lint_version: 'v1.53.2'
+      core_cache_key: ${{ needs.core.outputs.cache_key }}
+      core_cache_path: ${{ needs.core.outputs.cache_path }}
+
+  container:
+    needs: [compile]
+    uses: ./.github/workflows/container.yml
+    with:
+      image_name: 'ghcr.io/zitadel/zitadel'
+
+  e2e:
+    uses: ./.github/workflows/e2e.yml
+    needs: [container]
+    with:
+      image: ${{ needs.container.outputs.image }}-debug
+
+  release:
+    uses: ./.github/workflows/release.yml
+    needs: [version, core-unit-test, core-integration-test, lint, container, e2e]
+    if: ${{ needs.version.outputs.published == 'true' }}
+    secrets:
+      GCR_JSON_KEY_BASE64: ${{ secrets.GCR_JSON_KEY_BASE64 }}
+    with:
+      node_version: '16'
+      buf_version: 'latest'
+      image: ${{ needs.container.outputs.image }}
+      semantic_version: '19.0.2'
+      image_name: 'ghcr.io/zitadel/zitadel'
+      google_image_name: "europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel"
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@ -1,4 +1,4 @@
-name: "Code scanning - action"
+name: "Code Scanning"

 on:
  push:
--- a/.github/workflows/compile.yml
+++ b/.github/workflows/compile.yml
@ -0,0 +1,99 @@
+name: Compile
+
+on:
+  workflow_call:
+    inputs:
+      go_version:
+        required: true
+        type: string
+      core_cache_key:
+        required: true
+        type: string
+      core_cache_path:
+        required: true
+        type: string
+      console_cache_key:
+        required: true
+        type: string
+      console_cache_path:
+        required: true
+        type: string
+      version:
+        required: true
+        type: string
+
+jobs:
+  executable:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        goos: [linux, darwin, windows]
+        goarch: [amd64, arm64]
+    
+    steps:
+    - 
+      uses: actions/checkout@v3
+    - 
+      uses: actions/cache/restore@v3
+      timeout-minutes: 1
+      name: restore console
+      with:
+        path: ${{ inputs.console_cache_path }}
+        key: ${{ inputs.console_cache_key }}
+        fail-on-cache-miss: true
+    - 
+      uses: actions/cache/restore@v3
+      timeout-minutes: 1
+      name: restore core
+      with:
+        path: ${{ inputs.core_cache_path }}
+        key: ${{ inputs.core_cache_key }}
+        fail-on-cache-miss: true
+    -
+      uses: actions/setup-go@v4
+      with:
+        go-version: ${{ inputs.go_version }}
+    - 
+      name: compile
+      timeout-minutes: 5
+      run: |
+        GOOS="${{matrix.goos}}" \
+        GOARCH="${{matrix.goarch}}" \
+        VERSION="${{ inputs.version }}" \
+        COMMIT_SHA="${{ github.sha }}" \
+        make compile_pipeline
+    -
+      name: create folder
+      run: |
+        mkdir zitadel-${{ matrix.goos }}-${{ matrix.goarch }}
+        mv zitadel zitadel-${{ matrix.goos }}-${{ matrix.goarch }}/
+        cp LICENSE zitadel-${{ matrix.goos }}-${{ matrix.goarch }}/
+        cp README.md zitadel-${{ matrix.goos }}-${{ matrix.goarch }}/
+        tar -cvf zitadel-${{ matrix.goos }}-${{ matrix.goarch }}.tar zitadel-${{ matrix.goos }}-${{ matrix.goarch }}
+    - 
+      uses: actions/upload-artifact@v3
+      with:
+        name: zitadel-${{ matrix.goos }}-${{ matrix.goarch }}
+        path: zitadel-${{ matrix.goos }}-${{ matrix.goarch }}.tar
+  
+  checksums:
+    runs-on: ubuntu-latest
+    needs: executable
+    steps:
+    - 
+      uses: actions/download-artifact@v3
+      with:
+        path: executables
+    - 
+      name: move files one folder up
+      run: mv */*.tar . && find . -type d -empty -delete
+      working-directory: executables
+    -
+      run: sha256sum * > checksums.txt
+      working-directory: executables
+    - 
+      uses: actions/upload-artifact@v3
+      with:
+        name: checksums.txt
+        path: executables/checksums.txt
--- a/.github/workflows/console.yml
+++ b/.github/workflows/console.yml
@ -0,0 +1,61 @@
+name: Build console
+
+on: 
+  workflow_call:
+    inputs:
+      node_version:
+        required: true
+        type: string
+      buf_version:
+        required: true
+        type: string
+    outputs:
+      cache_key:
+        value: ${{ jobs.build.outputs.cache_key }}
+      cache_path:
+          value: ${{ jobs.build.outputs.cache_path }}
+
+env:
+  cache_path: console/dist/console
+
+jobs:
+  build:
+    outputs:
+      cache_key: ${{ steps.cache.outputs.cache-primary-key }}
+      cache_path: ${{ env.cache_path }}
+    runs-on: ubuntu-latest
+    steps:
+        - 
+          uses: actions/checkout@v3
+        - 
+          uses: actions/cache/restore@v3
+          timeout-minutes: 1
+          id: cache
+          with:
+            key: console-${{ hashFiles('console', 'proto') }}
+            restore-keys: |
+              console-
+            path: ${{ env.cache_path }}
+        - 
+          if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+          uses: bufbuild/buf-setup-action@v1
+          with:
+            github_token: ${{ github.token }}
+            version: ${{ inputs.buf_version }}
+        - 
+          if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+          uses: actions/setup-node@v3
+          with:
+            node-version: ${{ inputs.node_version }}
+            cache: 'yarn'
+            cache-dependency-path: console/yarn.lock
+        - 
+          if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+          run: make console_build
+        - 
+          if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+          uses: actions/cache/save@v3
+          with:
+            path: ${{ env.cache_path }}
+            key: ${{ steps.cache.outputs.cache-primary-key }}
+        
--- a/.github/workflows/container.yml
+++ b/.github/workflows/container.yml
@ -0,0 +1,168 @@
+name: Container
+
+on:
+  workflow_call:
+    inputs:
+      image_name:
+        required: true
+        type: string
+    outputs:
+      image:
+        value: '${{ inputs.image_name }}:${{ github.sha }}'
+
+env:
+  default_labels: |
+    org.opencontainers.image.documentation=https://zitadel.com/docs
+    org.opencontainers.image.vendor=CAOS AG
+
+jobs:
+  build:
+    name: zitadel
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: [amd64,arm64]
+    steps:
+      - 
+        uses: actions/checkout@v3
+      -
+        name: Scratch meta
+        id: scratch-meta
+        uses: docker/metadata-action@v4
+        with:
+          images: ${{ inputs.image_name }}
+          labels: ${{ env.default_labels}}
+          tags: |
+            type=sha,prefix=,suffix=,format=long
+      -
+        name: Debug meta
+        id: debug-meta
+        uses: docker/metadata-action@v4
+        with:
+          images: ${{ inputs.image_name }}
+          labels: ${{ env.default_labels}}
+          tags: |
+            type=sha,prefix=,suffix=-debug,format=long
+      - 
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+      - 
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+        with:
+          driver-opts: 'image=moby/buildkit:v0.11.6'
+      - 
+        name: Login to Docker registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - 
+        uses: actions/download-artifact@v3
+        with:
+          path: .artifacts
+          name: zitadel-linux-${{ matrix.arch }}
+      -
+        name: Unpack executable
+        run: |
+          tar -xvf .artifacts/zitadel-linux-${{ matrix.arch }}.tar
+          mv zitadel-linux-${{ matrix.arch }}/zitadel ./zitadel
+      - 
+        name: Debug
+        id: build-debug
+        uses: docker/build-push-action@v4
+        timeout-minutes: 3
+        with:
+          context: .
+          file: build/Dockerfile
+          target: artifact
+          platforms: linux/${{ matrix.arch }}
+          push: true
+          labels: ${{ steps.debug-meta.outputs.labels }}
+          outputs: type=image,name=${{ inputs.image_name }},push-by-digest=true,name-canonical=true,push=true
+      - 
+        name: Scratch
+        id: build-scratch
+        uses: docker/build-push-action@v4
+        timeout-minutes: 3
+        with:
+          context: .
+          file: build/Dockerfile
+          target: final
+          platforms: linux/${{ matrix.arch }}
+          push: true
+          labels: ${{ steps.scratch-meta.outputs.labels }}
+          outputs: type=image,name=${{ inputs.image_name }},push-by-digest=true,name-canonical=true,push=true
+      -
+        name: Export debug digest
+        run: |
+          mkdir -p /tmp/digests/debug
+          digest="${{ steps.build-debug.outputs.digest }}"
+          touch "/tmp/digests/debug/${digest#sha256:}"
+      -
+        name: Export scratch digest
+        run: |
+          mkdir -p /tmp/digests/scratch
+          digest="${{ steps.build-scratch.outputs.digest }}"
+          touch "/tmp/digests/scratch/${digest#sha256:}"
+      -
+        name: Upload digest
+        uses: actions/upload-artifact@v3
+        with:
+          name: digests
+          path: /tmp/digests
+          if-no-files-found: error
+          retention-days: 1
+  
+  merge:
+    runs-on: ubuntu-latest
+    needs:
+      - build
+    strategy:
+      fail-fast: false
+      matrix:
+        image: [scratch, debug]
+        include:
+          - image: scratch
+            suffix: ''
+          - image: debug
+            suffix: '-debug'
+    steps:
+      -
+        name: Download digests
+        uses: actions/download-artifact@v3
+        with:
+          name: digests
+          path: /tmp/digests
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+        with:
+          driver-opts: 'image=moby/buildkit:v0.11.6'
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: '${{ inputs.image_name }}'
+          tags: |
+            type=sha,prefix=,suffix=${{ matrix.suffix }},format=long
+      - 
+        name: Login to Docker registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - 
+        name: Create manifest list and push
+        working-directory: /tmp/digests/${{ matrix.image }}
+        run: |
+          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ inputs.image_name }}@sha256:%s ' *)
+      -
+        name: Inspect image
+        run: |
+          docker buildx imagetools inspect ${{ inputs.image_name }}:${{ github.sha }}${{ matrix.suffix }}
--- a/.github/workflows/core-integration-test.yml
+++ b/.github/workflows/core-integration-test.yml
@ -0,0 +1,153 @@
+name: Integration test core
+
+on: 
+  workflow_call:
+    inputs:
+      go_version:
+        required: true
+        type: string
+      core_cache_key:
+        required: true
+        type: string
+      core_cache_path:
+        required: true
+        type: string
+
+jobs:
+  postgres:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres
+        ports:
+          - 5432:5432
+        env:
+          POSTGRES_USER: zitadel
+          PGUSER: zitadel
+          POSTGRES_DB: zitadel
+          POSTGRES_HOST_AUTH_METHOD: trust
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+          --health-start-period 10s
+    steps:
+      - 
+        uses: actions/checkout@v3
+      -
+        uses: actions/setup-go@v4
+        with:
+          go-version: ${{ inputs.go_version }}
+      - 
+        uses: actions/cache/restore@v3
+        timeout-minutes: 1
+        name: restore core
+        id: restore-core
+        with:
+          path: ${{ inputs.core_cache_path }}
+          key: ${{ inputs.core_cache_key }}
+          fail-on-cache-miss: true
+      -
+        id: go-cache-path
+        name: set cache path
+        run: echo "GO_CACHE_PATH=$(go env GOCACHE)" >> $GITHUB_OUTPUT
+      - 
+        uses: actions/cache/restore@v3
+        id: cache
+        timeout-minutes: 1
+        name: restore previous results
+        with:
+          key: integration-test-postgres-${{ inputs.core_cache_key }}
+          restore-keys: |
+            integration-test-postgres-core-
+          path: ${{ steps.go-cache-path.outputs.GO_CACHE_PATH }}
+      - 
+        name: test
+        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        env:
+          ZITADEL_MASTERKEY: MasterkeyNeedsToHave32Characters
+          INTEGRATION_DB_FLAVOR: postgres
+        run: make core_integration_test
+      - 
+        name: publish coverage
+        uses: codecov/codecov-action@v3.1.4
+        with:
+          file: profile.cov
+          name: core-integration-tests-postgres
+          flags: core-integration-tests-postgres
+      - 
+        uses: actions/cache/save@v3
+        name: cache results
+        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        with:
+          key: integration-test-postgres-${{ inputs.core_cache_key }}
+          path: ${{ steps.go-cache-path.outputs.GO_CACHE_PATH }}
+
+  # TODO: enable as soon as cockroach allows `COCKROACH_ARGS`
+  # cockroach:
+  #   runs-on: ubuntu-latest
+  #   services:
+  #     cockroach:
+  #       image: cockroachdb/cockroach:latest
+  #       ports:
+  #         - 26257:26257
+  #         - 9090:9090
+  #       env:
+  #         COCKROACH_ARGS: start-single-node --insecure --http-addr :9090
+  #       options: >-
+  #         --health-cmd "curl http://localhost:9090/health?ready=1 || exit 1"
+  #         --health-interval 10s
+  #         --health-timeout 5s
+  #         --health-retries 5
+  #         --health-start-period 10s
+  #   steps:
+  #     - 
+  #       uses: actions/checkout@v3
+  #     -
+  #       uses: actions/setup-go@v4
+  #       with:
+  #         go-version: ${{ inputs.go_version }}
+  #     - 
+  #       uses: actions/cache/restore@v3
+  #       timeout-minutes: 1
+  #       name: restore core
+  #       with:
+  #         path: ${{ inputs.core_cache_path }}
+  #         key: ${{ inputs.core_cache_key }}
+  #         fail-on-cache-miss: true
+  #     -
+  #       id: go-cache-path
+  #       name: set cache path
+  #       run: echo "GO_CACHE_PATH=$(go env GOCACHE)" >> $GITHUB_OUTPUT
+  #     - 
+  #       uses: actions/cache/restore@v3
+  #       timeout-minutes: 1
+  #       name: restore previous results
+  #       cache: id
+  #       with:
+  #         key: integration-test-crdb-${{ inputs.core_cache_key }}
+  #         restore-keys: |
+  #           integration-test-crdb-core-
+  #         path: ${{ steps.go-cache-path.outputs.GO_CACHE_PATH }}
+  #     - 
+  #       name: test
+  #       if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+  #       env:
+  #         ZITADEL_MASTERKEY: MasterkeyNeedsToHave32Characters
+  #         INTEGRATION_DB_FLAVOR: cockroach
+  #       run: make core_integration_test
+  #     - 
+  #       name: publish coverage
+  #       uses: codecov/codecov-action@v3.1.4
+  #       with:
+  #         file: profile.cov
+  #         name: core-integration-tests-cockroach
+  #         flags: core-integration-tests-cockroach
+  #     - 
+  #       uses: actions/cache/save@v3
+  #       name: cache results
+  #       if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+  #       with:
