-
Notifications
You must be signed in to change notification settings - Fork 50
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into DEVOPS-1525-swift-workflow-for-package-publi…
…shing
- Loading branch information
Showing
865 changed files
with
29,378 additions
and
15,121 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| ignore: | ||
| - "crates/sdk-schemas" # Tool | ||
| - "crates/uniffi-bindgen" # Tool | ||
| - "crates/memory-testing" # Testing |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,49 +1,25 @@ | ||
| { | ||
| "$schema": "https://docs.renovatebot.com/renovate-schema.json", | ||
| "extends": [ | ||
| "config:base", | ||
| "schedule:weekends", | ||
| ":combinePatchMinorReleases", | ||
| ":dependencyDashboard", | ||
| ":maintainLockFilesWeekly", | ||
| ":prConcurrentLimit10", | ||
| ":rebaseStalePrs", | ||
| ":separateMajorReleases" | ||
| ], | ||
| "extends": ["github>bitwarden/renovate-config:non-pinned"], | ||
| "separateMajorMinor": true, | ||
| "enabledManagers": ["cargo", "github-actions", "npm", "nuget"], | ||
| "enabledManagers": ["cargo", "dockerfile", "github-actions", "npm", "nuget"], | ||
| "packageRules": [ | ||
| { | ||
| "groupName": "npm minor", | ||
| "matchManagers": ["npm"], | ||
| "matchUpdateTypes": ["minor", "patch"] | ||
| }, | ||
| { | ||
| "matchManagers": ["cargo"], | ||
| "matchUpdateTypes": ["patch"], | ||
| "enabled": false | ||
| }, | ||
| { | ||
| "matchManagers": ["cargo"], | ||
| "matchUpdateTypes": ["minor"], | ||
| "matchCurrentVersion": ">=1.0.0", | ||
| "enabled": false | ||
| }, | ||
| { | ||
| "matchManagers": ["cargo"], | ||
| "matchPackagePatterns": ["pyo3*"], | ||
| "matchUpdateTypes": ["minor", "patch"], | ||
| "groupName": "pyo3 non-major" | ||
| }, | ||
| { | ||
| "groupName": "nuget minor", | ||
| "matchManagers": ["nuget"], | ||
| "groupName": "dockerfile minor", | ||
| "matchManagers": ["dockerfile"], | ||
| "matchUpdateTypes": ["minor", "patch"] | ||
| }, | ||
| { | ||
| "groupName": "gh minor", | ||
| "matchManagers": ["github-actions"], | ||
| "matchUpdateTypes": ["minor", "patch"] | ||
| } | ||
| ] | ||
| ], | ||
| "ignoreDeps": ["dotnet-sdk"] | ||
| } |
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,157 @@ | ||
| --- | ||
| name: Build bws Docker image | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - "main" | ||
| - "rc" | ||
| - "hotfix-rc" | ||
| workflow_dispatch: | ||
| pull_request: | ||
|
|
||
| env: | ||
| _AZ_REGISTRY: bitwardenprod.azurecr.io | ||
|
|
||
| jobs: | ||
| build-docker: | ||
| name: Build Docker image | ||
| runs-on: ubuntu-22.04 | ||
| steps: | ||
| - name: Checkout Repository | ||
| uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 | ||
|
|
||
| - name: Check Branch to Publish | ||
| env: | ||
| PUBLISH_BRANCHES: "master,rc,hotfix-rc" | ||
| id: publish-branch-check | ||
| run: | | ||
| REF=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}} | ||
| IFS="," read -a publish_branches <<< $PUBLISH_BRANCHES | ||
| if [[ "${publish_branches[*]}" =~ "${REF}" ]]; then | ||
| echo "is_publish_branch=true" >> $GITHUB_ENV | ||
| else | ||
| echo "is_publish_branch=false" >> $GITHUB_ENV | ||
| fi | ||
| ########## Set up Docker ########## | ||
| - name: Set up QEMU emulators | ||
| uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0 | ||
|
|
||
| ########## Login to Docker registries ########## | ||
| - name: Login to Azure - Prod Subscription | ||
| uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0 | ||
| with: | ||
| creds: ${{ secrets.AZURE_PROD_KV_CREDENTIALS }} | ||
|
|
||
| - name: Login to Azure ACR | ||
| run: az acr login -n ${_AZ_REGISTRY%.azurecr.io} | ||
