ci(release): remove the disabled docker jobs from the release pipeline (#13128)
Tagging v9.0.0-rc.1 produced a startup_failure: the workflow was rejected
before any job ran. owncloud pins Actions to an org allowlist
(owncloud/admin:actions-allowlist.yml, allowed_actions: selected with
sha_pinning_required), and three pins in this file are not on it:
docker/setup-buildx-action @f87e5991 v4.4.1 (allowlist has v4.0.0)
docker/login-action @dbcb8138 v4.6.0 (allowlist has v4.1.0)
docker/build-push-action @c3c9e263 v7.4.0 (allowlist has v7.0.0)
Allowlist validation happens at parse time, so it does not care that all
three only appear in jobs already marked `if: false`.
Rather than pin them back, drop the jobs. Building, scanning and publishing
the production image moved to owncloud-docker/ocis, which is why these were
disabled in the first place; the image Trivy scan now runs there on every PR.
That leaves nothing to maintain here and removes all three offending pins.
Removes docker-build, docker-scan (dead too: it needs docker-build),
docker-manifest and docker-readme. Nothing outside that subgraph depended on
them, so the `docker_repos` and `is_production` outputs, the
PRODUCTION_RELEASE_TAGS / DOCKER_REPO_ROLLING / DOCKER_REPO_PRODUCTION env
vars and the REPOS computation go with them. is_prerelease stays, as
create-github-release still reads it.
The filesystem scan in security-scan-trivy is untouched.
(cherry picked from commit aab12d018e)
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix: the public share configuration and fixed graceful shutdown
* fix: [OCISDEV-1433] remove GRPC_MAX_CONNECTION_AGE
The setting closed healthy grpc connections on a timer so that clients would redo
their DNS lookup. It never helped against the failure it was reached for - a
connection whose peer stopped answering - because the age limit is enforced by
the server, the grace period was left at infinity so a request already in flight
was never ended, and any value without a unit suffix silently disabled it again.
Detecting a peer that stops answering is now the job of the grpc clients, which
ping the peer while a request is in flight. The servers here got the matching
enforcement policy so they accept those pings; the client side arrives with the
next reva bump.
* fix: Added the new variable OCDAV_DISABLE_PROPFIND_PUBLIC_LINK_RESOLUTION that disable the resolution of public link shares when answering PROPFIND requests.
* chore: bump reva
* fix: The keepalive added to grpc clinet
* chore: bump reva
* build(deps): bump go 1.26.8, grpc-go dependency
---------
(cherry picked from commit e86eb4d210)
For the 9.0 branch, the reva dependency was pointed at reva's main-branch
merge of PR #748 (commit 373f9509a, pseudo-version
v2.0.0-20261005091647-373f9509a363) instead of the 8.2-targeted
e0beaa380005, since the 8.2 merge predates the VaultMode/UploadSessionFilter.Orphaned
APIs already present on the 9.0 reva lineage.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
# Conflicts:
# changelog/unreleased/security-bump-grpc.md
# go.mod
# go.sum
# vendor/google.golang.org/grpc/server.go
# vendor/google.golang.org/grpc/stream.go
# vendor/google.golang.org/grpc/version.go
# vendor/modules.txt
feat(web): adopt Nx as task orchestrator for web/
Introduces Nx on top of the existing pnpm workspace, so lint/typecheck/
test can be scoped to only the projects affected by a change instead of
running against the whole monorepo on every PR.
- Phase 0: add nx (^23.2.1) as a workspace devDependency, nx.json with a
targetDefaults entry for test:unit (cache: true), ignore .nx/cache and
.nx/workspace-data. No behavior change to any existing script.
- Phase 1: register @nx/vitest's inference plugin so every package with
a vitest.config.ts gets a real, cached "test" target read directly
from its own config, not just the packages that happened to already
declare a "test:unit" npm script. Excludes vite.config.common.ts,
the root vite.config.ts and vite.cern.config.ts from the plugin's
default glob - none of them are test configs, and loading them as one
aborts the whole project graph. defaultBase: "master" (bare `nx
affected` defaults to a branch named "main"). testMode: "run" so `nx
run <project>:test` doesn't default to vitest's watch mode locally.
- Phase 2a: register @nx/eslint/plugin for a per-project "lint" target
on every project (root `lint` script untouched).
