Skip to content

Commit 4e43cc0

Browse files
BrunoQuaresmaBrunoQuaresma
committed
Merge branch 'main' of https://github.com/coder/coder into bq/add-registered-users-endpoint
2 parents a20be9f + bebe4f0 commit 4e43cc0

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

65 files changed

+1480
-720
lines changed

‎.github/workflows/ci.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,7 @@ jobs:
188188
189189
# Check for any typos
190190
- name: Check for typos
191-
uses: crate-ci/typos@d01f29c66d1bf1a08730750f61d86c210b0d039d # v1.27.0
191+
uses: crate-ci/typos@b74202f74b4346efdbce7801d187ec57b266bac8 # v1.27.3
192192
with:
193193
config: .github/workflows/typos.toml
194194

@@ -211,7 +211,7 @@ jobs:
211211
212212
- name: Check workflow files
213213
run: |
214-
bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) 1.6.22
214+
bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) 1.7.4
215215
./actionlint -color -shellcheck= -ignore "set-output"
216216
shell: bash
217217

‎.github/workflows/pr-deploy.yaml

+26-13
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ jobs:
110110
set -euo pipefail
111111
mkdir -p ~/.kube
112112
echo "${{ secrets.PR_DEPLOYMENTS_KUBECONFIG_BASE64 }}" | base64 --decode > ~/.kube/config
113-
chmod 644 ~/.kube/config
113+
chmod 600 ~/.kube/config
114114
export KUBECONFIG=~/.kube/config
115115
116116
- name: Check if the helm deployment already exists
@@ -284,7 +284,7 @@ jobs:
284284
set -euo pipefail
285285
mkdir -p ~/.kube
286286
echo "${{ secrets.PR_DEPLOYMENTS_KUBECONFIG_BASE64 }}" | base64 --decode > ~/.kube/config
287-
chmod 644 ~/.kube/config
287+
chmod 600 ~/.kube/config
288288
export KUBECONFIG=~/.kube/config
289289
290290
- name: Check if image exists
@@ -421,14 +421,14 @@ jobs:
421421
"${DEST}" version
422422
mv "${DEST}" /usr/local/bin/coder
423423
424-
- name: Create first user, template and workspace
424+
- name: Create first user
425425
if: needs.get_info.outputs.NEW == 'true' || github.event.inputs.deploy == 'true'
426426
id: setup_deployment
427+
env:
428+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
427429
run: |
428430
set -euo pipefail
429431
430-
# Create first user
431-
432432
# create a masked random password 12 characters long
433433
password=$(openssl rand -base64 16 | tr -d "=+/" | cut -c1-12)
434434
@@ -437,20 +437,22 @@ jobs:
437437
echo "password=$password" >> $GITHUB_OUTPUT
438438
439439
coder login \
440-
--first-user-username coder \
440+
--first-user-username pr${{ env.PR_NUMBER }}-admin \
441441
--first-user-email pr${{ env.PR_NUMBER }}@coder.com \
442442
--first-user-password $password \
443443
--first-user-trial=false \
444444
--use-token-as-session \
445445
https://${{ env.PR_HOSTNAME }}
446446
447-
# Create template
448-
cd ./.github/pr-deployments/template
449-
coder templates push -y --variable namespace=pr${{ env.PR_NUMBER }} kubernetes
447+
# Create a user for the github.actor
448+
# TODO: update once https://github.com/coder/coder/issues/15466 is resolved
449+
# coder users create \
450+
# --username ${{ github.actor }} \
451+
# --login-type github
450452
451-
# Create workspace
452-
coder create --template="kubernetes" kube --parameter cpu=2 --parameter memory=4 --parameter home_disk_size=2 -y
453-
coder stop kube -y
453+
# promote the user to admin role
454+
# coder org members edit-role ${{ github.actor }} organization-admin
455+
# TODO: update once https://github.com/coder/internal/issues/207 is resolved
454456
455457
- name: Send Slack notification
456458
if: needs.get_info.outputs.NEW == 'true' || github.event.inputs.deploy == 'true'
@@ -462,7 +464,7 @@ jobs:
462464
"pr_url": "'"${{ env.PR_URL }}"'",
463465
"pr_title": "'"${{ env.PR_TITLE }}"'",
464466
"pr_access_url": "'"https://${{ env.PR_HOSTNAME }}"'",
465-
"pr_username": "'"test"'",
467+
"pr_username": "'"pr${{ env.PR_NUMBER }}-admin"'",
466468
"pr_email": "'"pr${{ env.PR_NUMBER }}@coder.com"'",
467469
"pr_password": "'"${{ steps.setup_deployment.outputs.password }}"'",
468470
"pr_actor": "'"${{ github.actor }}"'"
@@ -495,3 +497,14 @@ jobs:
495497
cc: @${{ github.actor }}
496498
reactions: rocket
497499
reactions-edit-mode: replace
500+
501+
- name: Create template and workspace
502+
if: needs.get_info.outputs.NEW == 'true' || github.event.inputs.deploy == 'true'
503+
run: |
504+
set -euo pipefail
505+
cd .github/pr-deployments/template
506+
coder templates push -y --variable namespace=pr${{ env.PR_NUMBER }} kubernetes
507+
508+
# Create workspace
509+
coder create --template="kubernetes" kube --parameter cpu=2 --parameter memory=4 --parameter home_disk_size=2 -y
510+
coder stop kube -y

