mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 05:52:51 +00:00
711d688294
# Which Problems Are Solved When resolving the organization for a self-registration, the resource owner was determined only from an explicitly requested org, falling back to the default org. The login policy applied to the same request, however, is resolved from the requested org, the user org, and only then the default org. As a result the two could diverge — e.g. after the login context had already resolved a user's organization — and a user could be registered in a different organization than the one whose settings were evaluated for the request. # How the Problems Are Solved `determineResourceOwner` now uses the same resolution order as the policy lookup (requested org, then user org, then default org), so the organization a user is registered in matches the one the request was evaluated against. # Additional Changes Added a unit test covering the resolution order. # Additional Context Aligns login v1 registration org resolution with the behavior in login v2. Co-authored-by: Claude Opus 4.8 <[email protected]>
112 lines
3.9 KiB
YAML
112 lines
3.9 KiB
YAML
name: Lint Test Build
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
node_version:
|
|
required: true
|
|
type: string
|
|
secrets:
|
|
CODECOV_TOKEN:
|
|
required: true
|
|
NX_CLOUD_ACCESS_TOKEN_READONLY:
|
|
required: true
|
|
|
|
jobs:
|
|
lint_test_build:
|
|
name: Lint, Test and Build
|
|
runs-on: depot-ubuntu-22.04-16
|
|
environment: ${{ github.ref_protected == 'true' && 'Protected' || null }}
|
|
steps:
|
|
- name: Checkout Repository
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
filter: tree:0
|
|
- name: Fetch main branch
|
|
if: ${{ github.ref != 'refs/heads/main' }}
|
|
run: git fetch origin main:main
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: go.mod
|
|
- name: Set up pnpm
|
|
uses: pnpm/action-setup@v4
|
|
with:
|
|
run_install: false
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: ${{ inputs.node_version }}
|
|
cache: "pnpm"
|
|
- name: Set up Docker
|
|
uses: docker/setup-docker-action@v4
|
|
with:
|
|
version: v28.3.2
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
with:
|
|
version: v0.28.0
|
|
- name: Set up Docker Compose
|
|
uses: docker/setup-compose-action@v1
|
|
with:
|
|
version: v2.38.2
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Set SHAs for nx affected commands
|
|
uses: nrwl/nx-set-shas@v4
|
|
# The Depot runner image points /etc/resolv.conf directly at public DNS (8.8.8.8),
|
|
# bypassing the systemd-resolved stub, so *.integration.localhost (synthesized by
|
|
# systemd-resolved) no longer resolves and all API integration tests hang.
|
|
# Route DNS back through the stub until the image is fixed or the tests stop
|
|
# depending on wildcard localhost DNS.
|
|
- name: Restore systemd-resolved stub for *.localhost resolution
|
|
run: |
|
|
set -ex
|
|
test -e /run/systemd/resolve/stub-resolv.conf
|
|
sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
|
|
getent hosts foo.integration.localhost
|
|
- name: Lint, Test and Build
|
|
env:
|
|
NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }}
|
|
NX_DAEMON: "false"
|
|
NX_DISABLE_DB: "true"
|
|
run: pnpm nx affected --nxBail --targets lint test build --exclude @zitadel/docs
|
|
- name: Check for uncommitted changes (Codegen mismatch)
|
|
run: git diff --exit-code
|
|
- name: Suggest Pipeline Fix By Nx Cloud AI
|
|
if: failure() || cancelled()
|
|
env:
|
|
NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }}
|
|
run: pnpm nx fix-ci
|
|
- name: Publish API Unit Test Coverage
|
|
uses: codecov/[email protected]
|
|
with:
|
|
file: profile.api.test-unit.cov
|
|
name: api-test-unit
|
|
flags: api-test-unit
|
|
token: ${{ secrets.CODECOV_TOKEN }}
|
|
- name: Publish API Integration Test Coverage
|
|
uses: codecov/[email protected]
|
|
with:
|
|
file: profile.api.test-integration.cov
|
|
name: api-test-integration
|
|
flags: api-test-integration
|
|
token: ${{ secrets.CODECOV_TOKEN }}
|
|
- name: Upload API Integration Test Race Logs
|
|
if: failure() || cancelled()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: api-integration-test-race-logs
|
|
path: |
|
|
.artifacts/api-test-integration/race.log.*
|
|
- name: Upload Functional UI Test Artifacts
|
|
uses: actions/upload-artifact@v4
|
|
if: failure() || cancelled()
|
|
with:
|
|
name: functional-ui-tests
|
|
path: |
|
|
tests/functional-ui/cypress/screenshots
|
|
tests/functional-ui/cypress/videos
|
|
tests/functional-ui/cypress/results
|