- Phase 2b: register @nx/vite/plugin's typecheckTargetName for a
per-project "typecheck" target on projects with their own real
vite.config.ts (design-system, web-client, web-pkg, web-test-helpers).
The ~20 web-app-*/web-runtime projects only have a vitest.config.ts
and aren't covered; root `pnpm run check:types` (whole-repo vue-tsc)
stays the one check that covers everything.
- Phase 3 (CI): adds a `full-run` output to detect-web-changes - true for
push to master/stable-* or a `[full-ci]` PR title (unchanged behavior),
false for a normal PR, which instead runs `nx affected -t lint` / `nx
affected -t test --base=<PR base sha>`. Added fetch-depth: 0 to
web-build-test's checkout, needed for `nx affected --base=<sha>` to
find that commit. Check types and the full-run unit-test path
deliberately stay whole-repo (see inline comments for why).
Also:
- removes design-system's broken "lint": "lint:stylelint" alias (needed
the "lint" name free for the new per-project target; it was never
callable as written - "lint:stylelint" isn't a binary - and nothing
called it).
- makes the design system's webfontloader import fire-and-forget so an
in-flight rejection at test teardown doesn't surface as an unhandled
rejection under vitest's per-project runs.
- pin `typescript` via `pnpm.overrides`. Adding nx's own devDependencies
makes pnpm re-resolve the workspace's peer graph, and today's registry
now has a typescript 6.x that some peer ranges accept - without the
pin, half the vue-peer-dependent packages (pinia, vue-router,
vue3-gettext, focus-trap-vue, ...) fork into a second, incompatible
module instance. Same pin as the dependency-cycle fix, for an
unrelated reason; needed independently here since this branch changes
package.json on its own.
nx's `dependsOn: ["^target"]` errors outright on a circular task graph,
so this only works once the pre-existing web-pkg/design-system/
web-test-helpers dependency cycle is fixed - see
fix(web): break web-pkg/design-system/web-test-helpers dependency cycle,
which this PR targets rather than master.
Verified: nx run-many -t test / lint / typecheck succeed for all
projects; nx show projects --affected --files=... resolves correctly for
shared config changes; nx affected -t lint --base=<sha> matches pnpm
lint; root pnpm lint/check:types/check:format/test:unit/build all still
pass unchanged (380 files / 3128 tests).
acceptance-coverage ran unconditionally (if: always()) even when its
upstream test jobs (local-api-tests, cli-tests, ldap-pool-tests,
core-api-tests) were skipped for docs-only PRs, per detect-changes.
With no coverage artifacts to download, actions/download-artifact
never creates the target directory and the subsequent
`go tool covdata textfmt` step fails with "no such file or
directory", blocking merge of docs-only PRs.
Skip the job using the same docs-only guard build-and-test already
uses.
Signed-off-by: Lukas Hirt <info@hirt.cz>
* test: rollback sending last chunk twice status code to only 404
* test: run all suites
* test: run coreApiWebdav remaining suite in k8s
* test: exclude coreApiWebdavPreviews
* ci: Update k6-load-test.yml for new AWS setup
Moving from the old Hetzner hosted machines to a new AWS setup with a single self-hosted Github worker.
* fix: [OCISDEV-1381][PANAMA-538] Resolving comment on PR #12819
* fix: [OCISDEV-1381][PANAMA-538] Updated SEED_USERS_TOTAL=20
---------
Co-authored-by: Lukas Schwarz <lukas.schwarz@kiteworks.com>
Co-authored-by: Deyan Zhekov <deyan.zhekov@kiteworks.com>
* ci: pass the PR title through env: instead of interpolating it into the shell
acceptance-tests.yml and web-tests.yml both build their step script with
PR_TITLE="${{ github.event.pull_request.title }}". The expression is
substituted into the script text before bash parses it, so a pull request
title closing the quote runs as code on the runner.
Both steps write the value that gates the rest of the workflow
(docs-only, web-changed) to $GITHUB_OUTPUT, so an injected title can also
forge that value and skip the suite meant to test the pull request.
Passing the title through env: leaves it as an environment variable that is
never parsed as source. The [full-ci] check is unchanged.
* ci(release): take version_override through env: and reject non-version values
The env: move alone is not enough in release.yml: the value becomes the `version`
job output, which nine later run: blocks interpolate into their own script text --
one of them unquoted -- so a payload that never breaks out of the quotes at line 56
still executes in a different job. An allow-list on VERSION closes all nine at the
source.