+  #         key: integration-test-crdb-${{ inputs.core_cache_key }}
+  #         path: ${{ steps.go-cache-path.outputs.GO_CACHE_PATH }}
--- a/.github/workflows/core-unit-test.yml
+++ b/.github/workflows/core-unit-test.yml
@ -0,0 +1,67 @@
+name: Unit test core
+
+on: 
+  workflow_call:
+    inputs:
+      go_version:
+        required: true
+        type: string
+      core_cache_key:
+        required: true
+        type: string
+      core_cache_path:
+        required: true
+        type: string
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - 
+        uses: actions/checkout@v3
+      -
+        uses: actions/setup-go@v4
+        with:
+          go-version: ${{ inputs.go_version }}
+      - 
+        uses: actions/cache/restore@v3
+        timeout-minutes: 1
+        name: restore core
+        id: restore-core
+        with:
+          path: ${{ inputs.core_cache_path }}
+          key: ${{ inputs.core_cache_key }}
+          fail-on-cache-miss: true
+      -
+        id: go-cache-path
+        name: set cache path
+        run: echo "GO_CACHE_PATH=$(go env GOCACHE)" >> $GITHUB_OUTPUT
+      - 
+        uses: actions/cache/restore@v3
+        id: cache
+        timeout-minutes: 1
+        name: restore previous results
+        with:
+          key: unit-test-${{ inputs.core_cache_key }}
+          restore-keys: |
+            unit-test-core-
+          path: ${{ steps.go-cache-path.outputs.GO_CACHE_PATH }}
+      - 
+        name: test
+        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        run: make core_unit_test
+      - 
+        name: publish coverage
+        uses: codecov/codecov-action@v3.1.4
+        with:
+          file: profile.cov
+          name: core-unit-tests
+          flags: core-unit-tests
+      - 
+        uses: actions/cache/save@v3
+        name: cache results
+        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        with:
+          key: unit-test-${{ inputs.core_cache_key }}
+          path: ${{ steps.go-cache-path.outputs.GO_CACHE_PATH }}
+        
--- a/.github/workflows/core.yml
+++ b/.github/workflows/core.yml
@ -0,0 +1,81 @@
+name: Build core
+
+on: 
+  workflow_call:
+    inputs:
+      go_version:
+        required: true
+        type: string
+      buf_version:
+        required: true
+        type: string
+      node_version:
+        required: true
+        type: string
+    outputs:
+      cache_key:
+        value: ${{ jobs.build.outputs.cache_key }}
+      cache_path:
+        value: ${{ jobs.build.outputs.cache_path }}
+
+env:
+  cache_path: |
+    internal/statik/statik.go
+    internal/notification/statik/statik.go
+    internal/api/ui/login/static/resources/themes/zitadel/css/zitadel.css*
+    internal/api/ui/login/statik/statik.go
+    internal/api/assets/authz.go 
+    internal/api/assets/router.go
+    openapi/v2
+    pkg/grpc/**/*.pb.*
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    outputs:
+      cache_key: ${{ steps.cache.outputs.cache-primary-key }}
+      cache_path: ${{ env.cache_path }}
+    steps:
+        - 
+          uses: actions/checkout@v3
+        - 
+          uses: actions/cache/restore@v3
+          timeout-minutes: 1
+          id: cache
+          with:
+            key: core-${{ hashFiles( 'go.*', 'openapi', 'cmd', 'pkg/grpc/**/*.go', 'proto', 'internal') }}
+            restore-keys: |
+              core-
+            path: ${{ env.cache_path }}
+        - 
+          if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+          uses: bufbuild/buf-setup-action@v1
+          with:
+            github_token: ${{ github.token }}
+            version: ${{ inputs.buf_version }}
+        
+        - 
+          # node to install sass
+          if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+          uses: actions/setup-node@v3
+          with:
+            node-version: ${{ inputs.node_version }}
+        - 
+          if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+          run: npm install -g sass
+        
+        - 
+          if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+          uses: actions/setup-go@v4
+          with:
+            go-version: ${{ inputs.go_version }}
+        - 
+          if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+          run: make core_build
+        - 
+          if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+          uses: actions/cache/save@v3
+          with:
+            key: ${{ steps.cache.outputs.cache-primary-key }}
+            path: ${{ env.cache_path }}
+        
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@ -1,66 +1,104 @@
 name: "ZITADEL e2e Tests"

 on:
-  workflow_run:
-    workflows: [ZITADEL Release]
-    types:
-      - completed
-  workflow_dispatch:
+  workflow_call:
    inputs:
-      releaseversion:
-        description: 'Release version to test'
+      image:
        required: true
-        default: 'latest'
+        type: string

 jobs:
  test:
    strategy:
+      fail-fast: false
      matrix:
        browser: [firefox, chrome]
-    runs-on: ubuntu-20.04
+    services:
+      # we currently use postgres because cockroach doesn't work
+      postgres:
+        image: postgres
+        ports:
+          - 5432:5432
+        env:
+          POSTGRES_USER: zitadel
+          PGUSER: zitadel
+          POSTGRES_DB: zitadel
+          POSTGRES_HOST_AUTH_METHOD: trust
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+          --health-start-period 10s
+      zitadel:
+        image: ${{ inputs.image }}
+        credentials:
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+        options: >-
+          --health-cmd "zitadel ready"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+          --health-start-period 10s
+          --add-host host.docker.internal:host-gateway
+        ports:
+          - 8080:8080
+        env:
+          ZITADEL_ARGS: "start-from-init --masterkeyFromEnv"
+          ZITADEL_MASTERKEY: MasterkeyNeedsToHave32Characters
+          ZITADEL_LOG_LEVEL: debug
+          ZITADEL_EXTERNALDOMAIN: localhost
+          ZITADEL_EXTERNALSECURE: "false"
+          ZITADEL_TLS_ENABLED: "false"
+          ZITADEL_DATABASE_POSTGRES_HOST: postgres
+          ZITADEL_DATABASE_POSTGRES_PORT: "5432"
+          ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
+          ZITADEL_DATABASE_POSTGRES_MAXOPENCONNS: "20"
+          ZITADEL_DATABASE_POSTGRES_MAXIDLECONNS: "10"
+          ZITADEL_DATABASE_POSTGRES_USER_USERNAME: zitadel
+          ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
+          ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: zitadel
+          ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
+          ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORDCHANGEREQUIRED: "false"
+          ZITADEL_LOGSTORE_ACCESS_DATABASE_ENABLED: "true"
+          ZITADEL_LOGSTORE_ACCESS_DATABASE_DEBOUNCE_MINFREQUENCY: 0s
+          ZITADEL_LOGSTORE_ACCESS_DATABASE_DEBOUNCE_MAXBULKSIZE: "0"
+          ZITADEL_LOGSTORE_EXECUTION_DATABASE_ENABLED: "true"
+          ZITADEL_LOGSTORE_EXECUTION_STDOUT_ENABLED: "false"
+          ZITADEL_QUOTAS_ACCESS_EXHAUSTEDCOOKIEKEY: "zitadel.quota.limiting"
+          ZITADEL_QUOTAS_ACCESS_EXHAUSTEDCOOKIEMAXAGE: 60s
+          ZITADEL_PROJECTIONS_CUSTOMIZATIONS_NOTIFICATIONSQUOTAS_REQUEUEEVERY: 1s
+          ZITADEL_DEFAULTINSTANCE_LOGINPOLICY_MFAINITSKIPLIFETIME: "0"
+          ZITADEL_SYSTEMAPIUSERS: "{\"cypress\": {\"keyData\": \"LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUF6aStGRlNKTDdmNXl3NEtUd3pnTQpQMzRlUEd5Y20vTStrVDBNN1Y0Q2d4NVYzRWFESXZUUUtUTGZCYUVCNDV6YjlMdGpJWHpEdzByWFJvUzJoTzZ0CmgrQ1lRQ3ozS0N2aDA5QzBJenhaaUIySVMzSC9hVCs1Qng5RUZZK3ZuQWtaamNjYnlHNVlOUnZtdE9sbnZJZUkKSDdxWjB0RXdrUGZGNUdFWk5QSlB0bXkzVUdWN2lvZmRWUVMxeFJqNzMrYU13NXJ2SDREOElkeWlBQzNWZWtJYgpwdDBWajBTVVgzRHdLdG9nMzM3QnpUaVBrM2FYUkYwc2JGaFFvcWRKUkk4TnFnWmpDd2pxOXlmSTV0eXhZc3duCitKR3pIR2RIdlczaWRPRGxtd0V0NUsycGFzaVJJV0syT0dmcSt3MEVjbHRRSGFidXFFUGdabG1oQ2tSZE5maXgKQndJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg==\"}}"
+
+    runs-on: ubuntu-latest
    env:
-      ZITADEL_IMAGE_REGISTRY: 'ghcr.io/zitadel/zitadel'
+      ZITADEL_IMAGE: ${{ inputs.image }}
    steps:
-      - name: Checkout Repository
+      - 
+        name: Checkout Repository
        uses: actions/checkout@v3
-      - name: Set TAG env manual trigger
-        if: github.event_name == 'workflow_dispatch'
-        run: echo "ZITADEL_IMAGE=${ZITADEL_IMAGE_REGISTRY}:${{ github.event.inputs.releaseversion }}" >> $GITHUB_ENV
-      - name: get latest tag
-        uses: actions-ecosystem/action-get-latest-tag@v1
-        id: get-latest-tag
-        with: 
-           semver_only: true  
-      - name: Set TAG env on ZITADEL release
-        if: github.event_name == 'workflow_run'
-        run: echo "ZITADEL_IMAGE=${ZITADEL_IMAGE_REGISTRY}:${{ steps.get-latest-tag.outputs.tag }}" >> $GITHUB_ENV
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+      - 
+        name: Cypress run
+        uses: cypress-io/github-action@v5
+        env:
+          CYPRESS_BASE_URL: http://localhost:8080/ui/console
+          CYPRESS_WEBHOOK_HANDLER_HOST: host.docker.internal
+          CYPRESS_DATABASE_CONNECTION_URL: 'postgresql://zitadel@localhost:5432/zitadel'
+          CYPRESS_BACKEND_URL: http://localhost:8080
        with:
-          driver: docker
-          install: true
-      - name: Test ${{ matrix.browser }}
-        run: docker compose run --service-ports e2e --browser ${{ matrix.browser }}
-        working-directory: e2e/config/host.docker.internal
-      - name: Ensure Artifacts Directory Exists
-        run: mkdir -p ./.artifacts
-      - name: Save ZITADEL Logs
-        if: always()
-        run: docker compose logs zitadel > ../../../.artifacts/e2e-compose-zitadel.log
-        working-directory: e2e/config/host.docker.internal
-      - name: Save Prepare Logs
-        if: always()
-        run: docker compose logs prepare > ../../../.artifacts/e2e-compose-prepare.log
-        working-directory: e2e/config/host.docker.internal
-      - name: Archive production tests ${{ matrix.browser }}
-        if: always()
+          working-directory: e2e
+          browser: ${{ matrix.browser }}
+          command: npm run e2e
+          config-file: cypress.config.ts
+      - 
        uses: actions/upload-artifact@v3
+        if: always()
        with:
          name: production-tests-${{ matrix.browser }}
          path: |
-            e2e/cypress/results
-            e2e/cypress/videos
            e2e/cypress/screenshots
-            .artifacts/e2e-compose-zitadel.log
-            .artifacts/e2e-compose-prepare.log
+            e2e/cypress/videos
+            e2e/cypress/results
          retention-days: 30
--- a/.github/workflows/homebrew.yml
+++ b/.github/workflows/homebrew.yml
@ -0,0 +1,74 @@
+name: ZITADEL Update Homebrew Formula
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  homebrew-releaser:
+    runs-on: ubuntu-latest
+    name: homebrew-releaser
+    steps:
+      - name: Release my project to my Homebrew tap
+        uses: Justintime50/homebrew-releaser@v1
+        with:
+          # The name of the homebrew tap to publish your formula to as it appears on GitHub.
+          # Required - strings
+          homebrew_owner: zitadel
+          homebrew_tap: homebrew-tap
+
+          # The name of the folder in your homebrew tap where formula will be committed to.
+          # Default is shown - string
+          formula_folder: Formula
+
+          # The Personal Access Token (saved as a repo secret) that has `repo` permissions for the repo running the action AND Homebrew tap you want to release to.
+          # Required - string
+          github_token: ${{ secrets.CR_PAT }}
+
+          # Git author info used to commit to the homebrew tap.
+          # Defaults are shown - strings
+          commit_owner: homebrew-releaser
+          commit_email: homebrew-releaser@zitadel.com
+
+          # Custom dependencies in case other formulas are needed to build the current one.
+          # Optional - multiline string
+          depends_on: |
+            "go" => :optional
+            "git"
+
+          # Custom install command for your formula.
+          # Required - string
+          install: 'bin.install "zitadel"'
+
+          # Custom test command for your formula so you can run `brew test`.
+          # Optional - string
+          test: 'ystem "#{bin}/zitadel -v"'
+
+          # Allows you to set a custom download strategy. Note that you'll need
+          # to implement the strategy and add it to your tap repository.
+          # Example: https://docs.brew.sh/Formula-Cookbook#specifying-the-download-strategy-explicitly
+          # Optional - string
+        #   download_strategy: CurlDownloadStrategy
+
+          # Allows you to add a custom require_relative at the top of the formula template.
+          # Optional - string
+        #   custom_require: custom_download_strategy
+
+          # Adds URL and checksum targets for different OS and architecture pairs. Using this option assumes 
+          # a tar archive exists on your GitHub repo with the following URL pattern (this cannot be customized):
+          # https://github.com/{GITHUB_OWNER}/{REPO_NAME}/releases/download/{TAG}/{REPO_NAME}-{VERSION}-{OPERATING_SYSTEM}-{ARCHITECTURE}.tar.gz'
+          # Darwin AMD pre-existing path example: https://github.com/justintime50/myrepo/releases/download/v1.2.0/myrepo-1.2.0-darwin-amd64.tar.gz
+          # Linux ARM pre-existing path example: https://github.com/justintime50/myrepo/releases/download/v1.2.0/myrepo-1.2.0-linux-arm64.tar.gz
+          # Optional - booleans
+          target_darwin_amd64: true
+          target_darwin_arm64: true
+          target_linux_amd64: true
+          target_linux_arm64: true
+
+          # Skips committing the generated formula to a homebrew tap (useful for local testing).
+          # Default is shown - boolean
+          skip_commit: true
+
+          # Logs debugging info to console.
+          # Default is shown - boolean
+          debug: true
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@ -1,51 +0,0 @@
-name: Integration tests
-
-on:
-  push:
-    tags-ignore:
-      - '**'
-  pull_request:
-    branches:
-      - '**'
-
-jobs:
-  run:
-    strategy:
-      matrix:
-        db: [cockroach, postgres]
-    runs-on: ubuntu-20.04
-    env:
-      DOCKER_BUILDKIT: 1
-      INTEGRATION_DB_FLAVOR: ${{ matrix.db }}
-      ZITADEL_MASTERKEY: MasterkeyNeedsToHave32Characters
-    steps:
-      - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: '1.20'
-      - name: Source checkout
-        uses: actions/checkout@v3
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-        with:
-          driver: docker
-          install: true
-      - name: Generate gRPC definitions
-        run: docker build -f build/grpc/Dockerfile -t zitadel-base:local .
-      - name: Copy gRPC definitions
-        run: docker build -f build/zitadel/Dockerfile . -t zitadel-go-base --target go-copy -o .
