refactor: migrate JWT and JWKS handling to jwx v4 #6714
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| branches: [main, "release/**", "breaking/**"] | |
| permissions: | |
| contents: read | |
| actions: read | |
| checks: write | |
| pull-requests: write | |
| id-token: write | |
| concurrency: | |
| group: "${{ github.workflow }}-${{ github.event.pull_request.number }}" | |
| cancel-in-progress: true | |
| jobs: | |
| go-tests: | |
| name: Go Tests (${{ matrix.module.name }}) | |
| runs-on: depot-ubuntu-latest | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| module: | |
| - name: backend | |
| path: backend | |
| timeout: 30 | |
| gcc: true | |
| cgo_enabled: "1" | |
| - name: cli | |
| path: cli | |
| timeout: 10 | |
| gcc: false | |
| cgo_enabled: "1" | |
| - name: types | |
| path: types | |
| timeout: 10 | |
| gcc: false | |
| cgo_enabled: "1" | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Setup Just | |
| uses: extractions/setup-just@v4 | |
| - name: Set up Depot CLI | |
| if: matrix.module.gcc | |
| uses: depot/setup-action@v1 | |
| - name: Setup Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: ${{ matrix.module.path }}/go.mod | |
| cache: true | |
| cache-dependency-path: ${{ matrix.module.path }}/go.sum | |
| - name: Install GCC | |
| if: matrix.module.gcc | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y gcc | |
| - name: Download modules | |
| run: just deps install go | |
| - name: Run unit tests | |
| env: | |
| CGO_ENABLED: ${{ matrix.module.cgo_enabled }} | |
| run: just test ${{ matrix.module.name }} | |
| - name: Lint protobuf definitions | |
| if: matrix.module.name == 'backend' | |
| run: just lint proto | |
| - name: Upload coverage artifact | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: ${{ matrix.module.name }}-coverage | |
| path: ${{ matrix.module.path }}/coverage.txt | |
| go-linter: | |
| name: Go Linter (${{ matrix.module.name }}) | |
| runs-on: depot-ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| module: | |
| - name: backend | |
| args: --build-tags=exclude_frontend --config=../.github/.golangci.yml | |
| - name: cli | |
| args: --config=../.github/.golangci.yml | |
| - name: types | |
| args: --config=../.github/.golangci.yml | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| - name: Set up Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: ${{ matrix.module.name }}/go.mod | |
| cache-dependency-path: ${{ matrix.module.name }}/go.sum | |
| - name: Run Golangci-lint | |
| uses: golangci/golangci-lint-action@v9 | |
| with: | |
| version: latest | |
| args: ${{ matrix.module.args }} | |
| working-directory: ${{ matrix.module.name }} | |
| only-new-issues: false | |
| deadcode: | |
| name: Go Deadcode Analysis | |
| if: github.event.pull_request.head.repo.owner.login == 'getarcaneapp' | |
| runs-on: depot-ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| - name: Setup Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: backend/go.mod | |
| cache-dependency-path: backend/go.sum | |
| - name: Install deadcode | |
| run: go install golang.org/x/tools/cmd/deadcode@latest | |
| - name: Add deadcode problem matcher | |
| run: echo "::add-matcher::.github/matchers/deadcode-matcher.json" | |
| - name: Run deadcode analysis | |
| id: deadcode | |
| working-directory: backend | |
| continue-on-error: true | |
| run: | | |
| OUTPUT=$(deadcode ./... 2>&1 || true) | |
| echo "$OUTPUT" | |
| COUNT=$(echo "$OUTPUT" | grep -c "unreachable func" || true) | |
| if [ -z "$COUNT" ]; then COUNT=0; fi | |
| echo "count=$COUNT" >> $GITHUB_OUTPUT | |
| echo "output<<EOF" >> $GITHUB_OUTPUT | |
| echo "$OUTPUT" >> $GITHUB_OUTPUT | |
| echo "EOF" >> $GITHUB_OUTPUT | |
| - name: Find Comment | |
| uses: peter-evans/find-comment@v4 | |
| id: fc | |
| with: | |
| issue-number: ${{ github.event.pull_request.number }} | |
| comment-author: "github-actions[bot]" | |
| body-includes: "## 🔍 Deadcode Analysis" | |
| - name: Delete comment if no deadcode found | |
| if: steps.deadcode.outputs.count == '0' && steps.fc.outputs.comment-id != '' | |
| uses: actions/github-script@v9 | |
| with: | |
| script: | | |
| github.rest.issues.deleteComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| comment_id: ${{ steps.fc.outputs.comment-id }} | |
| }) | |
| - name: Comment deadcode results | |
| if: steps.deadcode.outputs.count != '0' | |
| uses: peter-evans/create-or-update-comment@v5 | |
| with: | |
| comment-id: ${{ steps.fc.outputs.comment-id }} | |
| issue-number: ${{ github.event.pull_request.number }} | |
