Skip to content

Commit eef8a18

Browse files
kylecarbskylecarbs
committed
Merge branch 'main' into templateeditor
2 parents 8440b44 + 71a8937 commit eef8a18

File tree

187 files changed

+4240
-1364
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

187 files changed

+4240
-1364
lines changed

‎.github/workflows/ci.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,8 @@ jobs:
121121
- 'site/**'
122122
k8s:
123123
- 'helm/**'
124-
- Dockerfile
124+
- scripts/Dockerfile
125+
- scripts/Dockerfile.base
125126
- scripts/helm.sh
126127
- id: debug
127128
run: |

‎.github/workflows/docker-base.yaml

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: docker-base
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- scripts/Dockerfile.base
9+
- scripts/Dockerfile
10+
11+
schedule:
12+
# Run every week at 09:43 on Monday, Wednesday and Friday. We build this
13+
# frequently to ensure that packages are up-to-date.
14+
- cron: "43 9 * * 1,3,5"
15+
16+
workflow_dispatch:
17+
18+
permissions:
19+
contents: read
20+
# Necessary to push docker images to ghcr.io.
21+
packages: write
22+
# Necessary for depot.dev authentication.
23+
id-token: write
24+
25+
# Avoid running multiple jobs for the same commit.
26+
concurrency:
27+
group: ${{ github.workflow }}-${{ github.ref }}-docker-base
28+
29+
jobs:
30+
build:
31+
runs-on: ubuntu-latest
32+
if: github.repository_owner == 'coder'
33+
steps:
34+
- uses: actions/checkout@v3
35+
36+
- name: Docker login
37+
uses: docker/login-action@v2
38+
with:
39+
registry: ghcr.io
40+
username: ${{ github.actor }}
41+
password: ${{ secrets.GITHUB_TOKEN }}
42+
43+
- name: Create empty base-build-context directory
44+
run: mkdir base-build-context
45+
46+
- name: Install depot.dev CLI
47+
uses: depot/setup-action@v1
48+
49+
# This uses OIDC authentication, so no auth variables are required.
50+
- name: Build base Docker image via depot.dev
51+
uses: depot/build-push-action@v1
52+
with:
53+
project: wl5hnrrkns
54+
context: base-build-context
55+
file: scripts/Dockerfile.base
56+
pull: true
57+
no-cache: true
58+
push: true
59+
tags: |
60+
ghcr.io/coder/coder-base:latest

‎.github/workflows/release.yaml

Lines changed: 50 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -112,17 +112,17 @@ jobs:
112112
set -euo pipefail
113113
wget -O /tmp/nfpm.deb https://github.com/goreleaser/nfpm/releases/download/v2.18.1/nfpm_amd64.deb
114114
sudo dpkg -i /tmp/nfpm.deb
115+
rm /tmp/nfpm.deb
115116
116117
- name: Install rcodesign
117118
run: |
118119
set -euo pipefail
119-
120-
# Install a prebuilt binary of rcodesign for linux amd64. Once the
121-
# following PR is merged and released upstream, we can download
122-
# directly from GitHub releases instead:
123-
# https://github.com/indygreg/PyOxidizer/pull/635
124-
wget -O /tmp/rcodesign https://cdn.discordapp.com/attachments/283356472258199552/1016767245717872700/rcodesign
125-
sudo install --mode 755 /tmp/rcodesign /usr/local/bin/rcodesign
120+
wget -O /tmp/rcodesign.tar.gz https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F0.22.0/apple-codesign-0.22.0-x86_64-unknown-linux-musl.tar.gz
121+
sudo tar -xzf /tmp/rcodesign.tar.gz \
122+
-C /usr/bin \
123+
--strip-components=1 \
124+
apple-codesign-0.22.0-x86_64-unknown-linux-musl/rcodesign
125+
rm /tmp/rcodesign.tar.gz
126126
127127
- name: Setup Apple Developer certificate and API key
128128
run: |
@@ -160,6 +160,39 @@ jobs:
160160
- name: Delete Apple Developer certificate and API key
161161
run: rm -f /tmp/{apple_cert.p12,apple_cert_password.txt,apple_apikey.p8}
162162