-      - name: Download Go modules
-        run: go mod download
-      - name: Start ${{ matrix.db }} database
-        run: docker compose -f internal/integration/config/docker-compose.yaml up --wait ${INTEGRATION_DB_FLAVOR}
-      - name: Run zitadel init and setup
-        run: |
-          go run main.go init --config internal/integration/config/zitadel.yaml --config internal/integration/config/${INTEGRATION_DB_FLAVOR}.yaml
-          go run main.go setup --masterkeyFromEnv --config internal/integration/config/zitadel.yaml --config internal/integration/config/${INTEGRATION_DB_FLAVOR}.yaml
-      - name: Run integration tests
-        run: go test -tags=integration -race -p 1 -v -coverprofile=profile.cov -coverpkg=./internal/...,./cmd/... ./internal/integration ./internal/api/grpc/... ./internal/notification/handlers/... ./internal/api/oidc
-      - name: Publish go coverage
-        uses: codecov/codecov-action@v3.1.0
-        with:
-          file: profile.cov
-          name: integration-tests
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@ -0,0 +1,104 @@
+name: Lint
+
+on:
+  workflow_call:
+    inputs:
+      node_version:
+        required: true
+        type: string
+      go_version:
+        required: true
+        type: string
+      buf_version:
+        required: true
+        type: string
+      go_lint_version:
+        required: true
+        type: string
+      core_cache_key:
+        required: true
+        type: string
+      core_cache_path:
+        required: true
+        type: string
+
+jobs:
+
+  lint-skip:
+    name: lint skip
+    runs-on: ubuntu-latest
+    if: ${{ github.event_name != 'pull_request' }}
+    steps:
+      - name: Lint skip
+        run: |
+          echo "Linting outside of pull requests is skipped"
+
+  api:
+    name: api
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    if: ${{ github.event_name == 'pull_request' }}
+    steps:
+    - 
+      uses: actions/checkout@v3
+    - 
+      uses: bufbuild/buf-setup-action@v1
+      with:
+        version: ${{ inputs.buf_version }}
+        github_token: ${{ secrets.GITHUB_TOKEN }}
+    - 
+      name: lint
+      uses: bufbuild/buf-lint-action@v1
+    - 
+      uses: bufbuild/buf-breaking-action@v1
+      with:
+        against: "https://github.com/${{ github.repository }}.git#branch=main"
+
+  console:
+    if: ${{ github.event_name == 'pull_request' }}
+    name: console
+    runs-on: ubuntu-latest
+    steps:
+    -
+      name: Checkout
+      uses: actions/checkout@v3
+    -
+      uses: actions/setup-node@v3
+      with:
+        node-version: ${{ inputs.node_version }}
+        cache: 'yarn'
+        cache-dependency-path: console/yarn.lock
+    -
+      run: cd console && yarn install
+    -
+      name: lint
+      run: make console_lint
+
+  core:
+    name: core
+    runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' }}
+    steps:
+    -
+      name: Checkout
+      uses: actions/checkout@v3
+    - 
+      uses: actions/setup-go@v4
+      with:
+        go-version: ${{ github.event.inputs.go_version }}
+    - 
+      uses: actions/cache/restore@v3
+      timeout-minutes: 1
+      name: restore core
+      with:
+        path: ${{ inputs.core_cache_path }}
+        key: ${{ inputs.core_cache_key }}
+        fail-on-cache-miss: true
+    - 
+      uses: golangci/golangci-lint-action@v3
+      with:
+        version: ${{ inputs.go_lint_version }}
+        github-token: ${{ github.token }}
+        only-new-issues: true
+        skip-pkg-cache: true
+        skip-build-cache: true
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@ -0,0 +1,81 @@
+name: Release
+
+on:
+  workflow_call:
+    inputs:
+      node_version:
+        required: true
+        type: string
+      buf_version:
+        required: true
+        type: string
+      semantic_version:
+        required: true
+        type: string
+      image:
+        required: true
+        type: string
+      image_name:
+        required: true
+        type: string
+      google_image_name:
+        required: true
+        type: string
+    secrets:
+      GCR_JSON_KEY_BASE64:
+        description: 'base64 endcrypted key to connect to Google'
+        required: true
+
+jobs:
+  version:
+    uses: ./.github/workflows/version.yml
+    with:
+      semantic_version: ${{ inputs.semantic_version }}
+      dry_run: true
+
+  docker:
+    runs-on: ubuntu-22.04
+    needs: [ version ]
+    steps:
+    -
+      name: Set up QEMU
+      uses: docker/setup-qemu-action@v2
+    -
+      name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v2
+    - 
+      name: Login to Docker registry
+      uses: docker/login-action@v2
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    -
+      name: Login to Google Artifact Registry
+      uses: docker/login-action@v2
+      with:
+        registry: europe-docker.pkg.dev
+        username: _json_key_base64
+        password: ${{ secrets.GCR_JSON_KEY_BASE64 }}
+    -
+      name: Publish ${{ needs.version.outputs.version }}
+      run: |
+        docker buildx imagetools create \
+          --tag ${{ inputs.image_name }}:${{ needs.version.outputs.version }} \
+          ${{ inputs.image }}
+        docker buildx imagetools create \
+          --tag ${{ inputs.image_name }}:${{ needs.version.outputs.version }}-debug \
+          ${{ inputs.image }}-debug        
+        docker buildx imagetools create \
+          --tag ${{ inputs.google_image_name }}:${{ needs.version.outputs.version }} \
+          ${{ inputs.image }}
+    -
+      name: Publish latest
+      if: ${{ github.ref_name == 'main' }}
+      run: |
+        docker buildx imagetools create \
+          --tag ${{ inputs.image_name }}:latest \
+          ${{ inputs.image }}
+        docker buildx imagetools create \
+          --tag ${{ inputs.image_name }}:latest-debug \
+          ${{ inputs.image }}-debug
--- a/.github/workflows/test-code.yml
+++ b/.github/workflows/test-code.yml
@ -1,75 +0,0 @@
-name: ZITADEL PR
-
-on:
-  pull_request:
-    paths-ignore:
-      - 'docs/**'
-      - 'guides/**'
-      - '**.md'
-      - 'release-channels.yaml'
-
-jobs:
-  Build-ZITADEL:
-    runs-on: ubuntu-20.04
-    env:
-      DOCKER_BUILDKIT: 1
-    steps:
-      - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: '1.20'
-      - name: Source checkout
-        uses: actions/checkout@v3
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-        with:
-          driver: docker
-          install: true
-      - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v3
-        with:
-          install-only: true
-          version: v1.10.3
-      - name: Build and Unit Test
-        run: GOOS="linux" GOARCH="amd64" goreleaser build --id prod --snapshot --single-target --rm-dist --output .artifacts/zitadel/zitadel
-      - name: linting
-        uses: golangci/golangci-lint-action@v3
-        with:
-          version: v1.52
-          only-new-issues: true
-          skip-pkg-cache: true
-      - name: Publish go coverage
-        uses: codecov/codecov-action@v3.1.0
-        with:
-          file: .artifacts/codecov/profile.cov
-          name: unit-tests
-      # As goreleaser doesn't build a dockerfile in snapshot mode, we have to build it here
-      - name: Build Docker Image
-        run: docker build -t zitadel:pr --file build/Dockerfile .artifacts/zitadel
-      - name: Run E2E Tests
-        run: docker compose run --service-ports e2e --browser chrome
-        working-directory: e2e/config/host.docker.internal
-        env:
-          ZITADEL_IMAGE: zitadel:pr
-      - name: Save ZITADEL Logs
-        if: always()
-        run: docker compose logs zitadel > ../../../.artifacts/e2e-compose-zitadel.log
-        working-directory: e2e/config/host.docker.internal
-      - name: Save Prepare Logs
-        if: always()
-        run: docker compose logs prepare > ../../../.artifacts/e2e-compose-prepare.log
-        working-directory: e2e/config/host.docker.internal
-      - name: Archive Test Results
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: pull-request-tests
-          path: |
-            e2e/cypress/results
-            e2e/cypress/videos
-            e2e/cypress/screenshots
-            .artifacts/e2e-compose-zitadel.log
-            .artifacts/e2e-compose-prepare.log
-          retention-days: 30
--- a/.github/workflows/test-docs.yml
+++ b/.github/workflows/test-docs.yml
@ -1,21 +0,0 @@
-# ATTENTION: Although this workflow doesn't do much, it is still important.
-# It is complementary to the workflow in the file test-code.yml.
-# It enables to exclude files for the workflow and still mark the Test job as required without having pending PRs.
-# GitHub recommends this solution here:
-# https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/troubleshooting-required-status-checks#handling-skipped-but-required-checks
-
-name: ZITADEL PR
-
-on:
-  pull_request:
-    paths:
-      - 'docs/**'
-      - 'guides/**'
-      - '**.md'
-      - 'release-channels.yaml'
-
-jobs:
-  Build-ZITADEL:
-    runs-on: ubuntu-20.04
-    steps:
-      - run: 'echo "No tests for docs are implemented, yet"'
--- a/.github/workflows/version.yml
+++ b/.github/workflows/version.yml
@ -0,0 +1,45 @@
+name: Version
+
+on:
+  workflow_call:
+    inputs:
+      semantic_version:
+        required: true
+        type: string
+      dry_run:
+        required: true
+        type: boolean
+    outputs:
+        version: 
+            value: ${{ jobs.generate.outputs.version }}
+        published: 
+            value: ${{jobs.generate.outputs.published }}
+
+jobs:
+  generate:
+    runs-on: ubuntu-22.04
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    outputs:
+      version: ${{ steps.output.outputs.VERSION }}
+      published: ${{ steps.semantic.outputs.new_release_published }}
+    steps:
+    - 
+      name: Source checkout
+      uses: actions/checkout@v3
+    - 
+      name: Semantic Release
+      uses: cycjimmy/semantic-release-action@v3
+      id: semantic
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        dry_run: ${{ inputs.dry_run }}
+        semantic_version: ${{ inputs.semantic_version }}
+        extra_plugins: |
+          @semantic-release/exec@6.0.3
+    -
+      name: output
+      id: output
+      run:
+        if [[ ! -z "${{ steps.semantic.outputs.new_release_version }}" ]]; then echo "VERSION=v${{ steps.semantic.outputs.new_release_version }}" >> "$GITHUB_OUTPUT"; else echo "VERSION=" >> "$GITHUB_OUTPUT";fi
--- a/.github/workflows/zitadel.yml
+++ b/.github/workflows/zitadel.yml
@ -1,88 +0,0 @@
-name: ZITADEL Release
-
-on:
-  push:
-    tags-ignore:
-      - "*"
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  packages: write
-
-jobs:
-  Build:
-    runs-on: ubuntu-20.04
-    env:
-      DOCKER_BUILDKIT: 1
-    steps:
-      - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: '1.20'
-      - name: Source checkout
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-      - name: Fetch all tags
-        run: git fetch --force --tags
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-        with:
-          driver: docker
-          install: true
-      - name: Tag
-        id: semantic
-        uses: cycjimmy/semantic-release-action@v2
-        with:
-          dry_run: false
-          semantic_version: 19.0.2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: GitHub Container Registry Login
-        if: steps.semantic.outputs.new_release_published == 'true' && github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: tibdex/github-app-token@v1
-        id: generate-token
-        with:
-          app_id: ${{ secrets.APP_ID }}
-          private_key: ${{ secrets.APP_PRIVATE_KEY }}
-      - name: Google Artifact Registry Login
-        if: steps.semantic.outputs.new_release_published == 'true' && github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
-        uses: docker/login-action@v2
-        with:
-          registry: europe-docker.pkg.dev
-          username: _json_key_base64
-          password: ${{ secrets.GCR_JSON_KEY_BASE64 }}
-      - uses: goreleaser/goreleaser-action@v3
-        name: Publish ZITADEL
-        if: steps.semantic.outputs.new_release_published == 'true' && github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
-        with:
-          distribution: goreleaser
-          version: v1.11.0
-          args: release --timeout 50m
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GORELEASER_TOKEN_TAP: ${{ steps.generate-token.outputs.token }}
-          RELEASE_VERSION: ${{ steps.semantic.outputs.release-version }} # I think this line is not needed. Nevertheless, it's explicit
-          DISCORD_WEBHOOK_ID: "976058224484687932"
-          DISCORD_WEBHOOK_TOKEN: "${{ secrets.DISCORD_WEBHOOK_TOKEN }}"
-      - name: Publish go coverage
-        uses: codecov/codecov-action@v3.1.0
-        with:
-          file: .artifacts/codecov/profile.cov
-          name: go-codecov
-      - name: Bump Chart Version
-        uses: peter-evans/repository-dispatch@v2
-        if: steps.semantic.outputs.new_release_published == 'true' && github.ref == 'refs/heads/next'
-        with:
-          token: ${{ steps.generate-token.outputs.token }}
-          repository: zitadel/zitadel-charts
-          event-type: zitadel-released
-          client-payload: '{"semanticoutputs": "${{ steps.semantic.outputs }}"}'
--- a/.gitignore
+++ b/.gitignore
@ -55,11 +55,17 @@ openapi/**/*.json
 /internal/api/assets/authz.go
 /internal/api/assets/router.go
 /internal/api/ui/console/static/*
+!/internal/api/ui/console/static/gitkeep
 docs/docs/apis/auth
 docs/docs/apis/admin
 docs/docs/apis/mgmt
 docs/docs/apis/system
 docs/docs/apis/proto
+**/.sass-cache
+/internal/api/ui/login/static/resources/themes/zitadel/css/zitadel.css
+/internal/api/ui/login/static/resources/themes/zitadel/css/zitadel.css.map
+zitadel
+zitadel-*-*

 # local
 build/local/*.env
--- a/.golangci.yaml
+++ b/.golangci.yaml
@ -6,7 +6,7 @@ issues:
  max-same-issues: 0

 run:
-  concurrency: 2
+  concurrency: 4
  timeout: 10m
  go: '1.19'
  skip-dirs:
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@ -1,126 +0,0 @@
-project_name: zitadel
-
-release:
-  github:
-    owner: zitadel
-    name: zitadel
-  draft: false
-  # If set to auto, will mark the release as not ready for production
-  # in case there is an indicator for this in the tag e.g. v1.0.0-rc1
-  # If set to true, will mark the release as not ready for production.
-  # Default is false.
-  prerelease: auto
-
-before:
-  hooks:
-    # this file would invalidate go source caches
-    - sh -c "rm openapi/statik/statik.go || true"
-    - docker build -f build/grpc/Dockerfile -t zitadel-base:local .
-    - docker build -f build/zitadel/Dockerfile . -t zitadel-go-test --target go-codecov -o .artifacts/codecov
-    - docker build -f build/zitadel/Dockerfile . -t zitadel-go-base --target go-copy -o .artifacts/grpc/go-client
-    - sh -c "find pkg/grpc -name '*.pb*.go' -delete"
-    - sh -c "cp -r .artifacts/grpc/go-client/* ."
-    - docker build -f build/console/Dockerfile . -t zitadel-npm-console --target angular-export -o .artifacts/console
-    - sh -c "cp -r .artifacts/console/* internal/api/ui/console/static/"
-
-builds:
-  - env:
-      - CGO_ENABLED=0
-    goos:
-      - linux
-      - windows
-      - darwin
-    goarch:
-      - amd64
-      - arm64
-    ldflags: -s -w -X github.com/zitadel/zitadel/cmd/build.version={{.Version}} -X github.com/zitadel/zitadel/cmd/build.commit={{.Commit}} -X github.com/zitadel/zitadel/cmd/build.date={{.Date}}
-
-dist: .artifacts/goreleaser
-
-dockers:
-  - image_templates:
-      - ghcr.io/zitadel/zitadel:{{ .Tag }}-amd64
-      - europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:{{ .Tag }}-amd64
-    goarch: amd64
-    use: buildx
-    dockerfile: build/Dockerfile
-    build_flag_templates:
-      - "--platform=linux/amd64"
-  - image_templates:
-      - ghcr.io/zitadel/zitadel:{{ .Tag }}-arm64
-      - ghcr.io/zitadel/zitadel:{{ .ShortCommit }}-arm64
-    goarch: arm64
-    use: buildx
-    dockerfile: build/Dockerfile
-    build_flag_templates:
-      - "--platform=linux/arm64"
-
-docker_manifests:
-  - id: zitadel-latest
-    name_template: ghcr.io/zitadel/zitadel:latest
-    image_templates:
-      - ghcr.io/zitadel/zitadel:{{ .Tag }}-amd64
-      - ghcr.io/zitadel/zitadel:{{ .Tag }}-arm64
-    # Skips can and shall be set for individual manifests same as in dockers
-    skip_push: auto
-  - id: zitadel-Tag
-    name_template: ghcr.io/zitadel/zitadel:{{ .Tag }}
-    image_templates:
-      - ghcr.io/zitadel/zitadel:{{ .Tag }}-amd64
-      - ghcr.io/zitadel/zitadel:{{ .Tag }}-arm64
-
-archives:
-  - name_template: "{{ .ProjectName }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}"
-    replacements:
-      darwin: Darwin
-      linux: Linux
-      windows: Windows
-      386: i386
-      amd64: x86_64
-    format_overrides:
-      - goos: windows
-        format: zip
-    files:
-      - README.md
-      - LICENSE
-
-gomod:
-  proxy: false
-
-checksum:
-  name_template: "checksums.txt"
-
-changelog:
-  sort: asc
-  filters:
-    exclude:
-      - "^docs:"
-      - "^test:"
-
-brews:
-  - tap:
-      owner: zitadel
-      name: homebrew-tap
-      token: "{{ .Env.GORELEASER_TOKEN_TAP }}"
-    folder: Formula
-    goarm: "7"
-    homepage: https://zitadel.com
-    description: Open source identity solution built for the container and cloud era
-    license: Apache 2.0
-    test: |
-      system "#{bin}/zitadel -v"
-    dependencies:
-      - name: go
-        type: optional
-      - name: git
-    install: |-
-      bin.install "zitadel"
-    # If set to auto, the release will not be uploaded to the homebrew tap
-    # in case there is an indicator for prerelease in the tag e.g. v1.0.0-rc1
-    # Default is false.
