312b7b6010
chore: 🚀 Migrate monorepo from Yarn to pnpm + Turbo integration + Configuration cleanup ( #10165 )
...
This PR modernizes the ZITADEL monorepo build system by migrating from
Yarn to pnpm, introducing Turbo for improved build orchestration, and
cleaning up configuration inconsistencies across all apps and packages.
### 🎯 Key Improvements
#### 📦 **Package Manager Migration (Yarn → pnpm)**
- **Performance**: Faster installs with pnpm's efficient symlink-based
node_modules structure
- **Disk space**: Significant reduction in disk usage through
content-addressable storage
- **Lockfile**: More reliable dependency resolution with pnpm-lock.yaml
- **Workspace support**: Better monorepo dependency management
#### ⚡ **Turbo Integration**
- **Build orchestration**: Dependency-aware task execution across the
monorepo
- **Intelligent caching**: Dramatically faster builds on CI/CD and local
development
- **Parallel execution**: Optimal task scheduling based on dependency
graphs
- **Vercel optimization**: Enhanced build performance and caching on
Vercel deployments
#### 🧹 **Configuration Cleanup & Unification**
- **Removed config packages**: Eliminated `@zitadel/*-config` packages
and inlined configurations
- **Simplified dependencies**: Reduced complexity in package.json files
across all apps
- **Consistent tooling**: Unified prettier, ESLint, and TypeScript
configurations
- **Standalone support**: Improved prepare-standalone.js script for
subtree deployments
### 📋 Detailed Changes
#### **🔧 Build System & Dependencies**
- ✅ Updated all package.json scripts to use `pnpm` instead of `yarn`
- ✅ Replaced `yarn.lock` with pnpm-lock.yaml and regenerated
dependencies
- ✅ Added Turbo configuration (turbo.json) to root and individual
packages
- ✅ Configured proper dependency chains: `@zitadel/proto#generate` →
`@zitadel/client#build` → `console#build`
- ✅ Added missing `@bufbuild/protobuf` dependency to console app for
TypeScript compilation
#### **🚀 CI/CD & Workflows**
- ✅ Updated all GitHub Actions workflows to use `pnpm/action-setup@v4`
- ✅ Migrated build processes to use Turbo with directory-based filters
(`--filter=./console`)
- ✅ **New**: Added `docs.yml` workflow for building documentation
locally (helpful for contributors without Vercel access)
- ✅ Fixed dependency resolution issues in lint workflows
- ✅ Ensured proto generation always runs before builds and linting
#### **📚 Documentation & Proto Generation**
- ✅ **Robust plugin management**: Enhanced plugin-download.sh with retry
logic and error handling
- ✅ **Vercel compatibility**: Fixed protoc-gen-connect-openapi plugin
availability in Vercel builds
- ✅ **API docs generation**: Resolved Docusaurus build errors with
OpenAPI plugin configuration
- ✅ **Type safety**: Improved TypeScript type extraction patterns in
Angular components
#### **🛠️ Developer Experience**
- ✅ Updated all README files to reference pnpm commands
- ✅ Improved Makefile targets to use Turbo for consistent builds
- ✅ Enhanced standalone build process for login app subtree deployments
- ✅ Added debug utilities for troubleshooting build issues
#### **🗂️ File Structure & Cleanup**
- ✅ Removed obsolete configuration packages and their references
- ✅ Cleaned up Docker files to remove non-existent package copies
- ✅ Updated workspace references and import paths
- ✅ Streamlined turbo.json configurations across all packages
### 🎉 Benefits
1. **⚡ Faster Builds**: Turbo's caching and parallel execution
significantly reduce build times
2. **🔄 Better Caching**: Improved cache hits on Vercel and CI/CD
environments
3. **🛠️ Simplified Maintenance**: Unified tooling and configuration
management
4. **📈 Developer Productivity**: Faster local development with optimized
dependency resolution
5. **🚀 Enhanced CI/CD**: More reliable and faster automated builds and
deployments
6. **📖 Better Documentation**: Comprehensive build documentation and
troubleshooting guides
### 🧪 Testing
- ✅ All apps build successfully with new pnpm + Turbo setup
- ✅ Proto generation works correctly across console, login, and docs
- ✅ GitHub Actions workflows pass with new configuration
- ✅ Vercel deployments work with enhanced plugin management
- ✅ Local development workflow verified and documented
This migration sets a solid foundation for future development while
maintaining backward compatibility and improving the overall developer
experience.