All jobs previously ran with the GitHub-hosted default timeout of 360
minutes, so a hung job (e.g. apt-get stalling in the libcurl install
step of the acceptance tests) blocked a runner for 6 hours before
being killed.
Add an explicit timeout-minutes to every job, sized by workload:
- 120 min: acceptance/e2e/k8s/deployment/k6 test suites and the
release docker-build and build-binaries jobs
- 30-60 min: web build, code generation, license checks, scans,
npm/GitHub release publishing, pipeline report
- 5-15 min: change-detection gates, aggregate status jobs, changelog,
manifest/readme, stale-branch cleanup
The timeout counts only the job's own runtime (queue time and waiting
on `needs` dependencies are excluded) and applies per matrix entry.
Not covered: the jobs in commit-message.yml and translation-sync.yml
call reusable workflows via job-level `uses:`, which does not accept
timeout-minutes; those need timeouts in owncloud/reusable-workflows.
Signed-off-by: Lukas Hirt <info@hirt.cz>
* test(ci): run test on k8s deployment
* chore: update authapp in config
* chore: update storageusers in config
* chore: update version and envs
* chore: normalize service name
Bump the vendored reva dependency to pick up the opt-in bounded LDAP
connection pool (owncloud/reva#658, #665), and wire it into oCIS: add
pool_enabled/pool_size/pool_checkout_timeout config to auth-basic,
users, groups and graph, forward it into the reva config map for the
first three, and unify graph's identity backend onto reva's LDAP
client (utils.GetLDAPClientFromConfig) instead of its own hand-rolled
reconnecting client, now that reva implements PasswordModify and
ModifyWithResult on both LDAP clients. Pooling is off by default and
fully backwards compatible.
Signed-off-by: Lukas Hirt <info@hirt.cz>
test(ldap): [OCISDEV-1031] run graph LDAP suites with pooling enabled in CI
Add a dedicated ldap-pool-tests job to acceptance-tests.yml that reruns
apiGraphUser/apiGraph/apiGraphGroup with OCIS_LDAP_POOL_ENABLED=true, so
concurrent behat requests exercise checkout/release, eviction and the
pooled PasswordModify/ModifyWithResult path end-to-end, in addition to
the existing pooling-disabled runs of the same suites.
Signed-off-by: Lukas Hirt <info@hirt.cz>
fix(ldap): [OCISDEV-1031] set real pool_size/pool_checkout_timeout defaults
Only PoolEnabled: false was set in the four defaultconfig.go files;
PoolSize/PoolCheckoutTimeout were left as Go zero values (0/0s),
relying on reva's NewLDAPPool substituting 5/30s when <= 0. That
reads as "zero connections" to an operator in the generated yaml
config rather than "default 5". Set the real defaults (5, 30s)
so documented defaults match what's emitted.
Signed-off-by: Lukas Hirt <info@hirt.cz>
chore(deps): [OCISDEV-1031] bump reva to pick up LDAP TLS fixes
Bumps the vendored reva dependency to owncloud/reva@8ee2020, picking
up owncloud/reva#672 (restore MinVersion: tls.VersionTLS12 on LDAP
TLS connections) and owncloud/reva#674 (restore pinned-CA-only trust
and PEM validation for the CA-cert path), both flagged during review
of this PR.
Signed-off-by: Lukas Hirt <info@hirt.cz>
docs: point changelog fragment at forward-port PR #12689
* fix: fix CI (#12551)
* fix(ci): disable docker release jobs like in 8.1
The docker-build/manifest/readme jobs were enabled in 8.2 and wired into
create-github-release/audit-release. They fail at docker/login-action
("Username and password required") because DockerHub credentials are not
available, which cascades and cancels the whole release.
Restore the 8.1 behavior: re-add `if: false` to the docker jobs and unwire
them from the downstream release jobs.
* fix(ci): reinstall web deps in license-check job
Excluding web from the generated-code artifact (#12557, to avoid OOM on
upload) also dropped web/node_modules, which provides the
license-checker-rseidelsohn binary used by `make ci-node-check-licenses`.
The job failed with "license-checker-rseidelsohn: not found".
Run `pnpm install` in web before the license check so its node_modules is
present again.
---------
Co-authored-by: Roman Perekhod <2403905@gmail.com>
The release workflow is running out of memory when uploading the generated code.
This fixes it by excluding the web directory. The web directory is not needed because the build is handled via the generation.
