Skip to content

Commit 3f88801

Browse files
EmyrkEmyrk
committed
Merge remote-tracking branch 'origin/main' into stevenmasley/license_id
2 parents 7493130 + a54de60 commit 3f88801

File tree

387 files changed

+12050
-3508
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

387 files changed

+12050
-3508
lines changed

‎.github/workflows/ci.yaml

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,8 @@ jobs:
121121
- 'site/**'
122122
k8s:
123123
- 'helm/**'
124-
- Dockerfile
124+
- scripts/Dockerfile
125+
- scripts/Dockerfile.base
125126
- scripts/helm.sh
126127
- id: debug
127128
run: |
@@ -582,9 +583,6 @@ jobs:
582583
- run: yarn playwright:install
583584
working-directory: site
584585

585-
- run: yarn playwright:install-deps
586-
working-directory: site
587-
588586
- run: yarn playwright:test
589587
env:
590588
DEBUG: pw:api

‎.github/workflows/docker-base.yaml

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: docker-base
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- scripts/Dockerfile.base
9+
- scripts/Dockerfile
10+
11+
schedule:
12+
# Run every week at 09:43 on Monday, Wednesday and Friday. We build this
13+
# frequently to ensure that packages are up-to-date.
14+
- cron: "43 9 * * 1,3,5"
15+
16+
workflow_dispatch:
17+
18+
permissions:
19+
contents: read
20+
# Necessary to push docker images to ghcr.io.
21+
packages: write
22+
# Necessary for depot.dev authentication.
23+
id-token: write
24+
25+
# Avoid running multiple jobs for the same commit.
26+
concurrency:
27+
group: ${{ github.workflow }}-${{ github.ref }}-docker-base
28+
29+
jobs:
30+
build:
31+
runs-on: ubuntu-latest
32+
if: github.repository_owner == 'coder'
33+
steps:
34+
- uses: actions/checkout@v3
35+
36+
- name: Docker login
37+
uses: docker/login-action@v2
38+
with:
39+
registry: ghcr.io
40+
username: ${{ github.actor }}
41+
password: ${{ secrets.GITHUB_TOKEN }}
42+
43+
- name: Create empty base-build-context directory
44+
run: mkdir base-build-context
45+
46+
- name: Install depot.dev CLI
47+
uses: depot/setup-action@v1
48+
49+
# This uses OIDC authentication, so no auth variables are required.
50+
- name: Build base Docker image via depot.dev
51+
uses: depot/build-push-action@v1
52+
with:
53+
project: wl5hnrrkns
54+
context: base-build-context
55+
file: scripts/Dockerfile.base
56+
pull: true
57+
no-cache: true
58+
push: true
59+
tags: |
60+
ghcr.io/coder/coder-base:latest

‎.github/workflows/release.yaml

Lines changed: 52 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ jobs:
6363
6464
- name: Create release notes
6565
env:
66+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
6667
# We always have to set this since there might be commits on
6768
# main that didn't have a PR.
6869
CODER_IGNORE_MISSING_COMMIT_METADATA: "1"
@@ -112,17 +113,17 @@ jobs:
112113
set -euo pipefail
113114
wget -O /tmp/nfpm.deb https://github.com/goreleaser/nfpm/releases/download/v2.18.1/nfpm_amd64.deb
114115
sudo dpkg -i /tmp/nfpm.deb
116+
rm /tmp/nfpm.deb
115117
116118
- name: Install rcodesign
117119
run: |
118120
set -euo pipefail
119-
120-
# Install a prebuilt binary of rcodesign for linux amd64. Once the
121-
# following PR is merged and released upstream, we can download
122-
# directly from GitHub releases instead:
123-
# https://github.com/indygreg/PyOxidizer/pull/635
124-
wget -O /tmp/rcodesign https://cdn.discordapp.com/attachments/283356472258199552/1016767245717872700/rcodesign
125-
sudo install --mode 755 /tmp/rcodesign /usr/local/bin/rcodesign
121+
wget -O /tmp/rcodesign.tar.gz https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F0.22.0/apple-codesign-0.22.0-x86_64-unknown-linux-musl.tar.gz
122+
sudo tar -xzf /tmp/rcodesign.tar.gz \
123+
-C /usr/bin \
124+
--strip-components=1 \
125+
apple-codesign-0.22.0-x86_64-unknown-linux-musl/rcodesign
126+
rm /tmp/rcodesign.tar.gz
126127
127128
- name: Setup Apple Developer certificate and API key
128129
run: |
@@ -160,6 +161,39 @@ jobs:
160161
- name: Delete Apple Developer certificate and API key
161162
run: rm -f /tmp/{apple_cert.p12,apple_cert_password.txt,apple_apikey.p8}
162163