---------
Co-authored-by: Elio Bischof <[email protected]
2025-07-16 09:10:19 +02:00
e1f112d59b
chore: disable dependabot on login ( #10265 )
...
# Which Problems Are Solved
- Dependabot creates noisy PRs to the mirror repo zitadel/typescript.
# How the Problems Are Solved
- We mark the dependabot file as an example, effectively disabling
dependabot.
- For cases this isn't intuitive enough, we add a guiding sentence to
the README.md
- Dependabot for the login [is already enabled in the zitadel
repo](https://github.com/zitadel/zitadel/blob/main/.github/dependabot.yml#L25-L37 ).
# Additional Changes
- Updates the CONTRIBUTING.md with instructions about how to submit
changes related to the mirror repo.
- @stebenz please dismiss the relevant Vanta checks if necessary.
---------
Co-authored-by: Copilot <[email protected]
2025-07-15 14:27:20 +00:00
91487a0b23
chore: fix login sync ( #10250 )
...
# Which Problems Are Solved
When changes are pulled or pushed from or to a login repository, they
can't be merged to zitadel, because the commit histories differ.
# How the Problems Are Solved
Changed the commands to allow diverging commit histories.
Pulling takes a lot of commits into the zitadel repo branch like this.
This is fine, as we anyway squash-merge PRs to a single commit.
So we don't care about a branches commit history.
# Additional Changes
Added an exception to the close-pr.yml workflow so sync PRs are not
auto-closed.
---------
Signed-off-by: dependabot[bot] <[email protected] [email protected] [email protected] [email protected] [email protected]
2025-07-15 09:23:34 +00:00
Max Peintner and GitHub
14a5946db8
fix(login): better error handling for saml cookie serialization ( #10259 )
...
Fixes issues where SAML identity provider authentication would fail
silently, leaving users unable to complete the login flow through
external SAML providers.
changes `saml.ts`:
- Enhanced
[setSAMLFormCookie()](vscode-file://vscode-app/Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/code/electron-browser/workbench/workbench.html)
with proper error handling and logging
- Improved
[getSAMLFormCookie()](vscode-file://vscode-app/Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/code/electron-browser/workbench/workbench.html)
with detailed error reporting
- Added cookie size validation and warnings
changes `zitadel.ts`:
- Enhanced
[startIdentityProviderFlow()](vscode-file://vscode-app/Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/code/electron-browser/workbench/workbench.html)
with robust form data handling
- Added detailed logging for protobuf object structure analysis
- Implemented safe fallback serialization for complex objects
- Added comprehensive error handling for JSON operations
2025-07-15 07:46:18 +00:00
Elio Bischof and GitHub
0598abe7e6
chore(login): fix close pr action ( #10234 )
...
# Which Problems Are Solved
The close PR action fails
https://github.com/zitadel/typescript/actions/runs/16196332400/job/45723668837?pr=511
# How the Problems Are Solved
A backtick is escaped.
# Additional Context
- Completes #10229
2025-07-10 13:39:45 +00:00
Elio Bischof and GitHub
f9cad0f3e5
chore(typescript): improve close PR action ( #10229 )
...
# Which Problems Are Solved
The close PR action currently fails because of unescaped backticks.
# How the Problems Are Solved
Backticks are escaped.
# Additional Changes
- Adding a login remote immediately fetches for better UX.
- Adding a subtree is not necessary, as it is already added in the repo.
- Fix and clarify PR migration steps.
- Add workflow dispatch event
2025-07-10 13:10:44 +02:00
Max Peintner and GitHub
253beb4d39
fix(login): encode formpost data to cookie ( #10173 )
...
This PR implements a SAML cookie which is used to save information to
complete the form post. It is primarily used to avoid sending the
information as url search params and therefore reducing its length.
2025-07-07 16:11:14 +02:00
12656235e2
chore: fix login image with sha release ( #10157 )
...
