-
Notifications
You must be signed in to change notification settings - Fork 50
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into ps/improve-ts-bindings
- Loading branch information
Showing
191 changed files
with
4,734 additions
and
2,689 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,163 @@ | ||
| --- | ||
| name: Build bws Docker image | ||
|
|
||
| on: | ||
| push: | ||
| paths: | ||
| - "crates/bws/**" | ||
| workflow_dispatch: | ||
| inputs: | ||
| sdk_branch: | ||
| description: "Server branch name to deploy (examples: 'master', 'rc', 'feature/sm')" | ||
| type: string | ||
| default: master | ||
| pull_request: | ||
| paths: | ||
| - ".github/workflows/build-cli-docker.yml" | ||
| - "crates/bws/**" | ||
|
|
||
| env: | ||
| _AZ_REGISTRY: bitwardenprod.azurecr.io | ||
|
|
||
| jobs: | ||
| build-docker: | ||
| name: Build Docker image | ||
| runs-on: ubuntu-22.04 | ||
| steps: | ||
| - name: Checkout Repository | ||
| uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 | ||
|
|
||
| - name: Check Branch to Publish | ||
| env: | ||
| PUBLISH_BRANCHES: "master,rc,hotfix-rc" | ||
| id: publish-branch-check | ||
| run: | | ||
| REF=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}} | ||
| IFS="," read -a publish_branches <<< $PUBLISH_BRANCHES | ||
| if [[ "${publish_branches[*]}" =~ "${REF}" ]]; then | ||
| echo "is_publish_branch=true" >> $GITHUB_ENV | ||
| else | ||
| echo "is_publish_branch=false" >> $GITHUB_ENV | ||
| fi | ||
| ########## Set up Docker ########## | ||
| - name: Set up QEMU emulators | ||
| uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0 | ||
|
|
||
| ########## Login to Docker registries ########## | ||
| - name: Login to Azure - Prod Subscription | ||
| uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0 | ||
| with: | ||
| creds: ${{ secrets.AZURE_PROD_KV_CREDENTIALS }} | ||
|
|
||
| - name: Login to Azure ACR | ||
| run: az acr login -n ${_AZ_REGISTRY%.azurecr.io} | ||
|
|
||
| - name: Login to Azure - CI Subscription | ||
| uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0 | ||
| with: | ||
| creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }} | ||
|
|
||
| - name: Retrieve github PAT secrets | ||
| id: retrieve-secret-pat | ||
| uses: bitwarden/gh-actions/get-keyvault-secrets@main | ||
| with: | ||
| keyvault: "bitwarden-ci" | ||
| secrets: "github-pat-bitwarden-devops-bot-repo-scope" | ||
|
|
||
| - name: Setup Docker Trust | ||
| if: ${{ env.is_publish_branch == 'true' }} | ||
| uses: bitwarden/gh-actions/setup-docker-trust@main | ||
| with: | ||
| azure-creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }} | ||
| azure-keyvault-name: "bitwarden-ci" | ||
|
|
||
| ########## Generate image tag and build Docker image ########## | ||
| - name: Generate Docker image tag | ||
| id: tag | ||
| run: | | ||
| REF=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}} | ||
| IMAGE_TAG=$(echo "${REF}" | sed "s#/#-#g") # slash safe branch name | ||
| if [[ "${IMAGE_TAG}" == "master" ]]; then | ||
| IMAGE_TAG=dev | ||
| elif [[ ("${IMAGE_TAG}" == "rc") || ("${IMAGE_TAG}" == "hotfix-rc") ]]; then | ||
| IMAGE_TAG=rc | ||
| fi | ||
| echo "image_tag=${IMAGE_TAG}" >> $GITHUB_OUTPUT | ||
| - name: Generate tag list | ||
| id: tag-list | ||
| env: | ||
| IMAGE_TAG: ${{ steps.tag.outputs.image_tag }} | ||
| IS_PUBLISH_BRANCH: ${{ env.is_publish_branch }} | ||
| run: | | ||
| if [[ ("${IMAGE_TAG}" == "dev" || "${IMAGE_TAG}" == "rc") && "${IS_PUBLISH_BRANCH}" == "true" ]]; then | ||
| echo "tags=$_AZ_REGISTRY/bws:${IMAGE_TAG},bitwarden/bws:${IMAGE_TAG}" >> $GITHUB_OUTPUT | ||
| else | ||
| echo "tags=$_AZ_REGISTRY/bws:${IMAGE_TAG}" >> $GITHUB_OUTPUT | ||
| fi | ||
| - name: Build and push Docker image | ||
| uses: docker/build-push-action@1104d471370f9806843c095c1db02b5a90c5f8b6 # v3.3.1 | ||
| with: | ||
| context: . | ||
| file: crates/bws/Dockerfile | ||
| platforms: | | ||
| linux/amd64, | ||
| linux/arm64/v8 | ||
| push: true | ||
| tags: ${{ steps.tag-list.outputs.tags }} | ||
| secrets: | | ||
| "GH_PAT=${{ steps.retrieve-secret-pat.outputs.github-pat-bitwarden-devops-bot-repo-scope }}" | ||
| - name: Log out of Docker and disable Docker Notary | ||
| if: ${{ env.is_publish_branch == 'true' }} | ||
| run: | | ||
| docker logout | ||
| echo "DOCKER_CONTENT_TRUST=0" >> $GITHUB_ENV | ||
| check-failures: | ||
| name: Check for failures | ||
| if: always() | ||
| runs-on: ubuntu-22.04 | ||
| needs: build-docker | ||
| steps: | ||
| - name: Check if any job failed | ||
| if: | | ||
| github.ref == 'refs/heads/master' | ||
| || github.ref == 'refs/heads/rc' | ||
| || github.ref == 'refs/heads/hotfix-rc' | ||
| env: | ||
| BUILD_DOCKER_STATUS: ${{ needs.build-docker.result }} | ||
| run: | | ||
| if [ "$BUILD_DOCKER_STATUS" = "failure" ]; then | ||
| exit 1 | ||
| fi | ||
| - name: Login to Azure - CI subscription | ||
| uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0 | ||
| if: failure() | ||
| with: | ||
| creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }} | ||
|
|
||
| - name: Retrieve secrets | ||
| id: retrieve-secrets | ||
| uses: bitwarden/gh-actions/get-keyvault-secrets@main | ||
| if: failure() | ||
| with: | ||
| keyvault: "bitwarden-ci" | ||
| secrets: "devops-alerts-slack-webhook-url" | ||
|
|
||
| - name: Notify Slack on failure | ||
| uses: act10ns/slack@ed1309ab9862e57e9e583e51c7889486b9a00b0f # v2.0.0 | ||
| if: failure() | ||
| env: | ||
| SLACK_WEBHOOK_URL: ${{ steps.retrieve-secrets.outputs.devops-alerts-slack-webhook-url }} | ||
| with: | ||
| status: ${{ job.status }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.