mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-19 06:02:52 +00:00
Tim MöhlmannandGitHub
e94d4c3986
# Which Problems Are Solved Enable FIPS 140-3 compliant build. # How the Problems Are Solved - Add runtime config validation, if the FIPS flag is enabled fail the application when a non-compliant hasher is used, or throw a warning when a legacy verifier is used - Add a build matrix for FIPS certified build: - Go binary is built with `GOFIPS140=certified` - Login container uses a separate base: [ubi9](https://catalog.redhat.com/en/software/containers/ubi9/ubi/615bcf606feffc5384e8452e) from redhat which provides a FIPS certified OpenSSL (used by NodeJS TLS stack) - Non-FIPS images where already pushed to both Github Container Registry and Google Artifact Repository (GAR). Fips images are only pushed to the GAR. - Tag versions are suffixed `-fips`. So on release the following images will be additionally available: ``` europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel-login:vX.Y.Z-fips europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips-debug europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips ``` # Other changes - Bumb Go toolchain. At least v1.25.10 is required for a GOFIPS140=certified setting. # Additional Context - Closes https://github.com/zitadel/zitadel/issues/4335 - Build [test run](https://github.com/zitadel/zitadel/actions/runs/27253916052) pushing FIPS and non-FIPS images
101 lines
3.3 KiB
YAML
101 lines
3.3 KiB
YAML
name: Lint Test Build
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
node_version:
|
|
required: true
|
|
type: string
|
|
secrets:
|
|
CODECOV_TOKEN:
|
|
required: true
|
|
NX_CLOUD_ACCESS_TOKEN_READONLY:
|
|
required: true
|
|
|
|
jobs:
|
|
lint_test_build:
|
|
name: Lint, Test and Build
|
|
runs-on: depot-ubuntu-22.04-16
|
|
environment: ${{ github.ref_protected == 'true' && 'Protected' || null }}
|
|
steps:
|
|
- name: Checkout Repository
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
filter: tree:0
|
|
- name: Fetch main branch
|
|
if: ${{ github.ref != 'refs/heads/main' }}
|
|
run: git fetch origin main:main
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: go.mod
|
|
- name: Set up pnpm
|
|
uses: pnpm/action-setup@v4
|
|
with:
|
|
run_install: false
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: ${{ inputs.node_version }}
|
|
cache: "pnpm"
|
|
- name: Set up Docker
|
|
uses: docker/setup-docker-action@v4
|
|
with:
|
|
version: v28.3.2
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
with:
|
|
version: v0.28.0
|
|
- name: Set up Docker Compose
|
|
uses: docker/setup-compose-action@v1
|
|
with:
|
|
version: v2.38.2
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Set SHAs for nx affected commands
|
|
uses: nrwl/nx-set-shas@v4
|
|
- name: Lint, Test and Build
|
|
env:
|
|
NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }}
|
|
NX_DAEMON: "false"
|
|
NX_DISABLE_DB: "true"
|
|
run: pnpm nx affected --nxBail --targets lint test build --exclude @zitadel/docs
|
|
- name: Check for uncommitted changes (Codegen mismatch)
|
|
run: git diff --exit-code
|
|
- name: Suggest Pipeline Fix By Nx Cloud AI
|
|
if: failure() || cancelled()
|
|
env:
|
|
NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }}
|
|
run: pnpm nx fix-ci
|
|
- name: Publish API Unit Test Coverage
|
|
uses: codecov/[email protected]
|
|
with:
|
|
file: profile.api.test-unit.cov
|
|
name: api-test-unit
|
|
flags: api-test-unit
|
|
token: ${{ secrets.CODECOV_TOKEN }}
|
|
- name: Publish API Integration Test Coverage
|
|
uses: codecov/[email protected]
|
|
with:
|
|
file: profile.api.test-integration.cov
|
|
name: api-test-integration
|
|
flags: api-test-integration
|
|
token: ${{ secrets.CODECOV_TOKEN }}
|
|
- name: Upload API Integration Test Race Logs
|
|
if: failure() || cancelled()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: api-integration-test-race-logs
|
|
path: |
|
|
.artifacts/api-test-integration/race.log.*
|
|
- name: Upload Functional UI Test Artifacts
|
|
uses: actions/upload-artifact@v4
|
|
if: failure() || cancelled()
|
|
with:
|
|
name: functional-ui-tests
|
|
path: |
|
|
tests/functional-ui/cypress/screenshots
|
|
tests/functional-ui/cypress/videos
|
|
tests/functional-ui/cypress/results
|