diff --git a/.github/workflows/_build-rs.yml b/.github/workflows/_build-rs.yml index 5261a9e7..88f1aa8d 100644 --- a/.github/workflows/_build-rs.yml +++ b/.github/workflows/_build-rs.yml @@ -63,6 +63,25 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: ref: ${{ github.event.pull_request.head.sha }} + # Both are I/O bound and independent of the toolchain setup below, so + # overlap them with it; `wait-all` joins them before the build. + - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4 + background: true + with: + path: | + ~/.cargo/registry + ~/.cargo/git + cache/ + key: target-cache-${{ matrix.platform }}-${{ hashFiles('**/Cargo.lock') }}-${{ matrix.target }} + restore-keys: | + target-cache-${{ matrix.platform }}-${{ hashFiles('**/Cargo.lock') }}- + target-cache-${{ matrix.platform }}- + # Only rust-toolchain.toml is read from the build context, so the cache + # restore writing into cache/ concurrently is harmless. + - name: Build builder image + if: startsWith(matrix.platform, 'ubuntu') + background: true + run: make containers/builder/build - if: ${{ matrix.target == 'ak-agent-desktop' }} uses: pnpm/action-setup@v6.1.0 with: @@ -99,19 +118,7 @@ jobs: ~/.rustup/toolchains ~/.rustup/update-hashes key: rustup-toolchain-${{ matrix.platform }}-${{ hashFiles('rust-toolchain.toml') }} - - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4 - with: - path: | - ~/.cargo/registry - ~/.cargo/git - cache/ - key: target-cache-${{ matrix.platform }}-${{ hashFiles('**/Cargo.lock') }}-${{ matrix.target }} - restore-keys: | - target-cache-${{ matrix.platform }}-${{ hashFiles('**/Cargo.lock') }}- - target-cache-${{ matrix.platform }}- - - name: Build builder image - if: startsWith(matrix.platform, 'ubuntu') - run: make containers/builder/build + - wait-all: - run: | make ${{ matrix.target }}/build env: diff --git a/.github/workflows/_deploy.yml b/.github/workflows/_deploy.yml index 12300041..429414a2 100644 --- a/.github/workflows/_deploy.yml +++ b/.github/workflows/_deploy.yml @@ -17,11 +17,12 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 with: ref: ${{ github.event.pull_request.head.sha }} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - path: ./bin - - run: | - sudo apt-get remove --purge man-db + - parallel: + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + path: ./bin + - run: | + sudo apt-get remove --purge man-db - uses: ./.github/actions/repo id: repo with: diff --git a/.github/workflows/_package-darwin.yml b/.github/workflows/_package-darwin.yml index f3ff1689..2084a03a 100644 --- a/.github/workflows/_package-darwin.yml +++ b/.github/workflows/_package-darwin.yml @@ -16,26 +16,27 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 with: ref: ${{ github.event.pull_request.head.sha }} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_macos-26_ak-agent-desktop - path: bin/ - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_macos-26_ak-cli - path: bin/ - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_macos-26_ak-sysd - path: bin/ - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_macos-26_ak-browser-support - path: bin/ - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_xcode-27_psso - path: bin/ + - parallel: + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_macos-26_ak-agent-desktop + path: bin/ + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_macos-26_ak-cli + path: bin/ + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_macos-26_ak-sysd + path: bin/ + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_macos-26_ak-browser-support + path: bin/ + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_xcode-27_psso + path: bin/ - id: check env: diff --git a/.github/workflows/_package-linux.yml b/.github/workflows/_package-linux.yml index dbf4db19..18356b2c 100644 --- a/.github/workflows/_package-linux.yml +++ b/.github/workflows/_package-linux.yml @@ -26,38 +26,39 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 with: ref: ${{ github.event.pull_request.head.sha }} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_${{ matrix.platform }}_ak-cli${{ inputs.artifact_suffix }} - path: bin/ - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_${{ matrix.platform }}_ak-agent${{ inputs.artifact_suffix }} - path: bin/ - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_${{ matrix.platform }}_ak-agent-desktop${{ inputs.artifact_suffix }} - path: bin/ - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_${{ matrix.platform }}_ak-sysd${{ inputs.artifact_suffix }} - path: bin/ - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_${{ matrix.platform }}_ak-browser-support${{ inputs.artifact_suffix }} - path: bin/ - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_${{ matrix.platform }}_ak-nss${{ inputs.artifact_suffix }} - path: bin/ - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_${{ matrix.platform }}_ak-pam${{ inputs.artifact_suffix }} - path: bin/ - - run: | - echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list - sudo apt update - sudo apt install nfpm -y + - parallel: + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_${{ matrix.platform }}_ak-cli${{ inputs.artifact_suffix }} + path: bin/ + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_${{ matrix.platform }}_ak-agent${{ inputs.artifact_suffix }} + path: bin/ + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_${{ matrix.platform }}_ak-agent-desktop${{ inputs.artifact_suffix }} + path: bin/ + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_${{ matrix.platform }}_ak-sysd${{ inputs.artifact_suffix }} + path: bin/ + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_${{ matrix.platform }}_ak-browser-support${{ inputs.artifact_suffix }} + path: bin/ + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_${{ matrix.platform }}_ak-nss${{ inputs.artifact_suffix }} + path: bin/ + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_${{ matrix.platform }}_ak-pam${{ inputs.artifact_suffix }} + path: bin/ + - run: | + echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list + sudo apt