mirror of
https://github.com/goauthentik/authentik
synced 2026-04-25 17:15:26 +02:00
257 lines
9.3 KiB
YAML
257 lines
9.3 KiB
YAML
---
|
|
name: Release - On publish
|
|
|
|
on:
|
|
release:
|
|
types: [published, created]
|
|
|
|
jobs:
|
|
build-server:
|
|
uses: ./.github/workflows/_reusable-docker-build.yml
|
|
secrets: inherit
|
|
permissions:
|
|
contents: read
|
|
# Needed to upload container images to ghcr.io
|
|
packages: write
|
|
# Needed for attestation
|
|
id-token: write
|
|
attestations: write
|
|
with:
|
|
image_name: ghcr.io/goauthentik/server,authentik/server
|
|
release: true
|
|
registry_dockerhub: true
|
|
registry_ghcr: true
|
|
build-docs:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
# Needed to upload container images to ghcr.io
|
|
packages: write
|
|
# Needed for attestation
|
|
id-token: write
|
|
attestations: write
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
|
|
- name: prepare variables
|
|
uses: ./.github/actions/docker-push-variables
|
|
id: ev
|
|
env:
|
|
DOCKER_USERNAME: ${{ secrets.DOCKER_CORP_USERNAME }}
|
|
with:
|
|
image-name: ghcr.io/goauthentik/docs
|
|
- name: Login to GitHub Container Registry
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.repository_owner }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
- name: Build Docker Image
|
|
id: push
|
|
uses: docker/build-push-action@601a80b39c9405e50806ae38af30926f9d957c47 # v6
|
|
with:
|
|
tags: ${{ steps.ev.outputs.imageTags }}
|
|
file: website/Dockerfile
|
|
push: true
|
|
platforms: linux/amd64,linux/arm64
|
|
context: .
|
|
- uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3
|
|
id: attest
|
|
if: true
|
|
with:
|
|
subject-name: ${{ steps.ev.outputs.attestImageNames }}
|
|
subject-digest: ${{ steps.push.outputs.digest }}
|
|
push-to-registry: true
|
|
build-outpost:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
# Needed to upload container images to ghcr.io
|
|
packages: write
|
|
# Needed for attestation
|
|
id-token: write
|
|
attestations: write
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
type:
|
|
- proxy
|
|
- ldap
|
|
- radius
|
|
- rac
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
|
|
- uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
|
|
with:
|
|
go-version-file: "go.mod"
|
|
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v5
|
|
with:
|
|
node-version-file: web/package.json
|
|
cache: "npm"
|
|
cache-dependency-path: web/package-lock.json
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
|
|
- name: prepare variables
|
|
uses: ./.github/actions/docker-push-variables
|
|
id: ev
|
|
env:
|
|
DOCKER_USERNAME: ${{ secrets.DOCKER_CORP_USERNAME }}
|
|
with:
|
|
image-name: ghcr.io/goauthentik/${{ matrix.type }},authentik/${{ matrix.type }}
|
|
- name: Generate API Clients
|
|
run: |
|
|
make gen-client-ts
|
|
make gen-client-go
|
|
- name: Docker Login Registry
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
|
|
with:
|
|
username: ${{ secrets.DOCKER_CORP_USERNAME }}
|
|
password: ${{ secrets.DOCKER_CORP_PASSWORD }}
|
|
- name: Login to GitHub Container Registry
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.repository_owner }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
- name: Build Docker Image
|
|
uses: docker/build-push-action@601a80b39c9405e50806ae38af30926f9d957c47 # v6
|
|
id: push
|
|
with:
|
|
push: true
|
|
build-args: |
|
|
VERSION=${{ github.ref }}
|
|
tags: ${{ steps.ev.outputs.imageTags }}
|
|
file: lifecycle/container/${{ matrix.type }}.Dockerfile
|
|
platforms: linux/amd64,linux/arm64
|
|
context: .
