mirror of
https://github.com/zitadel/zitadel.git
synced 2025-12-30 07:30:05 +00:00
chore: rehaul DevX (#10571)
# Which Problems Are Solved Replaces Turbo by Nx and lays the foundation for the next CI improvements. It enables using Nx Cloud to speed the up the pipelines that affect any node package. It streamlines the dev experience for frontend and backend developers by providing the following commands: | Task | Command | Notes | |------|---------|--------| | **Production** | `nx run PROJECT:prod` | Production server | | **Develop** | `nx run PROJECT:dev` | Hot reloading development server | | **Test** | `nx run PROJECT:test` | Run all tests | | **Lint** | `nx run PROJECT:lint` | Check code style | | **Lint Fix** | `nx run PROJECT:lint-fix` | Auto-fix style issues | The following values can be used for PROJECT: - @zitadel/zitadel (root commands) - @zitadel/api, - @zitadel/login, - @zitadel/console, - @zitadel/docs, - @zitadel/client - @zitadel/proto The project names and folders are streamlined: | Old Folder | New Folder | | --- | --- | | ./e2e | ./tests/functional-ui | | ./load-test | ./benchmark | | ./build/zitadel | ./apps/api | | ./console | ./apps/console (postponed so the PR is reviewable) | Also, all references to the TypeScript repo are removed so we can archive it. # How the Problems Are Solved - Ran `npx nx@latest init` - Replaced all turbo.json by project.json and fixed the target configs - Removed Turbo dependency - All JavaScript related code affected by a PRs changes is quality-checked using the `nx affected` command - We move PR checks that are runnable using Nx into the `check` workflow. For workflows where we don't use Nx, yet, we restore previously built dependency artifacts from Nx. - We only use a single and easy to understand dev container - The CONTRIBUTING.md is streamlined - The setup with a generated client pat is orchestrated with Nx - Everything related to the TypeScript repo is updated or removed. A **Deploy with Vercel** button is added to the docs and the CONTRIBUTING.md. # Additional Changes - NPM package names have a consistent pattern. - Docker bake is removed. The login container is built and released like the core container. - The integration tests build the login container before running, so they don't rely on the login container action anymore. This fixes consistently failing checks on PRs from forks. - The docs build in GitHub actions is removed, as we already build on Vercel. # Additional Context - Internal discussion: https://zitadel.slack.com/archives/C087ADF8LRX/p1756277884928169 - Workflow dispatch test: https://github.com/zitadel/zitadel/actions/runs/17760122959 --------- Co-authored-by: Florian Forster <florian@zitadel.com> Co-authored-by: Tim Möhlmann <tim+github@zitadel.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
This commit is contained in:
Elio Bischof
145
.github/workflows/build.yml
vendored
145
.github/workflows/build.yml
vendored
@@ -1,145 +0,0 @@
|
||||
name: ZITADEL CI/CD
|
||||
|
||||
on:
|
||||
push:
|
||||
tags-ignore:
|
||||
- "*"
|
||||
branches:
|
||||
- "main"
|
||||
pull_request:
|
||||
workflow_dispatch:
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
packages: write
|
||||
issues: write
|
||||
pull-requests: write
|
||||
actions: write
|
||||
|
||||
jobs:
|
||||
core:
|
||||
uses: ./.github/workflows/core.yml
|
||||
with:
|
||||
node_version: "20"
|
||||
buf_version: "latest"
|
||||
|
||||
console:
|
||||
uses: ./.github/workflows/console.yml
|
||||
with:
|
||||
node_version: "20"
|
||||
|
||||
docs:
|
||||
uses: ./.github/workflows/docs.yml
|
||||
with:
|
||||
node_version: "20"
|
||||
buf_version: "latest"
|
||||
|
||||
version:
|
||||
uses: ./.github/workflows/version.yml
|
||||
with:
|
||||
semantic_version: "23.0.7"
|
||||
dry_run: true
|
||||
|
||||
compile:
|
||||
needs: [core, console, version]
|
||||
uses: ./.github/workflows/compile.yml
|
||||
with:
|
||||
core_cache_key: ${{ needs.core.outputs.cache_key }}
|
||||
console_cache_key: ${{ needs.console.outputs.cache_key }}
|
||||
core_cache_path: ${{ needs.core.outputs.cache_path }}
|
||||
console_cache_path: ${{ needs.console.outputs.cache_path }}
|
||||
version: ${{ needs.version.outputs.version }}
|
||||
node_version: "20"
|
||||
|
||||
core-unit-test:
|
||||
needs: core
|
||||
uses: ./.github/workflows/core-unit-test.yml
|
||||
with:
|
||||
core_cache_key: ${{ needs.core.outputs.cache_key }}
|
||||
core_cache_path: ${{ needs.core.outputs.cache_path }}
|
||||
secrets:
|
||||
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
|
||||
|
||||
core-integration-test:
|
||||
needs: core
|
||||
uses: ./.github/workflows/core-integration-test.yml
|
||||
with:
|
||||
core_cache_key: ${{ needs.core.outputs.cache_key }}
|
||||
core_cache_path: ${{ needs.core.outputs.cache_path }}
|
||||
secrets:
|
||||
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
|
||||
|
||||
lint:
|
||||
needs: [core, console]
|
||||
uses: ./.github/workflows/lint.yml
|
||||
with:
|
||||
node_version: "18"
|
||||
buf_version: "latest"
|
||||
go_lint_version: "latest"
|
||||
core_cache_key: ${{ needs.core.outputs.cache_key }}
|
||||
core_cache_path: ${{ needs.core.outputs.cache_path }}
|
||||
|
||||
container:
|
||||
needs: [compile]
|
||||
uses: ./.github/workflows/container.yml
|
||||
secrets: inherit
|
||||
permissions:
|
||||
packages: write
|
||||
if: ${{ github.event_name == 'workflow_dispatch' }}
|
||||
with:
|
||||
build_image_name: "ghcr.io/zitadel/zitadel-build"
|
||||
|
||||
login-container:
|
||||
uses: ./.github/workflows/login-container.yml
|
||||
permissions:
|
||||
packages: write
|
||||
id-token: write
|
||||
with:
|
||||
login_build_image_name: "ghcr.io/zitadel/zitadel-login-build"
|
||||
node_version: "20"
|
||||
|
||||
login-integration-test:
|
||||
uses: ./.github/workflows/login-integration-test.yml
|
||||
needs: [login-container]
|
||||
with:
|
||||
login_build_image: ${{ needs.login-container.outputs.login_build_image }}
|
||||
|
||||
e2e:
|
||||
uses: ./.github/workflows/e2e.yml
|
||||
needs: [compile]
|
||||
|
||||
release:
|
||||
uses: ./.github/workflows/release.yml
|
||||
permissions:
|
||||
packages: write
|
||||
contents: write
|
||||
issues: write
|
||||
pull-requests: write
|
||||
needs:
|
||||
[
|
||||
version,
|
||||
core-unit-test,
|
||||
core-integration-test,
|
||||
lint,
|
||||
container,
|
||||
login-container,
|
||||
login-integration-test,
|
||||
e2e,
|
||||
]
|
||||
if: ${{ github.event_name == 'workflow_dispatch' }}
|
||||