163+
- name: Determine base image tag
164+
id: image-base-tag
165+
run: |
166+
set -euo pipefail
167+
if [[ "${CODER_RELEASE:-}" != *t* ]] || [[ "${CODER_DRY_RUN:-}" == *t* ]]; then
168+
# Empty value means use the default and avoid building a fresh one.
169+
echo "tag=" >> $GITHUB_OUTPUT
170+
else
171+
echo "tag=$(CODER_IMAGE_BASE=ghcr.io/coder/coder-base ./scripts/image_tag.sh)" >> $GITHUB_OUTPUT
172+
fi
173+
174+
- name: Create empty base-build-context directory
175+
if: steps.image-base-tag.outputs.tag != ''
176+
run: mkdir base-build-context
177+
178+
- name: Install depot.dev CLI
179+
if: steps.image-base-tag.outputs.tag != ''
180+
uses: depot/setup-action@v1
181+
182+
# This uses OIDC authentication, so no auth variables are required.
183+
- name: Build base Docker image via depot.dev
184+
if: steps.image-base-tag.outputs.tag != ''
185+
uses: depot/build-push-action@v1
186+
with:
187+
project: wl5hnrrkns
188+
context: base-build-context
189+
file: scripts/Dockerfile.base
190+
pull: true
191+
no-cache: true
192+
push: true
193+
tags: |
194+
${{ steps.image-base-tag.outputs.tag }}
195+
163196
- name: Build Linux Docker images
164197
run: |
165198
set -euxo pipefail
@@ -188,6 +221,8 @@ jobs:
188221
--target "$(./scripts/image_tag.sh --version latest)" \
189222
$(cat build/coder_"$version"_linux_{amd64,arm64,armv7}.tag)
190223
fi
224+
env:
225+
CODER_BASE_IMAGE_TAG: ${{ steps.image-base-tag.outputs.tag }}
191226

192227
- name: ls build
193228
run: ls -lh build
@@ -252,6 +287,14 @@ jobs:
252287
./build/*.rpm
253288
retention-days: 7
254289

290+
- name: Start Packer builds
291+
uses: peter-evans/repository-dispatch@v2
292+
with:
293+
token: ${{ secrets.CDRCI_GITHUB_TOKEN }}
294+
repository: coder/packages
295+
event-type: coder-release
296+
client-payload: '{"coder_version": "${{ steps.version.outputs.version }}"}'
297+
255298
publish-winget:
256299
name: Publish to winget-pkgs
257300
runs-on: windows-latest
@@ -333,11 +376,3 @@ jobs:
333376
# For gh CLI. We need a real token since we're commenting on a PR in a
334377
# different repo.
335378
GH_TOKEN: ${{ secrets.CDRCI_GITHUB_TOKEN }}
336-
337-
- name: Start Packer builds
338-
uses: peter-evans/repository-dispatch@v2
339-
with:
340-
token: ${{ secrets.CDRCI_GITHUB_TOKEN }}
341-
repository: coder/packages
342-
event-type: coder-release
343-
client-payload: '{"coder_version": "${{ needs.release.outputs.version }}"}'

‎.github/workflows/security.yaml

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,8 +96,20 @@ jobs:
9696
id: build
9797
run: |
9898
set -euo pipefail
99-
image_job="build/coder_$(./scripts/version.sh)_linux_amd64.tag"
100-
DOCKER_IMAGE_NO_PREREQUISITES=true make -j "$image_job"
99+
100+
version="$(./scripts/version.sh)"
101+
image_job="build/coder_${version}_linux_amd64.tag"
102+
103+
# This environment variable force make to not build packages and
104+
# archives (which the Docker image depends on due to technical reasons
105+
# related to concurrent FS writes).
106+
export DOCKER_IMAGE_NO_PREREQUISITES=true
107+
# This environment variables forces scripts/build_docker.sh to build
108+
# the base image tag locally instead of using the cached version from
109+
# the registry.
110+
export CODER_IMAGE_BUILD_BASE_TAG="$(CODER_IMAGE_BASE=coder-base ./scripts/image_tag.sh --version "$version")"
111+
112+
make -j "$image_job"
101113
echo "image=$(cat "$image_job")" >> $GITHUB_OUTPUT
102114
103115
- name: Run Trivy vulnerability scanner

