feat: update workflows; fix SAML bug; setup Crowdin; add documentation

.envrc

@@ -0,0 +1,17 @@
+# direnv configuration for hcp-casdoor
+# Sets up Go paths and installs dependencies on first enter
+export GOPATH="${GOPATH:-$HOME/go}"
+export GOBIN="${GOBIN:-$GOPATH/bin}"
+export PATH="$GOBIN:$PATH"
+
+# Fetch Go modules (best-effort)
+if command -v go >/dev/null 2>&1 && [ -f go.mod ]; then
+  go mod download || true
+fi
+
+# Install web dependencies only if yarn is available and node_modules missing
+if command -v yarn >/dev/null 2>&1 && [ ! -d web/node_modules ]; then
+  (cd web && yarn install --frozen-lockfile --network-timeout 1000000) || true
+fi
+
+# You may run `direnv allow` to authorize this file (this is done automatically by the workflow below)

.github/workflows/bootstrap-ecr.yml

@@ -0,0 +1,180 @@
+name: Bootstrap ECR
+
+on:
+  workflow_dispatch:
+    inputs:
+      integration_role_arn:
+        description: Integration AWS role ARN used by Doormat
+        type: string
+        required: false
+        default: arn:aws:iam::995429640676:role/DoormatGithubActionsRole
+      production_role_arn:
+        description: Production AWS role ARN used by Doormat
+        type: string
+        required: false
+        default: arn:aws:iam::877995958936:role/DoormatAdminRole
+
+permissions:
+  contents: read
+  id-token: write
+
+env:
+  AWS_REGION: "us-east-2"
+  ECR_STANDARD_REPOSITORY: "casdoor"
+  ECR_ALL_IN_ONE_REPOSITORY: "casdoor-all-in-one"
+
+jobs:
+  bootstrap-integration:
+    name: Bootstrap Integration ECR
+    runs-on: ubuntu-latest
+    env:
+      ACCOUNT_ID: "995429640676"
+      ROLE_ARN: ${{ inputs.integration_role_arn }}
+      TARGET_ENV: integration
+    outputs:
+      standard-repository-uri: ${{ steps.bootstrap.outputs.standard_repository_uri }}
+      standard-repository-arn: ${{ steps.bootstrap.outputs.standard_repository_arn }}
+      all-in-one-repository-uri: ${{ steps.bootstrap.outputs.all_in_one_repository_uri }}
+      all-in-one-repository-arn: ${{ steps.bootstrap.outputs.all_in_one_repository_arn }}
+    steps:
+      - name: Configure AWS Credentials
+        uses: hashicorp/doormat-action@690d0244e8d4751d3090f6785acac1b4b84d5223
+        with:
+          aws-role-arn: ${{ env.ROLE_ARN }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Bootstrap Repositories
+        id: bootstrap
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          bootstrap_repository() {
+            local repository_name="$1"
+
+            if ! aws ecr describe-repositories --region "$AWS_REGION" --repository-names "$repository_name" >/dev/null 2>&1; then
+              aws ecr create-repository \
+                --region "$AWS_REGION" \
+                --repository-name "$repository_name" \
+                --image-scanning-configuration scanOnPush=true \
+                >/dev/null
+            fi
+
+            aws ecr describe-repositories \
+              --region "$AWS_REGION" \
+              --repository-names "$repository_name" \
+              --query 'repositories[0].[repositoryUri,repositoryArn]' \
+              --output text
+          }
+
+          read -r standard_uri standard_arn < <(bootstrap_repository "$ECR_STANDARD_REPOSITORY")
+          read -r all_in_one_uri all_in_one_arn < <(bootstrap_repository "$ECR_ALL_IN_ONE_REPOSITORY")
+
+          {
+            echo "standard_repository_uri=$standard_uri"
+            echo "standard_repository_arn=$standard_arn"
+            echo "all_in_one_repository_uri=$all_in_one_uri"
+            echo "all_in_one_repository_arn=$all_in_one_arn"
+          } >> "$GITHUB_OUTPUT"
+
+          {
+            echo "### ${TARGET_ENV^}"
+            echo "- account: $ACCOUNT_ID"
+            echo "- region: $AWS_REGION"
+            echo "- standard repository: $standard_uri"
+            echo "- standard repository ARN: $standard_arn"
+            echo "- all-in-one repository: $all_in_one_uri"
+            echo "- all-in-one repository ARN: $all_in_one_arn"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  bootstrap-production:
+    name: Bootstrap Production ECR
+    runs-on: ubuntu-latest
+    env:
+      ACCOUNT_ID: "877995958936"
+      ROLE_ARN: ${{ inputs.production_role_arn }}