164+
- name: Determine base image tag
165+
id: image-base-tag
166+
run: |
167+
set -euo pipefail
168+
if [[ "${CODER_RELEASE:-}" != *t* ]] || [[ "${CODER_DRY_RUN:-}" == *t* ]]; then
169+
# Empty value means use the default and avoid building a fresh one.
170+
echo "tag=" >> $GITHUB_OUTPUT
171+
else
172+
echo "tag=$(CODER_IMAGE_BASE=ghcr.io/coder/coder-base ./scripts/image_tag.sh)" >> $GITHUB_OUTPUT
173+
fi
174+
175+
- name: Create empty base-build-context directory
176+
if: steps.image-base-tag.outputs.tag != ''
177+
run: mkdir base-build-context
178+
179+
- name: Install depot.dev CLI
180+
if: steps.image-base-tag.outputs.tag != ''
181+
uses: depot/setup-action@v1
182+
183+
# This uses OIDC authentication, so no auth variables are required.
184+
- name: Build base Docker image via depot.dev
185+
if: steps.image-base-tag.outputs.tag != ''
186+
uses: depot/build-push-action@v1
187+
with:
188+
project: wl5hnrrkns
189+
context: base-build-context
190+
file: scripts/Dockerfile.base
191+
pull: true
192+
no-cache: true
193+
push: true
194+
tags: |
195+
${{ steps.image-base-tag.outputs.tag }}
196+
163197
- name: Build Linux Docker images
164198
run: |
165199
set -euxo pipefail
@@ -188,6 +222,8 @@ jobs:
188222
--target "$(./scripts/image_tag.sh --version latest)" \
189223
$(cat build/coder_"$version"_linux_{amd64,arm64,armv7}.tag)
190224
fi
225+
env:
226+
CODER_BASE_IMAGE_TAG: ${{ steps.image-base-tag.outputs.tag }}
191227

192228
- name: ls build
193229
run: ls -lh build
@@ -252,6 +288,15 @@ jobs:
252288
./build/*.rpm
253289
retention-days: 7
254290

291+
- name: Start Packer builds
292+
if: ${{ !inputs.dry_run }}
293+
uses: peter-evans/repository-dispatch@v2
294+
with:
295+
token: ${{ secrets.CDRCI_GITHUB_TOKEN }}
296+
repository: coder/packages
297+
event-type: coder-release
298+
client-payload: '{"coder_version": "${{ steps.version.outputs.version }}"}'
299+
255300
publish-winget:
256301
name: Publish to winget-pkgs
257302
runs-on: windows-latest
@@ -333,11 +378,3 @@ jobs:
333378
# For gh CLI. We need a real token since we're commenting on a PR in a
334379
# different repo.
335380
GH_TOKEN: ${{ secrets.CDRCI_GITHUB_TOKEN }}
336-
337-
- name: Start Packer builds
338-
uses: peter-evans/repository-dispatch@v2
339-
with:
340-
token: ${{ secrets.CDRCI_GITHUB_TOKEN }}
341-
repository: coder/packages
342-
event-type: coder-release
343-
client-payload: '{"coder_version": "${{ needs.release.outputs.version }}"}'

‎.github/workflows/security.yaml

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -92,12 +92,27 @@ jobs:
9292
restore-keys: |
9393
js-${{ runner.os }}-
9494
95+
- name: Install yq
96+
run: go run github.com/mikefarah/yq/v4@v4.30.6
97+
9598
- name: Build Coder linux amd64 Docker image
9699
id: build
97100
run: |
98101
set -euo pipefail
99-
image_job="build/coder_$(./scripts/version.sh)_linux_amd64.tag"
100-
DOCKER_IMAGE_NO_PREREQUISITES=true make -j "$image_job"
102+
103+
version="$(./scripts/version.sh)"
104+
image_job="build/coder_${version}_linux_amd64.tag"
105+
106+
# This environment variable force make to not build packages and
107+
# archives (which the Docker image depends on due to technical reasons
108+
# related to concurrent FS writes).
109+
export DOCKER_IMAGE_NO_PREREQUISITES=true
110+
# This environment variables forces scripts/build_docker.sh to build
111+
# the base image tag locally instead of using the cached version from
112+
# the registry.
113+
export CODER_IMAGE_BUILD_BASE_TAG="$(CODER_IMAGE_BASE=coder-base ./scripts/image_tag.sh --version "$version")"
114+
115+
make -j "$image_job"
101116
echo "image=$(cat "$image_job")" >> $GITHUB_OUTPUT
102117
103118
- name: Run Trivy vulnerability scanner
@@ -112,6 +127,7 @@ jobs:
112127
uses: github/codeql-action/upload-sarif@v2
113128
with:
114129
sarif_file: trivy-results.sarif
130+
category: "Trivy"
115131

116132
- name: Upload Trivy scan results as an artifact
117133
uses: actions/upload-artifact@v2

‎.github/workflows/stale.yaml

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
name: Stale Issue Cron
1+
name: Stale Issue and Branch Cleanup
22
on:
33
schedule:
44
# Every day at midnight
55
- cron: "0 0 * * *"
66
workflow_dispatch:
77
jobs:
8-
stale:
8+
issues:
99
runs-on: ubuntu-latest
1010
permissions:
1111
issues: write
@@ -32,3 +32,17 @@ jobs:
3232
operations-per-run: 60
3333
# Start with the oldest issues, always.
3434
ascending: true
35+
branches:
36+
runs-on: ubuntu-latest
37+
steps:
38+
- name: Checkout repository
39+
uses: actions/checkout@v2
40+
- name: Run delete-old-branches-action
41+
uses: beatlabs/delete-old-branches-action@v0.0.9
42+
with:
43+
repo_token: ${{ github.token }}
44+
date: "6 months ago"
45+
dry_run: false
46+
delete_tags: false
47+
# extra_protected_branch_regex: ^(foo|bar)$
48+
exclude_open_pr_branches: true

‎Makefile

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -610,7 +610,8 @@ test-postgres-docker:
610610
-c max_connections=1000 \
611611
-c fsync=off \
612612
-c synchronous_commit=off \
613-
-c full_page_writes=off
613+
-c full_page_writes=off \
614+
-c log_statement=all
614615
while ! pg_isready -h 127.0.0.1
615616
do
616617
echo "$(date) - waiting for database to start"

0 commit comments

Comments
 (0)