GitHub-Bitwarden
/
self-host
mirror of https://github.com/bitwarden/self-host.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Bitwarden's self-hosted release repository
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
126 Commits
17 Branches
99 Tags
2.3 MiB
 
 
 
 
 
Tree: 269d3eb140
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '269d3eb140'
${ noResults }
self-host/.github/workflows/release.yml

419 lines
14 KiB
Raw Blame History

---
name: Release
run-name: Release ${{ github.event.inputs.release_type }} v${{ github.event.inputs.release_version }}
on:
workflow_dispatch:
inputs:
release_version:
description: "Release Version"
required: true
release_type:
description: "Release Options"
required: true
default: "Release"
type: choice
options:
- Release
- Dry Run
jobs:
setup:
name: Setup
runs-on: ubuntu-22.04
outputs:
_WEB_RELEASE_TAG: ${{ steps.set-tags.outputs.WEB_RELEASE_TAG }}
_CORE_RELEASE_TAG: ${{ steps.set-tags.outputs.CORE_RELEASE_TAG }}
steps:
- name: Branch check
if: ${{ github.event.inputs.release_type != 'Dry Run' }}
run: |
if [[ "$GITHUB_REF" != "refs/heads/master" ]]; then
echo "==================================="
echo "[!] Can only release from the 'master' branch"
echo "==================================="
exit 1
fi
- name: Checkout repo
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
- name: Get Latest Self-Host Version
id: get-self-host
uses: bitwarden/gh-actions/get-release-version@c86ced0dc8c9daeecf057a6333e6f318db9c5a2b
with:
repository: bitwarden/self-host
- name: Check Release Version
env:
RELEASE_VERSION: ${{ github.event.inputs.release_version }}
PREVIOUS_RELEASE_VERSION: ${{ steps.get-self-host.outputs.version }}
run: |
if [ "$RELEASE_VERSION" == "$PREVIOUS_RELEASE_VERSION" ]; then
echo "[!] Already released v$RELEASE_VERSION. Please bump version to continue"
exit 1
fi
- name: Set Release Tags
id: set-tags
run: |
WEB=$(jq -r '.versions.webVersion' < version.json)
CORE=$(jq -r '.versions.coreVersion' < version.json)
echo "WEB_RELEASE_TAG=$WEB" >> $GITHUB_OUTPUT
echo "CORE_RELEASE_TAG=$CORE" >> $GITHUB_OUTPUT
release:
name: Create GitHub Release
runs-on: ubuntu-22.04
needs: setup
steps:
- name: Checkout repo
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
with:
ref: master
- name: Create release
if: ${{ github.event.inputs.release_type != 'Dry Run' }}
uses: ncipollo/release-action@a2e71bdd4e7dab70ca26a852f29600c98b33153e # v1.12.0
with:
artifacts: 'bitwarden.sh,
run.sh,
bitwarden.ps1,
run.ps1,
version.json'
commit: ${{ github.sha }}
tag: "v${{ github.event.inputs.release_version }}"
name: "Version ${{ github.event.inputs.release_version }}"
body: "<insert release notes here>"
token: ${{ secrets.GITHUB_TOKEN }}
draft: true
release-version:
name: Upload version.json
runs-on: ubuntu-22.04
needs:
- setup
- release
steps:
- name: Checkout repo
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
with:
ref: master
- name: Login to Azure - CI Subscription
uses: Azure/login@92a5484dfaf04ca78a94597f4f19fea633851fa2 # v1.4.6
with:
creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
- name: Retrieve secrets
id: retrieve-secrets
uses: bitwarden/gh-actions/get-keyvault-secrets@c86ced0dc8c9daeecf057a6333e6f318db9c5a2b
with:
keyvault: "bitwarden-ci"
secrets: "aws-selfhost-version-access-id,
aws-selfhost-version-access-key,
r2-electron-access-id,
r2-electron-access-key,
r2-bitwarden-selfhost-version-bucket-name,
cf-prod-account"
- name: Upload version.json to S3 bucket
if: ${{ github.event.inputs.release_type != 'Dry Run' }}
env:
AWS_ACCESS_KEY_ID: ${{ steps.retrieve-secrets.outputs.aws-selfhost-version-access-id }}
AWS_SECRET_ACCESS_KEY: ${{ steps.retrieve-secrets.outputs.aws-selfhost-version-access-key }}
AWS_DEFAULT_REGION: 'us-west-2'
AWS_S3_BUCKET_NAME: 's3://public-s3-bitwarden-selfhost-version-artifact'
run: |
aws s3 cp version.json $AWS_S3_BUCKET_NAME \
--acl "public-read" \
--quiet
- name: Upload version.json to R2 bucket
if: ${{ github.event.inputs.release_type != 'Dry Run' }}
env:
AWS_ACCESS_KEY_ID: ${{ steps.retrieve-secrets.outputs.r2-electron-access-id }}
AWS_SECRET_ACCESS_KEY: ${{ steps.retrieve-secrets.outputs.r2-electron-access-key }}
AWS_DEFAULT_REGION: 'us-east-1'
AWS_S3_BUCKET_NAME: ${{ steps.retrieve-secrets.outputs.r2-bitwarden-selfhost-version-bucket-name }}
CF_ACCOUNT: ${{ steps.retrieve-secrets.outputs.cf-prod-account }}
run: |
aws s3 cp version.json $AWS_S3_BUCKET_NAME \
--quiet \
--endpoint-url https://${CF_ACCOUNT}.r2.cloudflarestorage.com
tag-docker-latest:
name: Tag Docker images latest
runs-on: ubuntu-22.04
needs:
- setup
- release
env:
_CORE_RELEASE_TAG: ${{ needs.setup.outputs._CORE_RELEASE_TAG }}
_BRANCH_NAME: master
strategy:
fail-fast: false
matrix:
include:
- project_name: Admin
- project_name: Api
- project_name: Attachments
- project_name: Events
- project_name: Icons
- project_name: Identity
- project_name: MsSql
- project_name: Nginx
- project_name: Notifications
- project_name: Server
- project_name: Setup
- project_name: Sso
- project_name: Web
release_tag: ${{ needs.setup.outputs._WEB_RELEASE_TAG }}
- project_name: Scim
steps:
- name: Print environment
run: |
whoami
docker --version
echo "GitHub ref: $GITHUB_REF"
echo "GitHub event: $GITHUB_EVENT"
- name: Checkout repo
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
with:
ref: master
- name: Setup project name and release tag
id: setup
run: |
PROJECT_NAME=$(echo "${{ matrix.project_name }}" | awk '{print tolower($0)}')
echo "Matrix name: ${{ matrix.project_name }}"
echo "PROJECT_NAME: $PROJECT_NAME"
echo "project_name=$PROJECT_NAME" >> $GITHUB_OUTPUT
if [ -z "${{ matrix.release_tag }}" ]; then
# Use core release tag by default.
echo "release_tag=$_CORE_RELEASE_TAG" >> $GITHUB_OUTPUT
else
echo "release_tag=${{ matrix.release_tag }}" >> $GITHUB_OUTPUT
fi
########## DockerHub ##########
- name: Setup DCT
id: setup-dct
uses: bitwarden/gh-actions/setup-docker-trust@c86ced0dc8c9daeecf057a6333e6f318db9c5a2b
with:
azure-creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
azure-keyvault-name: "bitwarden-ci"
- name: Pull versioned image
env:
PROJECT_NAME: ${{ steps.setup.outputs.project_name }}
RELEASE_TAG: ${{ steps.setup.outputs.release_tag }}
run: docker pull bitwarden/$PROJECT_NAME:$RELEASE_TAG
- name: Tag latest
env:
PROJECT_NAME: ${{ steps.setup.outputs.project_name }}
RELEASE_TAG: ${{ steps.setup.outputs.release_tag }}
run: docker tag bitwarden/$PROJECT_NAME:$RELEASE_TAG bitwarden/$PROJECT_NAME:latest
- name: Push latest image
if: ${{ github.event.inputs.release_type != 'Dry Run' }}
env:
DOCKER_CONTENT_TRUST: 1
DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: ${{ steps.setup-dct.outputs.dct-delegate-repo-passphrase }}
PROJECT_NAME: ${{ steps.setup.outputs.project_name }}
run: |
if [ "$PROJECT_NAME" == "scim" ]; then
export DOCKER_CONTENT_TRUST=0
fi
docker push bitwarden/$PROJECT_NAME:latest
- name: Log out of Docker and disable Docker Notary
run: |
docker logout
echo "DOCKER_CONTENT_TRUST=0" >> $GITHUB_ENV
########## ACR ##########
- name: Login to Azure - QA Subscription
uses: Azure/login@92a5484dfaf04ca78a94597f4f19fea633851fa2 # v1.4.6
with:
creds: ${{ secrets.AZURE_QA_KV_CREDENTIALS }}
- name: Login to Azure ACR
run: az acr login -n bitwardenqa
- name: Tag latest
env:
PROJECT_NAME: ${{ steps.setup.outputs.project_name }}
REGISTRY: bitwardenqa.azurecr.io
RELEASE_TAG: ${{ steps.setup.outputs.release_tag }}
run: docker tag bitwarden/$PROJECT_NAME:$RELEASE_TAG $REGISTRY/$PROJECT_NAME:latest
- name: Push latest image
if: ${{ github.event.inputs.release_type != 'Dry Run' }}
env:
PROJECT_NAME: ${{ steps.setup.outputs.project_name }}
REGISTRY: bitwardenqa.azurecr.io
run: docker push $REGISTRY/$PROJECT_NAME:latest
- name: Log out of Docker
run: docker logout
tag-docker-web-latest:
name: Tag Web Docker images from bitwardenqa latest
runs-on: ubuntu-22.04
needs:
- setup
- release
strategy:
fail-fast: false
matrix:
include:
- project_name: web-sh
# - project_name: web-ee # Needs to be fixed in Web client release workflow.
env:
_RELEASE_TAG: ${{ needs.setup.outputs._WEB_RELEASE_TAG}}
