# Which Problems Are Solved
When resolving the organization for a self-registration, the resource
owner was determined only from an explicitly requested org, falling back
to the default org. The login policy applied to the same request,
however, is resolved from the requested org, the user org, and only then
the default org. As a result the two could diverge — e.g. after the
login context had already resolved a user's organization — and a user
could be registered in a different organization than the one whose
settings were evaluated for the request.
# How the Problems Are Solved
`determineResourceOwner` now uses the same resolution order as the
policy lookup (requested org, then user org, then default org), so the
organization a user is registered in matches the one the request was
evaluated against.
# Additional Changes
Added a unit test covering the resolution order.
# Additional Context
Aligns login v1 registration org resolution with the behavior in login
v2.
Co-authored-by: Claude Opus 4.8 <[email protected]>
# Which Problems Are Solved
Enable FIPS 140-3 compliant build.
# How the Problems Are Solved
- Add runtime config validation, if the FIPS flag is enabled fail the
application when a non-compliant hasher is used, or throw a warning when
a legacy verifier is used
- Add a build matrix for FIPS certified build:
- Go binary is built with `GOFIPS140=certified`
- Login container uses a separate base:
[ubi9](https://catalog.redhat.com/en/software/containers/ubi9/ubi/615bcf606feffc5384e8452e)
from redhat which provides a FIPS certified OpenSSL (used by NodeJS TLS
stack)
- Non-FIPS images where already pushed to both Github Container Registry
and Google Artifact Repository (GAR). Fips images are only pushed to the
GAR.
- Tag versions are suffixed `-fips`. So on release the following images
will be additionally available:
```
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel-login:vX.Y.Z-fips
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips-debug
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips
```
# Other changes
- Bumb Go toolchain. At least v1.25.10 is required for a
GOFIPS140=certified setting.
# Additional Context
- Closes https://github.com/zitadel/zitadel/issues/4335
- Build [test
run](https://github.com/zitadel/zitadel/actions/runs/27253916052)
pushing FIPS and non-FIPS images
Updates all dependencies to latests versions (apart from the ones where
there are already issues to solve their updates).
Some updates required minor changes.
# Which Problems Are Solved
Removes the Cypress integration tests and associated configuration from
the apps/login project to streamline the build process.
# How the Problems Are Solved
- Removed cypress directory, integration directory, and
cypress.config.ts from apps/login.
- Updated project.json to remove test-integration targets and
dependencies.
- Updated package.json to remove the cypress dev dependency and clean
script reference.
- Updated tsconfig.json to remove the now-redundant integration
exclusion.
- Ensured acceptance tests are preserved and correctly excluded from
build inputs.
---------
Co-authored-by: Florian Forster <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: conblem <[email protected]>
This fixes a case where potentially some static files get not properly
treated as inputs in the hash for nx cache calculation.
Also it fixes a problem where the assets.mdx get sorted randomly each
generation.
Factors in some overlap from
https://github.com/zitadel/zitadel/pull/11447
---------
Co-authored-by: Copilot <[email protected]>
# Which Problems Are Solved
This PR improves our NX caching, especially for the console and api.
It makes sure that if the console is changed the api is also rebuilt and
if the api is changed the functional-ui tests are rerun. It is important
to note this only fixes a subset of our problems.
# How the Problems Are Solved
NX ignores .gitignored files even if they are explicitly added to the
inputs of an NX target. To counteract this one can add these files to a
.nxignore file with a negated pattern.
https://nx.dev/docs/reference/inputs#token-behavior-with-nested-projects
. This solution is not documented per se but can be find in this Github
issue: https://github.com/nrwl/nx/issues/6821 . Further more nx
calculates the hashes of inputs at the start and does not recalculate
them even if a dependency of a target changes. To solve this problem one
needs to use
https://nx.dev/docs/reference/inputs#outputs-of-dependent-tasks . This
comment of an NX developer helped me further to understand the actual
behaviour of NX:
https://github.com/nrwl/nx/issues/33379#issuecomment-3657929455 .
# Additional Changes
Because the functional-ui tests now correctly run again they had to be
fixed. This pr unifies the field names in the user create v1 and v2 ui.
# Additional Context
To document this somewhere, this proposed fix does not work:
https://github.com/nrwl/nx/issues/6821#issuecomment-1309475504 . In my
local testing NX runtime inputs also get executed at the beginning of
the NX loop and ignore subsequent changes by targets. While testing this
fix and browsing through NX code I found this, which could be helpful in
the future and isn't documented: https://github.com/nrwl/nx/pull/31428
# Which Problems Are Solved
This PR makes sure that the tarballs containing the API binary and the
standalone login are separately downloadable from the release pages
again.