# Which Problems Are Solved
Fixes the releasing of multi-architecture login images.
# How the Problems Are Solved
- The login-container workflow extends the bake definition with a file
docker-bake-release.hcl wich adds the platforms linux/arm and linux/amd
to all relevant build targets. The used technique is similar to how the
docker metadata action allows to extend the bake definitions.
- The local login tag is moved to the metadata bake target, which is
always inherited and overwritten in the pipeline
- Packages write permission is added
# Additional Changes
- The MIT license is noted in container labels and annotations
- The Image is built from root so that the local proto files are used
---------
Co-authored-by: Copilot <[email protected]
2025-07-03 13:10:10 +02:00
Max Peintner and GitHub
47f0486ee8
fix(login): email or phone query, session context from loginname ( #10158 )
...
This PR fixes an issue where the orQuery for phone and email was not
correctly set.
2025-07-03 08:07:34 +00:00
8c39779533
chore(deps): bump github.com/go-chi/chi/v5 from 5.2.1 to 5.2.2 in /login/apps/login-test-acceptance/idp/oidc in the go_modules group across 1 directory ( #10152 )
...
Bumps the go_modules group with 1 update in the
/login/apps/login-test-acceptance/idp/oidc directory:
[github.com/go-chi/chi/v5](https://github.com/go-chi/chi ).
Updates `github.com/go-chi/chi/v5` from 5.2.1 to 5.2.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-chi/chi/releases ">github.com/go-chi/chi/v5's
releases</a>.</em></p>
<blockquote>
<h2>v5.2.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Use strings.Cut in a few places by <a
href="https://github.com/JRaspass "><code>@JRaspass</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/971 ">go-chi/chi#971</a></li>
<li>Fix non-constant format strings in t.Fatalf by <a
href="https://github.com/JRaspass "><code>@JRaspass</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/972 ">go-chi/chi#972</a></li>
<li>Apply fieldalignment fixes to optimize struct memory layout by <a
href="https://github.com/pixel365 "><code>@pixel365</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/974 ">go-chi/chi#974</a></li>
<li>go 1.24 by <a
href="https://github.com/pkieltyka "><code>@pkieltyka</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/977 ">go-chi/chi#977</a></li>
<li>chore: delint ioutil usage by <a
href="https://github.com/costela "><code>@costela</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/962 ">go-chi/chi#962</a></li>
<li>Fixed typo in Router interface definition by <a
href="https://github.com/mithileshgupta12 "><code>@mithileshgupta12</code></a>
in <a
href="https://redirect.github.com/go-chi/chi/pull/958 ">go-chi/chi#958</a></li>
<li>Add support for TinyGo by <a
href="https://github.com/efraimbart "><code>@efraimbart</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/978 ">go-chi/chi#978</a></li>
<li>Exclude middleware/profiler.go in TinyGo, as there's no
net/http/pprof pkg by <a
href="https://github.com/cxjava "><code>@cxjava</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/982 ">go-chi/chi#982</a></li>
<li>Make use of strings.Cut by <a
href="https://github.com/scop "><code>@scop</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1005 ">go-chi/chi#1005</a></li>
<li>Change install command format to code block by <a
href="https://github.com/sglkc "><code>@sglkc</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1001 ">go-chi/chi#1001</a></li>
<li>Correct documentation by <a
href="https://github.com/mrdomino "><code>@mrdomino</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/992 ">go-chi/chi#992</a></li>
</ul>
<h2>Security fix</h2>
<ul>
<li>Fixes <a
href="https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93 ">GHSA-vrw8-fxc6-2r93</a>
- "Host Header Injection Leads to Open Redirect in
RedirectSlashes" <a
href="https://github.com/go-chi/chi/commit/1be7ad938cc9c5b39a9dea01a5c518848928ab65 ">commit</a>
<ul>
<li>a lower-severity Open Redirect that can't be exploited in browser or
email client, as it requires manipulation of a Host header</li>
<li>reported by Anuraag Baishya, <a
href="https://github.com/anuraagbaishya "><code>@anuraagbaishya</code></a>.