-    skip_upload: auto
-
-announce:
-  discord:
-    enabled: true
-    message_template: "ZITADEL {{ .Tag }} is ready! Check the notes: https://github.com/zitadel/zitadel/releases/tag/{{ .Tag }}"
--- a/.releaserc.js
+++ b/.releaserc.js
@ -1,4 +1,12 @@
 module.exports = {
-  branches: [{ name: "main" }, { name: "next" }],
-  plugins: ["@semantic-release/commit-analyzer"],
+  branches: [
+    { name: "main" }, 
+    { name: "next" },
+    { name: "ci/improve-make", prerelease: "2.29-ignore-me" }
+  ],
+  plugins: [
+    "@semantic-release/commit-analyzer",
+    "@semantic-release/release-notes-generator",
+    "@semantic-release/github"
+  ],
 };
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -127,7 +127,7 @@ We add the label "good first issue" for problems we think are a good starting po

 By executing the commands from this section, you run everything you need to develop the ZITADEL backend locally.
 Using [Docker Compose](https://docs.docker.com/compose/), you run a [CockroachDB](https://www.cockroachlabs.com/docs/stable/start-a-local-cluster-in-docker-mac.html) on your local machine.
-With [goreleaser](https://opencollective.com/goreleaser), you build a debuggable ZITADEL binary and run it using [delve](https://github.com/go-delve/delve).
+With [make](https://www.gnu.org/software/make/), you build a debuggable ZITADEL binary and run it using [delve](https://github.com/go-delve/delve).
 Then, you test your changes via the console your binary is serving at http://<span because="breaks the link"></span>localhost:8080 and by verifying the database.
 Once you are happy with your changes, you run end-to-end tests and tear everything down.

@ -136,8 +136,7 @@ ZITADEL uses [golangci-lint](https://golangci-lint.run) for code quality checks.
 The commands in this section are tested against the following software versions:

 - [Docker version 20.10.17](https://docs.docker.com/engine/install/)
- [Goreleaser version v1.8.3](https://goreleaser.com/install/)
- [Go version 1.19](https://go.dev/doc/install)
+- [Go version 1.20](https://go.dev/doc/install)
 - [Delve 1.9.1](https://github.com/go-delve/delve/tree/v1.9.1/Documentation/installation)

 Make some changes to the source code, then run the database locally.
@ -150,16 +149,15 @@ docker compose --file ./e2e/docker-compose.yaml up --detach db
 Build the binary. This takes some minutes, but you can speed up rebuilds.

 ```bash
-# You just need goreleasers build part (--snapshot) and you just need to target your current platform (--single-target)
-goreleaser build --id dev --snapshot --single-target --rm-dist --output .artifacts/zitadel/zitadel
+make compile
 ```

 > Note: With this command, several steps are executed.
 > For speeding up rebuilds, you can reexecute only specific steps you think are necessary based on your changes.  
-> Generating gRPC stubs: `DOCKER_BUILDKIT=1 docker build -f build/zitadel/Dockerfile . --target go-copy -o .`  
-> Running unit tests: `DOCKER_BUILDKIT=1 docker build -f build/zitadel/Dockerfile . --target go-codecov`  
-> Generating the console: `DOCKER_BUILDKIT=1 docker build -f build/console/Dockerfile . --target angular-export -o internal/api/ui/console/static/`  
-> Build the binary: `goreleaser build --id dev --snapshot --single-target --rm-dist --output .artifacts/zitadel/zitadel --skip-before`
+> Generating gRPC stubs: `make core_api`  
+> Running unit tests: `make core_unit_test`  
+> Generating the console: `make console_build console_move`  
+> Build the binary: `make compile`

 You can now run and debug the binary in .artifacts/zitadel/zitadel using your favourite IDE, for example GoLand.
 You can test if ZITADEL does what you expect by using the UI at http://localhost:8080/ui/console.
@ -167,19 +165,20 @@ Also, you can verify the data by running `cockroach sql --database zitadel --ins

 As soon as you are ready to battle test your changes, run the end-to-end tests.

-#### Running the tests with docker
+#### Running the tests

-Running the tests with docker doesn't require you to take care of other dependencies than docker and goreleaser.
+Running the tests with docker doesn't require you to take care of other dependencies than docker and make.

 ```bash
 # Build the production binary (unit tests are executed, too)
-goreleaser build --id prod --snapshot --single-target --rm-dist --output .artifacts/zitadel/zitadel
+make core_build console_build
+GOOS=linux make compile_pipeline

 # Pack the binary into a docker image
-DOCKER_BUILDKIT=1 docker build --file build/Dockerfile .artifacts/zitadel -t zitadel:local
+DOCKER_BUILDKIT=1 docker build --file build/Dockerfile . -t zitadel:local

 # If you made changes in the e2e directory, make sure you reformat the files
-(cd ./e2e && npm run lint:fix)
+make console_lint

 # Run the tests
 ZITADEL_IMAGE=zitadel:local docker compose --file ./e2e/config/host.docker.internal/docker-compose.yaml run --service-ports e2e
@ -222,9 +221,7 @@ In order to run the integrations tests for the gRPC API, PostgreSQL and Cockroac
 ```bash
 export INTEGRATION_DB_FLAVOR="cockroach" ZITADEL_MASTERKEY="MasterkeyNeedsToHave32Characters"
 docker compose -f internal/integration/config/docker-compose.yaml up --wait ${INTEGRATION_DB_FLAVOR}
-go run main.go init --config internal/integration/config/zitadel.yaml --config internal/integration/config/${INTEGRATION_DB_FLAVOR}.yaml
-go run main.go setup --masterkeyFromEnv --config internal/integration/config/zitadel.yaml --config internal/integration/config/${INTEGRATION_DB_FLAVOR}.yaml
-go test -count 1 -tags=integration -race -p 1 ./internal/integration ./internal/api/grpc/... ./internal/api/oidc
+make core_integration_test
 docker compose -f internal/integration/config/docker-compose.yaml down
 ```

--- a/112
+++ b/112
@ -0,0 +1,112 @@
+go_bin := "$$(go env GOPATH)/bin"
+gen_authopt_path := "$(go_bin)/protoc-gen-authoption"
+gen_zitadel_path := "$(go_bin)/protoc-gen-zitadel"
+
+now := $(shell date --rfc-3339=seconds | sed 's/ /T/')
+VERSION ?= development
+COMMIT_SHA ?= $(shell git rev-parse HEAD)
+
+.PHONY: compile
+compile: core_build console_build compile_pipeline
+
+.PHONY: compile_pipeline
+compile_pipeline: console_move
+	CGO_ENABLED=0 go build -o zitadel -v -ldflags="-s -w -X 'github.com/zitadel/zitadel/cmd/build.commit=$(COMMIT_SHA)' -X 'github.com/zitadel/zitadel/cmd/build.date=$(now)' -X 'github.com/zitadel/zitadel/cmd/build.version=$(VERSION)' "
+	chmod +x zitadel
+
+.PHONY: core_dependencies
+core_dependencies:
+	go mod download
+
+.PHONY: core_static
+core_static:
+	go install github.com/rakyll/statik@v0.1.7
+	go generate internal/api/ui/login/statik/generate.go
+	go generate internal/api/ui/login/static/resources/generate.go
+	go generate internal/notification/statik/generate.go
+	go generate internal/statik/generate.go
+
+.PHONY: core_assets
+core_assets:
+	mkdir -p docs/apis/assets
+	go run internal/api/assets/generator/asset_generator.go -directory=internal/api/assets/generator/ -assets=docs/apis/assets/assets.md
+
+.PHONY: core_api_generator
+core_api_generator:
+ifeq (,$(wildcard $(gen_authopt_path)))
+	go install internal/protoc/protoc-gen-authoption/main.go \
+    && mv $$(go env GOPATH)/bin/main $(gen_authopt_path)
+endif
+ifeq (,$(wildcard $(gen_zitadel_path)))
+	go install internal/protoc/protoc-gen-zitadel/main.go \
+    && mv $$(go env GOPATH)/bin/main $(gen_zitadel_path)
+endif
+
+.PHONY: core_grpc_dependencies
+core_grpc_dependencies:
+	go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.30 
+	go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.3 
+	go install github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-grpc-gateway@v2.15.2 
+	go install github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2@v2.15.2 
+	go install github.com/envoyproxy/protoc-gen-validate@v0.10.1
+
+.PHONY: core_api
+core_api: core_api_generator core_grpc_dependencies
+	buf generate
+	mkdir -p pkg/grpc
+	cp -r .artifacts/grpc/github.com/zitadel/zitadel/pkg/grpc/* pkg/grpc/
+	mkdir -p openapi/v2/zitadel
+	cp -r .artifacts/grpc/zitadel/ openapi/v2/zitadel
+
+.PHONY: core_build
+core_build: core_dependencies core_api core_static core_assets
+
+.PHONY: console_move
+console_move:
+	cp -r console/dist/console/* internal/api/ui/console/static
+
+.PHONY: console_dependencies
+console_dependencies:
+	cd console && \
+	yarn install --immutable
+
+.PHONY: console_client
+console_client:
+	cd console && \
+	yarn generate
+
+.PHONY: console_build
+console_build: console_dependencies console_client
+	cd console && \
+	yarn build
+
+.PHONY: clean
+clean:
+	$(RM) .artifacts/grpc
+	$(RM) $(gen_authopt_path)
+	$(RM) $(gen_zitadel_path)
+
+.PHONY: core_unit_test
+core_unit_test:
+	go test -race -coverprofile=profile.cov ./...
+
+.PHONY: core_integration_test
+core_integration_test:
+	go build -o zitadel main.go
+	./zitadel init --config internal/integration/config/zitadel.yaml --config internal/integration/config/${INTEGRATION_DB_FLAVOR}.yaml
+	./zitadel setup --masterkeyFromEnv --config internal/integration/config/zitadel.yaml --config internal/integration/config/${INTEGRATION_DB_FLAVOR}.yaml
+	$(RM) zitadel
+	go test -tags=integration -race -p 1 -v -coverprofile=profile.cov -coverpkg=./internal/...,./cmd/... ./internal/integration ./internal/api/grpc/...  ./internal/notification/handlers/... ./internal/api/oidc/...
+
+.PHONY: console_lint
+console_lint:
+	cd console && \
+	yarn lint
+
+.PHONE: core_lint
+core_lint:
+	golangci-lint run \
+		--timeout 10m \
+		--config ./.golangci.yaml \
+		--out-format=github-actions \
+		--concurrency=$$(getconf _NPROCESSORS_ONLN)
--- a/buf.gen.yaml
+++ b/buf.gen.yaml
@ -0,0 +1,21 @@
+version: v1
+plugins:
+  - plugin: go
+    out: .artifacts/grpc
+  - plugin: go-grpc
+    out: .artifacts/grpc
+  - plugin: grpc-gateway
+    out: .artifacts/grpc
+    opt: 
+    - allow_delete_body=true
+  - plugin: openapiv2
+    out: .artifacts/grpc
+    opt: 
+    - allow_delete_body=true
+  - plugin: validate
+    out: .artifacts/grpc
+    opt: lang=go
+  - plugin: authoption
+    out: .artifacts/grpc
+  - plugin: zitadel
+    out: .artifacts/grpc
--- a/build/Dockerfile
+++ b/build/Dockerfile
@ -1,21 +1,32 @@
-#######################
-## Final Production Image
-#######################
-FROM alpine:3 as artifact
-COPY zitadel /app/zitadel
-RUN adduser -D zitadel && \
-    chown zitadel /app/zitadel && \
-    chmod +x /app/zitadel
+FROM --platform=$TARGETPLATFORM debian:latest as artifact
+ENV ZITADEL_ARGS=
+ARG TARGETPLATFORM
+
+RUN apt-get update && apt-get install ca-certificates -y
+
+COPY build/entrypoint.sh /app/entrypoint.sh
+COPY zitadel /app/zitadel
+
+RUN useradd -s "" --home / zitadel && \
+    chown zitadel /app/zitadel && \
+    chmod +x /app/zitadel && \
+    chown zitadel /app/entrypoint.sh && \
+    chmod +x /app/entrypoint.sh
+
+WORKDIR /app
+ENV PATH="/app:${PATH}"
+
+USER zitadel
+ENTRYPOINT ["/app/entrypoint.sh"]
+
+FROM --platform=$TARGETPLATFORM scratch as final
+ARG TARGETPLATFORM

-#######################
-## Scratch Image
-#######################
-FROM scratch as final
-LABEL org.opencontainers.image.source="https://github.com/zitadel/zitadel"
 COPY --from=artifact /etc/passwd /etc/passwd
 COPY --from=artifact /etc/ssl/certs /etc/ssl/certs
-COPY --from=artifact /app /
-USER zitadel
-HEALTHCHECK NONE
-ENTRYPOINT ["/zitadel"]
+COPY --from=artifact /app/zitadel /app/zitadel

+HEALTHCHECK NONE
+
+USER zitadel
+ENTRYPOINT ["/app/zitadel"]
--- a/build/console/Dockerfile
+++ b/build/console/Dockerfile
@ -1,30 +0,0 @@
-ARG NODE_VERSION=18
-
-#######################
-## With this step we prepare all node_modules, this helps caching the build
-## Speed up this step by mounting your local node_modules directory
-## We also copy and generate the source code
-#######################
-FROM node:${NODE_VERSION} as npm-base
-WORKDIR /console
-
-# Dependencies
-COPY console/package.json console/package-lock.json ./
-RUN npm ci
-
-# Sources
-COPY console .
-COPY proto/ /proto/
-
-#######################
-## angular lint workspace and prod build
-#######################
-FROM npm-base as angular-build
-RUN npm run lint
-RUN npm run build
-
-#######################
-## Only Copy Assets
-#######################
-FROM scratch as angular-export
-COPY --from=angular-build /console/dist/console .
--- a/build/entrypoint.sh
+++ b/build/entrypoint.sh
@ -0,0 +1,17 @@
+#!/bin/bash
+
+case $@ in 
+    sh*)
+        ${@:3}
+        ;;
+    bash*)
+        ${@:5}
+        ;;
+    *)
+        if [[ ! -z "$@" ]]
+        then
+            ZITADEL_ARGS="$@"
+        fi
+        /app/zitadel ${ZITADEL_ARGS}
+        ;;
+esac
--- a/build/grpc/Dockerfile
+++ b/build/grpc/Dockerfile
@ -1,47 +0,0 @@
-#ARG BUILDARCH=x86_64
-
-#######################
-## These steps set platform / arch type specific variables
-#######################
-FROM alpine:3 AS arm64-base
-ENV PROTOC_ARCH aarch_64
-
-FROM alpine:3 AS amd64-base
-ENV PROTOC_ARCH x86_64
-
-#######################
-## This step sets up the folder structure,
-## initalices go mods,
-## downloads the protofiles,
-## protoc and protoc-gen-grpc-web for later use
-#######################
-FROM ${BUILDARCH}-base
-ARG PROTOC_VERSION=22.3
-ARG PROTOC_ZIP=protoc-${PROTOC_VERSION}-linux-${PROTOC_ARCH}.zip
-ARG GRPC_WEB_VERSION=1.3.0
-ARG GATEWAY_VERSION=2.15.2
-ARG VALIDATOR_VERSION=0.10.1
-# no arm specific version available and x86 works fine at the moment:
-ARG GRPC_WEB=protoc-gen-grpc-web-${GRPC_WEB_VERSION}-linux-x86_64
-
-RUN apk add tar curl
-WORKDIR /proto
-
-#protoc
-RUN apk add tar curl \
-    && curl -OL https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/$PROTOC_ZIP \
-    && unzip -o $PROTOC_ZIP -d /usr/local bin/protoc \
-    && unzip -o $PROTOC_ZIP -d /proto include/* \
-    && rm -f $PROTOC_ZIP \
-    && curl -OL https://github.com/grpc/grpc-web/releases/download/${GRPC_WEB_VERSION}/${GRPC_WEB} \
-    && mv ${GRPC_WEB} /usr/local/bin/protoc-gen-grpc-web \
-    && chmod +x /usr/local/bin/protoc-gen-grpc-web \
-    && curl https://raw.githubusercontent.com/envoyproxy/protoc-gen-validate/v${VALIDATOR_VERSION}/validate/validate.proto --create-dirs -o include/validate/validate.proto  \
-    && curl https://raw.githubusercontent.com/grpc-ecosystem/grpc-gateway/v${GATEWAY_VERSION}/protoc-gen-openapiv2/options/annotations.proto --create-dirs -o include/protoc-gen-openapiv2/options/annotations.proto \
-    && curl https://raw.githubusercontent.com/grpc-ecosystem/grpc-gateway/v${GATEWAY_VERSION}/protoc-gen-openapiv2/options/openapiv2.proto --create-dirs -o include/protoc-gen-openapiv2/options/openapiv2.proto \
-    && curl https://raw.githubusercontent.com/googleapis/googleapis/master/google/api/annotations.proto --create-dirs -o include/google/api/annotations.proto \
-    && curl https://raw.githubusercontent.com/googleapis/googleapis/master/google/api/http.proto --create-dirs -o include/google/api/http.proto \
-    && curl https://raw.githubusercontent.com/googleapis/googleapis/master/google/api/field_behavior.proto --create-dirs -o include/google/api/field_behavior.proto
-
-#zitadel protos
-COPY proto/ include/.