# How the Problems Are Solved
Because the `Pack` workflow uploads a single GitHub artifact containing
all tarballs since #10571, we download this artifact so that it
correctly unpacks into the correct folder structure configured in
`.releaserc.js`
The changes are tested [with this action
run](https://github.com/eliobischof/zitadel/actions/runs/18745783976),
which [created this
release](https://github.com/eliobischof/zitadel/releases/tag/v1.0.0-release-archives.5).
# Additional Changes
- The term `standalone` is removed from the login tarball, as it should
be clear that it is a standalone build.
- The go builds and the login archiving are less verbose
- The pipelines go versions are pinned to *v1.25*, a minor above the
minimally required go version *v1.24.0* described in the go.mod file.
This makes sure that we build using newer patches for security and
performance.
# Additional Context
- The archives weren't published anymore since #10571
- Closes#10896
---------
Co-authored-by: Silvan <[email protected]>
# Which Problems Are Solved
In order for golangci-lint to be able to compare what changed against
main, we have to check out main on branches.
If the pipeline runs on main, the branch can't be checked out twice and
the pipeline fails.
# How the Problems Are Solved
The step `Fetch main branch` in `lint_test_build` is only executed if
the workflow doesn't run on main, because in this case, the branch is
already checked out by the `Checkout Repository` step.
# Additional Changes
PRs can only be merged if `lint_test_buld` succeeds on an up-to-date
branch. When a PR is merged, it triggers a push event which runs
`lint_test_build` again on main with the same conditions. This is
obsolete. Pushes to main don't trigger the `lint_test_build` workflow
anymore.
# Additional Context
- Resolves
https://github.com/zitadel/zitadel/actions/runs/18339015014/job/52229685065
# Which Problems Are Solved
Replaces Turbo by Nx and lays the foundation for the next CI
improvements. It enables using Nx Cloud to speed the up the pipelines
that affect any node package.
It streamlines the dev experience for frontend and backend developers by
providing the following commands:
| Task | Command | Notes |
|------|---------|--------|
| **Production** | `nx run PROJECT:prod` | Production server |
| **Develop** | `nx run PROJECT:dev` | Hot reloading development server
|
| **Test** | `nx run PROJECT:test` | Run all tests |
| **Lint** | `nx run PROJECT:lint` | Check code style |
| **Lint Fix** | `nx run PROJECT:lint-fix` | Auto-fix style issues |
The following values can be used for PROJECT:
- @zitadel/zitadel (root commands)
- @zitadel/api,
- @zitadel/login,
- @zitadel/console,
- @zitadel/docs,
- @zitadel/client
- @zitadel/proto
The project names and folders are streamlined:
| Old Folder | New Folder |
| --- | --- |
| ./e2e | ./tests/functional-ui |
| ./load-test | ./benchmark |
| ./build/zitadel | ./apps/api |
| ./console | ./apps/console (postponed so the PR is reviewable) |
Also, all references to the TypeScript repo are removed so we can
archive it.
# How the Problems Are Solved
- Ran `npx nx@latest init`
- Replaced all turbo.json by project.json and fixed the target configs
- Removed Turbo dependency
- All JavaScript related code affected by a PRs changes is
quality-checked using the `nx affected` command
- We move PR checks that are runnable using Nx into the `check`
workflow. For workflows where we don't use Nx, yet, we restore
previously built dependency artifacts from Nx.
- We only use a single and easy to understand dev container
- The CONTRIBUTING.md is streamlined
- The setup with a generated client pat is orchestrated with Nx
- Everything related to the TypeScript repo is updated or removed. A
**Deploy with Vercel** button is added to the docs and the
CONTRIBUTING.md.
# Additional Changes
- NPM package names have a consistent pattern.
- Docker bake is removed. The login container is built and released like
the core container.
- The integration tests build the login container before running, so
they don't rely on the login container action anymore. This fixes
consistently failing checks on PRs from forks.
- The docs build in GitHub actions is removed, as we already build on
Vercel.
# Additional Context
- Internal discussion:
https://zitadel.slack.com/archives/C087ADF8LRX/p1756277884928169
- Workflow dispatch test:
https://github.com/zitadel/zitadel/actions/runs/17760122959
---------
Co-authored-by: Florian Forster <[email protected]>
Co-authored-by: Tim Möhlmann <[email protected]>
Co-authored-by: Copilot <[email protected]>
Tim MöhlmannandGitHub