‎.github/workflows/stale.yaml

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
name: Stale Issue Cron
1+
name: Stale Issue and Branch Cleanup
22
on:
33
schedule:
44
# Every day at midnight
55
- cron: "0 0 * * *"
66
workflow_dispatch:
77
jobs:
8-
stale:
8+
issues:
99
runs-on: ubuntu-latest
1010
permissions:
1111
issues: write
@@ -32,3 +32,17 @@ jobs:
3232
operations-per-run: 60
3333
# Start with the oldest issues, always.
3434
ascending: true
35+
branches:
36+
runs-on: ubuntu-latest
37+
steps:
38+
- name: Checkout repository
39+
uses: actions/checkout@v2
40+
- name: Run delete-old-branches-action
41+
uses: beatlabs/delete-old-branches-action@v0.0.9
42+
with:
43+
repo_token: ${{ github.token }}
44+
date: "6 months ago"
45+
dry_run: false
46+
delete_tags: false
47+
# extra_protected_branch_regex: ^(foo|bar)$
48+
exclude_open_pr_branches: true

‎Makefile

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -610,7 +610,8 @@ test-postgres-docker:
610610
-c max_connections=1000 \
611611
-c fsync=off \
612612
-c synchronous_commit=off \
613-
-c full_page_writes=off
613+
-c full_page_writes=off \
614+
-c log_statement=all
614615
while ! pg_isready -h 127.0.0.1
615616
do
616617
echo "$(date) - waiting for database to start"

‎agent/agent.go

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -268,10 +268,13 @@ func (a *agent) run(ctx context.Context) error {
268268

269269
scriptDone := make(chan error, 1)
270270
scriptStart := time.Now()
271-
go func() {
271+
err := a.trackConnGoroutine(func() {
272272
defer close(scriptDone)
273273
scriptDone <- a.runStartupScript(ctx, metadata.StartupScript)
274-
}()
274+
})
275+
if err != nil {
276+
return xerrors.Errorf("track startup script: %w", err)
277+
}
275278
go func() {
276279
var timeout <-chan time.Time
277280
// If timeout is zero, an older version of the coder

‎agent/agent_test.go

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -305,7 +305,7 @@ func TestAgent_TCPLocalForwarding(t *testing.T) {
305305
}
306306
}()
307307

308-
cmd := setupSSHCommand(t, []string{"-L", fmt.Sprintf("%d:127.0.0.1:%d", randomPort, remotePort)}, []string{"sleep", "10"})
308+
cmd := setupSSHCommand(t, []string{"-L", fmt.Sprintf("%d:127.0.0.1:%d", randomPort, remotePort)}, []string{"sleep", "5"})
309309
err = cmd.Start()
310310
require.NoError(t, err)
311311

@@ -372,7 +372,7 @@ func TestAgent_TCPRemoteForwarding(t *testing.T) {
372372
}
373373
}()
374374

375-
cmd := setupSSHCommand(t, []string{"-R", fmt.Sprintf("127.0.0.1:%d:127.0.0.1:%d", randomPort, localPort)}, []string{"sleep", "10"})
375+
cmd := setupSSHCommand(t, []string{"-R", fmt.Sprintf("127.0.0.1:%d:127.0.0.1:%d", randomPort, localPort)}, []string{"sleep", "5"})
376376
err = cmd.Start()
377377
require.NoError(t, err)
378378

@@ -437,7 +437,7 @@ func TestAgent_UnixLocalForwarding(t *testing.T) {
437437
}
438438
}()
439439

440-
cmd := setupSSHCommand(t, []string{"-L", fmt.Sprintf("%s:%s", localSocketPath, remoteSocketPath)}, []string{"sleep", "10"})
440+
cmd := setupSSHCommand(t, []string{"-L", fmt.Sprintf("%s:%s", localSocketPath, remoteSocketPath)}, []string{"sleep", "5"})
441441
err = cmd.Start()
442442
require.NoError(t, err)
443443

@@ -495,7 +495,7 @@ func TestAgent_UnixRemoteForwarding(t *testing.T) {
495495
}
496496
}()
497497

498-
cmd := setupSSHCommand(t, []string{"-R", fmt.Sprintf("%s:%s", remoteSocketPath, localSocketPath)}, []string{"sleep", "10"})
498+
cmd := setupSSHCommand(t, []string{"-R", fmt.Sprintf("%s:%s", remoteSocketPath, localSocketPath)}, []string{"sleep", "5"})
499499
err = cmd.Start()
500500
require.NoError(t, err)
501501