update + sudo apt install nfpm -y - shell: bash run: make vpkg/linux/package env: diff --git a/.github/workflows/_package-windows.yml b/.github/workflows/_package-windows.yml index c4a31524..b4e9afd1 100644 --- a/.github/workflows/_package-windows.yml +++ b/.github/workflows/_package-windows.yml @@ -16,28 +16,28 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 with: ref: ${{ github.event.pull_request.head.sha }} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_windows-2025_ak-agent-desktop - path: bin/ - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_windows-2025_ak-cli - path: bin/ - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_windows-2025_ak-sysd - path: bin/ - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_windows-2025_ak-browser-support - path: bin/ - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_windows-2025_ee-wcp - path: bin/ - - - uses: digicert/code-signing-software-trust-action@v1 + - parallel: + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_windows-2025_ak-agent-desktop + path: bin/ + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_windows-2025_ak-cli + path: bin/ + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_windows-2025_ak-sysd + path: bin/ + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_windows-2025_ak-browser-support + path: bin/ + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_windows-2025_ee-wcp + path: bin/ + - uses: digicert/code-signing-software-trust-action@v1 - shell: bash run: | echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12 diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index b870a243..d351faf7 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -180,6 +180,7 @@ jobs: with: product: platform new-version: ${{ steps.get-version.outputs.version }} + changelog-url: ${{ github.event.release.html_url }} reason: bugfix token: ${{ steps.app-token.outputs.token }} github-app-slug: ${{ steps.app-token.outputs.app-slug }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index f294c9e3..b14f1118 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -59,16 +59,19 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 with: ref: ${{ github.event.pull_request.head.sha }} - - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 - with: - rustflags: "" - build-warnings: warn + - parallel: + - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 + with: + rustflags: "" + build-warnings: warn + - uses: ./.github/actions/setup-toolchain + with: + platform: ${{ matrix.platform }} + # install-action writes ~/.cargo/bin, which the toolchain's rust-cache + # snapshots and restores, so it must not overlap with it. - uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2 with: tool: cargo-llvm-cov nextest - - uses: ./.github/actions/setup-toolchain - with: - platform: ${{ matrix.platform }} - run: | make ${{ matrix.target }}/test env: @@ -136,11 +139,12 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 with: ref: ${{ github.event.pull_request.head.sha }} - - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 - with: - rustflags: "" - build-warnings: warn - - run: make ci-install-deps + - parallel: + - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 + with: + rustflags: "" + build-warnings: warn + - run: make ci-install-deps - uses: ./.github/actions/setup-toolchain with: platform: ${{ matrix.platform }} @@ -197,50 +201,54 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 with: ref: ${{ github.event.pull_request.head.sha }} - - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 - with: - rustflags: "" - build-warnings: warn + - parallel: + - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 + with: + rustflags: "" + build-warnings: warn + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_package-linux-ubuntu-26.04-e2e + path: bin/ + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_ubuntu-26.04_ak-agent-e2e + path: bin/ + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_ubuntu-26.04_ak-cli-e2e + path: bin/ + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_ubuntu-26.04_ak-nss-e2e + path: bin/ + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 + with: + name: authentik_ubuntu-26.04_ak-pam-e2e + path: bin/ + # see test_rs: must not overlap with setup-rust-toolchain - uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2 with: tool: cargo-llvm-cov nextest - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_package-linux-ubuntu-26.04-e2e - path: bin/ - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_ubuntu-26.04_ak-agent-e2e - path: bin/ - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_ubuntu-26.04_ak-cli-e2e - path: bin/ - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_ubuntu-26.04_ak-nss-e2e - path: bin/ - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6 - with: - name: authentik_ubuntu-26.04_ak-pam-e2e - path: bin/ - run: chmod +x bin/agent/ak-agent bin/cli/ak bin/sysd/ak-sysd - - uses: goauthentik/action-setup-authentik@5b35e5951a1ec761847711a5d8170dbd67675526 # v3.3 - id: setup - with: - version: beta - sentry_env: goauthentik-platform-ci - blueprints_path: ./hack/authentik/blueprints - wait: true - enterprise_license: true - enterprise_license_users_internal: 100 - enterprise_license_users_external: 100 + # authentik startup and the e2e image build are independent; overlap them. + - parallel: + - uses: goauthentik/action-setup-authentik@5b35e5951a1ec761847711a5d8170dbd67675526 # v3.3 + id: setup + with: + version: beta + sentry_env: goauthentik-platform-ci + blueprints_path: ./hack/authentik/blueprints + wait: true + enterprise_license: true + enterprise_license_users_internal: 100 + enterprise_license_users_external: 100 + - run: make containers/e2e/ci-build - env: AK_TOKEN: ${{ steps.setup.outputs.admin_token }} AK_URL: ${{ steps.setup.outputs.http_url }} run: | ./hack/authentik/wait.sh - - run: make containers/e2e/ci-build # AppArmor policy is host-global: and the container cannot load policy of # its own (no securityfs during docker build) - name: Load authentik AppArmor drop-in