--- a/build/workflow.Dockerfile
+++ b/build/workflow.Dockerfile
@ -0,0 +1,302 @@
+# ##############################################################################
+# core
+# ##############################################################################
+
+# #######################################
+# download dependencies
+# #######################################
+FROM golang:buster AS core-deps
+
+WORKDIR /go/src/github.com/zitadel/zitadel
+
+COPY go.mod .
+COPY go.sum .
+
+RUN go mod download
+
+# #######################################
+# compile custom protoc plugins
+# #######################################
+FROM golang:buster AS core-api-generator
+
+WORKDIR /go/src/github.com/zitadel/zitadel
+
+COPY go.mod .
+COPY go.sum .
+COPY internal/protoc internal/protoc
+COPY pkg/grpc/protoc/v2 pkg/grpc/protoc/v2
+
+RUN go install internal/protoc/protoc-gen-authoption/main.go \
+    && mv $(go env GOPATH)/bin/main $(go env GOPATH)/bin/protoc-gen-authoption \
+	&& go install internal/protoc/protoc-gen-zitadel/main.go \
+    && mv $(go env GOPATH)/bin/main $(go env GOPATH)/bin/protoc-gen-zitadel
+
+# #######################################
+# build backend stub
+# #######################################
+FROM golang:buster AS core-api
+
+WORKDIR /go/src/github.com/zitadel/zitadel
+
+COPY go.mod .
+COPY go.sum .
+COPY proto proto
+COPY buf.*.yaml .
+COPY Makefile Makefile
+COPY --from=core-api-generator /go/bin /usr/local/bin
+
+RUN make grpc
+
+# #######################################
+# generate code for login ui
+# #######################################
+FROM golang:buster AS core-login
+
+WORKDIR /go/src/github.com/zitadel/zitadel
+
+COPY Makefile Makefile
+COPY internal/api/ui/login/static internal/api/ui/login/static
+COPY internal/api/ui/login/statik internal/api/ui/login/statik
+COPY internal/notification/static internal/notification/static
+COPY internal/notification/statik internal/notification/statik
+COPY internal/static internal/static
+COPY internal/statik internal/statik
+
+RUN make static
+
+# #######################################
+# generate code for assets
+# #######################################
+FROM golang:buster AS core-assets
+WORKDIR /go/src/github.com/zitadel/zitadel
+
+COPY go.mod .
+COPY go.sum .
+COPY Makefile Makefile
+COPY internal/api/assets/generator internal/api/assets/generator
+COPY internal/config internal/config
+COPY internal/errors internal/errors
+COPY --from=core-api /go/src/github.com/zitadel/zitadel/openapi/v2 openapi/v2
+
+RUN make assets
+
+# #######################################
+# Gather all core files
+# #######################################
+FROM core-deps AS core-gathered
+
+COPY cmd cmd
+COPY internal internal
+COPY pkg pkg
+COPY proto proto
+COPY openapi openapi
+COPY statik statik
+COPY main.go main.go
+COPY --from=core-api /go/src/github.com/zitadel/zitadel .
+COPY --from=core-login /go/src/github.com/zitadel/zitadel .
+COPY --from=core-assets /go/src/github.com/zitadel/zitadel/internal ./internal
+
+# ##############################################################################
+# build console
+# ##############################################################################
+
+# #######################################
+# download console dependencies
+# #######################################
+FROM node:18-buster AS console-deps
+
+WORKDIR /zitadel/console
+
+COPY console/package.json .
+COPY console/yarn.lock .
+
+RUN yarn install --frozen-lockfile
+
+# #######################################
+# generate console client
+# #######################################
+FROM node:18-buster AS console-client
+
+WORKDIR /zitadel/console
+
+# install buf
+COPY --from=bufbuild/buf:latest /usr/local/bin/* /usr/local/bin/
+ENV PATH="/usr/local/bin:${PATH}"
+
+COPY console/package.json .
+COPY console/buf.*.yaml .
+COPY proto ../proto
+
+RUN yarn generate
+
+# #######################################
+# Gather all console files
+# #######################################
+FROM console-deps as console-gathered
+
+COPY --from=console-client /zitadel/console/src/app/proto/generated src/app/proto/generated
+
+COPY console/src src
+COPY console/angular.json .
+COPY console/ngsw-config.json .
+COPY console/tsconfig* .
+
+# #######################################
+# Build console
+# #######################################
+FROM console-gathered AS console
+RUN yarn build
+
+# ##############################################################################
+# build the executable
+# ##############################################################################
+
+# #######################################
+# build executable
+# #######################################
+FROM core-gathered AS compile
+
+ARG GOOS 
+ARG GOARCH
+
+COPY --from=console /zitadel/console/dist/console internal/api/ui/console/static/
+
+RUN go build -o zitadel -ldflags="-s -w -race" \
+    && chmod +x zitadel
+
+ENTRYPOINT [ "./zitadel" ]
+
+# #######################################
+# copy executable
+# #######################################
+FROM scratch AS copy-executable
+ARG GOOS 
+ARG GOARCH
+
+COPY --from=compile /go/src/github.com/zitadel/zitadel/zitadel /.artifacts/zitadel
+
+# ##############################################################################
+#  tests
+# ##############################################################################
+FROM ubuntu/postgres:latest AS test-core-base
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        gcc \
+        make \
+        ca-certificates \
+        gcc \
+        && \
+    update-ca-certificates; \
+    rm -rf /var/lib/apt/lists/*
+
+# install go
+COPY --from=golang:latest /usr/local/go/ /usr/local/go/
+ENV PATH="/go/bin:/usr/local/go/bin:${PATH}"
+
+WORKDIR /go/src/github.com/zitadel/zitadel
+
+# default vars
+ENV DB_FLAVOR=postgres
+ENV POSTGRES_USER=zitadel
+ENV POSTGRES_DB=zitadel
+ENV POSTGRES_PASSWORD=postgres
+ENV POSTGRES_HOST_AUTH_METHOD=trust
+
+ENV PGUSER=zitadel
+ENV PGDATABASE=zitadel
+ENV PGPASSWORD=postgres
+
+ENV CGO_ENABLED=1
+
+# copy zitadel files
+COPY --from=core-deps /go/pkg/mod /root/go/pkg/mod
+COPY --from=core-gathered /go/src/github.com/zitadel/zitadel .
+
+# #######################################
+# unit test core
+# #######################################
+FROM test-core-base AS test-core-unit
+RUN go test -race -v -coverprofile=profile.cov ./...
+
+# #######################################
+# coverage output
+# #######################################
+FROM scratch AS coverage-core-unit
+COPY --from=test-core-unit /go/src/github.com/zitadel/zitadel/profile.cov /coverage/
+
+# #######################################
+# integration test core
+# #######################################
+FROM test-core-base AS test-core-integration
+ENV DB_FLAVOR=cockroach
+
+# install cockroach
+COPY --from=cockroachdb/cockroach:latest /cockroach/cockroach /usr/local/bin/
+ENV COCKROACH_BINARY=/cockroach/cockroach
+
+ENV ZITADEL_MASTERKEY=MasterkeyNeedsToHave32Characters
+
+COPY build/core-integration-test.sh /usr/local/bin/run-tests.sh
+RUN chmod +x /usr/local/bin/run-tests.sh
+
+RUN run-tests.sh
+
+# #######################################
+# coverage output
+# #######################################
+FROM scratch AS coverage-core-integration
+COPY --from=test-core-integration /go/src/github.com/zitadel/zitadel/profile.cov /coverage/
+
+# ##############################################################################
+#  linting
+# ##############################################################################
+
+# #######################################
+# api
+# #######################################
+FROM bufbuild/buf:latest AS lint-api
+
+COPY proto proto
+COPY buf.*.yaml .
+
+RUN buf lint
+
+# #######################################
+# console
+# #######################################
+FROM console-gathered AS lint-console
+
+COPY console/.eslintrc.js .
+COPY console/.prettier* .
+RUN yarn lint
+
+# #######################################
+# core
+# #######################################
+FROM golangci/golangci-lint:latest AS lint-core
+ARG LINT_EXIT_CODE=1
+
+WORKDIR /go/src/github.com/zitadel/zitadel
+
+COPY .golangci.yaml .
+COPY .git/ .git/
+COPY --from=core-deps /go/pkg/mod /go/pkg/mod
+COPY --from=core-gathered /go/src/github.com/zitadel/zitadel .
+
+RUN git fetch https://github.com/zitadel/zitadel main:main
+
+RUN golangci-lint run \
+    --timeout 10m \
+    --config ./.golangci.yaml \
+    --out-format=github-actions:report,colored-line-number \
+    --issues-exit-code=${LINT_EXIT_CODE} \
+    --concurrency=$(getconf _NPROCESSORS_ONLN)
+
+# #######################################
+# report output
+# #######################################
+FROM scratch AS lint-core-report
+COPY --from=lint-core /go/src/github.com/zitadel/zitadel/report .
--- a/build/zitadel/Dockerfile
+++ b/build/zitadel/Dockerfile
@ -1,107 +0,0 @@
-ARG GO_VERSION=1.20
-
-#######################
-## Go dependencies
-## Speed up this step by mounting your local go mod pkg directory
-#######################
-FROM golang:${GO_VERSION} as go-dep
-WORKDIR /go/src/github.com/zitadel/zitadel
-
-#download modules
-COPY go.mod ./
-COPY go.sum ./
-RUN go mod download
-
-# install tools
-COPY tools ./tools
-RUN ./tools/install.sh
-
-#######################
-## generates static files
-#######################
-FROM go-dep AS go-static
-COPY internal/api/ui/login/static internal/api/ui/login/static
-COPY internal/api/ui/login/statik internal/api/ui/login/statik
-COPY internal/notification/static internal/notification/static
-COPY internal/notification/statik internal/notification/statik
-COPY internal/static internal/static
-COPY internal/statik internal/statik
-
-RUN go generate internal/api/ui/login/statik/generate.go \
-    && go generate internal/api/ui/login/static/generate.go \
-    && go generate internal/notification/statik/generate.go \
-    && go generate internal/statik/generate.go
-
-#######################
-## generates grpc stub
-#######################
-FROM go-static AS go-stub
-COPY --from=zitadel-base:local /proto /proto
-COPY --from=zitadel-base:local /usr/local/bin /usr/local/bin/.
-
-COPY build/zitadel/generate-grpc.sh build/zitadel/generate-grpc.sh
-COPY internal/protoc internal/protoc
-COPY openapi/statik openapi/statik
-COPY internal/api/assets/generator internal/api/assets/generator
-COPY internal/config internal/config
-COPY internal/errors internal/errors
-
-RUN build/zitadel/generate-grpc.sh && \
-    go generate openapi/statik/generate.go && \
-    mkdir -p docs/apis/assets/ && \
-    go run internal/api/assets/generator/asset_generator.go -directory=internal/api/assets/generator/ -assets=docs/apis/assets/assets.md
-
-#######################
-## Go base build
-#######################
-FROM go-stub as go-base
-# copy remaining zitadel files
-COPY cmd cmd
-COPY internal internal
-COPY pkg pkg
-COPY openapi openapi
-
-#######################
-## copy for local dev
-#######################
-FROM scratch as go-copy
-COPY --from=go-stub /go/src/github.com/zitadel/zitadel/internal/api/ui/login/statik/statik.go internal/api/ui/login/statik/statik.go
-COPY --from=go-stub /go/src/github.com/zitadel/zitadel/internal/notification/statik/statik.go internal/notification/statik/statik.go
-COPY --from=go-stub /go/src/github.com/zitadel/zitadel/internal/statik/statik.go internal/statik/statik.go
-COPY --from=go-stub /go/src/github.com/zitadel/zitadel/openapi/statik/statik.go openapi/statik/statik.go
-
-COPY --from=go-stub /go/src/github.com/zitadel/zitadel/pkg/grpc pkg/grpc
-COPY --from=go-stub /go/src/github.com/zitadel/zitadel/openapi/v2/zitadel openapi/v2/zitadel
-COPY --from=go-stub /go/src/github.com/zitadel/zitadel/openapi/statik/statik.go openapi/statik/statik.go
-COPY --from=go-stub /go/src/github.com/zitadel/zitadel/internal/protoc/protoc-gen-authoption/authoption/options.pb.go internal/protoc/protoc-gen-authoption/authoption/options.pb.go
-COPY --from=go-stub /go/src/github.com/zitadel/zitadel/docs/apis/proto docs/docs/apis/proto
-COPY --from=go-stub /go/src/github.com/zitadel/zitadel/docs/apis/assets docs/docs/apis/assets
-
-COPY --from=go-stub /go/src/github.com/zitadel/zitadel/internal/api/assets/authz.go ./internal/api/assets/authz.go
-COPY --from=go-stub /go/src/github.com/zitadel/zitadel/internal/api/assets/router.go ./internal/api/assets/router.go
-
-#######################
-## Go test
-#######################
-FROM go-base as go-test
-
-ARG COCKROACH_BINARY=/usr/local/bin/cockroach
-ARG COCKROACH_VERSION=v22.2.2
-RUN apt install openssl tzdata tar
-
-# cockroach binary used to backup database
-RUN mkdir /usr/local/lib/cockroach
-RUN wget -qO- https://binaries.cockroachdb.com/cockroach-${COCKROACH_VERSION}.linux-amd64.tgz \
-    | tar  xvz && cp -i cockroach-${COCKROACH_VERSION}.linux-amd64/cockroach /usr/local/bin/
-RUN rm -r cockroach-${COCKROACH_VERSION}.linux-amd64
-
-# Migrations for cockroach-secure
-RUN go install github.com/rakyll/statik \
-    && go test -race -coverprofile=profile.cov $(go list ./... | grep -v /operator/)
-
-#######################
-## Go test results
-#######################
-FROM scratch as go-codecov
-COPY --from=go-test /go/src/github.com/zitadel/zitadel/profile.cov profile.cov
-
--- a/build/zitadel/generate-grpc.sh
+++ b/build/zitadel/generate-grpc.sh
@ -1,123 +0,0 @@
-#!/bin/sh
-
-set -eux
-
-echo "Generate grpc"
-
-OPENAPI_PATH=${GOPATH}/src/github.com/zitadel/zitadel/openapi/v2
-ZITADEL_PATH=${GOPATH}/src/github.com/zitadel/zitadel
-GRPC_PATH=${ZITADEL_PATH}/pkg/grpc
-PROTO_PATH=/proto/include/zitadel
-DOCS_PATH=${ZITADEL_PATH}/docs/apis/proto
-
-# generate go stub and grpc code for all files
-protoc \
-  -I=/proto/include/ \
-  --go_out $GOPATH/src \
-  --go-grpc_out $GOPATH/src \
-  --validate_out=lang=go:${GOPATH}/src \
-  $(find ${PROTO_PATH} -iname *.proto)
-
-# install authoption and zitadel proto compiler
-go install ${ZITADEL_PATH}/internal/protoc/protoc-gen-auth
-go install ${ZITADEL_PATH}/internal/protoc/protoc-gen-zitadel
-
-# output folder for openapi v2
