Skip to content

Commit ae6e17f

Browse files
ssncferreirassncferreira
committed
Merge remote-tracking branch 'origin/main' into ssncferreira/feat-cli-schedule-prebuild
2 parents 50133fc + 791d39c commit ae6e17f

File tree

6 files changed

+100
-5
lines changed

6 files changed

+100
-5
lines changed

‎.github/workflows/release.yaml

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,36 @@ env:
3232
CODER_RELEASE_NOTES: ${{ inputs.release_notes }}
3333

3434
jobs:
35+
# Only allow maintainers/admins to release.
36+
check-perms:
37+
runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
38+
steps:
39+
- name: Allow only maintainers/admins
40+
uses: actions/github-script@v7.0.1
41+
with:
42+
github-token: ${{ secrets.GITHUB_TOKEN }}
43+
script: |
44+
const {data} = await github.rest.repos.getCollaboratorPermissionLevel({
45+
owner: context.repo.owner,
46+
repo: context.repo.repo,
47+
username: context.actor
48+
});
49+
const role = data.role_name || data.user?.role_name || data.permission;
50+
const perms = data.user?.permissions || {};
51+
core.info(`Actor ${context.actor} permission=${data.permission}, role_name=${role}`);
52+
53+
const allowed =
54+
role === 'admin' ||
55+
role === 'maintain' ||
56+
perms.admin === true ||
57+
perms.maintain === true;
58+
59+
if (!allowed) core.setFailed('Denied: requires maintain or admin');
60+
3561
# build-dylib is a separate job to build the dylib on macOS.
3662
build-dylib:
3763
runs-on: ${{ github.repository_owner == 'coder' && 'depot-macos-latest' || 'macos-latest' }}
64+
needs: check-perms
3865
steps:
3966
# Harden Runner doesn't work on macOS.
4067
- name: Checkout
@@ -114,7 +141,7 @@ jobs:
114141

115142
release:
116143
name: Build and publish
117-
needs: build-dylib
144+
needs: [build-dylib, check-perms]
118145
runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
119146
permissions:
120147
# Required to publish a release

‎coderd/database/querier_test.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6009,10 +6009,10 @@ func TestUserSecretsCRUDOperations(t *testing.T) {
60096009

60106010
// Use raw database without dbauthz wrapper for this test
60116011
db, _ := dbtestutil.NewDB(t)
6012-
ctx := testutil.Context(t, testutil.WaitMedium)
60136012

60146013
t.Run("FullCRUDWorkflow", func(t *testing.T) {
60156014
t.Parallel()
6015+
ctx := testutil.Context(t, testutil.WaitMedium)
60166016

60176017
// Create a new user for this test
60186018
testUser := dbgen.User(t, db, database.User{})
@@ -6085,6 +6085,7 @@ func TestUserSecretsCRUDOperations(t *testing.T) {
60856085

60866086
t.Run("UniqueConstraints", func(t *testing.T) {
60876087
t.Parallel()
6088+
ctx := testutil.Context(t, testutil.WaitMedium)
60886089

60896090
// Create a new user for this test
60906091
testUser := dbgen.User(t, db, database.User{})
@@ -6156,7 +6157,6 @@ func TestUserSecretsAuthorization(t *testing.T) {
61566157
db, _ := dbtestutil.NewDB(t)
61576158
authorizer := rbac.NewStrictCachingAuthorizer(prometheus.NewRegistry())
61586159
authDB := dbauthz.New(db, authorizer, slogtest.Make(t, &slogtest.Options{}), coderdtest.AccessControlStorePointer())
6159-
ctx := testutil.Context(t, testutil.WaitMedium)
61606160

61616161
// Create test users
61626162
user1 := dbgen.User(t, db, database.User{})
@@ -6234,6 +6234,7 @@ func TestUserSecretsAuthorization(t *testing.T) {
62346234
tc := tc // capture range variable
62356235
t.Run(tc.name, func(t *testing.T) {
62366236
t.Parallel()
6237+
ctx := testutil.Context(t, testutil.WaitMedium)
62376238

62386239
authCtx := dbauthz.As(ctx, tc.subject)
62396240

‎docs/admin/monitoring/logs.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ machine/VM.
1717
options.
1818
- To only display certain types of logs, use
1919
the[`CODER_LOG_FILTER`](../../reference/cli/server.md#-l---log-filter) server
20-
config.
20+
config. Using `.*` will result in the `DEBUG` log level being used.
2121

2222
Events such as server errors, audit logs, user activities, and SSO & OpenID
2323
Connect logs are all captured in the `coderd` logs.