secrets:
|
||||
GCR_JSON_KEY_BASE64: ${{ secrets.GCR_JSON_KEY_BASE64 }}
|
||||
APP_ID: ${{ secrets.APP_ID }}
|
||||
APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
|
||||
with:
|
||||
build_image_name: ${{ needs.container.outputs.build_image }}
|
||||
semantic_version: "23.0.7"
|
||||
image_name: "ghcr.io/zitadel/zitadel"
|
||||
google_image_name: "europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel"
|
||||
build_image_name_login: ${{ needs.login-container.outputs.login_build_image }}
|
||||
image_name_login: "ghcr.io/zitadel/zitadel-login"
|
||||
google_image_name_login: "europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel-login"
|
||||
67
.github/workflows/ci.yml
vendored
Normal file
67
.github/workflows/ci.yml
vendored
Normal file
@@ -0,0 +1,67 @@
|
||||
name: CI
|
||||
|
||||
on:
|
||||
push:
|
||||
tags-ignore:
|
||||
- "*"
|
||||
branches:
|
||||
- "main"
|
||||
pull_request:
|
||||
workflow_dispatch:
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
packages: write
|
||||
issues: write
|
||||
pull-requests: write
|
||||
actions: write
|
||||
|
||||
jobs:
|
||||
lint_test_build:
|
||||
uses: ./.github/workflows/lint_test_build.yml
|
||||
with:
|
||||
node_version: "22"
|
||||
secrets:
|
||||
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
|
||||
NX_CLOUD_ACCESS_TOKEN_READONLY: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
|
||||
|
||||
pack:
|
||||
uses: ./.github/workflows/pack.yml
|
||||
secrets:
|
||||
GCR_JSON_KEY_BASE64: ${{ secrets.GCR_JSON_KEY_BASE64 }}
|
||||
permissions:
|
||||
packages: write
|
||||
if: ${{ github.event_name == 'workflow_dispatch' }}
|
||||
with:
|
||||
node_version: "22"
|
||||
semantic_version: "23.0.7"
|
||||
image_name_github_api: "ghcr.io/zitadel/zitadel"
|
||||
image_name_google_api: "europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel"
|
||||
image_name_github_login: "ghcr.io/zitadel/zitadel-login"
|
||||
image_name_google_login: "europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel-login"
|
||||
|
||||
release:
|
||||
uses: ./.github/workflows/release.yml
|
||||
permissions:
|
||||
packages: write
|
||||
contents: write
|
||||
issues: write
|
||||
pull-requests: write
|
||||
needs:
|
||||
- lint_test_build
|
||||
- pack
|
||||
if: ${{ github.event_name == 'workflow_dispatch' }}
|
||||
secrets:
|
||||
GCR_JSON_KEY_BASE64: ${{ secrets.GCR_JSON_KEY_BASE64 }}
|
||||
APP_ID: ${{ secrets.APP_ID }}
|
||||
APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
|
||||
with:
|
||||
semantic_version: "23.0.7"
|
||||
image_name_github_api: "ghcr.io/zitadel/zitadel"
|
||||
image_name_google_api: "europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel"
|
||||
image_name_github_login: "ghcr.io/zitadel/zitadel-login"
|
||||
image_name_google_login: "europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel-login"
|
||||
14
.github/workflows/codeql.yml
vendored
14
.github/workflows/codeql.yml
vendored
@@ -25,21 +25,21 @@ jobs:
|
||||
matrix:
|
||||
language: [go,javascript]
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
- name: Checkout Repository
|
||||
uses: actions/checkout@v4
|
||||
- if: matrix.language == 'go'
|
||||
name: Install Go
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version-file: go.mod
|
||||
|
||||
# node to install sass for go
|
||||
- if: matrix.language == 'go'
|
||||
uses: actions/setup-node@v4
|
||||
- if: matrix.language == 'go'
|
||||
name: Set up pnpm
|
||||
uses: pnpm/action-setup@v4
|
||||
- name: Generate gRPC Stubs and Static Assets
|
||||
if: matrix.language == 'go'
|
||||
run: |
|
||||
npm install -g sass
|
||||
make core_build
|
||||
pnpm install --frozen-lockfile
|
||||
pnpm nx run-many --nxBail --projects @zitadel/api --targets generate-stubs generate-statik generate-assets
|
||||
# Initializes the CodeQL tools for scanning.
|
||||
- name: Initialize CodeQL
|
||||
uses: github/codeql-action/init@v3
|
||||
|
||||
89
.github/workflows/compile.yml
vendored
89
.github/workflows/compile.yml
vendored
@@ -1,89 +0,0 @@
|
||||
name: Compile
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
core_cache_key:
|
||||
required: true
|
||||
type: string
|
||||
core_cache_path:
|
||||
required: true
|
||||
type: string
|
||||
console_cache_key:
|
||||
required: true
|
||||
type: string
|
||||
console_cache_path:
|
||||
required: true
|
||||
type: string
|
||||
version:
|
||||
required: true
|
||||
type: string
|
||||
node_version:
|
||||
required: true
|
||||
type: string
|
||||
|
||||
jobs:
|
||||
executable:
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
goos: [linux, darwin, windows]
|
||||
goarch: [amd64, arm64]
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/cache/restore@v4
|
||||
timeout-minutes: 1
|
||||
name: restore console
|
||||
with:
|
||||
path: ${{ inputs.console_cache_path }}
|
||||
key: ${{ inputs.console_cache_key }}
|
||||
fail-on-cache-miss: true
|
||||
- uses: actions/cache/restore@v4
|
||||
timeout-minutes: 1
|
||||
name: restore core
|
||||
with:
|
||||
path: ${{ inputs.core_cache_path }}
|
||||
key: ${{ inputs.core_cache_key }}
|
||||
fail-on-cache-miss: true
|
||||
- uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version-file: "go.mod"
|
||||
- name: compile
|
||||
timeout-minutes: 5
|
||||
run: |
|
||||
GOOS="${{matrix.goos}}" \
|
||||
GOARCH="${{matrix.goarch}}" \
|
||||
VERSION="${{ inputs.version }}" \
|
||||
COMMIT_SHA="${{ github.sha }}" \
|
||||
make compile_pipeline
|
||||
- name: create folder
|
||||
run: |
|
||||
mkdir zitadel-${{ matrix.goos }}-${{ matrix.goarch }}
|
||||
mv zitadel zitadel-${{ matrix.goos }}-${{ matrix.goarch }}/
|
||||
cp LICENSE zitadel-${{ matrix.goos }}-${{ matrix.goarch }}/
|
||||
cp README.md zitadel-${{ matrix.goos }}-${{ matrix.goarch }}/
|
||||
tar -czvf zitadel-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz zitadel-${{ matrix.goos }}-${{ matrix.goarch }}
|
||||
- uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: zitadel-${{ matrix.goos }}-${{ matrix.goarch }}
|
||||
path: zitadel-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz
|
||||
|
||||
checksums:
|
||||
runs-on: ubuntu-latest
|
||||
needs: [executable]
|
||||
steps:
|
||||
- uses: actions/download-artifact@v4
|
||||
with:
|
||||
path: executables
|
||||
pattern: 'zitadel-*-*'
|
||||
- name: move files one folder up
|
||||
run: mv */*.tar.gz . && find . -type d -empty -delete
|
||||
working-directory: executables
|
||||
- run: sha256sum * > checksums.txt
|
||||
working-directory: executables