Signed-off-by: Lukas Hirt <info@hirt.cz>
* chore: [OCISDEV-5] Merge and relicense ownCloud Web into oCIS
Consolidate the ownCloud Web frontend into this repository as a single
product with one contribution surface and one license. The web/ source
is imported as-is from the final standalone owncloud/web release
(v12.5.0 / last-agpl-release @ b16a34fdf5569d2fd63b1ff3c575c1a4ee569ad3);
the archived owncloud/web repository remains the historical record for
everything at and before that commit.
Relicensing:
- All web/ contributors have signed the ownCloud CLA, granting ownCloud
GmbH the right to relicense their contributions.
- web/LICENSE (AGPL-3.0) removed; the repository root LICENSE
(Apache-2.0) now governs web/ as well, matching how the rest of the
repo is already licensed.
- All 25 web/packages/*/package.json license fields flipped to
Apache-2.0; root NOTICE added documenting the relicensing provenance.
- Added REUSE.toml + LICENSES/ so the whole repository (including
vendored Go dependencies) is REUSE 3.3 compliant.
CI/build:
- services/web/Makefile now builds web assets from the in-tree source
instead of downloading a release tarball from owncloud/web; license
checking/saving likewise runs against the in-tree source.
- ci.env and tests/acceptance/run-e2e.py no longer clone owncloud/web
for Playwright e2e tests.
- Added the app-provider and ocm e2e suites to acceptance-tests.yml's
matrix, closing a coverage gap where they were silently excluded;
ported the Collabora/OnlyOffice/federated-instance orchestration
web's old CI used to run them.
- Added web-tests.yml (typecheck/format/lint/unit-test), a
check-licenses.yml, commit-message.yml, and release-npm-packages.yml
for the @ownclouders/* packages, replacing web's old standalone CI.
- Removed dead CI tooling inherited from the standalone repo
(web/tests/drone, web/tests/actions, web/.github, and an orphaned
ci.env-dependent cache-check script).
Docs:
- Rewrote docs/services/web/releasing.md and web/docs/releasing to
describe the in-tree build/release process.
- Updated remaining references to github.com/owncloud/web across docs,
services/web/README.md, and the deployment example to point at the
in-tree web/ directory.
Signed-off-by: Lukas Hirt <info@hirt.cz>
* ci: sync web/ translations via Transifex
web/ is a pnpm workspace nested inside the repo, so it isn't covered by
the existing translation-sync job (sub_path: ., no package.json at the
repo root). Add a second sync-web job invoking the same reusable
workflow with sub_path: web and package_manager: pnpm, so its l10n-read/
push/pull/write targets actually install web's dependencies instead of
silently running against an empty node_modules. Sequenced after the
existing sync job since both push to the same hardcoded
chore/translations-update branch.
* ci: fix pnpm cache setup order in web-tests and check-licenses
actions/setup-node's cache: pnpm input shells out to pnpm to resolve
the cache directory, so pnpm must already be on PATH when that step
runs. Both workflows ran `corepack enable` *after* setup-node, which
still failed: corepack writes its pnpm shim into the currently active
Node installation's bin dir, and setup-node had already swapped PATH
to the newly-installed Node version by that point, leaving the shim
behind. Use pnpm/action-setup instead, which installs a standalone
pnpm binary independent of the Node version, before setup-node runs.
Also set cache-dependency-path explicitly: the lockfile lives at
web/pnpm-lock.yaml, and cache-dependency-path resolves relative to
GITHUB_WORKSPACE regardless of the job's working-directory default
(that default only applies to run: steps, not to setup-node itself).
* fix(web): resolve 19 HIGH trivy findings in pnpm-lock.yaml
All 19 findings had fixes available upstream, so per this repo's own
.trivyignore policy (reserved for cases with no fix available), these
get fixed rather than suppressed.
vite (7.3.2 -> 7.3.5) is a direct dependency, bumped directly in every
package.json that pins it.
The other 8 (@xmldom/xmldom, flatted, form-data, immutable, js-cookie,
linkify-it, minimatch, ws) are purely transitive. Verified empirically
that `pnpm update <pkg>` silently no-ops on packages not declared in
any workspace manifest, even when a parent's semver range would allow
the fix (e.g. glob@10.5.0's `^9.0.4` covers 9.0.7) -- so pnpm.overrides
is genuinely required here, not just convenient.
minimatch is overridden with a version-range key
(minimatch@>=9.0.0 <9.0.7) rather than a blanket override, since 6
different major versions of minimatch coexist in the tree for
different consumers (3.x/5.x/10.x elsewhere); a blanket override would
have forced all of them to 9.0.7 and likely broken callers expecting a
different major's API.