-mkdir -p ${OPENAPI_PATH}
-mkdir -p ${DOCS_PATH}
-
-# generate additional output
-
-protoc \
-  -I=/proto/include \
-  --grpc-gateway_out ${GOPATH}/src \
-  --grpc-gateway_opt logtostderr=true \
-  --openapiv2_out ${OPENAPI_PATH} \
-  --openapiv2_opt logtostderr=true \
-  --auth_out ${GOPATH}/src \
-  --validate_out=lang=go:${GOPATH}/src \
-  ${PROTO_PATH}/system.proto
-
-protoc \
-  -I=/proto/include \
-  --grpc-gateway_out ${GOPATH}/src \
-  --grpc-gateway_opt logtostderr=true \
-  --openapiv2_out ${OPENAPI_PATH} \
-  --openapiv2_opt logtostderr=true \
-  --auth_out ${GOPATH}/src \
-  --validate_out=lang=go:${GOPATH}/src \
-  ${PROTO_PATH}/admin.proto
-
-protoc \
-  -I=/proto/include \
-  --grpc-gateway_out ${GOPATH}/src \
-  --grpc-gateway_opt logtostderr=true \
-  --grpc-gateway_opt allow_delete_body=true \
-  --openapiv2_out ${OPENAPI_PATH} \
-  --openapiv2_opt logtostderr=true \
-  --openapiv2_opt allow_delete_body=true \
-  --auth_out ${GOPATH}/src \
-  --validate_out=lang=go:${GOPATH}/src \
-  ${PROTO_PATH}/management.proto
-
-protoc \
-  -I=/proto/include \
-  --grpc-gateway_out ${GOPATH}/src \
-  --grpc-gateway_opt logtostderr=true \
-  --grpc-gateway_opt allow_delete_body=true \
-  --openapiv2_out ${OPENAPI_PATH} \
-  --openapiv2_opt logtostderr=true \
-  --openapiv2_opt allow_delete_body=true \
-  --auth_out=${GOPATH}/src \
-  --validate_out=lang=go:${GOPATH}/src \
-  ${PROTO_PATH}/auth.proto
-
-protoc \
-  -I=/proto/include \
-  --grpc-gateway_out ${GOPATH}/src \
-  --grpc-gateway_opt logtostderr=true \
-  --grpc-gateway_opt allow_delete_body=true \
-  --openapiv2_out ${OPENAPI_PATH} \
-  --openapiv2_opt logtostderr=true \
-  --openapiv2_opt allow_delete_body=true \
-  --zitadel_out=${GOPATH}/src \
-  --validate_out=lang=go:${GOPATH}/src \
-  ${PROTO_PATH}/user/v2alpha/user_service.proto
-
-protoc \
-  -I=/proto/include \
-  --grpc-gateway_out ${GOPATH}/src \
-  --grpc-gateway_opt logtostderr=true \
-  --grpc-gateway_opt allow_delete_body=true \
-  --openapiv2_out ${OPENAPI_PATH} \
-  --openapiv2_opt logtostderr=true \
-  --openapiv2_opt allow_delete_body=true \
-  --zitadel_out=${GOPATH}/src \
-  --validate_out=lang=go:${GOPATH}/src \
-  ${PROTO_PATH}/session/v2alpha/session_service.proto
-
-protoc \
-  -I=/proto/include \
-  --grpc-gateway_out ${GOPATH}/src \
-  --grpc-gateway_opt logtostderr=true \
-  --grpc-gateway_opt allow_delete_body=true \
-  --openapiv2_out ${OPENAPI_PATH} \
-  --openapiv2_opt logtostderr=true \
-  --openapiv2_opt allow_delete_body=true \
-  --zitadel_out=${GOPATH}/src \
-  --validate_out=lang=go:${GOPATH}/src \
-  ${PROTO_PATH}/settings/v2alpha/settings_service.proto
-
-protoc \
-  -I=/proto/include \
-  --grpc-gateway_out ${GOPATH}/src \
-  --grpc-gateway_opt logtostderr=true \
-  --grpc-gateway_opt allow_delete_body=true \
-  --openapiv2_out ${OPENAPI_PATH} \
-  --openapiv2_opt logtostderr=true \
-  --openapiv2_opt allow_delete_body=true \
-  --zitadel_out=${GOPATH}/src \
-  --validate_out=lang=go:${GOPATH}/src \
-  ${PROTO_PATH}/oidc/v2alpha/oidc_service.proto
-
-echo "done generating grpc"
--- a/cmd/ready/config.go
+++ b/cmd/ready/config.go
@ -0,0 +1,34 @@
+package ready
+
+import (
+	"time"
+
+	"github.com/mitchellh/mapstructure"
+	"github.com/spf13/viper"
+	"github.com/zitadel/logging"
+
+	"github.com/zitadel/zitadel/internal/config/hook"
+)
+
+type Config struct {
+	Log  *logging.Config
+	Port uint16
+}
+
+func MustNewConfig(v *viper.Viper) *Config {
+	config := new(Config)
+	err := v.Unmarshal(config,
+		viper.DecodeHook(mapstructure.ComposeDecodeHookFunc(
+			hook.Base64ToBytesHookFunc(),
+			mapstructure.StringToTimeDurationHookFunc(),
+			mapstructure.StringToTimeHookFunc(time.RFC3339),
+			mapstructure.StringToSliceHookFunc(","),
+		)),
+	)
+	logging.OnError(err).Fatal("unable to read default config")
+
+	err = config.Log.SetLogger()
+	logging.OnError(err).Fatal("unable to set logger")
+
+	return config
+}
--- a/cmd/ready/ready.go
+++ b/cmd/ready/ready.go
@ -0,0 +1,37 @@
+package ready
+
+import (
+	"net"
+	"net/http"
+	"os"
+	"strconv"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"github.com/zitadel/logging"
+)
+
+func New() *cobra.Command {
+	return &cobra.Command{
+		Use:   "ready",
+		Short: "Checks if zitadel is ready",
+		Long:  "Checks if zitadel is ready",
+		Run: func(cmd *cobra.Command, args []string) {
+			config := MustNewConfig(viper.GetViper())
+			if !ready(config) {
+				os.Exit(1)
+			}
+		},
+	}
+}
+
+func ready(config *Config) bool {
+	res, err := http.Get("http://" + net.JoinHostPort("localhost", strconv.Itoa(int(config.Port))) + "/debug/ready")
+	if err != nil {
+		logging.WithError(err).Warn("ready check failed")
+		return false
+	}
+	defer res.Body.Close()
+	logging.WithFields("status", res.StatusCode).Warn("ready check failed")
+	return res.StatusCode == 200
+}
--- a/cmd/start/config.go
+++ b/cmd/start/config.go
@ -1,6 +1,8 @@
 package start

 import (
+	"encoding/json"
+	"reflect"
 	"time"

 	"github.com/mitchellh/mapstructure"
@ -59,7 +61,7 @@ type Config struct {
 	EncryptionKeys    *encryptionKeyConfig
 	DefaultInstance   command.InstanceSetup
 	AuditLogRetention time.Duration
-	SystemAPIUsers    map[string]*internal_authz.SystemAPIUser
+	SystemAPIUsers    SystemAPIUsers
 	CustomerPortal    string
 	Machine           *id.Config
 	Actions           *actions.Config
@ -85,6 +87,7 @@ func MustNewConfig(v *viper.Viper) *Config {
 			mapstructure.StringToSliceHookFunc(","),
 			database.DecodeHook,
 			actions.HTTPConfigDecodeHook,
+			systemAPIUsersDecodeHook,
 		)),
 	)
 	logging.OnError(err).Fatal("unable to read config")
@ -116,3 +119,22 @@ type encryptionKeyConfig struct {
 	CSRFCookieKeyID      string
 	UserAgentCookieKeyID string
 }
+
+type SystemAPIUsers map[string]*internal_authz.SystemAPIUser
+
+func systemAPIUsersDecodeHook(from, to reflect.Value) (any, error) {
+	if to.Type() != reflect.TypeOf(SystemAPIUsers{}) {
+		return from.Interface(), nil
+	}
+
+	data, ok := from.Interface().(string)
+	if !ok {
+		return from.Interface(), nil
+	}
+	users := make(SystemAPIUsers)
+	err := json.Unmarshal([]byte(data), &users)
+	if err != nil {
+		return nil, err
+	}
+	return users, nil
+}
--- a/cmd/zitadel.go
+++ b/cmd/zitadel.go
@ -15,6 +15,7 @@ import (
 	"github.com/zitadel/zitadel/cmd/build"
 	"github.com/zitadel/zitadel/cmd/initialise"
 	"github.com/zitadel/zitadel/cmd/key"
+	"github.com/zitadel/zitadel/cmd/ready"
 	"github.com/zitadel/zitadel/cmd/setup"
 	"github.com/zitadel/zitadel/cmd/start"
 )
@ -55,6 +56,7 @@ func New(out io.Writer, in io.Reader, args []string, server chan<- *start.Server
 		start.NewStartFromInit(server),
 		start.NewStartFromSetup(server),
 		key.New(),
+		ready.New(),
 	)

 	cmd.InitDefaultVersionFlag()
--- a/console/angular.json
+++ b/console/angular.json
@ -26,6 +26,9 @@
            "assets": ["src/favicon.ico", "src/assets", "src/manifest.webmanifest"],
            "styles": ["src/styles.scss"],
            "scripts": ["./node_modules/tinycolor2/dist/tinycolor-min.js"],
+            "stylePreprocessorOptions": {
+              "includePaths": ["node_modules"]
+            },
            "allowedCommonJsDependencies": [
              "fast-sha256",
              "buffer",
@ -46,7 +49,8 @@
                  "inline": false
                },
                "styles": {
-                  "inlineCritical": false
+                  "inlineCritical": false,
+                  "minify": false
                }
              },
              "budgets": [
--- a/console/package-lock.json
+++ b/console/package-lock.json
--- a/console/yarn.lock
+++ b/console/yarn.lock
--- a/docs/apis/assets/assets.md
+++ b/docs/apis/assets/assets.md
@ -0,0 +1,259 @@
+---
+title: zitadel/assets
+---
+
+## AssetsService
+
+	
+	
+	
+
+### UploadDefaultLabelPolicyFont()
+
+> UploadDefaultLabelPolicyFont()
+
+POST: /instance/policy/label/font
+
+ 	
+
+### GetDefaultLabelPolicyFont()
+
+> GetDefaultLabelPolicyFont()
+
+GET: /instance/policy/label/font
+
+ 	
+
+### GetPreviewDefaultLabelPolicyFont()
+
+> GetPreviewDefaultLabelPolicyFont()
+
+GET: /instance/policy/label/font/_preview
+
+ 	
+	
+	
+
+### UploadDefaultLabelPolicyIcon()
+
+> UploadDefaultLabelPolicyIcon()
+
+POST: /instance/policy/label/icon
+
+### UploadDefaultLabelPolicyIcon()
+
+> UploadDefaultLabelPolicyIconDark()
+
+POST: /instance/policy/label/icon/dark
+ 	
+ 	
+
+### GetDefaultLabelPolicyIcon()
+
+> GetDefaultLabelPolicyIcon()
+
+GET: /instance/policy/label/icon
+
+### GetDefaultLabelPolicyIcon()
+
+> GetDefaultLabelPolicyIconDark()
+
+GET: /instance/policy/label/icon/dark
+ 	
+ 	
+
+### GetPreviewDefaultLabelPolicyIcon()
+
+> GetPreviewDefaultLabelPolicyIcon()
+
+GET: /instance/policy/label/icon/_preview
+
+### GetPreviewDefaultLabelPolicyIcon()
+
+> GetPreviewDefaultLabelPolicyIconDark()
+
+GET: /instance/policy/label/icon/dark/_preview
+ 	
+ 	
+	
+	
+
+### UploadDefaultLabelPolicyLogo()
+
+> UploadDefaultLabelPolicyLogo()
+
+POST: /instance/policy/label/logo
+
+### UploadDefaultLabelPolicyLogo()
+
+> UploadDefaultLabelPolicyLogoDark()
+
+POST: /instance/policy/label/logo/dark
+ 	
+ 	
+
+### GetDefaultLabelPolicyLogo()
+
+> GetDefaultLabelPolicyLogo()
+
+GET: /instance/policy/label/logo
+
+### GetDefaultLabelPolicyLogo()
+
+> GetDefaultLabelPolicyLogoDark()
+
+GET: /instance/policy/label/logo/dark
+ 	
+ 	
+
+### GetPreviewDefaultLabelPolicyLogo()
+
+> GetPreviewDefaultLabelPolicyLogo()
+
+GET: /instance/policy/label/logo/_preview
+
+### GetPreviewDefaultLabelPolicyLogo()
+
+> GetPreviewDefaultLabelPolicyLogoDark()
+
+GET: /instance/policy/label/logo/dark/_preview
+ 	
+ 	
+	
+	
+	
+	
+
+### UploadOrgLabelPolicyFont()
+
+> UploadOrgLabelPolicyFont()
+
+POST: /org/policy/label/font
+
+ 	
+
+### GetOrgLabelPolicyFont()
+
+> GetOrgLabelPolicyFont()
+
+GET: /org/policy/label/font
+
+ 	
+
+### GetPreviewOrgLabelPolicyFont()
+
+> GetPreviewOrgLabelPolicyFont()
+
+GET: /org/policy/label/font/_preview
+
+ 	
+	
+	
+
+### UploadOrgLabelPolicyIcon()
+
+> UploadOrgLabelPolicyIcon()
+
+POST: /org/policy/label/icon
+
+### UploadOrgLabelPolicyIcon()
+
+> UploadOrgLabelPolicyIconDark()
+
+POST: /org/policy/label/icon/dark
+ 	
+ 	
+
+### GetOrgLabelPolicyIcon()
+
+> GetOrgLabelPolicyIcon()
+
+GET: /org/policy/label/icon
+
+### GetOrgLabelPolicyIcon()
+
+> GetOrgLabelPolicyIconDark()
+
+GET: /org/policy/label/icon/dark
+ 	
+ 	
+
+### GetPreviewOrgLabelPolicyIcon()
+
+> GetPreviewOrgLabelPolicyIcon()
+
+GET: /org/policy/label/icon/_preview
+
+### GetPreviewOrgLabelPolicyIcon()
+
+> GetPreviewOrgLabelPolicyIconDark()
+
+GET: /org/policy/label/icon/dark/_preview
+ 	
+ 	
+	
+	
+
+### UploadOrgLabelPolicyLogo()
+
+> UploadOrgLabelPolicyLogo()
+
+POST: /org/policy/label/logo
+
+### UploadOrgLabelPolicyLogo()
+
+> UploadOrgLabelPolicyLogoDark()
+
+POST: /org/policy/label/logo/dark
+ 	
+ 	
+
+### GetOrgLabelPolicyLogo()
+
+> GetOrgLabelPolicyLogo()
+
+GET: /org/policy/label/logo
+
+### GetOrgLabelPolicyLogo()
+
+> GetOrgLabelPolicyLogoDark()
+
+GET: /org/policy/label/logo/dark
+ 	
+ 	
+
+### GetPreviewOrgLabelPolicyLogo()
+
+> GetPreviewOrgLabelPolicyLogo()
+
+GET: /org/policy/label/logo/_preview
+
+### GetPreviewOrgLabelPolicyLogo()
+
+> GetPreviewOrgLabelPolicyLogoDark()
+
+GET: /org/policy/label/logo/dark/_preview
+ 	
+ 	
+	
+	
+	
+	
+
+### UploadMyUserAvatar()
+
+> UploadMyUserAvatar()
+
+POST: /users/me/avatar
+
+ 	
+
+### GetMyUserAvatar()
+
+> GetMyUserAvatar()
+
+GET: /users/me/avatar
+
+ 	
+	
+	
--- a/e2e/config/host.docker.internal/docker-compose.yaml
+++ b/e2e/config/host.docker.internal/docker-compose.yaml
@ -1,18 +1,22 @@
 version: '3.8'

 services:
-  zitadel:
-    extends:
-      file: '../localhost/docker-compose.yaml'
-      service: 'zitadel'
-    volumes:
-      - ./zitadel.yaml:/zitadel.yaml

  db:
    extends:
      file: '../localhost/docker-compose.yaml'
      service: 'db'

+  zitadel:
+    depends_on:
+      db:
+        condition: 'service_healthy'
+    extends:
+      file: '../localhost/docker-compose.yaml'
+      service: 'zitadel'
+    volumes:
+      - ./zitadel.yaml:/zitadel.yaml
+
  prepare:
    image: node:18-alpine3.15
    working_dir: /e2e
--- a/e2e/cypress/e2e/quotas/quotas.cy.ts
+++ b/e2e/cypress/e2e/quotas/quotas.cy.ts
@ -130,12 +130,12 @@ describe('quotas', () => {
              expect(res.status).to.equal(429);
            });
            // visit limited console
-            cy.visit('/users/me');
-            cy.contains('#authenticated-requests-exhausted-dialog button', 'Continue').click();
-            const upgradeInstancePage = `https://example.com/instances/${ctx.instanceId}`;
-            cy.origin(upgradeInstancePage, { args: { upgradeInstancePage } }, ({ upgradeInstancePage }) => {
-              cy.location('href').should('equal', upgradeInstancePage);
-            });
+            // cy.visit('/users/me');
+            // cy.contains('#authenticated-requests-exhausted-dialog button', 'Continue').click();
+            // const upgradeInstancePage = `https://example.com/instances/${ctx.instanceId}`;
+            // cy.origin(upgradeInstancePage, { args: { upgradeInstancePage } }, ({ upgradeInstancePage }) => {
+            //   cy.location('href').should('equal', upgradeInstancePage);
+            // });
            // upgrade instance
            ensureQuotaIsRemoved(ctx, Unit.AuthenticatedRequests);
            // visit upgraded console again
--- a/e2e/cypress/support/login/users.ts
+++ b/e2e/cypress/support/login/users.ts
@ -82,6 +82,8 @@ export function login(

        onAuthenticated ? onAuthenticated() : null;

+        cy.wait(1000);
+
        cy.visit('/');

        cy.get('[data-e2e=authenticated-welcome]', {
--- a/internal/api/assets/generator/asset_generator.go
+++ b/internal/api/assets/generator/asset_generator.go
@ -128,7 +128,9 @@ func GenerateAssetHandler(configFilePath, handlerPrefix string, authz, router, d
 	logging.Log("ASSETS-Bfd41").OnError(err).Fatal("cannot generate docs")
 }

-const authzTmpl = `package {{.GoPkgName}}
+const authzTmpl = `// Code generated by assets generator. DO NOT EDIT.