|
||||
- uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: checksums.txt
|
||||
path: executables/checksums.txt
|
||||
54
.github/workflows/console.yml
vendored
54
.github/workflows/console.yml
vendored
@@ -1,54 +0,0 @@
|
||||
name: Build console
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
node_version:
|
||||
required: true
|
||||
type: string
|
||||
outputs:
|
||||
cache_key:
|
||||
value: ${{ jobs.build.outputs.cache_key }}
|
||||
cache_path:
|
||||
value: ${{ jobs.build.outputs.cache_path }}
|
||||
|
||||
env:
|
||||
cache_path: console/dist/console
|
||||
|
||||
jobs:
|
||||
build:
|
||||
outputs:
|
||||
cache_key: ${{ steps.cache.outputs.cache-primary-key }}
|
||||
cache_path: ${{ env.cache_path }}
|
||||
runs-on:
|
||||
group: zitadel-public
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/cache/restore@v4
|
||||
timeout-minutes: 1
|
||||
continue-on-error: true
|
||||
id: cache
|
||||
with:
|
||||
key: console-${{ hashFiles('console', 'proto', '!console/dist') }}
|
||||
restore-keys: |
|
||||
console-
|
||||
path: ${{ env.cache_path }}
|
||||
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
uses: pnpm/action-setup@v4
|
||||
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ inputs.node_version }}
|
||||
cache: "pnpm"
|
||||
cache-dependency-path: pnpm-lock.yaml
|
||||
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
name: Install dependencies
|
||||
run: pnpm install --frozen-lockfile
|
||||
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
name: Build console with Turbo
|
||||
run: pnpm turbo build --filter=./console
|
||||
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
uses: actions/cache/save@v4
|
||||
with:
|
||||
path: ${{ env.cache_path }}
|
||||
key: ${{ steps.cache.outputs.cache-primary-key }}
|
||||
173
.github/workflows/container.yml
vendored
173
.github/workflows/container.yml
vendored
@@ -1,173 +0,0 @@
|
||||
name: Container
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
build_image_name:
|
||||
required: true
|
||||
type: string
|
||||
outputs:
|
||||
build_image:
|
||||
value: '${{ inputs.build_image_name }}:${{ github.sha }}'
|
||||
|
||||
permissions:
|
||||
packages: write
|
||||
|
||||
env:
|
||||
default_labels: |
|
||||
org.opencontainers.image.documentation=https://zitadel.com/docs
|
||||
org.opencontainers.image.vendor=CAOS AG
|
||||
|
||||
jobs:
|
||||
build:
|
||||
name: zitadel
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
arch: [amd64,arm64]
|
||||
steps:
|
||||
-
|
||||
uses: actions/checkout@v4
|
||||
-
|
||||
name: Scratch meta
|
||||
id: scratch-meta
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: ${{ inputs.build_image_name }}
|
||||
labels: ${{ env.default_labels}}
|
||||
tags: |
|
||||
type=sha,prefix=,suffix=,format=long
|
||||
-
|
||||
name: Debug meta
|
||||
id: debug-meta
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: ${{ inputs.build_image_name }}
|
||||
labels: ${{ env.default_labels}}
|
||||
tags: |
|
||||
type=sha,prefix=,suffix=-debug,format=long
|
||||
-
|
||||
name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
-
|
||||
name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
-
|
||||
name: Login to Docker registry
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
-
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
path: .artifacts
|
||||
name: zitadel-linux-${{ matrix.arch }}
|
||||
-
|
||||
name: Unpack executable
|
||||
run: |
|
||||
tar -xvf .artifacts/zitadel-linux-${{ matrix.arch }}.tar.gz
|
||||
mv zitadel-linux-${{ matrix.arch }}/zitadel ./zitadel
|
||||
-
|
||||
name: Debug
|
||||
id: build-debug
|
||||
uses: docker/build-push-action@v6
|
||||
timeout-minutes: 5
|
||||
with:
|
||||
context: .
|
||||
cache-from: type=gha
|
||||
cache-to: type=gha,mode=max
|
||||
file: build/zitadel/Dockerfile
|
||||
target: artifact
|
||||
platforms: linux/${{ matrix.arch }}
|
||||
push: true
|
||||
labels: ${{ steps.debug-meta.outputs.labels }}
|
||||
outputs: type=image,name=${{ inputs.build_image_name }},push-by-digest=true,name-canonical=true,push=true
|
||||
-
|
||||
name: Scratch
|
||||
id: build-scratch
|
||||
uses: docker/build-push-action@v6
|
||||
timeout-minutes: 3
|
||||
with:
|
||||
context: .
|
||||
cache-from: type=gha
|
||||
cache-to: type=gha,mode=max
|
||||
file: build/zitadel/Dockerfile
|
||||
target: final
|
||||
platforms: linux/${{ matrix.arch }}
|
||||
push: true
|
||||
labels: ${{ steps.scratch-meta.outputs.labels }}
|
||||
outputs: type=image,name=${{ inputs.build_image_name }},push-by-digest=true,name-canonical=true,push=true
|
||||
-
|
||||
name: Export debug digest
|
||||
run: |
|
||||
mkdir -p /tmp/digests/debug
|
||||
digest="${{ steps.build-debug.outputs.digest }}"
|
||||
touch "/tmp/digests/debug/${digest#sha256:}"
|
||||
-
|
||||
name: Export scratch digest
|
||||
run: |
|
||||
mkdir -p /tmp/digests/scratch
|
||||
digest="${{ steps.build-scratch.outputs.digest }}"
|
||||
touch "/tmp/digests/scratch/${digest#sha256:}"
|
||||
-
|
||||
name: Upload digest
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: digests-${{ matrix.arch }}
|
||||
path: /tmp/digests
|
||||
if-no-files-found: error
|
||||
retention-days: 1
|
||||
|
||||
merge:
|
||||
runs-on: ubuntu-latest
|
||||
needs:
|
||||
- build
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
image: [scratch, debug]
|
||||
include:
|
||||
- image: scratch
|
||||
suffix: ''
|
||||
- image: debug
|
||||
suffix: '-debug'
|
||||
steps:
|
||||
-
|
||||
name: Download digests
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
pattern: digests-*
|
||||
path: /tmp/digests
|
||||
merge-multiple: true
|
||||
-
|
||||
name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
-
|
||||
name: Login to Docker registry
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
-
|
||||
name: Docker meta
|
||||
id: build-meta
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: '${{ inputs.build_image_name }}'
|
||||
tags: |
|
||||
type=sha,prefix=,suffix=${{ matrix.suffix }},format=long
|
||||
-
|
||||
name: Create build manifest list and push
|
||||
working-directory: /tmp/digests/${{ matrix.image }}
|
||||
run: |
|
||||
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< '${{ steps.build-meta.outputs.json }}') \
|
||||
$(printf '${{ inputs.build_image_name }}@sha256:%s ' *)
|
||||
-
|
||||
name: Inspect build image
|
||||
run: |
|
||||
docker buildx imagetools inspect ${{ inputs.build_image_name }}:${{ github.sha }}${{ matrix.suffix }}
|
||||
|
||||
100