* fix(web): unify @types/node resolution to stop duplicate vite types
The previous vite 7.3.2 -> 7.3.5 bump caused pnpm to resolve two
different @types/node versions (25.7.0 and 26.1.0) as vite's optional
peer across different workspace packages. vue-tsc then saw two
structurally-different copies of vite's types (e.g. Plugin, HotUpdateOptions)
and failed with TS2769 in design-system, web-client, web-pkg and
web-test-helpers' vite.config.ts files.
Force a single resolution via pnpm.overrides, pinned to 24.13.2 to
match the Node 24 runtime (engines/volta) rather than an arbitrary
newer major.
* fix(tests): fix ocm/app-provider e2e suites' oCIS orchestration
Both suites were newly wired up by the previous merge-web-repo commit
and hadn't run against real CI yet, so their setup had two latent bugs:
e2e-ocm: the federated instance's env only offset *_DEBUG_ADDR ports,
leaving the actual service ports (e.g. gateway's default
127.0.0.1:9142) unset. The federated "ocis server" process then
crashed trying to bind the same ports the primary instance already
held. run-github.py's Behat apiOcm suite already solved this with a
canonical tests/config/local/.env-federation port map (proven working,
since apiOcm passes) -- reuse it instead of the ad-hoc offset. Also
adds OCIS_ADD_RUN_SERVICES=ocm/OCIS_ENABLE_OCM, missing from the
primary instance too.
e2e-app-provider: tests/config/ci/app-registry.yaml maps its one
mimetype to "FakeOffice" (the stub used by apiCollaboration) and has
no docx entry at all, so the real Collabora/OnlyOffice containers this
suite drives never appeared in the web UI's "New file" menu. Add a
dedicated app-registry mapping both odt->Collabora and docx->OnlyOffice
with allow_creation, and use it only when COLLABORATION_NEEDED is set.
Signed-off-by: Lukas Hirt <info@hirt.cz>
* fix(tests): trust federated oCIS cert, register office templates by target_ext
e2e-ocm: the primary and federated instances each generate their own
self-signed proxy cert. Only the primary's was ever added to the
system CA trust store, so Chromium refused the federated instance's
TLS handshake ("tls: unknown certificate") once federation began.
Trust the federated cert too, and thread OCIS_BASE_DATA_PATH through
its `ocis init` call (previously only set for the running server),
since that's where the cert actually gets written.
e2e-app-provider: reproduced the suite locally (real Collabora/
OnlyOffice containers + `ocis collaboration server`) and diffed
`/app/list` before/after. allow_creation and default_app alone don't
make the web UI's "New file" menu show an entry -- it additionally
requires app_providers[].target_ext, which reva's app-provider only
stamps onto a hardcoded set of "-template" mimetypes
(vendor/github.com/owncloud/reva/v2/.../appprovider/templates.go), not
the plain document mimetypes the previous config used. Existing odt/
docx files still open fine without a static entry, since Collabora/
OnlyOffice register their full supported mimetype list dynamically via
WOPI discovery -- it's specifically file *creation* that needs this.
Signed-off-by: Lukas Hirt <info@hirt.cz>
* fix(changelog): shorten title over the 80-char lint limit
changelog/unreleased/bugfix-personal-space-fail-closed.md landed on
master (#12442) with a 97-char title, which changelog-lint rejects.
GitHub tests PRs against a merge with the current master tip, so this
started failing build-and-test on every open PR once master picked up
that commit -- unrelated to this branch's own changes. Fixing it here
since master needed to be merged in anyway.
* fix(tests): load web apps the ocm/app-provider e2e suites depend on
Both suites drive the web UI, and web only loads the web apps listed in
its UI config's "apps" array. run-e2e.py reuses
tests/config/ci/ocis-config.json, which predates the playwright suites
and lists neither app they need, so both failed deterministically while
the API-only Behat suites (apiOcm, apiCollaboration) kept passing:
e2e-ocm: the "open-cloud-mesh" app menu item can never render because
"ocm" was missing, so web-app-ocm was never loaded. Add it for the
federated suite. Behind that sat a second bug: the invite flow embeds
token@<BASE_URL_OCIS host> (127.0.0.1:9200) into invite codes, but the
federated instance authorizes providers against
tests/config/local/providers.json, which only lists localhost:9200.