|
|
||
| - name: Login to Azure - CI Subscription | ||
| uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0 | ||
| with: | ||
| creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }} | ||
|
|
||
| - name: Retrieve github PAT secrets | ||
| id: retrieve-secret-pat | ||
| uses: bitwarden/gh-actions/get-keyvault-secrets@main | ||
| with: | ||
| keyvault: "bitwarden-ci" | ||
| secrets: "github-pat-bitwarden-devops-bot-repo-scope" | ||
|
|
||
| - name: Setup Docker Trust | ||
| if: ${{ env.is_publish_branch == 'true' }} | ||
| uses: bitwarden/gh-actions/setup-docker-trust@main | ||
| with: | ||
| azure-creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }} | ||
| azure-keyvault-name: "bitwarden-ci" | ||
|
|
||
| ########## Generate image tag and build Docker image ########## | ||
| - name: Generate Docker image tag | ||
| id: tag | ||
| run: | | ||
| REF=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}} | ||
| IMAGE_TAG=$(echo "${REF}" | sed "s#/#-#g") # slash safe branch name | ||
| if [[ "${IMAGE_TAG}" == "master" ]]; then | ||
| IMAGE_TAG=dev | ||
| elif [[ ("${IMAGE_TAG}" == "rc") || ("${IMAGE_TAG}" == "hotfix-rc") ]]; then | ||
| IMAGE_TAG=rc | ||
| fi | ||
| echo "image_tag=${IMAGE_TAG}" >> $GITHUB_OUTPUT | ||
| - name: Generate tag list | ||
| id: tag-list | ||
| env: | ||
| IMAGE_TAG: ${{ steps.tag.outputs.image_tag }} | ||
| IS_PUBLISH_BRANCH: ${{ env.is_publish_branch }} | ||
| run: | | ||
| if [[ ("${IMAGE_TAG}" == "dev" || "${IMAGE_TAG}" == "rc") && "${IS_PUBLISH_BRANCH}" == "true" ]]; then | ||
| echo "tags=$_AZ_REGISTRY/bws:${IMAGE_TAG},bitwarden/bws:${IMAGE_TAG}" >> $GITHUB_OUTPUT | ||
| else | ||
| echo "tags=$_AZ_REGISTRY/bws:${IMAGE_TAG}" >> $GITHUB_OUTPUT | ||
| fi | ||
| - name: Build and push Docker image | ||
| uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0 | ||
| with: | ||
| context: . | ||
| file: crates/bws/Dockerfile | ||
| platforms: | | ||
| linux/amd64, | ||
| linux/arm64/v8 | ||
| push: true | ||
| tags: ${{ steps.tag-list.outputs.tags }} | ||
| secrets: | | ||
| "GH_PAT=${{ steps.retrieve-secret-pat.outputs.github-pat-bitwarden-devops-bot-repo-scope }}" | ||
| - name: Log out of Docker and disable Docker Notary | ||
| if: ${{ env.is_publish_branch == 'true' }} | ||
| run: | | ||
| docker logout | ||
| echo "DOCKER_CONTENT_TRUST=0" >> $GITHUB_ENV | ||
| check-failures: | ||
| name: Check for failures | ||
| if: always() | ||
| runs-on: ubuntu-22.04 | ||
| needs: build-docker | ||
| steps: | ||
| - name: Check if any job failed | ||
| if: | | ||
| github.ref == 'refs/heads/master' | ||
| || github.ref == 'refs/heads/rc' | ||
| || github.ref == 'refs/heads/hotfix-rc' | ||
| env: | ||
| BUILD_DOCKER_STATUS: ${{ needs.build-docker.result }} | ||
| run: | | ||
| if [ "$BUILD_DOCKER_STATUS" = "failure" ]; then | ||
| exit 1 | ||
| fi | ||
| - name: Login to Azure - CI subscription | ||
| uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0 | ||
| if: failure() | ||
| with: | ||
| creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }} | ||
|
|
||
| - name: Retrieve secrets | ||
| id: retrieve-secrets | ||
| uses: bitwarden/gh-actions/get-keyvault-secrets@main | ||
| if: failure() | ||
| with: | ||
| keyvault: "bitwarden-ci" | ||
| secrets: "devops-alerts-slack-webhook-url" | ||
|
|
||
| - name: Notify Slack on failure | ||
| uses: act10ns/slack@ed1309ab9862e57e9e583e51c7889486b9a00b0f # v2.0.0 | ||
| if: failure() | ||
| env: | ||
| SLACK_WEBHOOK_URL: ${{ steps.retrieve-secrets.outputs.devops-alerts-slack-webhook-url }} | ||
| with: | ||
| status: ${{ job.status }} |
Oops, something went wrong.