.github/workflows/core-integration-test.yml
vendored
100
.github/workflows/core-integration-test.yml
vendored
@@ -1,100 +0,0 @@
|
||||
name: Integration test core
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
core_cache_key:
|
||||
required: true
|
||||
type: string
|
||||
core_cache_path:
|
||||
required: true
|
||||
type: string
|
||||
secrets:
|
||||
CODECOV_TOKEN:
|
||||
required: true
|
||||
|
||||
jobs:
|
||||
postgres:
|
||||
runs-on:
|
||||
group: zitadel-public
|
||||
services:
|
||||
postgres:
|
||||
image: postgres:17
|
||||
ports:
|
||||
- 5432:5432
|
||||
env:
|
||||
POSTGRES_USER: zitadel
|
||||
PGUSER: zitadel
|
||||
POSTGRES_DB: zitadel
|
||||
POSTGRES_HOST_AUTH_METHOD: trust
|
||||
options: >-
|
||||
--health-cmd pg_isready
|
||||
--health-interval 10s
|
||||
--health-timeout 5s
|
||||
--health-retries 5
|
||||
--health-start-period 10s
|
||||
cache:
|
||||
image: redis:latest
|
||||
ports:
|
||||
- 6379:6379
|
||||
steps:
|
||||
-
|
||||
uses: actions/checkout@v4
|
||||
-
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version-file: 'go.mod'
|
||||
-
|
||||
uses: actions/cache/restore@v4
|
||||
timeout-minutes: 1
|
||||
name: restore core
|
||||
id: restore-core
|
||||
with:
|
||||
path: ${{ inputs.core_cache_path }}
|
||||
key: ${{ inputs.core_cache_key }}
|
||||
fail-on-cache-miss: true
|
||||
-
|
||||
id: go-cache-path
|
||||
name: set cache path
|
||||
run: echo "GO_CACHE_PATH=$(go env GOCACHE)" >> $GITHUB_OUTPUT
|
||||
-
|
||||
uses: actions/cache/restore@v4
|
||||
id: cache
|
||||
timeout-minutes: 1
|
||||
continue-on-error: true
|
||||
name: restore previous results
|
||||
with:
|
||||
key: integration-test-postgres-${{ inputs.core_cache_key }}
|
||||
restore-keys: |
|
||||
integration-test-postgres-core-
|
||||
path: ${{ steps.go-cache-path.outputs.GO_CACHE_PATH }}
|
||||
-
|
||||
name: test
|
||||
if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
env:
|
||||
ZITADEL_MASTERKEY: MasterkeyNeedsToHave32Characters
|
||||
run: make core_integration_test
|
||||
-
|
||||
name: upload server logs
|
||||
if: always()
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: integration-test-server-logs
|
||||
path: |
|
||||
tmp/zitadel.log
|
||||
tmp/race.log.*
|
||||
-
|
||||
name: publish coverage
|
||||
uses: codecov/codecov-action@v4.3.0
|
||||
with:
|
||||
file: profile.cov
|
||||
name: core-integration-tests-postgres
|
||||
flags: core-integration-tests-postgres
|
||||
token: ${{ secrets.CODECOV_TOKEN }}
|
||||
-
|
||||
uses: actions/cache/save@v4
|
||||
name: cache results
|
||||
if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
with:
|
||||
key: integration-test-postgres-${{ inputs.core_cache_key }}
|
||||
path: ${{ steps.go-cache-path.outputs.GO_CACHE_PATH }}
|
||||
73
.github/workflows/core-unit-test.yml
vendored
73
.github/workflows/core-unit-test.yml
vendored
@@ -1,73 +0,0 @@
|
||||
name: Unit test core
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
core_cache_key:
|
||||
required: true
|
||||
type: string
|
||||
core_cache_path:
|
||||
required: true
|
||||
type: string
|
||||
crdb_version:
|
||||
required: false
|
||||
type: string
|
||||
secrets:
|
||||
CODECOV_TOKEN:
|
||||
required: true
|
||||
|
||||
jobs:
|
||||
test:
|
||||
runs-on:
|
||||
group: zitadel-public
|
||||
steps:
|
||||
-
|
||||
uses: actions/checkout@v3
|
||||
-
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version-file: 'go.mod'
|
||||
-
|
||||
uses: actions/cache/restore@v4
|
||||
timeout-minutes: 1
|
||||
name: restore core
|
||||
id: restore-core
|
||||
with:
|
||||
path: ${{ inputs.core_cache_path }}
|
||||
key: ${{ inputs.core_cache_key }}
|
||||
fail-on-cache-miss: true
|
||||
-
|
||||
id: go-cache-path
|
||||
name: set cache path
|
||||
run: echo "GO_CACHE_PATH=$(go env GOCACHE)" >> $GITHUB_OUTPUT
|
||||
-
|
||||
uses: actions/cache/restore@v4
|
||||
id: cache
|
||||
timeout-minutes: 1
|
||||
continue-on-error: true
|
||||
name: restore previous results
|
||||
with:
|
||||
key: unit-test-${{ inputs.core_cache_key }}
|
||||
restore-keys: |
|
||||
unit-test-core-
|
||||
path: ${{ steps.go-cache-path.outputs.GO_CACHE_PATH }}
|
||||
-
|
||||
name: test
|
||||
if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
run: make core_unit_test
|
||||
-
|
||||
name: publish coverage
|
||||
uses: codecov/codecov-action@v4.3.0
|
||||
with:
|
||||
file: profile.cov
|
||||
name: core-unit-tests
|
||||
flags: core-unit-tests
|
||||
token: ${{ secrets.CODECOV_TOKEN }}
|
||||
-
|
||||
uses: actions/cache/save@v4
|
||||
name: cache results
|
||||
if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
with:
|
||||
key: unit-test-${{ inputs.core_cache_key }}
|
||||
path: ${{ steps.go-cache-path.outputs.GO_CACHE_PATH }}
|
||||
|
||||
81
.github/workflows/core.yml
vendored
81
.github/workflows/core.yml
vendored
@@ -1,81 +0,0 @@
|
||||
name: Build core
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
buf_version:
|
||||
required: true
|
||||
type: string
|
||||
node_version:
|
||||
required: true
|
||||
type: string
|
||||
outputs:
|
||||
cache_key:
|
||||
value: ${{ jobs.build.outputs.cache_key }}
|
||||
cache_path:
|
||||
value: ${{ jobs.build.outputs.cache_path }}
|
||||
|
||||
env:
|
||||
cache_path: |
|
||||
internal/statik/statik.go
|
||||
internal/notification/statik/statik.go
|
||||
internal/api/ui/login/static/resources/themes/zitadel/css/zitadel.css*
|
||||
internal/api/ui/login/statik/statik.go
|
||||
internal/api/assets/authz.go
|
||||
internal/api/assets/router.go
|
||||
openapi/v2
|
||||
pkg/grpc/**/*.pb.*
|
||||
pkg/grpc/**/*.connect.go
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on:
|
||||
group: zitadel-public
|
||||
outputs:
|
||||
cache_key: ${{ steps.cache.outputs.cache-primary-key }}
|
||||
cache_path: ${{ env.cache_path }}
|
||||
steps:
|
||||
-
|
||||
uses: actions/checkout@v4
|
||||
-
|
||||
uses: actions/cache/restore@v4
|
||||
timeout-minutes: 1
|
||||
continue-on-error: true
|
||||
id: cache
|
||||
with:
|
||||
key: core-${{ hashFiles( 'go.*', 'openapi', 'cmd', 'pkg/grpc/**/*.go', 'proto', 'internal', 'backend') }}
|
||||
restore-keys: |
|
||||
core-
|
||||
path: ${{ env.cache_path }}
|
||||
-
|
||||
if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
uses: bufbuild/buf-setup-action@v1
|
||||
with:
|
||||
github_token: ${{ github.token }}
|
||||
version: ${{ inputs.buf_version }}
|
||||
|
||||
-
|
||||
# node to install sass
|
||||
if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ inputs.node_version }}
|
||||
-
|