Address the primary as https://localhost:9200 when federated, mirroring
run-github.py's passing apiOcm setup (the self-signed cert covers both
hosts; other suites keep 127.0.0.1).
e2e-app-provider: web-runtime only builds the per-provider Collabora/
OnlyOffice editor apps -- including their "New file" menu entries --
when web-app-external is loaded (web/packages/web-runtime/src/index.ts
gates on applicationStore.has('web-app-external')), and "external" was
missing. This also falsifies the previous target_ext theory: the
template-mimetype registry was active in the failing run and the menu
still never appeared, because the New-file menu needs only
allow_creation plus a registered provider
(web-app-external/src/index.ts). Revert the app registry to the plain
odt->Collabora / docx->OnlyOffice mimetypes web's own e2e CI proved out
(web/dev/docker/ocis/app-registry.yaml). Create-from-template still
works without static entries: reva stamps target_ext onto the -template
mimetypes the providers register via WOPI discovery.
Signed-off-by: Lukas Hirt <info@hirt.cz>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci: upload playwright traces and a11y report from e2e suites
Port the two upload-artifact steps the standalone web repo's e2e
workflow had: playwright error contexts/report output on failure, and
the a11y report on any non-cancelled run. Paths are prefixed with web/
since the web repo now lives in that subdirectory, artifact names use
the suite name instead of the job index, and the action pin matches the
one already used in this workflow.
Signed-off-by: Lukas Hirt <info@hirt.cz>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(tests): allow office editor iframes in the e2e proxy CSP
The app-provider suite got past file creation but every office test
then timed out waiting for the editor to render: ocis's default proxy
CSP only allows frame-src 'self' (exact scheme+host+port), so the
browser refused to embed the Collabora/OnlyOffice iframes served on
other ports. The COLLABORA_DOMAIN/ONLYOFFICE_DOMAIN env vars do nothing
on their own -- they are only substituted into a custom CSP file, which
is why the pre-merge web CI always set PROXY_CSP_CONFIG_FILE_LOCATION
(tests/drone/csp.yaml there). The localStorage SecurityError seen in
the logs was a downstream symptom: the CSP-blocked frame ends up with
an opaque origin where storage access throws.
Add the two editor domains to tests/config/ci/csp.yaml's frame-src and
img-src (mirroring web's proven csp.yaml) and point the collaboration
suite at it. The keycloak suite shares this file; for it the new
entries fall back to nonexistent default hosts and are inert.
Signed-off-by: Lukas Hirt <info@hirt.cz>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(licenses): attribute REUSE.toml copyright to ownCloud contributors
The web/ tree carries community contributions dating back to 2016; the
CLA grants a relicensing right, not a copyright transfer, so declaring
sole 2020-2026 ownCloud GmbH authorship was inaccurate.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix(tests): trust the Keycloak cert in e2e TLS setup
The Keycloak cert had no SAN, and NODE_EXTRA_CA_CERTS only ever pointed
at the oCIS cert, so any node-fetch/axios call made directly against
Keycloak (admin token fetch, user provisioning) failed TLS validation
and aborted the keycloak/mfa matrix jobs before a spec could run.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix(web): don't wipe assets/ before a successful build
build-assets ran `git clean -xfd assets` before the pnpm build; a failed
typecheck or vite build left assets/core/ empty, so the next Go embed or
docker deployment served no web UI. Clean only after the build succeeds.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* ci: fail clearly when a release tag matches no known package
If the tag-prefix loop found no match, the workflow silently fell
through to a jq lookup against "packages//package.json", failing with a
confusing path error instead of naming the problem.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* ci: drop duplicate dependency-license-check job
web-tests.yml already enforces the license allow-list via
`pnpm licenses:check` (license-checker-rseidelsohn) on every PR.
check-licenses.yml's dependency-license-check ran a second, differently
configured tool (npx license-checker, GPL/AGPL deny-list only), which
could disagree with the first without adding coverage.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---------
Signed-off-by: Lukas Hirt <info@hirt.cz>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The patterns only matched root-level CHANGELOG.md, CONTRIBUTING.md, and
README.md, causing nested files like services/storage-users/README.md to
trigger full CI.