| body: | | |
| ## 🔍 Deadcode Analysis | |
| Found **${{ steps.deadcode.outputs.count }}** unreachable functions in the backend. | |
| <details> | |
| <summary>View details</summary> | |
| ``` | |
| ${{ steps.deadcode.outputs.output }} | |
| ``` | |
| Only remove deadcode that you know is 100% no longer used. | |
| </details> | |
| > Analysis from commit ${{ github.sha }} | |
| edit-mode: replace | |
| type-check: | |
| name: Type Check | |
| runs-on: depot-ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| - name: Setup Vite+ | |
| uses: voidzero-dev/setup-vp@9446e853b27985e00fb1b21193be026fc09198db | |
| with: | |
| node-version: 26 | |
| cache: true | |
| run-install: true | |
| - name: Setup Just | |
| uses: extractions/setup-just@v4 | |
| - name: Add svelte-check problem matcher | |
| run: echo "::add-matcher::.github/matchers/svelte-check-matcher.json" | |
| - name: Build frontend | |
| run: just build single frontend | |
| - name: Run workspace type checks | |
| run: just lint js | |
| e2e-tests: | |
| name: E2E Tests (${{ matrix.database.name }}) | |
| if: ${{ github.head_ref != 'l10n_crowdin' }} | |
| runs-on: depot-ubuntu-24.04-4 | |
| permissions: | |
| contents: read | |
| actions: write | |
| id-token: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| database: | |
| - name: sqlite | |
| compose_file: setup/compose.yaml | |
| port: 3000 | |
| - name: postgres | |
| compose_file: setup/compose-postgres.yaml | |
| port: 3001 | |
| - name: proxy | |
| compose_file: setup/compose-proxy.yaml | |
| port: 3002 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| - name: Setup Vite+ | |
| uses: voidzero-dev/setup-vp@9446e853b27985e00fb1b21193be026fc09198db | |
| with: | |
| node-version: 26 | |
| cache: true | |
| run-install: false | |
| - name: Setup Just | |
| uses: extractions/setup-just@v4 | |
| - name: Set up Depot CLI | |
| uses: depot/setup-action@v1 | |
| - name: Setup depot buildx driver | |
| run: depot configure-docker | |
| - name: Cache Playwright Browsers | |
| uses: actions/cache@v6 | |
| id: playwright-cache | |
| with: | |
| path: ~/.cache/ms-playwright | |
| key: ${{ runner.os }}-playwright-${{ hashFiles('pnpm-lock.yaml', 'tests/package.json') }} | |
| restore-keys: | | |
| ${{ runner.os }}-playwright- | |
| - name: Pull and save test images | |
| run: | | |
| docker pull public.ecr.aws/nginx/nginx:stable-alpine | |
| docker pull public.ecr.aws/docker/library/busybox:1.37 | |
| docker pull quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z | |
| docker pull ghcr.io/rustic-rs/rustic:v0.11.2 | |
| docker save public.ecr.aws/nginx/nginx:stable-alpine public.ecr.aws/docker/library/busybox:1.37 > /tmp/test-images.tar | |
| - name: Setup and Install Playwright Dependencies | |
| run: just deps install tests | |
| - name: Run Playwright E2E tests | |
| run: vp -C tests exec playwright test --project=chromium | |
| env: | |
| COMPOSE_FILE: ${{ matrix.database.compose_file }} | |
| BASE_URL: http://localhost:${{ matrix.database.port }} | |
| - name: Upload Playwright HTML report | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: playwright-report-${{ matrix.database.name }} | |
| path: tests/.report | |
| include-hidden-files: true | |
| retention-days: 15 | |
| cli-e2e-tests: | |
| name: CLI E2E Tests (proxy) | |
| if: ${{ github.head_ref != 'l10n_crowdin' }} | |
| runs-on: depot-ubuntu-24.04-4 | |
| permissions: | |
| contents: read | |
| actions: write | |
| id-token: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| - name: Setup Vite+ | |
| uses: voidzero-dev/setup-vp@9446e853b27985e00fb1b21193be026fc09198db | |
| with: | |
| node-version: 26 | |
| cache: true | |
| run-install: false | |
| - name: Setup Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: cli/go.mod | |
| cache-dependency-path: cli/go.sum | |
| - name: Set up Depot CLI | |
| uses: depot/setup-action@v1 | |
| - name: Setup depot buildx driver | |
| run: depot configure-docker | |
| - name: Install Playwright test dependencies | |
| run: vp -C tests install | |
| - name: Run CLI E2E tests against socket proxy | |
| run: vp -C tests exec playwright test --project=cli | |
| env: | |
| COMPOSE_FILE: setup/compose-proxy.yaml | |
| BASE_URL: http://localhost:3002 | |
| E2E_ADMIN_STATIC_API_KEY: ${{ secrets.E2E_ADMIN_STATIC_API_KEY }} | |
| - name: Upload Playwright HTML report | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: playwright-report-proxy-cli | |
| path: tests/.report | |
| include-hidden-files: true | |
| retention-days: 15 |