||||
if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
run: npm install -g sass
|
||||
|
||||
-
|
||||
if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version-file: 'go.mod'
|
||||
-
|
||||
if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
run: make core_build
|
||||
-
|
||||
if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
uses: actions/cache/save@v4
|
||||
with:
|
||||
key: ${{ steps.cache.outputs.cache-primary-key }}
|
||||
path: ${{ env.cache_path }}
|
||||
|
||||
61
.github/workflows/docs.yml
vendored
61
.github/workflows/docs.yml
vendored
@@ -1,61 +0,0 @@
|
||||
name: Build docs
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
node_version:
|
||||
required: true
|
||||
type: string
|
||||
buf_version:
|
||||
required: true
|
||||
type: string
|
||||
outputs:
|
||||
cache_key:
|
||||
value: ${{ jobs.build.outputs.cache_key }}
|
||||
cache_path:
|
||||
value: ${{ jobs.build.outputs.cache_path }}
|
||||
|
||||
env:
|
||||
cache_path: docs/build
|
||||
|
||||
jobs:
|
||||
build:
|
||||
outputs:
|
||||
cache_key: ${{ steps.cache.outputs.cache-primary-key }}
|
||||
cache_path: ${{ env.cache_path }}
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/cache/restore@v4
|
||||
timeout-minutes: 1
|
||||
continue-on-error: true
|
||||
id: cache
|
||||
with:
|
||||
key: docs-${{ hashFiles('docs', 'proto', '!docs/build', '!docs/node_modules', '!docs/protoc-gen-connect-openapi') }}
|
||||
restore-keys: |
|
||||
docs-
|
||||
path: ${{ env.cache_path }}
|
||||
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
uses: bufbuild/buf-setup-action@v1
|
||||
with:
|
||||
github_token: ${{ github.token }}
|
||||
version: ${{ inputs.buf_version }}
|
||||
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
uses: pnpm/action-setup@v4
|
||||
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ inputs.node_version }}
|
||||
cache: "pnpm"
|
||||
cache-dependency-path: pnpm-lock.yaml
|
||||
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
name: Install dependencies
|
||||
run: pnpm install
|
||||
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
name: Build docs with Turbo
|
||||
run: pnpm turbo build --filter=./docs
|
||||
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
|
||||
uses: actions/cache/save@v4
|
||||
with:
|
||||
path: ${{ env.cache_path }}
|
||||
key: ${{ steps.cache.outputs.cache-primary-key }}
|
||||
64
.github/workflows/e2e.yml
vendored
64
.github/workflows/e2e.yml
vendored
@@ -1,64 +0,0 @@
|
||||
name: "ZITADEL e2e Tests"
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
|
||||
jobs:
|
||||
test:
|
||||
timeout-minutes: 10
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
browser: [firefox, chrome]
|
||||
runs-on:
|
||||
group: zitadel-public
|
||||
steps:
|
||||
- name: Checkout Repository
|
||||
uses: actions/checkout@v4
|
||||
- uses: actions/download-artifact@v4
|
||||
with:
|
||||
path: .artifacts
|
||||
name: zitadel-linux-amd64
|
||||
- name: Unpack executable
|
||||
run: |
|
||||
tar -xvf .artifacts/zitadel-linux-amd64.tar.gz
|
||||
mv zitadel-linux-amd64/zitadel ./zitadel
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
- uses: pnpm/action-setup@v4
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 20
|
||||
cache: "pnpm"
|
||||
cache-dependency-path: pnpm-lock.yaml
|
||||
- name: Install dependencies
|
||||
run: pnpm install
|
||||
- name: Install Cypress binary
|
||||
run: cd ./e2e && pnpm exec cypress install
|
||||
- name: Start DB and ZITADEL
|
||||
run: |
|
||||
cd ./e2e
|
||||
ZITADEL_IMAGE=zitadel:local docker compose up --detach --wait
|
||||
- name: Cypress run
|
||||
uses: cypress-io/github-action@v6
|
||||
env:
|
||||
CYPRESS_BASE_URL: http://localhost:8080/ui/console
|
||||
CYPRESS_WEBHOOK_HANDLER_HOST: host.docker.internal
|
||||
CYPRESS_DATABASE_CONNECTION_URL: "postgresql://root@localhost:26257/zitadel"
|
||||
CYPRESS_BACKEND_URL: http://localhost:8080
|
||||
with:
|
||||
working-directory: e2e
|
||||
browser: ${{ matrix.browser }}
|
||||
config-file: cypress.config.ts
|
||||
install: false
|
||||
- uses: actions/upload-artifact@v4
|
||||
if: always()
|
||||
with:
|
||||
name: production-tests-${{ matrix.browser }}
|
||||
path: |
|
||||
e2e/cypress/screenshots
|
||||
e2e/cypress/videos
|
||||
e2e/cypress/results
|
||||
retention-days: 30
|
||||
93
.github/workflows/lint.yml
vendored
93
.github/workflows/lint.yml
vendored
@@ -1,93 +0,0 @@
|
||||
name: Lint
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
node_version:
|
||||
required: true
|
||||
type: string
|
||||
buf_version:
|
||||
required: true
|
||||
type: string
|
||||
go_lint_version:
|
||||
required: true
|
||||
type: string
|
||||
core_cache_key:
|
||||
required: true
|
||||
type: string
|
||||
core_cache_path:
|
||||
required: true
|
||||
type: string
|
||||
|
||||
jobs:
|
||||
lint-skip:
|
||||
name: lint skip
|
||||
runs-on: ubuntu-latest
|
||||
if: ${{ github.event_name != 'pull_request' }}
|
||||
steps:
|
||||
- name: Lint skip
|
||||
run: |
|
||||
echo "Linting outside of pull requests is skipped"
|
||||
|
||||
api:
|
||||
name: api
|
||||
runs-on: ubuntu-latest
|
||||
continue-on-error: true
|
||||
if: ${{ github.event_name == 'pull_request' }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: bufbuild/buf-setup-action@v1
|
||||
with:
|
||||
version: ${{ inputs.buf_version }}
|
||||
github_token: ${{ secrets.GITHUB_TOKEN }}
|
||||
- name: lint
|
||||
uses: bufbuild/buf-lint-action@v1
|
||||
- uses: bufbuild/buf-breaking-action@v1
|
||||
with:
|
||||
against: "https://github.com/${{ github.repository }}.git#branch=${{ github.base_ref }}"
|
||||
|
||||
turbo-lint-unit:
|
||||
if: ${{ github.event_name == 'pull_request' }}
|
||||
name: turbo-lint-unit
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
- name: Install Dev Container CLI
|
||||
run: npm install -g @devcontainers/cli@0.80.0
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
- name: Lint and Unit Test All JavaScript Code
|
||||
run: npm run devcontainer:lint-unit
|
||||
- name: Fix Failures
|
||||
if: failure()
|
||||
run: |
|
||||
echo "Reproduce this check locally:"
|
||||
echo "npm run devcontainer:lint-unit"
|
||||
echo "If you have pnpm installed, most linting errors can be fixed automatically:"
|
||||
echo "pnpm turbo lint:fix"
|
||||
echo "In other cases, you can open the dev container called \"Turbo Lint and Unit Tests\"."
|
||||
echo "You will have the same environment as the pipeline check as well as some guidance on how to fix the errors."