‎docs/admin/users/oidc-auth/google.md

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# Google authentication (OIDC)
2+
3+
This guide shows how to configure Coder to authenticate users with Google using OpenID Connect (OIDC).
4+
5+
## Prerequisites
6+
7+
- A Google Cloud project with the OAuth consent screen configured
8+
- Permission to create OAuth 2.0 Client IDs in Google Cloud
9+
10+
## Step 1: Create an OAuth client in Google Cloud
11+
12+
1. Open Google Cloud Console → APIs & Services → Credentials → Create Credentials → OAuth client ID.
13+
2. Application type: Web application.
14+
3. Authorized redirect URIs: add your Coder callback URL:
15+
- `https://coder.example.com/api/v2/users/oidc/callback`
16+
4. Save and note the Client ID and Client secret.
17+
18+
## Step 2: Configure Coder OIDC for Google
19+
20+
Set the following environment variables on your Coder deployment and restart Coder:
21+
22+
```env
23+
CODER_OIDC_ISSUER_URL=https://accounts.google.com
24+
CODER_OIDC_CLIENT_ID=<client id>
25+
CODER_OIDC_CLIENT_SECRET=<client secret>
26+
# Restrict to one or more email domains (comma-separated)
27+
CODER_OIDC_EMAIL_DOMAIN="example.com"
28+
# Standard OIDC scopes for Google
29+
CODER_OIDC_SCOPES=openid,profile,email
30+
# Optional: customize the login button
31+
CODER_OIDC_SIGN_IN_TEXT="Sign in with Google"
32+
CODER_OIDC_ICON_URL=/icon/google.svg
33+
```
34+
35+
> [!NOTE]
36+
> The redirect URI must exactly match what you configured in Google Cloud.
37+
38+
## Enable refresh tokens (recommended)
39+
40+
Google uses auth URL parameters to issue refresh tokens. Configure:
41+
42+
```env
43+
# Keep standard scopes
44+
CODER_OIDC_SCOPES=openid,profile,email
45+
# Add Google-specific auth URL params
46+
CODER_OIDC_AUTH_URL_PARAMS='{"access_type": "offline", "prompt": "consent"}'
47+
```
48+
49+
After changing settings, users must log out and back in once to obtain refresh tokens.
50+
51+
Learn more in [Configure OIDC refresh tokens](./refresh-tokens.md).
52+
53+
## Troubleshooting
54+
55+
- "invalid redirect_uri": ensure the redirect URI in Google Cloud matches `https://<your-coder-host>/api/v2/users/oidc/callback`.
56+
- Domain restriction: if users from unexpected domains can log in, verify `CODER_OIDC_EMAIL_DOMAIN`.
57+
- Claims: to inspect claims returned by Google, see guidance in the [OIDC overview](./index.md#oidc-claims).
58+
59+
## See also
60+
61+
- [OIDC overview](./index.md)
62+
- [Configure OIDC refresh tokens](./refresh-tokens.md)

‎docs/manifest.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -416,6 +416,11 @@
416416
"description": "Configure OpenID Connect authentication with identity providers like Okta or Active Directory",
417417
"path": "./admin/users/oidc-auth/index.md",
418418
"children": [
419+
{
420+
"title": "Google",
421+
"description": "Configure Google as an OIDC provider",
422+
"path": "./admin/users/oidc-auth/google.md"
423+
},
419424
{
420425
"title": "Configure OIDC refresh tokens",
421426
"description": "How to configure OIDC refresh tokens",

‎site/src/components/ActiveUserChart/ActiveUserChart.tsx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ type ActiveUsersTitleProps = {
113113

114114
export const ActiveUsersTitle: FC<ActiveUsersTitleProps> = ({ interval }) => {
115115
return (
116-
<div css={{ display: "flex", alignItems: "center", gap: 8 }}>
116+
<div className="flex items-center gap-2">
117117
{interval === "day" ? "Daily" : "Weekly"} Active Users
118118
<HelpTooltip>
119119
<HelpTooltipTrigger size="small" />

0 commit comments

Comments
 (0)