‎.github/workflows/scorecard.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,6 @@ jobs:
4747

4848
# Upload the results to GitHub's code scanning dashboard.
4949
- name: "Upload to code-scanning"
50-
uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
50+
uses: github/codeql-action/upload-sarif@4f3212b61783c3c68e8309a0f18a699764811cda # v3.27.1
5151
with:
5252
sarif_file: results.sarif

‎.github/workflows/security.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ jobs:
3838
uses: ./.github/actions/setup-go
3939

4040
- name: Initialize CodeQL
41-
uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
41+
uses: github/codeql-action/init@4f3212b61783c3c68e8309a0f18a699764811cda # v3.27.1
4242
with:
4343
languages: go, javascript
4444

@@ -48,7 +48,7 @@ jobs:
4848
rm Makefile
4949
5050
- name: Perform CodeQL Analysis
51-
uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
51+
uses: github/codeql-action/analyze@4f3212b61783c3c68e8309a0f18a699764811cda # v3.27.1
5252

5353
- name: Send Slack notification on failure
5454
if: ${{ failure() }}
@@ -142,7 +142,7 @@ jobs:
142142
severity: "CRITICAL,HIGH"
143143

144144
- name: Upload Trivy scan results to GitHub Security tab
145-
uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
145+
uses: github/codeql-action/upload-sarif@4f3212b61783c3c68e8309a0f18a699764811cda # v3.27.1
146146
with:
147147
sarif_file: trivy-results.sarif
148148
category: "Trivy"

‎.github/workflows/weekly-docs.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@ on:
44
schedule:
55
- cron: "0 9 * * 1"
66
workflow_dispatch: # allows to run manually for testing
7-
pull_request:
8-
branches:
9-
- main
10-
paths:
11-
- "docs/**"
7+
# pull_request:
8+
# branches:
9+
# - main
10+
# paths:
11+
# - "docs/**"
1212

1313
permissions:
1414
contents: read

‎agent/reconnectingpty/screen.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -67,8 +67,6 @@ func newScreen(ctx context.Context, cmd *pty.Cmd, options *Options, logger slog.
6767
timeout: options.Timeout,
6868
}
6969

70-
go rpty.lifecycle(ctx, logger)
71-
7270
// Socket paths are limited to around 100 characters on Linux and macOS which
7371
// depending on the temporary directory can be a problem. To give more leeway
7472
// use a short ID.
@@ -80,6 +78,8 @@ func newScreen(ctx context.Context, cmd *pty.Cmd, options *Options, logger slog.
8078
}
8179
rpty.id = hex.EncodeToString(buf)
8280

81+
go rpty.lifecycle(ctx, logger)
82+
8383
settings := []string{
8484
// Disable the startup message that appears for five seconds.
8585
"startup_message off",

‎cli/cliui/agent.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -411,7 +411,8 @@ func (d ConnDiags) splitDiagnostics() (general, client, agent []string) {
411411
}
412412

413413
if d.DisableDirect {
414-
general = append(general, "❗ Direct connections are disabled locally, by `--disable-direct` or `CODER_DISABLE_DIRECT`")
414+
general = append(general, "❗ Direct connections are disabled locally, by `--disable-direct-connections` or `CODER_DISABLE_DIRECT_CONNECTIONS`.\n"+
415+
" They may still be established over a private network.")
415416
if !d.Verbose {
416417
return general, client, agent
417418
}

‎cli/ping.go

+25-5
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,7 @@ func (r *RootCmd) ping() *serpent.Command {
118118
workspaceName,
119119
)
120120
if err != nil {
121+
spin.Stop()
121122
return err
122123
}
123124

@@ -128,7 +129,6 @@ func (r *RootCmd) ping() *serpent.Command {
128129
}
129130

130131
if r.disableDirect {
131-
_, _ = fmt.Fprintln(inv.Stderr, "Direct connections disabled.")
132132
opts.BlockEndpoints = true
133133
}
134134
if !r.disableNetworkTelemetry {
@@ -137,6 +137,7 @@ func (r *RootCmd) ping() *serpent.Command {
137137
wsClient := workspacesdk.New(client)
138138
conn, err := wsClient.DialAgent(ctx, workspaceAgent.ID, opts)
139139
if err != nil {
140+
spin.Stop()
140141
return err
141142
}
142143
defer conn.Close()
@@ -168,6 +169,7 @@ func (r *RootCmd) ping() *serpent.Command {
168169