|
||||
|
||||
core:
|
||||
name: core
|
||||
runs-on: ubuntu-latest
|
||||
if: ${{ github.event_name == 'pull_request' }}
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
- uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version-file: "go.mod"
|
||||
- uses: actions/cache/restore@v4
|
||||
timeout-minutes: 1
|
||||
name: restore core
|
||||
with:
|
||||
path: ${{ inputs.core_cache_path }}
|
||||
key: ${{ inputs.core_cache_key }}
|
||||
fail-on-cache-miss: true
|
||||
- uses: golangci/golangci-lint-action@v8
|
||||
with:
|
||||
version: ${{ inputs.go_lint_version }}
|
||||
github-token: ${{ github.token }}
|
||||
only-new-issues: true
|
||||
98
.github/workflows/lint_test_build.yml
vendored
Normal file
98
.github/workflows/lint_test_build.yml
vendored
Normal file
@@ -0,0 +1,98 @@
|
||||
name: Lint Test Build
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
node_version:
|
||||
required: true
|
||||
type: string
|
||||
secrets:
|
||||
CODECOV_TOKEN:
|
||||
required: true
|
||||
NX_CLOUD_ACCESS_TOKEN_READONLY:
|
||||
required: true
|
||||
|
||||
jobs:
|
||||
lint_test_build:
|
||||
name: Lint, Test and Build
|
||||
runs-on: depot-ubuntu-22.04-16
|
||||
environment: ${{ github.ref_protected == 'true' && 'Protected' || null }}
|
||||
steps:
|
||||
- name: Checkout Repository
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
filter: tree:0
|
||||
- name: Fetch main branch
|
||||
run: git fetch origin main:main
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version-file: 'go.mod'
|
||||
- name: Set up pnpm
|
||||
uses: pnpm/action-setup@v4
|
||||
with:
|
||||
run_install: false
|
||||
- name: Set up Node.js
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ inputs.node_version }}
|
||||
cache: "pnpm"
|
||||
- name: Set up Docker
|
||||
uses: docker/setup-docker-action@v4
|
||||
with:
|
||||
version: v28.3.2
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
with:
|
||||
version: v0.28.0
|
||||
- name: Set up Docker Compose
|
||||
uses: docker/setup-compose-action@v1
|
||||
with:
|
||||
version: v2.38.2
|
||||
- name: Install dependencies
|
||||
run: pnpm install --frozen-lockfile
|
||||
- name: Install Cypress binary
|
||||
run: pnpm cypress install
|
||||
working-directory: apps/login
|
||||
- name: Set SHAs for nx affected commands
|
||||
uses: nrwl/nx-set-shas@v4
|
||||
- name: Lint, Test and Build
|
||||
env:
|
||||
NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }}
|
||||
run: pnpm nx affected --nxBail --targets lint test build --exclude @zitadel/docs
|
||||
- name: Suggest Pipeline Fix By Nx Cloud AI
|
||||
if: failure() || cancelled()
|
||||
env:
|
||||
NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }}
|
||||
run: pnpm nx fix-ci
|
||||
- name: Publish API Unit Test Coverage
|
||||
uses: codecov/codecov-action@v4.3.0
|
||||
with:
|
||||
file: profile.api.test-unit.cov
|
||||
name: api-test-unit
|
||||
flags: api-test-unit
|
||||
token: ${{ secrets.CODECOV_TOKEN }}
|
||||
- name: Publish API Integration Test Coverage
|
||||
uses: codecov/codecov-action@v4.3.0
|
||||
with:
|
||||
file: profile.api.test-integration.cov
|
||||
name: api-test-integration
|
||||
flags: api-test-integration
|
||||
token: ${{ secrets.CODECOV_TOKEN }}
|
||||
- name: Upload API Integration Test Race Logs
|
||||
if: failure() || cancelled()
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: api-integration-test-race-logs
|
||||
path: |
|
||||
.artifacts/api-test-integration/race.log.*
|
||||
- name: Upload Functional UI Test Artifacts
|
||||
uses: actions/upload-artifact@v4
|
||||
if: failure() || cancelled()
|
||||
with:
|
||||
name: functional-ui-tests
|
||||
path: |
|
||||
tests/functional-ui/cypress/screenshots
|
||||
tests/functional-ui/cypress/videos
|
||||
tests/functional-ui/cypress/results
|
||||
69
.github/workflows/login-container.yml
vendored
69
.github/workflows/login-container.yml
vendored
@@ -1,69 +0,0 @@
|
||||
name: Login Container
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
login_build_image_name:
|
||||
description: 'The image repository name of the standalone login image'
|
||||
type: string
|
||||
required: true
|
||||
node_version:
|
||||
required: true
|
||||
type: string
|
||||
outputs:
|
||||
login_build_image:
|
||||
description: 'The full image tag of the standalone login image'
|
||||
value: ${{ inputs.login_build_image_name }}:${{ github.sha }}
|
||||
|
||||
permissions:
|
||||
packages: write
|
||||
|
||||
env:
|
||||
default_labels: |
|
||||
org.opencontainers.image.documentation=https://zitadel.com/docs
|
||||
org.opencontainers.image.vendor=CAOS AG
|
||||
org.opencontainers.image.licenses=MIT
|
||||
|
||||
jobs:
|
||||
login-container:
|
||||
name: Build Login Container
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
packages: write
|
||||
outputs:
|
||||
login_build_image: ${{ steps.short-sha.outputs.login_build_image }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Login meta
|
||||
id: login-meta
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: ${{ inputs.login_build_image_name }}
|
||||
labels: ${{ env.default_labels}}
|
||||
annotations: |
|
||||
manifest:org.opencontainers.image.licenses=MIT
|
||||
tags: |
|
||||
type=sha,prefix=,format=long
|
||||
- name: Login to Docker registry
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
- name: Set up Docker Buildx
|
||||
id: setup-buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
- name: Bake login multi-arch
|
||||
uses: docker/bake-action@v6
|
||||
env:
|
||||
NODE_VERSION: ${{ inputs.node_version }}
|
||||
with:
|
||||
source: .
|
||||
push: true
|
||||
provenance: true
|
||||
targets: login-standalone
|
||||
files: |
|
||||
./apps/login/docker-bake.hcl
|
||||
${{ github.event_name == 'workflow_dispatch' && './apps/login/docker-bake-release.hcl' || '' }}
|
||||
./docker-bake.hcl
|
||||
cwd://${{ steps.login-meta.outputs.bake-file }}
|
||||
58
.github/workflows/login-integration-test.yml
vendored
58
.github/workflows/login-integration-test.yml
vendored
@@ -1,58 +0,0 @@
|
||||
name: Integration test core
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
login_build_image:
|
||||
required: true
|
||||
type: string
|
||||
|
||||
permissions:
|
||||
packages: write
|
||||
|
||||
jobs:
|
||||
login-integration-test:
|
||||
name: login-integration-test
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
- name: Install Dev Container CLI
|
||||
run: npm install -g @devcontainers/cli@0.80.0
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
- name: Pull Login Build Image
|
||||
run: docker compose --file .devcontainer/login-integration/docker-compose.yaml pull
|
||||
env:
|
||||
LOGIN_TAG: ${{ inputs.login_build_image }}
|
||||
- name: Run Integration Tests against the Login and a Mocked Zitadel API
|
||||
run: npm run devcontainer:integration:login
|
||||
env:
|
||||
LOGIN_TAG: ${{ inputs.login_build_image }}
|
||||
DOCKER_BUILDKIT: 1
|
||||
- name: Fix Failures
|
||||
if: failure()
|
||||
run: |
|
||||
echo "Reproduce this check locally:"
|
||||
echo "LOGIN_TAG=${{ inputs.login_build_image }} npm run devcontainer:integration:login"
|
||||
echo "To fix the failures, open the dev container called \"Login Integration Tests\"."
|
||||
echo "You will have the same environment as the pipeline check as well as some guidance on how to fix the errors."
