chore(ci): fix release (#10886)

# Which Problems Are Solved

The new pipeline did not correctly build the release. Console was not
built into the binary. Also there were some pipeline permission errors.

# How the Problems Are Solved

- add `build-console` as dependency to pack binaries
- streamline permissions and only pass necessary into steps

# Additional Changes

none

# Additional Context

- relates to #10571

.github/workflows/ci.yml

@@ -18,11 +18,12 @@ permissions:
   packages: write
   issues: write
   pull-requests: write
-  actions: write
 
 jobs:
   lint_test_build:
     uses: ./.github/workflows/lint_test_build.yml
+    permissions:
+      contents: read
     with:
       node_version: "22"
     secrets:
@@ -31,10 +32,11 @@ jobs:
 
   pack:
     uses: ./.github/workflows/pack.yml
+    permissions:
+      contents: write
+      packages: write
     secrets:
       GCR_JSON_KEY_BASE64: ${{ secrets.GCR_JSON_KEY_BASE64 }}
-    permissions:
-      packages: write
     if: ${{ github.event_name == 'workflow_dispatch' }}
     with:
       node_version: "22"

.github/workflows/pack.yml

@@ -26,9 +26,6 @@ on:
         description: 'base64 endcrypted key to connect to Google'
         required: true
 
-permissions:
-  packages: write
-
 env:
   default_labels: |
     org.opencontainers.image.documentation=https://zitadel.com/docs
@@ -37,6 +34,8 @@ env:
 jobs:
   version:
     uses: ./.github/workflows/version.yml
+    permissions:
+      contents: write
     with:
       semantic_version: ${{ inputs.semantic_version }}
       dry_run: true
@@ -46,6 +45,9 @@ jobs:
       group: zitadel-public
     environment: ${{ github.ref_protected == 'true' && 'Protected' || null }}
     needs: version
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4

.github/workflows/release.yml

@@ -32,6 +32,8 @@ on:
 jobs:
   version:
     uses: ./.github/workflows/version.yml
+    permissions:
+      contents: write
     with:
       semantic_version: ${{ inputs.semantic_version }}
       dry_run: false

apps/api/project.json

@@ -115,9 +115,7 @@
         "test-unit": {
             "description": "Runs the unit tests with coverage",
             "dependsOn": [
-                "generate-stubs",
+                "generate"
-                "generate-assets",
-                "generate-statik"
             ],
             "command": "go test -race -coverprofile=profile.api.test-unit.cov -coverpkg=./internal/...  ./...",
             "inputs": [
@@ -131,9 +129,7 @@
         "test-integration-build": {
             "description": "Builds the test binary for integration tests.",
             "dependsOn": [
-                "generate-stubs",
+                "generate"
-                "generate-assets",
-                "generate-statik"
             ],
             "command": "go build -cover -race -tags integration -o .artifacts/bin/$(go env GOOS)/$(go env GOARCH)/zitadel.test main.go",
             "cache": true,
@@ -360,9 +356,8 @@
         "pack-darwin-amd64": {
             "description": "Packages the API for Darwin AMD64 (Intel) architecture",
             "dependsOn": [
-                "generate-stubs",
+                "generate",
-                "generate-assets",
+                "build-console"
-                "generate-statik"
             ],
             "command": "GOOS=darwin GOARCH=amd64 nx run @zitadel/api:pack-platform",
             "cache": true,
@@ -378,9 +373,8 @@
         "pack-darwin-arm64": {
             "description": "Packages the API for Darwin ARM64 (Apple Silicon) architecture",
             "dependsOn": [
-                "generate-stubs",
+                "generate",
-                "generate-assets",
+                "build-console"
-                "generate-statik"
             ],
             "command": "GOOS=darwin GOARCH=arm64 nx run @zitadel/api:pack-platform",
             "cache": true,
@@ -396,9 +390,8 @@
         "pack-linux-amd64": {
             "description": "Packages the API for Linux AMD64 architecture",
             "dependsOn": [
-                "generate-stubs",
+                "generate",
-                "generate-assets",
+                "build-console"
-                "generate-statik"
             ],
             "command": "GOOS=linux GOARCH=amd64 nx run @zitadel/api:pack-platform",
             "cache": true,
@@ -414,9 +407,8 @@
         "pack-linux-arm64": {
             "description": "Packages the API for Linux ARM64 architecture",
             "dependsOn": [
-                "generate-stubs",
+                "generate",
-                "generate-assets",
+                "build-console"
-                "generate-statik"
             ],
             "command": "GOOS=linux GOARCH=arm64 nx run @zitadel/api:pack-platform",
             "cache": true,
@@ -432,9 +424,8 @@
         "pack-windows-amd64": {
             "description": "Packages the API for Windows AMD64 architecture",
             "dependsOn": [
-                "generate-stubs",
+                "generate",
-                "generate-assets",
+                "build-console"
-                "generate-statik"
             ],
             "command": "GOOS=windows GOARCH=amd64 nx run @zitadel/api:pack-platform",
             "cache": true,
@@ -450,9 +441,8 @@
         "pack-windows-arm64": {
             "description": "Packages the API for Windows ARM64 architecture",
             "dependsOn": [
-                "generate-stubs",
+                "generate",
-                "generate-assets",
+                "build-console"
-                "generate-statik"
             ],
             "command": "GOOS=windows GOARCH=arm64 nx run @zitadel/api:pack-platform",
             "cache": true,