+
+package {{.GoPkgName}}

 import (
 	"github.com/zitadel/zitadel/internal/api/authz"
@ -159,7 +161,9 @@ var {{.Name}}_AuthMethods = authz.MethodMapping {
 }
 `

-const routerTmpl = `package {{.GoPkgName}}
+const routerTmpl = `// Code generated by assets generator. DO NOT EDIT.
+
+package {{.GoPkgName}}

 import (
 	"github.com/gorilla/mux"
--- a/internal/api/ui/console/console.go
+++ b/internal/api/ui/console/console.go
@ -34,7 +34,7 @@ type spaHandler struct {
 }

 var (
-	//go:embed static/*
+	//go:embed static
 	static embed.FS
 )

--- a/internal/api/ui/console/static/.gitkeep
+++ b/internal/api/ui/console/static/.gitkeep
--- a/internal/api/ui/console/static/gitkeep
+++ b/internal/api/ui/console/static/gitkeep
--- a/internal/api/ui/login/static/resources/themes/scss/styles/vars.scss
+++ b/internal/api/ui/login/static/resources/themes/scss/styles/vars.scss
@ -108,8 +108,8 @@
  --zitadel-color-grey-800: #424242;
  --zitadel-color-grey-900: #212121;

-  --zitadel-icon-select: url("../select_arrow_light.svg");
-  --zitadel-logo-powered-by: url("../logo-dark.svg");
+  --zitadel-icon-select: url(../../zitadel/select_arrow_light.svg);
+  --zitadel-logo-powered-by: url(../../zitadel/logo-dark.svg);

  --zitadel-color-google-text: #8b8d8d;
  --zitadel-color-google-background: #ffffff;
@ -218,8 +218,8 @@
  );

  /*--zitadel-color-label: var(--zitadel-color-grey-600); same */
-  --zitadel-icon-select: url("../select_arrow_dark.svg");
-  --zitadel-logo-powered-by: url("../logo-light.svg");
+  --zitadel-icon-select: url(../../zitadel/select_arrow_dark.svg);
+  --zitadel-logo-powered-by: url(../../zitadel/logo-light.svg);

  --zitadel-color-google-text: #8b8d8d;
  --zitadel-color-google-background: #ffffff;
--- a/internal/api/ui/login/static/resources/themes/zitadel/css/zitadel.css
+++ b/internal/api/ui/login/static/resources/themes/zitadel/css/zitadel.css
--- a/internal/api/ui/login/static/resources/themes/zitadel/css/zitadel.css.map
+++ b/internal/api/ui/login/static/resources/themes/zitadel/css/zitadel.css.map
--- a/internal/protoc/protoc-base/protoc_helper.go
+++ b/internal/protoc/protoc-base/protoc_helper.go
@ -1,113 +0,0 @@
-package protocbase
-
-import (
-	"flag"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"os"
-	"strings"
-	"text/template"
-
-	"github.com/golang/glog"
-	"github.com/golang/protobuf/proto"
-	plugin "github.com/golang/protobuf/protoc-gen-go/plugin"
-	"github.com/grpc-ecosystem/grpc-gateway/protoc-gen-grpc-gateway/descriptor"
-)
-
-type GeneratorFunc func(target string, registry *descriptor.Registry, file *descriptor.File) (string, string, error)
-
-type ProtocGenerator interface {
-	Generate(target string, registry *descriptor.Registry, file *descriptor.File) (string, string, error)
-}
-
-func (f GeneratorFunc) Generate(target string, registry *descriptor.Registry, file *descriptor.File) (string, string, error) {
-	return f(target, registry, file) //TODO: in my opinion we should use file.GoPkg here analog https://github.com/grpc-ecosystem/grpc-gateway/blob/0cc2680a4990244dcc7602bad34fef935310c0e8/protoc-gen-grpc-gateway/internal/gengateway/generator.go#L111
-}
-
-func parseReq(r io.Reader) (*plugin.CodeGeneratorRequest, error) {
-	glog.V(1).Info("Parsing code generator request")
-
-	input, err := ioutil.ReadAll(r)
-
-	if err != nil {
-		glog.Errorf("Failed to read code generator request: %v", err)
-		return nil, err
-	}
-
-	req := &plugin.CodeGeneratorRequest{}
-
-	if err = proto.Unmarshal(input, req); err != nil {
-		glog.Errorf("Failed to unmarshal code generator request: %v", err)
-		return nil, err
-	}
-
-	glog.V(1).Info("Parsed code generator request")
-
-	return req, nil
-}
-
-func RunWithBaseTemplate(targetFileNameFmt string, tmpl *template.Template) {
-	Run(GeneratorFunc(func(target string, registry *descriptor.Registry, file *descriptor.File) (string, string, error) {
-		fileName := fmt.Sprintf(targetFileNameFmt, strings.Split(target, ".")[0])
-		fContent, err := GenerateFromBaseTemplate(tmpl, registry, file)
-		return fileName, fContent, err
-	}))
-}
-
-func Run(generator ProtocGenerator) {
-	flag.Parse()
-	defer glog.Flush()
-
-	req, err := parseReq(os.Stdin)
-	if err != nil {
-		glog.Fatal(err)
-	}
-
-	registry := descriptor.NewRegistry()
-	registry.SetAllowDeleteBody(true)
-	if err = registry.Load(req); err != nil {
-		glog.Fatal(err)
-	}
-
-	var result []*plugin.CodeGeneratorResponse_File
-
-	for _, t := range req.FileToGenerate {
-		file, err := registry.LookupFile(t)
-		if err != nil {
-			EmitError(err)
-			return
-		}
-
-		fName, fContent, err := generator.Generate(t, registry, file)
-		if err != nil {
-			EmitError(err)
-			return
-		}
-
-		result = append(result, &plugin.CodeGeneratorResponse_File{
-			Name:    &fName,
-			Content: &fContent,
-		})
-	}
-
-	EmitFiles(result)
-}
-
-func EmitFiles(out []*plugin.CodeGeneratorResponse_File) {
-	EmitResp(&plugin.CodeGeneratorResponse{File: out})
-}
-
-func EmitError(err error) {
-	EmitResp(&plugin.CodeGeneratorResponse{Error: proto.String(err.Error())})
-}
-
-func EmitResp(resp *plugin.CodeGeneratorResponse) {
-	buf, err := proto.Marshal(resp)
-	if err != nil {
-		glog.Fatal(err)
-	}
-	if _, err := os.Stdout.Write(buf); err != nil {
-		glog.Fatal(err)
-	}
-}
--- a/internal/protoc/protoc-base/templates.go
+++ b/internal/protoc/protoc-base/templates.go
@ -1,106 +0,0 @@
-package protocbase
-
-import (
-	"bytes"
-	"fmt"
-	"text/template"
-	"time"
-
-	"github.com/Masterminds/sprig"
-	"github.com/golang/protobuf/proto"
-	"github.com/grpc-ecosystem/grpc-gateway/protoc-gen-grpc-gateway/descriptor"
-	"golang.org/x/tools/imports"
-)
-
-var extensions = map[string]*proto.ExtensionDesc{}
-
-type BaseTemplateData struct {
-	Now  time.Time
-	File *descriptor.File
-
-	registry *descriptor.Registry
-}
-
-var templateFuncs = map[string]interface{}{
-	"option": getOption,
-}
-
-func RegisterTmplFunc(name string, f interface{}) {
-	if _, found := templateFuncs[name]; found {
-		panic(fmt.Sprintf("func with name %v is already registered", name))
-	}
-
-	templateFuncs[name] = f
-}
-
-func RegisterExtension(ext *proto.ExtensionDesc) {
-	extensions[ext.Name] = ext
-}
-
-func GetBaseTemplateData(registry *descriptor.Registry, file *descriptor.File) *BaseTemplateData {
-	return &BaseTemplateData{
-		Now:      time.Now().UTC(),
-		File:     file,
-		registry: registry,
-	}
-}
-
-func getOption(opts proto.Message, extName string) interface{} {
-	extDesc := extensions[extName]
-
-	if !proto.HasExtension(opts, extDesc) {
-		return nil
-	}
-
-	ext, err := proto.GetExtension(opts, extDesc)
-	if err != nil {
-		panic(err)
-	}
-
-	return ext
-}
-
-func (data *BaseTemplateData) ResolveMsgType(msgType string) string {
-	msg, err := data.registry.LookupMsg(data.File.GetPackage(), msgType)
-	if err != nil {
-		panic(err)
-	}
-
-	return msg.GoType(data.File.GoPkg.Path)
-}
-
-func (data *BaseTemplateData) ResolveFile(fileName string) *descriptor.File {
-	file, err := data.registry.LookupFile(fileName)
-	if err != nil {
-		panic(err)
-	}
-
-	return file
-}
-
-func LoadTemplate(templateData []byte, err error) *template.Template {
-	if err != nil {
-		panic(err)
-	}
-
-	return template.Must(template.New("").
-		Funcs(sprig.TxtFuncMap()).
-		Funcs(templateFuncs).
-		Parse(string(templateData)))
-}
-
-func GenerateFromTemplate(tmpl *template.Template, data interface{}) (string, error) {
-	var tpl bytes.Buffer
-	err := tmpl.Execute(&tpl, data)
-	if err != nil {
-		return "", err
-	}
-
-	tmplResult := tpl.Bytes()
-	tmplResult, err = imports.Process(".", tmplResult, nil)
-	return string(tmplResult), err
-}
-
-func GenerateFromBaseTemplate(tmpl *template.Template, registry *descriptor.Registry, file *descriptor.File) (string, error) {
-	return GenerateFromTemplate(tmpl, GetBaseTemplateData(registry, file))
-}
--- a/internal/protoc/protoc-gen-authoption/auth_method_mapping.go.tmpl
+++ b/internal/protoc/protoc-gen-authoption/auth_method_mapping.go.tmpl
--- a/internal/protoc/protoc-gen-authoption/authoption/generate.go
+++ b/internal/protoc/protoc-gen-authoption/authoption/generate.go
@ -1,3 +0,0 @@
-package authoption
-
-//go:generate protoc -I. -I$GOPATH/src --go-grpc_out=plugins=grpc:$GOPATH/src options.proto
--- a/internal/protoc/protoc-gen-authoption/authoption/options.pb.go
+++ b/internal/protoc/protoc-gen-authoption/authoption/options.pb.go
@ -0,0 +1,187 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: zitadel/options.proto
+
+package authoption
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	descriptorpb "google.golang.org/protobuf/types/descriptorpb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type AuthOption struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Permission     string `protobuf:"bytes,1,opt,name=permission,proto3" json:"permission,omitempty"`
+	CheckFieldName string `protobuf:"bytes,2,opt,name=check_field_name,json=checkFieldName,proto3" json:"check_field_name,omitempty"`
+}
+
+func (x *AuthOption) Reset() {
+	*x = AuthOption{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_zitadel_options_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthOption) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthOption) ProtoMessage() {}
+
+func (x *AuthOption) ProtoReflect() protoreflect.Message {
+	mi := &file_zitadel_options_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthOption.ProtoReflect.Descriptor instead.
+func (*AuthOption) Descriptor() ([]byte, []int) {
+	return file_zitadel_options_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *AuthOption) GetPermission() string {
+	if x != nil {
+		return x.Permission
+	}
+	return ""
+}
+
+func (x *AuthOption) GetCheckFieldName() string {
+	if x != nil {
+		return x.CheckFieldName
+	}
+	return ""
+}
+
+var file_zitadel_options_proto_extTypes = []protoimpl.ExtensionInfo{
+	{
+		ExtendedType:  (*descriptorpb.MethodOptions)(nil),
+		ExtensionType: (*AuthOption)(nil),
+		Field:         50000,
+		Name:          "zitadel.v1.auth_option",
+		Tag:           "bytes,50000,opt,name=auth_option",
+		Filename:      "zitadel/options.proto",
+	},
+}
+
+// Extension fields to descriptorpb.MethodOptions.