169170
connInfo, err := wsClient.AgentConnectionInfoGeneric(diagCtx)
170171
if err != nil || connInfo.DERPMap == nil {
172+
spin.Stop()
171173
return xerrors.Errorf("Failed to retrieve connection info from server: %w\n", err)
172174
}
173175
connDiags.ConnInfo = connInfo
@@ -197,6 +199,11 @@ func (r *RootCmd) ping() *serpent.Command {
197199
results := &pingSummary{
198200
Workspace: workspaceName,
199201
}
202+
var (
203+
pong *ipnstate.PingResult
204+
dur time.Duration
205+
p2p bool
206+
)
200207
n := 0
201208
start := time.Now()
202209
pingLoop:
@@ -207,7 +214,7 @@ func (r *RootCmd) ping() *serpent.Command {
207214
n++
208215

209216
ctx, cancel := context.WithTimeout(ctx, pingTimeout)
210-
dur, p2p, pong, err := conn.Ping(ctx)
217+
dur, p2p, pong, err = conn.Ping(ctx)
211218
cancel()
212219
results.addResult(pong)
213220
if err != nil {
@@ -275,10 +282,15 @@ func (r *RootCmd) ping() *serpent.Command {
275282
}
276283
}
277284

278-
if didP2p {
279-
_, _ = fmt.Fprintf(inv.Stderr, "✔ You are connected directly (p2p)\n")
285+
if p2p {
286+
msg := "✔ You are connected directly (p2p)"
287+
if pong != nil && isPrivateEndpoint(pong.Endpoint) {
288+
msg += ", over a private network"
289+
}
290+
_, _ = fmt.Fprintln(inv.Stderr, msg)
280291
} else {
281-
_, _ = fmt.Fprintf(inv.Stderr, "❗ You are connected via a DERP relay, not directly (p2p)\n%s#common-problems-with-direct-connections\n", connDiags.TroubleshootingURL)
292+
_, _ = fmt.Fprintf(inv.Stderr, "❗ You are connected via a DERP relay, not directly (p2p)\n"+
293+
" %s#common-problems-with-direct-connections\n", connDiags.TroubleshootingURL)
282294
}
283295

284296
results.Write(inv.Stdout)
@@ -329,3 +341,11 @@ func isAWSIP(awsRanges *cliutil.AWSIPRanges, ni *tailcfg.NetInfo) bool {
329341
}
330342
return false
331343
}
344+
345+
func isPrivateEndpoint(endpoint string) bool {
346+
ip, err := netip.ParseAddrPort(endpoint)
347+
if err != nil {
348+
return false
349+
}
350+
return ip.Addr().IsPrivate()
351+
}

‎cli/testdata/coder_server_--help.golden

-13
Original file line numberDiff line numberDiff line change
@@ -506,11 +506,6 @@ OIDC OPTIONS:
506506
groups. This filter is applied after the group mapping and before the
507507
regex filter.
508508

509-
--oidc-organization-assign-default bool, $CODER_OIDC_ORGANIZATION_ASSIGN_DEFAULT (default: true)
510-
If set to true, users will always be added to the default
511-
organization. If organization sync is enabled, then the default org is
512-
always added to the user's set of expectedorganizations.
513-
514509
--oidc-auth-url-params struct[map[string]string], $CODER_OIDC_AUTH_URL_PARAMS (default: {"access_type": "offline"})
515510
OIDC auth URL parameters to pass to the upstream provider.
516511

@@ -557,14 +552,6 @@ OIDC OPTIONS:
557552
--oidc-name-field string, $CODER_OIDC_NAME_FIELD (default: name)
558553
OIDC claim field to use as the name.
559554

560-
--oidc-organization-field string, $CODER_OIDC_ORGANIZATION_FIELD
561-
This field must be set if using the organization sync feature. Set to
562-
the claim to be used for organizations.
563-
564-
--oidc-organization-mapping struct[map[string][]uuid.UUID], $CODER_OIDC_ORGANIZATION_MAPPING (default: {})
565-
A map of OIDC claims and the organizations in Coder it should map to.
566-
This is required because organization IDs must be used within Coder.
567-
568555
--oidc-group-regex-filter regexp, $CODER_OIDC_GROUP_REGEX_FILTER (default: .*)
569556
If provided any group name not matching the regex is ignored. This
570557
allows for filtering out groups that are not needed. This filter is

0 commit comments

Comments
 (0)