|
||||
- name: Show Compose Status
|
||||
if: failure()
|
||||
run: docker compose --file .devcontainer/base/docker-compose.yaml --file .devcontainer/login-integration/docker-compose.yaml ps
|
||||
- name: Print Config
|
||||
if: failure()
|
||||
run: COMPOSE_BAKE=1 docker compose --file .devcontainer/base/docker-compose.yaml --file .devcontainer/login-integration/docker-compose.yaml config login-integration
|
||||
env:
|
||||
LOGIN_TAG: ${{ inputs.login_build_image }}
|
||||
- name: Show Container Logs
|
||||
if: failure()
|
||||
run: docker compose --file .devcontainer/base/docker-compose.yaml --file .devcontainer/login-integration/docker-compose.yaml logs --timestamps --no-color --tail 100 login-integration
|
||||
- name: Inspect All Failed Containers
|
||||
if: failure()
|
||||
run: |
|
||||
docker ps -a --filter "status=exited" --filter "status=created" --format "table {{.ID}}\t{{.Names}}\t{{.Status}}\t{{.Image}}"
|
||||
for container in $(docker ps -a --filter "status=exited" --filter "status=created" -q); do
|
||||
echo "Inspecting container $container"
|
||||
docker inspect $container || true
|
||||
done
|
||||
177
.github/workflows/pack.yml
vendored
Normal file
177
.github/workflows/pack.yml
vendored
Normal file
@@ -0,0 +1,177 @@
|
||||
name: Package und Publish Archives and Images
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
node_version:
|
||||
required: true
|
||||
type: string
|
||||
image_name_github_api:
|
||||
required: true
|
||||
type: string
|
||||
image_name_github_login:
|
||||
required: true
|
||||
type: string
|
||||
image_name_google_api:
|
||||
required: true
|
||||
type: string
|
||||
image_name_google_login:
|
||||
required: true
|
||||
type: string
|
||||
semantic_version:
|
||||
required: false
|
||||
type: string
|
||||
secrets:
|
||||
GCR_JSON_KEY_BASE64:
|
||||
description: 'base64 endcrypted key to connect to Google'
|
||||
required: true
|
||||
|
||||
permissions:
|
||||
packages: write
|
||||
|
||||
env:
|
||||
default_labels: |
|
||||
org.opencontainers.image.documentation=https://zitadel.com/docs
|
||||
org.opencontainers.image.vendor=ZITADEL
|
||||
|
||||
jobs:
|
||||
version:
|
||||
uses: ./.github/workflows/version.yml
|
||||
with:
|
||||
semantic_version: ${{ inputs.semantic_version }}
|
||||
dry_run: true
|
||||
|
||||
pack:
|
||||
runs-on:
|
||||
group: zitadel-public
|
||||
environment: ${{ github.ref_protected == 'true' && 'Protected' || null }}
|
||||
needs: version
|
||||
steps:
|
||||
- name: Checkout Repository
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
filter: tree:0
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version-file: 'go.mod'
|
||||
- name: Set up pnpm
|
||||
uses: pnpm/action-setup@v4
|
||||
with:
|
||||
run_install: false
|
||||
- name: Set up Node.js
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ inputs.node_version }}
|
||||
cache: "pnpm"
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
with:
|
||||
version: v0.28.0
|
||||
- name: Install dependencies
|
||||
run: pnpm install --frozen-lockfile
|
||||
- name: Pack API and Login
|
||||
env:
|
||||
ZITADEL_VERSION: ${{ needs.version.outputs.version }}
|
||||
NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }}
|
||||
run: pnpm nx run --nxBail pack
|
||||
- name: Suggest Pipeline Fix By Nx Cloud AI
|
||||
if: always()
|
||||
env:
|
||||
NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }}
|
||||
run: pnpm nx fix-ci
|
||||
- name: Upload all platform archives
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: zitadel-archives
|
||||
path: .artifacts/pack
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
- name: Login to Docker registry
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
- name: Login to Google Artifact Registry
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: europe-docker.pkg.dev
|
||||
username: _json_key_base64
|
||||
password: ${{ secrets.GCR_JSON_KEY_BASE64 }}
|
||||
- name: Generate Standard Tags and Labels from the GitHub Context for the API Scratch Container Image
|
||||
id: scratch-meta
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: |
|
||||
${{ inputs.image_name_github_api }}
|
||||
${{ inputs.image_name_google_api }}
|
||||
labels: ${{ env.default_labels}}
|
||||
tags: |
|
||||
type=sha,prefix=,suffix=,format=long
|
||||
- name: Build and Push the SHA-tagged API Scratch Container Image
|
||||
id: build-scratch
|
||||
uses: docker/build-push-action@v6
|
||||
timeout-minutes: 3
|
||||
with:
|
||||
context: .
|
||||
cache-from: type=gha
|
||||
cache-to: type=gha,mode=max
|
||||
file: apps/api/Dockerfile
|
||||
target: final
|
||||
platforms: linux/amd64,linux/arm64
|
||||
push: true
|
||||
labels: ${{ steps.scratch-meta.outputs.labels }}
|
||||
tags: ${{ steps.scratch-meta.outputs.tags }}
|
||||
- name: Generate Standard Tags and Labels from the GitHub Context for the API Debug Container Image
|
||||
id: debug-meta
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: |
|
||||
${{ inputs.image_name_github_api }}
|
||||
${{ inputs.image_name_google_api }}
|
||||
labels: ${{ env.default_labels}}
|
||||
tags: |
|
||||
type=sha,prefix=,suffix=-debug,format=long
|
||||
- name: Build and Push the SHA-tagged API Debug Container Image
|
||||
id: build-debug
|
||||
uses: docker/build-push-action@v6
|
||||
timeout-minutes: 5
|
||||
with:
|
||||
context: .
|
||||
cache-from: type=gha
|
||||
cache-to: type=gha,mode=max
|
||||
file: apps/api/Dockerfile
|
||||
target: builder
|
||||
platforms: linux/amd64,linux/arm64
|
||||
push: true
|
||||
labels: ${{ steps.debug-meta.outputs.labels }}
|
||||
tags: ${{ steps.debug-meta.outputs.tags }}
|
||||
outputs: type=image,name=${{ inputs.image_name_github_api }},name-canonical=true
|
||||
- name: Generate Standard Tags and Labels from the GitHub Context for the Login Container Image
|
||||
id: login-meta
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: |
|
||||
${{ inputs.image_name_github_login }}
|
||||
${{ inputs.image_name_google_login }}
|
||||
labels: |
|
||||
org.opencontainers.image.licenses=MIT
|
||||
${{ env.default_labels}}
|
||||
tags: |
|
||||
type=sha,prefix=,suffix=,format=long
|
||||
- name: Build and Push the SHA-tagged Login Container Image
|
||||
id: build-login
|
||||
uses: docker/build-push-action@v6
|
||||
timeout-minutes: 3
|
||||
with:
|
||||
context: apps/login
|
||||
cache-from: type=gha
|
||||
cache-to: type=gha,mode=max
|
||||
platforms: linux/amd64,linux/arm64
|
||||
push: true
|
||||
labels: ${{ steps.login-meta.outputs.labels }}
|
||||
tags: ${{ steps.login-meta.outputs.tags }}
|
||||
79
.github/workflows/release.yml
vendored
79
.github/workflows/release.yml
vendored
@@ -6,22 +6,16 @@ on:
|
||||
semantic_version:
|
||||
required: true
|
||||
type: string
|
||||
build_image_name:
|
||||
image_name_github_api:
|
||||
required: true
|
||||
type: string
|
||||
image_name:
|
||||
image_name_google_api:
|
||||
required: true