+var (
+	// optional zitadel.v1.AuthOption auth_option = 50000;
+	E_AuthOption = &file_zitadel_options_proto_extTypes[0]
+)
+
+var File_zitadel_options_proto protoreflect.FileDescriptor
+
+var file_zitadel_options_proto_rawDesc = []byte{
+	0x0a, 0x15, 0x7a, 0x69, 0x74, 0x61, 0x64, 0x65, 0x6c, 0x2f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0a, 0x7a, 0x69, 0x74, 0x61, 0x64, 0x65, 0x6c,
+	0x2e, 0x76, 0x31, 0x1a, 0x20, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x56, 0x0a, 0x0a, 0x41, 0x75, 0x74, 0x68, 0x4f, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x12, 0x1e, 0x0a, 0x0a, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f,
+	0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x12, 0x28, 0x0a, 0x10, 0x63, 0x68, 0x65, 0x63, 0x6b, 0x5f, 0x66, 0x69, 0x65,
+	0x6c, 0x64, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x63,
+	0x68, 0x65, 0x63, 0x6b, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x3a, 0x59, 0x0a,
+	0x0b, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1e, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d,
+	0x65, 0x74, 0x68, 0x6f, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0xd0, 0x86, 0x03,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x7a, 0x69, 0x74, 0x61, 0x64, 0x65, 0x6c, 0x2e, 0x76,
+	0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x61, 0x75,
+	0x74, 0x68, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x47, 0x5a, 0x45, 0x67, 0x69, 0x74, 0x68,
+	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x7a, 0x69, 0x74, 0x61, 0x64, 0x65, 0x6c, 0x2f, 0x7a,
+	0x69, 0x74, 0x61, 0x64, 0x65, 0x6c, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x2d, 0x67, 0x65,
+	0x6e, 0x2d, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_zitadel_options_proto_rawDescOnce sync.Once
+	file_zitadel_options_proto_rawDescData = file_zitadel_options_proto_rawDesc
+)
+
+func file_zitadel_options_proto_rawDescGZIP() []byte {
+	file_zitadel_options_proto_rawDescOnce.Do(func() {
+		file_zitadel_options_proto_rawDescData = protoimpl.X.CompressGZIP(file_zitadel_options_proto_rawDescData)
+	})
+	return file_zitadel_options_proto_rawDescData
+}
+
+var file_zitadel_options_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_zitadel_options_proto_goTypes = []interface{}{
+	(*AuthOption)(nil),                 // 0: zitadel.v1.AuthOption
+	(*descriptorpb.MethodOptions)(nil), // 1: google.protobuf.MethodOptions
+}
+var file_zitadel_options_proto_depIdxs = []int32{
+	1, // 0: zitadel.v1.auth_option:extendee -> google.protobuf.MethodOptions
+	0, // 1: zitadel.v1.auth_option:type_name -> zitadel.v1.AuthOption
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	1, // [1:2] is the sub-list for extension type_name
+	0, // [0:1] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_zitadel_options_proto_init() }
+func file_zitadel_options_proto_init() {
+	if File_zitadel_options_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_zitadel_options_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AuthOption); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_zitadel_options_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 1,
+			NumServices:   0,
+		},
+		GoTypes:           file_zitadel_options_proto_goTypes,
+		DependencyIndexes: file_zitadel_options_proto_depIdxs,
+		MessageInfos:      file_zitadel_options_proto_msgTypes,
+		ExtensionInfos:    file_zitadel_options_proto_extTypes,
+	}.Build()
+	File_zitadel_options_proto = out.File
+	file_zitadel_options_proto_rawDesc = nil
+	file_zitadel_options_proto_goTypes = nil
+	file_zitadel_options_proto_depIdxs = nil
+}
--- a/internal/protoc/protoc-gen-authoption/authoption/options.proto
+++ b/internal/protoc/protoc-gen-authoption/authoption/options.proto
@ -1,18 +0,0 @@
-syntax = "proto3";
-
-package caos.zitadel.utils.v1;
-
-import "google/protobuf/descriptor.proto";
-
-option go_package = "github.com/zitadel/zitadel/internal/protoc/protoc-gen-authoption/authoption";
-
-
-extend google.protobuf.MethodOptions {
-    AuthOption auth_option = 50000;
-}
-
-message AuthOption {
-    string permission = 1;
-    string check_field_name = 2;
-    string feature = 3;
-}
--- a/internal/protoc/protoc-gen-authoption/main.go
+++ b/internal/protoc/protoc-gen-authoption/main.go
--- a/openapi/handler.go
+++ b/openapi/handler.go
@ -1,24 +1,21 @@
 package openapi

 import (
+	"embed"
 	"net/http"

-	"github.com/rakyll/statik/fs"
 	"github.com/rs/cors"
-
-	_ "github.com/zitadel/zitadel/openapi/statik"
 )

 const (
 	HandlerPrefix = "/openapi/v2/swagger"
 )

+//go:embed v2/zitadel/*
+var openapi embed.FS
+
 func Start() (http.Handler, error) {
-	statikFS, err := fs.NewWithNamespace("swagger")
-	if err != nil {
-		return nil, err
-	}
 	handler := &http.ServeMux{}
-	handler.Handle("/", cors.AllowAll().Handler(http.FileServer(statikFS)))
+	handler.Handle("/", cors.AllowAll().Handler(http.FileServer(http.FS(openapi))))
 	return handler, nil
 }
--- a/openapi/statik/generate.go
+++ b/openapi/statik/generate.go
@ -1,3 +0,0 @@
-package statik
-
-//go:generate statik -src=../v2/zitadel -dest=.. -ns=swagger
--- a/pkg/grpc/protoc/v2/options.pb.go
+++ b/pkg/grpc/protoc/v2/options.pb.go
@ -0,0 +1,333 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        (unknown)
+// source: zitadel/protoc_gen_zitadel/v2/options.proto
+
+package protoc
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	descriptorpb "google.golang.org/protobuf/types/descriptorpb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type Options struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AuthOption   *AuthOption         `protobuf:"bytes,1,opt,name=auth_option,json=authOption,proto3" json:"auth_option,omitempty"`
+	HttpResponse *CustomHTTPResponse `protobuf:"bytes,2,opt,name=http_response,json=httpResponse,proto3" json:"http_response,omitempty"`
+}
+
+func (x *Options) Reset() {
+	*x = Options{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_zitadel_protoc_gen_zitadel_v2_options_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Options) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Options) ProtoMessage() {}
+
+func (x *Options) ProtoReflect() protoreflect.Message {
+	mi := &file_zitadel_protoc_gen_zitadel_v2_options_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Options.ProtoReflect.Descriptor instead.
+func (*Options) Descriptor() ([]byte, []int) {
+	return file_zitadel_protoc_gen_zitadel_v2_options_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Options) GetAuthOption() *AuthOption {
+	if x != nil {
+		return x.AuthOption
+	}
+	return nil
+}
+
+func (x *Options) GetHttpResponse() *CustomHTTPResponse {
+	if x != nil {
+		return x.HttpResponse
+	}
+	return nil
+}
+
+type AuthOption struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Permission string `protobuf:"bytes,1,opt,name=permission,proto3" json:"permission,omitempty"`
+	OrgField   string `protobuf:"bytes,3,opt,name=org_field,json=orgField,proto3" json:"org_field,omitempty"`
+}
+
+func (x *AuthOption) Reset() {
+	*x = AuthOption{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_zitadel_protoc_gen_zitadel_v2_options_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthOption) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthOption) ProtoMessage() {}
+
+func (x *AuthOption) ProtoReflect() protoreflect.Message {
+	mi := &file_zitadel_protoc_gen_zitadel_v2_options_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthOption.ProtoReflect.Descriptor instead.
+func (*AuthOption) Descriptor() ([]byte, []int) {
+	return file_zitadel_protoc_gen_zitadel_v2_options_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *AuthOption) GetPermission() string {
+	if x != nil {
+		return x.Permission
+	}
+	return ""
+}
+
+func (x *AuthOption) GetOrgField() string {
+	if x != nil {
+		return x.OrgField
+	}
+	return ""
+}
+
+type CustomHTTPResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	SuccessCode int32 `protobuf:"varint,1,opt,name=success_code,json=successCode,proto3" json:"success_code,omitempty"`
+}
+
+func (x *CustomHTTPResponse) Reset() {
+	*x = CustomHTTPResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_zitadel_protoc_gen_zitadel_v2_options_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CustomHTTPResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CustomHTTPResponse) ProtoMessage() {}
+
+func (x *CustomHTTPResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_zitadel_protoc_gen_zitadel_v2_options_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CustomHTTPResponse.ProtoReflect.Descriptor instead.
+func (*CustomHTTPResponse) Descriptor() ([]byte, []int) {
+	return file_zitadel_protoc_gen_zitadel_v2_options_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *CustomHTTPResponse) GetSuccessCode() int32 {
+	if x != nil {
+		return x.SuccessCode
+	}
+	return 0
+}
+
+var file_zitadel_protoc_gen_zitadel_v2_options_proto_extTypes = []protoimpl.ExtensionInfo{
+	{
+		ExtendedType:  (*descriptorpb.MethodOptions)(nil),
+		ExtensionType: (*Options)(nil),
+		Field:         50001,
+		Name:          "zitadel.protoc_gen_zitadel.v2.options",
+		Tag:           "bytes,50001,opt,name=options",
+		Filename:      "zitadel/protoc_gen_zitadel/v2/options.proto",
+	},
+}
+
+// Extension fields to descriptorpb.MethodOptions.
+var (
+	// optional zitadel.protoc_gen_zitadel.v2.Options options = 50001;
+	E_Options = &file_zitadel_protoc_gen_zitadel_v2_options_proto_extTypes[0]
+)
+
+var File_zitadel_protoc_gen_zitadel_v2_options_proto protoreflect.FileDescriptor
+
+var file_zitadel_protoc_gen_zitadel_v2_options_proto_rawDesc = []byte{
+	0x0a, 0x2b, 0x7a, 0x69, 0x74, 0x61, 0x64, 0x65, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63,
+	0x5f, 0x67, 0x65, 0x6e, 0x5f, 0x7a, 0x69, 0x74, 0x61, 0x64, 0x65, 0x6c, 0x2f, 0x76, 0x32, 0x2f,
+	0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1d, 0x7a,
+	0x69, 0x74, 0x61, 0x64, 0x65, 0x6c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x5f, 0x67, 0x65,
+	0x6e, 0x5f, 0x7a, 0x69, 0x74, 0x61, 0x64, 0x65, 0x6c, 0x2e, 0x76, 0x32, 0x1a, 0x20, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x65,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xad,
+	0x01, 0x0a, 0x07, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x4a, 0x0a, 0x0b, 0x61, 0x75,
+	0x74, 0x68, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x29, 0x2e, 0x7a, 0x69, 0x74, 0x61, 0x64, 0x65, 0x6c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63,
+	0x5f, 0x67, 0x65, 0x6e, 0x5f, 0x7a, 0x69, 0x74, 0x61, 0x64, 0x65, 0x6c, 0x2e, 0x76, 0x32, 0x2e,
+	0x41, 0x75, 0x74, 0x68, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x61, 0x75, 0x74, 0x68,
+	0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x56, 0x0a, 0x0d, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x72,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x31, 0x2e,
+	0x7a, 0x69, 0x74, 0x61, 0x64, 0x65, 0x6c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x5f, 0x67,
+	0x65, 0x6e, 0x5f, 0x7a, 0x69, 0x74, 0x61, 0x64, 0x65, 0x6c, 0x2e, 0x76, 0x32, 0x2e, 0x43, 0x75,
+	0x73, 0x74, 0x6f, 0x6d, 0x48, 0x54, 0x54, 0x50, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x52, 0x0c, 0x68, 0x74, 0x74, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x4f,
+	0x0a, 0x0a, 0x41, 0x75, 0x74, 0x68, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1e, 0x0a, 0x0a,
+	0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0a, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1b, 0x0a, 0x09,
+	0x6f, 0x72, 0x67, 0x5f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x08, 0x6f, 0x72, 0x67, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03, 0x22,
+	0x37, 0x0a, 0x12, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x48, 0x54, 0x54, 0x50, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73,
+	0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0b, 0x73, 0x75, 0x63,
+	0x63, 0x65, 0x73, 0x73, 0x43, 0x6f, 0x64, 0x65, 0x3a, 0x62, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x12, 0x1e, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x4f, 0x70, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x18, 0xd1, 0x86, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x7a, 0x69,
+	0x74, 0x61, 0x64, 0x65, 0x6c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x5f, 0x67, 0x65, 0x6e,
+	0x5f, 0x7a, 0x69, 0x74, 0x61, 0x64, 0x65, 0x6c, 0x2e, 0x76, 0x32, 0x2e, 0x4f, 0x70, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x36, 0x5a, 0x34,
+	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x7a, 0x69, 0x74, 0x61, 0x64,
+	0x65, 0x6c, 0x2f, 0x7a, 0x69, 0x74, 0x61, 0x64, 0x65, 0x6c, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67,
+	0x72, 0x70, 0x63, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x2f, 0x76, 0x32, 0x3b, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x63, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_zitadel_protoc_gen_zitadel_v2_options_proto_rawDescOnce sync.Once
+	file_zitadel_protoc_gen_zitadel_v2_options_proto_rawDescData = file_zitadel_protoc_gen_zitadel_v2_options_proto_rawDesc
+)
+
+func file_zitadel_protoc_gen_zitadel_v2_options_proto_rawDescGZIP() []byte {
+	file_zitadel_protoc_gen_zitadel_v2_options_proto_rawDescOnce.Do(func() {
+		file_zitadel_protoc_gen_zitadel_v2_options_proto_rawDescData = protoimpl.X.CompressGZIP(file_zitadel_protoc_gen_zitadel_v2_options_proto_rawDescData)
+	})
+	return file_zitadel_protoc_gen_zitadel_v2_options_proto_rawDescData
+}
+
+var file_zitadel_protoc_gen_zitadel_v2_options_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_zitadel_protoc_gen_zitadel_v2_options_proto_goTypes = []interface{}{
+	(*Options)(nil),                    // 0: zitadel.protoc_gen_zitadel.v2.Options
+	(*AuthOption)(nil),                 // 1: zitadel.protoc_gen_zitadel.v2.AuthOption
+	(*CustomHTTPResponse)(nil),         // 2: zitadel.protoc_gen_zitadel.v2.CustomHTTPResponse
+	(*descriptorpb.MethodOptions)(nil), // 3: google.protobuf.MethodOptions
+}
+var file_zitadel_protoc_gen_zitadel_v2_options_proto_depIdxs = []int32{
+	1, // 0: zitadel.protoc_gen_zitadel.v2.Options.auth_option:type_name -> zitadel.protoc_gen_zitadel.v2.AuthOption
+	2, // 1: zitadel.protoc_gen_zitadel.v2.Options.http_response:type_name -> zitadel.protoc_gen_zitadel.v2.CustomHTTPResponse
+	3, // 2: zitadel.protoc_gen_zitadel.v2.options:extendee -> google.protobuf.MethodOptions
+	0, // 3: zitadel.protoc_gen_zitadel.v2.options:type_name -> zitadel.protoc_gen_zitadel.v2.Options
+	4, // [4:4] is the sub-list for method output_type
+	4, // [4:4] is the sub-list for method input_type
+	3, // [3:4] is the sub-list for extension type_name
+	2, // [2:3] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_zitadel_protoc_gen_zitadel_v2_options_proto_init() }
+func file_zitadel_protoc_gen_zitadel_v2_options_proto_init() {
+	if File_zitadel_protoc_gen_zitadel_v2_options_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_zitadel_protoc_gen_zitadel_v2_options_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Options); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_zitadel_protoc_gen_zitadel_v2_options_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AuthOption); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_zitadel_protoc_gen_zitadel_v2_options_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CustomHTTPResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_zitadel_protoc_gen_zitadel_v2_options_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   3,
+			NumExtensions: 1,
+			NumServices:   0,
+		},
+		GoTypes:           file_zitadel_protoc_gen_zitadel_v2_options_proto_goTypes,
+		DependencyIndexes: file_zitadel_protoc_gen_zitadel_v2_options_proto_depIdxs,
+		MessageInfos:      file_zitadel_protoc_gen_zitadel_v2_options_proto_msgTypes,
+		ExtensionInfos:    file_zitadel_protoc_gen_zitadel_v2_options_proto_extTypes,
+	}.Build()
+	File_zitadel_protoc_gen_zitadel_v2_options_proto = out.File
+	file_zitadel_protoc_gen_zitadel_v2_options_proto_rawDesc = nil
+	file_zitadel_protoc_gen_zitadel_v2_options_proto_goTypes = nil
+	file_zitadel_protoc_gen_zitadel_v2_options_proto_depIdxs = nil
+}
--- a/proto/buf.yaml
+++ b/proto/buf.yaml
@ -10,3 +10,28 @@ breaking:
 lint:
  use:
    - MINIMAL
+  ignore:
+    - zitadel/action.proto
+    - zitadel/admin.proto
+    - zitadel/app.proto
+    - zitadel/auth_n_key.proto
+    - zitadel/auth.proto
+    - zitadel/change.proto
+    - zitadel/event.proto
+    - zitadel/idp.proto
+    - zitadel/instance.proto
+    - zitadel/management.proto
+    - zitadel/member.proto
+    - zitadel/message.proto
+    - zitadel/metadata.proto
+    - zitadel/object.proto
+    - zitadel/options.proto
+    - zitadel/org.proto
+    - zitadel/policy.proto
+    - zitadel/project.proto
+    - zitadel/quota.proto
+    - zitadel/settings.proto
+    - zitadel/system.proto
+    - zitadel/text.proto
+    - zitadel/user.proto
+    - zitadel/v1.proto
--- a/proto/zitadel/options.proto
+++ b/proto/zitadel/options.proto
@ -6,7 +6,6 @@ import "google/protobuf/descriptor.proto";

 option go_package = "github.com/zitadel/zitadel/internal/protoc/protoc-gen-authoption/authoption";

-
 extend google.protobuf.MethodOptions {
    AuthOption auth_option = 50000;
 }
--- a/yarn.lock
+++ b/yarn.lock
@ -1,4 +0,0 @@
-# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
-# yarn lockfile v1
-
-