|
|
- uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3
|
|
id: attest
|
|
with:
|
|
subject-name: ${{ steps.ev.outputs.attestImageNames }}
|
|
subject-digest: ${{ steps.push.outputs.digest }}
|
|
push-to-registry: true
|
|
build-outpost-binary:
|
|
timeout-minutes: 120
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
# Needed to upload binaries to the release
|
|
contents: write
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
type:
|
|
- proxy
|
|
- ldap
|
|
- radius
|
|
goos: [linux, darwin]
|
|
goarch: [amd64, arm64]
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
|
|
- uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
|
|
with:
|
|
go-version-file: "go.mod"
|
|
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v5
|
|
with:
|
|
node-version-file: web/package.json
|
|
cache: "npm"
|
|
cache-dependency-path: web/package-lock.json
|
|
- name: Install web dependencies
|
|
working-directory: web/
|
|
run: |
|
|
npm ci
|
|
- name: Generate API Clients
|
|
run: |
|
|
make gen-client-ts
|
|
make gen-client-go
|
|
- name: Build web
|
|
working-directory: web/
|
|
run: |
|
|
npm run build-proxy
|
|
- name: Build outpost
|
|
run: |
|
|
set -x
|
|
export GOOS=${{ matrix.goos }}
|
|
export GOARCH=${{ matrix.goarch }}
|
|
export CGO_ENABLED=0
|
|
go build -tags=outpost_static_embed -v -o ./authentik-outpost-${{ matrix.type }}_${{ matrix.goos }}_${{ matrix.goarch }} ./cmd/${{ matrix.type }}
|
|
- name: Upload binaries to release
|
|
uses: svenstaro/upload-release-action@6b7fa9f267e90b50a19fef07b3596790bb941741 # v2
|
|
with:
|
|
repo_token: ${{ secrets.GITHUB_TOKEN }}
|
|
file: ./authentik-outpost-${{ matrix.type }}_${{ matrix.goos }}_${{ matrix.goarch }}
|
|
asset_name: authentik-outpost-${{ matrix.type }}_${{ matrix.goos }}_${{ matrix.goarch }}
|
|
tag: ${{ github.ref }}
|
|
upload-aws-cfn-template:
|
|
permissions:
|
|
# Needed for AWS login
|
|
id-token: write
|
|
contents: read
|
|
needs:
|
|
- build-server
|
|
- build-outpost
|
|
env:
|
|
AWS_REGION: eu-central-1
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
|
|
- uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
|
|
with:
|
|
role-to-assume: "arn:aws:iam::016170277896:role/github_goauthentik_authentik"
|
|
aws-region: ${{ env.AWS_REGION }}
|
|
- name: Upload template
|
|
run: |
|
|
aws s3 cp --acl=public-read lifecycle/aws/template.yaml s3://authentik-cloudformation-templates/authentik.ecs.${{ github.ref }}.yaml
|
|
aws s3 cp --acl=public-read lifecycle/aws/template.yaml s3://authentik-cloudformation-templates/authentik.ecs.latest.yaml
|
|
test-release:
|
|
needs:
|
|
- build-server
|
|
- build-outpost
|
|
- build-outpost-binary
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
|
|
- name: Run test suite in final docker images
|
|
run: |
|
|
echo "PG_PASS=$(openssl rand 32 | base64 -w 0)" >> lifecycle/container/.env
|
|
echo "AUTHENTIK_SECRET_KEY=$(openssl rand 32 | base64 -w 0)" >> lifecycle/container/.env
|
|
docker compose -f lifecycle/container/compose.yml pull -q
|
|
docker compose -f lifecycle/container/compose.yml up --no-start
|
|
docker compose -f lifecycle/container/compose.yml start postgresql
|
|
docker compose -f lifecycle/container/compose.yml run -u root server test-all
|
|
sentry-release:
|
|
needs:
|
|
- build-server
|
|
- build-outpost
|
|
- build-outpost-binary
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
|
|
- name: prepare variables
|
|
uses: ./.github/actions/docker-push-variables
|
|
id: ev
|
|
env:
|
|
DOCKER_USERNAME: ${{ secrets.DOCKER_CORP_USERNAME }}
|
|
with:
|
|
image-name: ghcr.io/goauthentik/server
|
|
- name: Get static files from docker image
|
|
run: |
|
|
docker pull ${{ steps.ev.outputs.imageMainName }}
|
|
container=$(docker container create ${{ steps.ev.outputs.imageMainName }})
|
|
docker cp ${container}:web/ .
|
|
- name: Create a Sentry.io release
|
|
uses: getsentry/action-release@dab6548b3c03c4717878099e43782cf5be654289 # v3
|
|
continue-on-error: true
|
|
env:
|
|
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
|
|
SENTRY_ORG: authentik-security-inc
|
|
SENTRY_PROJECT: authentik
|
|
with:
|
|
release: authentik@${{ steps.ev.outputs.version }}
|
|
sourcemaps: "./web/dist"
|
|
url_prefix: "~/static/dist"
|