|
||||
type: string
|
||||
google_image_name:
|
||||
image_name_github_login:
|
||||
required: true
|
||||
type: string
|
||||
build_image_name_login:
|
||||
required: true
|
||||
type: string
|
||||
image_name_login:
|
||||
required: true
|
||||
type: string
|
||||
google_image_name_login:
|
||||
image_name_google_login:
|
||||
required: true
|
||||
type: string
|
||||
secrets:
|
||||
@@ -47,7 +41,8 @@ jobs:
|
||||
# https://docs.github.com/en/rest/releases/releases?apiVersion=2022-11-28#create-a-release--parameters
|
||||
publish:
|
||||
runs-on: ubuntu-22.04
|
||||
needs: [ version ]
|
||||
needs: version
|
||||
if: needs.version.outputs.published == 'true'
|
||||
steps:
|
||||
- id: get_release
|
||||
uses: cardinalby/git-get-release-action@v1
|
||||
@@ -72,6 +67,7 @@ jobs:
|
||||
docker:
|
||||
runs-on: ubuntu-22.04
|
||||
needs: [ version ]
|
||||
if: needs.version.outputs.published == 'true'
|
||||
steps:
|
||||
-
|
||||
name: Set up QEMU
|
||||
@@ -97,38 +93,38 @@ jobs:
|
||||
name: Publish ${{ needs.version.outputs.version }}
|
||||
run: |
|
||||
docker buildx imagetools create \
|
||||
--tag ${{ inputs.image_name }}:${{ needs.version.outputs.version }} \
|
||||
${{ inputs.build_image_name }}
|
||||
--tag ${{ inputs.image_name_github_api }}:${{ needs.version.outputs.version }} \
|
||||
${{ inputs.image_name_github_api }}:${{ github.sha }}
|
||||
docker buildx imagetools create \
|
||||
--tag ${{ inputs.image_name }}:${{ needs.version.outputs.version }}-debug \
|
||||
${{ inputs.build_image_name }}-debug
|
||||
--tag ${{ inputs.image_name_github_api }}:${{ needs.version.outputs.version }}-debug \
|
||||
${{ inputs.image_name_github_api }}:${{ github.sha }}-debug
|
||||
docker buildx imagetools create \
|
||||
--tag ${{ inputs.google_image_name }}:${{ needs.version.outputs.version }} \
|
||||
${{ inputs.build_image_name }}
|
||||
--tag ${{ inputs.image_name_google_api }}:${{ needs.version.outputs.version }} \
|
||||
${{ inputs.image_name_google_api }}:${{ github.sha }}
|
||||
docker buildx imagetools create \
|
||||
--tag ${{ inputs.image_name_login }}:${{ needs.version.outputs.version }} \
|
||||
${{ inputs.build_image_name_login }}
|
||||
--tag ${{ inputs.image_name_github_login }}:${{ needs.version.outputs.version }} \
|
||||
${{ inputs.image_name_github_login }}:${{ github.sha }}
|
||||
docker buildx imagetools create \
|
||||
--tag ${{ inputs.google_image_name_login }}:${{ needs.version.outputs.version }} \
|
||||
${{ inputs.build_image_name_login }}
|
||||
--tag ${{ inputs.image_name_google_login }}:${{ needs.version.outputs.version }} \
|
||||
${{ inputs.image_name_google_login }}:${{ github.sha }}
|
||||
-
|
||||
name: Publish latest
|
||||
if: ${{ github.ref_name == 'next' }}
|
||||
run: |
|
||||
docker buildx imagetools create \
|
||||
--tag ${{ inputs.image_name }}:latest \
|
||||
${{ inputs.build_image_name }}
|
||||
--tag ${{ inputs.image_name_github_api }}:latest \
|
||||
${{ inputs.image_name_github_api }}:${{ github.sha }}
|
||||
docker buildx imagetools create \
|
||||
--tag ${{ inputs.image_name }}:latest-debug \
|
||||
${{ inputs.build_image_name }}-debug
|
||||
--tag ${{ inputs.image_name_github_api }}:latest-debug \
|
||||
${{ inputs.image_name_github_api }}:${{ github.sha }}-debug
|
||||
docker buildx imagetools create \
|
||||
--tag ${{ inputs.image_name_login }}:latest \
|
||||
${{ inputs.build_image_name_login }}
|
||||
--tag ${{ inputs.image_name_github_login }}:latest \
|
||||
${{ inputs.image_name_github_login }}:${{ github.sha }}
|
||||
|
||||
homebrew-tap:
|
||||
runs-on: ubuntu-22.04
|
||||
needs: version
|
||||
if: ${{ github.ref_name == 'next' }}
|
||||
if: needs.version.outputs.published == 'true' && github.ref_name == 'next'
|
||||
continue-on-error: true
|
||||
steps:
|
||||
- name: generate token
|
||||
@@ -148,7 +144,7 @@ jobs:
|
||||
helm-chart:
|
||||
runs-on: ubuntu-22.04
|
||||
needs: version
|
||||
if: ${{ github.ref_name == 'next' }}
|
||||
if: needs.version.outputs.published == 'true' && github.ref_name == 'next'
|
||||
continue-on-error: true
|
||||
steps:
|
||||
- name: generate token
|
||||
@@ -168,7 +164,7 @@ jobs:
|
||||
npm-packages:
|
||||
runs-on: ubuntu-latest
|
||||
needs: version
|
||||
if: ${{ github.ref_name == 'next' }}
|
||||
if: needs.version.outputs.published == 'true' && github.ref_name == 'next'
|
||||
continue-on-error: true
|
||||
steps:
|
||||
- name: Checkout code
|
||||
@@ -194,26 +190,3 @@ jobs:
|
||||
version: ${{ needs.version.outputs.version }}
|
||||
cwd: packages
|
||||
createGithubReleases: false
|
||||
|
||||
login-repo:
|
||||
runs-on: ubuntu-latest
|
||||
needs: version
|
||||
if: ${{ github.ref_name == 'next' }}
|
||||
continue-on-error: true
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
- name: Push Subtree
|
||||
run: make login_push LOGIN_REMOTE_BRANCH=mirror-zitadel-repo
|
||||
- name: Create Pull Request
|
||||
uses: peter-evans/create-pull-request@v7
|
||||
with:
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
commit-message: 'chore: mirror zitadel repo'
|
||||
branch: mirror-zitadel-repo
|
||||
title: 'chore: mirror zitadel repo'
|
||||
body: 'This PR updates the login repository with the latest changes from the zitadel repository.'
|
||||
base: main
|
||||
reviewers: |
|
||||
@peintnermax
|
||||
@eliobischof
|
||||
|
||||
13
.github/workflows/version.yml
vendored
13
.github/workflows/version.yml
vendored
@@ -11,12 +11,12 @@ on:
|
||||
type: boolean
|
||||
outputs:
|
||||
version:
|
||||
value: ${{ jobs.generate.outputs.version }}
|
||||
value: ${{ jobs.semantic.outputs.version }}
|
||||
published:
|
||||
value: ${{jobs.generate.outputs.published }}
|
||||
value: ${{jobs.semantic.outputs.published }}
|
||||
|
||||
jobs:
|
||||
generate:
|
||||
semantic:
|
||||
runs-on: ubuntu-22.04
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
@@ -25,16 +25,17 @@ jobs:
|
||||
published: ${{ steps.semantic.outputs.new_release_published }}
|
||||
steps:
|
||||
-
|
||||
name: Source checkout
|
||||
name: Checkout Repository
|
||||
uses: actions/checkout@v4
|
||||
-
|
||||
name: Download Artifacts
|
||||
uses: actions/download-artifact@v4
|
||||
if: ${{ !inputs.dry_run }}
|
||||
with:
|
||||
path: .artifacts
|
||||
pattern: "{checksums.txt,zitadel-*}"
|
||||
-
|
||||
name: Semantic Release
|
||||
name: Run Semantic Release
|
||||
uses: cycjimmy/semantic-release-action@v4
|
||||
id: semantic
|
||||
env:
|
||||
@@ -46,7 +47,7 @@ jobs:
|
||||
@semantic-release/exec@6.0.3
|
||||
@semantic-release/github@10.0.2
|
||||
-
|
||||
name: output
|
||||
name: Output Version For Dependent Workflows
|
||||
id: output
|
||||
run:
|
||||
if [[ ! -z "${{ steps.semantic.outputs.new_release_version }}" ]]; then echo "VERSION=v${{ steps.semantic.outputs.new_release_version }}" >> "$GITHUB_OUTPUT"; else echo "VERSION=${{ github.sha }}" >> "$GITHUB_OUTPUT";fi
|
||||
|
||||
Reference in New Issue
Block a user