_BRANCH_NAME: master
steps:
- name: Print environment
run: |
whoami
docker --version
echo "GitHub ref: $GITHUB_REF"
echo "GitHub event: $GITHUB_EVENT"
- name: Checkout repo
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
with:
ref: master
- name: Setup project name
id: setup
run: |
PROJECT_NAME=$(echo "${{ matrix.project_name }}" | awk '{print tolower($0)}')
echo "Matrix name: ${{ matrix.project_name }}"
echo "PROJECT_NAME: $PROJECT_NAME"
echo "project_name=$PROJECT_NAME" >> $GITHUB_OUTPUT
########## ACR ##########
- name: Login to Azure - Prod Subscription
uses: Azure/login@92a5484dfaf04ca78a94597f4f19fea633851fa2 # v1.4.6
with:
creds: ${{ secrets.AZURE_PROD_KV_CREDENTIALS }}
- name: Login to Azure ACR
run: az acr login -n bitwardenprod
- name: Pull versioned image
env:
PROJECT_NAME: ${{ steps.setup.outputs.project_name }}
REGISTRY: bitwardenprod.azurecr.io
run: docker pull $REGISTRY/$PROJECT_NAME:$_RELEASE_TAG
- name: Tag latest
env:
PROJECT_NAME: ${{ steps.setup.outputs.project_name }}
REGISTRY: bitwardenprod.azurecr.io
run: docker tag $REGISTRY/$PROJECT_NAME:$_RELEASE_TAG $REGISTRY/$PROJECT_NAME:latest
- name: Push latest image
if: ${{ github.event.inputs.release_type != 'Dry Run' }}
env:
PROJECT_NAME: ${{ steps.setup.outputs.project_name }}
REGISTRY: bitwardenprod.azurecr.io
run: docker push $REGISTRY/$PROJECT_NAME:latest
- name: Log out of Docker
run: docker logout
release-unified:
name: Release Self-host unified
runs-on: ubuntu-22.04
needs:
- setup
- release
env:
_RELEASE_VERSION: ${{ github.event.inputs.release_version }}-beta # TODO: remove `-beta` after GA
steps:
########## DockerHub ##########
- name: Setup DCT
id: setup-dct
uses: bitwarden/gh-actions/setup-docker-trust@c86ced0dc8c9daeecf057a6333e6f318db9c5a2b
with:
azure-creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
azure-keyvault-name: "bitwarden-ci"
- name: Pull self-host image
run: |
if [[ "${{ github.event.inputs.release_type }}" == "Dry Run" ]]; then
docker pull bitwarden/self-host:dev
else
docker pull bitwarden/self-host:beta
fi
- name: Tag version and latest
run: |
if [[ "${{ github.event.inputs.release_type }}" == "Dry Run" ]]; then
docker tag bitwarden/self-host:dev bitwarden/self-host:dryrun
else
docker tag bitwarden/self-host:beta bitwarden/self-host:$_RELEASE_VERSION
# docker tag bitwarden/self-host:beta bitwarden/self-host:latest # TODO: uncomment this line after GA
fi
- name: Push version and latest image
if: ${{ github.event.inputs.release_type != 'Dry Run' }}
env:
DOCKER_CONTENT_TRUST: 1
DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: ${{ steps.setup-dct.outputs.dct-delegate-repo-passphrase }}
run: |
docker push bitwarden/self-host:$_RELEASE_VERSION
# docker push bitwarden/self-host:latest # TODO: uncomment this line after GA
- name: Log out of Docker and disable Docker Notary
run: |
docker logout
echo "DOCKER_CONTENT_TRUST=0" >> $GITHUB_ENV
########## ACR PROD ##########
- name: Login to Azure - PROD Subscription
uses: Azure/login@92a5484dfaf04ca78a94597f4f19fea633851fa2 # v1.4.7
with:
creds: ${{ secrets.AZURE_PROD_KV_CREDENTIALS }}
- name: Login to Azure ACR
run: az acr login -n bitwardenprod
- name: Pull latest project image
env:
REGISTRY: bitwardenprod.azurecr.io
run: |
if [[ "${{ github.event.inputs.release_type }}" == "Dry Run" ]]; then
docker pull $REGISTRY/self-host:dev
else
docker pull $REGISTRY/self-host:beta
fi
- name: Tag version and latest
env:
REGISTRY: bitwardenprod.azurecr.io
run: |
if [[ "${{ github.event.inputs.release_type }}" == "Dry Run" ]]; then
docker tag $REGISTRY/self-host:dev $REGISTRY/self-host:dryrun
else
docker tag $REGISTRY/self-host:beta $REGISTRY/self-host:$_RELEASE_VERSION
docker tag $REGISTRY/self-host:beta $REGISTRY/self-host:latest
fi
- name: Push version and latest image
if: ${{ github.event.inputs.release_type != 'Dry Run' }}
env:
REGISTRY: bitwardenprod.azurecr.io
run: |
docker push $REGISTRY/self-host:$_RELEASE_VERSION
docker push $REGISTRY/self-host:latest
- name: Log out of Docker
run: docker logout