+      TARGET_ENV: production
+    outputs:
+      standard-repository-uri: ${{ steps.bootstrap.outputs.standard_repository_uri }}
+      standard-repository-arn: ${{ steps.bootstrap.outputs.standard_repository_arn }}
+      all-in-one-repository-uri: ${{ steps.bootstrap.outputs.all_in_one_repository_uri }}
+      all-in-one-repository-arn: ${{ steps.bootstrap.outputs.all_in_one_repository_arn }}
+    steps:
+      - name: Configure AWS Credentials
+        uses: hashicorp/doormat-action@690d0244e8d4751d3090f6785acac1b4b84d5223
+        with:
+          aws-role-arn: ${{ env.ROLE_ARN }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Bootstrap Repositories
+        id: bootstrap
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          bootstrap_repository() {
+            local repository_name="$1"
+
+            if ! aws ecr describe-repositories --region "$AWS_REGION" --repository-names "$repository_name" >/dev/null 2>&1; then
+              aws ecr create-repository \
+                --region "$AWS_REGION" \
+                --repository-name "$repository_name" \
+                --image-scanning-configuration scanOnPush=true \
+                >/dev/null
+            fi
+
+            aws ecr describe-repositories \
+              --region "$AWS_REGION" \
+              --repository-names "$repository_name" \
+              --query 'repositories[0].[repositoryUri,repositoryArn]' \
+              --output text
+          }
+
+          read -r standard_uri standard_arn < <(bootstrap_repository "$ECR_STANDARD_REPOSITORY")
+          read -r all_in_one_uri all_in_one_arn < <(bootstrap_repository "$ECR_ALL_IN_ONE_REPOSITORY")
+
+          {
+            echo "standard_repository_uri=$standard_uri"
+            echo "standard_repository_arn=$standard_arn"
+            echo "all_in_one_repository_uri=$all_in_one_uri"
+            echo "all_in_one_repository_arn=$all_in_one_arn"
+          } >> "$GITHUB_OUTPUT"
+
+          {
+            echo "### ${TARGET_ENV^}"
+            echo "- account: $ACCOUNT_ID"
+            echo "- region: $AWS_REGION"
+            echo "- standard repository: $standard_uri"
+            echo "- standard repository ARN: $standard_arn"
+            echo "- all-in-one repository: $all_in_one_uri"
+            echo "- all-in-one repository ARN: $all_in_one_arn"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  summary:
+    name: Summarize ECR Repositories
+    runs-on: ubuntu-latest
+    needs: [ bootstrap-integration, bootstrap-production ]
+    steps:
+      - name: Summarize Bootstrap Results
+        shell: bash
+        run: |
+          {
+            echo "## ECR bootstrap complete"
+            echo
+            echo "### Integration"
+            echo "- standard repository: ${{ needs.bootstrap-integration.outputs.standard-repository-uri }}"
+            echo "- standard repository ARN: ${{ needs.bootstrap-integration.outputs.standard-repository-arn }}"
+            echo "- all-in-one repository: ${{ needs.bootstrap-integration.outputs.all-in-one-repository-uri }}"
+            echo "- all-in-one repository ARN: ${{ needs.bootstrap-integration.outputs.all-in-one-repository-arn }}"
+            echo
+            echo "### Production"
+            echo "- standard repository: ${{ needs.bootstrap-production.outputs.standard-repository-uri }}"
+            echo "- standard repository ARN: ${{ needs.bootstrap-production.outputs.standard-repository-arn }}"
+            echo "- all-in-one repository: ${{ needs.bootstrap-production.outputs.all-in-one-repository-uri }}"
+            echo "- all-in-one repository ARN: ${{ needs.bootstrap-production.outputs.all-in-one-repository-arn }}"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          echo "Integration standard repository: ${{ needs.bootstrap-integration.outputs.standard-repository-uri }}"
+          echo "Integration all-in-one repository: ${{ needs.bootstrap-integration.outputs.all-in-one-repository-uri }}"
+          echo "Production standard repository: ${{ needs.bootstrap-production.outputs.standard-repository-uri }}"
+          echo "Production all-in-one repository: ${{ needs.bootstrap-production.outputs.all-in-one-repository-uri }}"