Thank you!</li>
</ul>
</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/pixel365 "><code>@pixel365</code></a>
made their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/974 ">go-chi/chi#974</a></li>
<li><a
href="https://github.com/mithileshgupta12 "><code>@mithileshgupta12</code></a>
made their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/958 ">go-chi/chi#958</a></li>
<li><a
href="https://github.com/efraimbart "><code>@efraimbart</code></a> made
their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/978 ">go-chi/chi#978</a></li>
<li><a href="https://github.com/cxjava "><code>@cxjava</code></a> made
their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/982 ">go-chi/chi#982</a></li>
<li><a href="https://github.com/sglkc "><code>@sglkc</code></a> made
their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/1001 ">go-chi/chi#1001</a></li>
<li><a href="https://github.com/mrdomino "><code>@mrdomino</code></a>
made their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/992 ">go-chi/chi#992</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-chi/chi/compare/v5.2.1...v5.2.2 ">https://github.com/go-chi/chi/compare/v5.2.1...v5.2.2 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/go-chi/chi/commit/23c395f8524a30334126ca16fb4d37b88745b9b9 "><code>23c395f</code></a>
Correct documentation (<a
href="https://redirect.github.com/go-chi/chi/issues/992 ">#992</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/5516d147c14a2b03824be7076fc6200bed906901 "><code>5516d14</code></a>
docs: change install code to code block (<a
href="https://redirect.github.com/go-chi/chi/issues/1001 ">#1001</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/e235052c10146fb724439442fc9d9a23e19fe931 "><code>e235052</code></a>
Make use of strings.Cut (<a
href="https://redirect.github.com/go-chi/chi/issues/1005 ">#1005</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/1be7ad938cc9c5b39a9dea01a5c518848928ab65 "><code>1be7ad9</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/go-chi/chi/commit/d7034fdfdaefd10f1bc1a7b813bc979f2eda3a36 "><code>d7034fd</code></a>
Exclude profiler when use tinygo (<a
href="https://redirect.github.com/go-chi/chi/issues/982 ">#982</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/d04703412f631922c8dd1527c6500627174828c1 "><code>d047034</code></a>
support tinygo (<a
href="https://redirect.github.com/go-chi/chi/issues/978 ">#978</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/fe2c065bc046056aecfa141022509a1e25bdd04b "><code>fe2c065</code></a>
Fixed the typo (<a
href="https://redirect.github.com/go-chi/chi/issues/958 ">#958</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/1aae5b2d2dc8f9e8ea1f68a7462693aaaa5f368c "><code>1aae5b2</code></a>
chore: delint ioutil usage (<a
href="https://redirect.github.com/go-chi/chi/issues/962 ">#962</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/c6225e35a4880a9a884c135b5f847a74e1e3a01e "><code>c6225e3</code></a>
go 1.24 (<a
href="https://redirect.github.com/go-chi/chi/issues/977 ">#977</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/e846b8304c769c4f1a51c9de06bebfaa4576bd88 "><code>e846b83</code></a>
Apply fieldalignment fixes to optimize struct memory layout (<a
href="https://redirect.github.com/go-chi/chi/issues/974 ">#974</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/go-chi/chi/compare/v5.2.1...v5.2.2 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/zitadel/zitadel/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <[email protected]
2025-07-02 12:32:16 +00:00
Max Peintner and GitHub
325aa1f184
fix(login): ensure correct i18n locale context ( #10156 )
...
This PR ensures that the correct locale context is set for the new login
2025-07-02 09:43:19 +00:00
2928c6ac2b
chore(login): migrate nextjs login to monorepo ( #10134 )
...
# Which Problems Are Solved
We move the login code to the zitadel repo.
# How the Problems Are Solved
The login repo is added to ./login as a git subtree pulled from the
dockerize-ci branch.
Apart from the login code, this PR contains the changes from #10116
# Additional Context
- Closes https://github.com/zitadel/typescript/issues/474
- Also merges #10116
- Merging is blocked by failing check because of:
- https://github.com/zitadel/zitadel/pull/10134#issuecomment-3012086106
---------
Co-authored-by: Max Peintner <[email protected] [email protected] [email protected]
2025-07-02 10:04:19 +02:00