@@ -703,7 +703,7 @@ func TestAgent_Lifecycle(t *testing.T) {
703703
t.Parallel()
704704

705705
_, client, _, _ := setupAgent(t, agentsdk.Metadata{
706-
StartupScript: "sleep 10",
706+
StartupScript: "sleep 5",
707707
StartupScriptTimeout: time.Nanosecond,
708708
}, 0)
709709

‎cli/configssh_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -532,7 +532,7 @@ func TestConfigSSH_FileWriteAndOptionsFlow(t *testing.T) {
532532
{
533533
name: "Start/End out of order",
534534
matches: []match{
535-
//{match: "Continue?", write: "yes"},
535+
// {match: "Continue?", write: "yes"},
536536
},
537537
writeConfig: writeConfig{
538538
ssh: strings.Join([]string{
@@ -547,7 +547,7 @@ func TestConfigSSH_FileWriteAndOptionsFlow(t *testing.T) {
547547
{
548548
name: "Multiple sections",
549549
matches: []match{
550-
//{match: "Continue?", write: "yes"},
550+
// {match: "Continue?", write: "yes"},
551551
},
552552
writeConfig: writeConfig{
553553
ssh: strings.Join([]string{

‎cli/create_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ func TestCreate(t *testing.T) {
8787
_ = coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
8888
cmd, root := clitest.New(t, "create", "my-workspace", "-y")
8989

90-
member := coderdtest.CreateAnotherUser(t, client, user.OrganizationID)
90+
member, _ := coderdtest.CreateAnotherUser(t, client, user.OrganizationID)
9191
clitest.SetupConfig(t, member, root)
9292
cmdCtx, done := context.WithTimeout(context.Background(), testutil.WaitLong)
9393
go func() {

‎cli/delete_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ func TestDelete(t *testing.T) {
7777
adminClient := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
7878
adminUser := coderdtest.CreateFirstUser(t, adminClient)
7979
orgID := adminUser.OrganizationID
80-
client := coderdtest.CreateAnotherUser(t, adminClient, orgID)
80+
client, _ := coderdtest.CreateAnotherUser(t, adminClient, orgID)
8181
user, err := client.User(context.Background(), codersdk.Me)
8282
require.NoError(t, err)
8383

‎cli/deployment/config.go

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -486,7 +486,7 @@ func newConfig() *codersdk.DeploymentConfig {
486486
},
487487
MaxTokenLifetime: &codersdk.DeploymentConfigField[time.Duration]{
488488
Name: "Max Token Lifetime",
489-
Usage: "The maximum lifetime duration for any user creating a token.",
489+
Usage: "The maximum lifetime duration users can specify when creating an API token.",
490490
Flag: "max-token-lifetime",
491491
Default: 24 * 30 * time.Hour,
492492
},
@@ -538,6 +538,24 @@ func newConfig() *codersdk.DeploymentConfig {
538538
Flag: "disable-path-apps",
539539
Default: false,
540540
},
541+
SessionDuration: &codersdk.DeploymentConfigField[time.Duration]{
542+
Name: "Session Duration",
543+
Usage: "The token expiry duration for browser sessions. Sessions may last longer if they are actively making requests, but this functionality can be disabled via --disable-session-expiry-refresh.",
544+
Flag: "session-duration",
545+
Default: 24 * time.Hour,
546+
},
547+
DisableSessionExpiryRefresh: &codersdk.DeploymentConfigField[bool]{
548+
Name: "Disable Session Expiry Refresh",
549+
Usage: "Disable automatic session expiry bumping due to activity. This forces all sessions to become invalid after the session expiry duration has been reached.",
550+
Flag: "disable-session-expiry-refresh",
551+
Default: false,
552+
},
553+
DisablePasswordAuth: &codersdk.DeploymentConfigField[bool]{
554+
Name: "Disable Password Authentication",
555+
Usage: "Disable password authentication. This is recommended for security purposes in production deployments that rely on an identity provider. Any user with the owner role will be able to sign in with their password regardless of this setting to avoid potential lock out. If you are locked out of your account, you can use the `coder server create-admin` command to create a new admin user directly in the database.",
556+
Flag: "disable-password-auth",
557+
Default: false,
558+
},
541559
}
542560
}
543561

0 commit comments

Comments
 (0)