You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
255 lines
9.1 KiB
255 lines
9.1 KiB
name: Build Bitwarden lite |
|
|
|
on: |
|
push: |
|
paths: |
|
- "bitwarden-lite/**" |
|
- ".github/workflows/build-bitwarden-lite.yml" |
|
workflow_dispatch: |
|
inputs: |
|
server_branch: |
|
description: "Server branch name (examples: 'main', 'rc', 'feature/sm')" |
|
type: string |
|
default: main |
|
web_branch: |
|
description: "Web client branch name (examples: 'main', 'rc', 'feature/sm')" |
|
type: string |
|
default: main |
|
use_latest_core_version: |
|
description: "Use the latest core version from version.json instead of branch" |
|
type: boolean |
|
default: false |
|
use_latest_web_version: |
|
description: "Use the latest web version from version.json instead of branch" |
|
type: boolean |
|
default: false |
|
workflow_call: |
|
inputs: |
|
server_branch: |
|
description: "Server branch name (examples: 'main', 'rc', 'feature/sm')" |
|
type: string |
|
default: main |
|
web_branch: |
|
description: "Web client branch name (examples: 'main', 'rc', 'feature/sm')" |
|
type: string |
|
default: main |
|
use_latest_core_version: |
|
description: "Use the latest core version from version.json instead of branch" |
|
type: boolean |
|
default: false |
|
use_latest_web_version: |
|
description: "Use the latest web version from version.json instead of branch" |
|
type: boolean |
|
default: false |
|
pull_request: |
|
paths: |
|
- ".github/workflows/build-bitwarden-lite.yml" |
|
- "bitwarden-lite/**" |
|
|
|
concurrency: |
|
group: ${{ github.workflow }}-${{ github.ref }} |
|
cancel-in-progress: true |
|
|
|
permissions: |
|
contents: read |
|
|
|
jobs: |
|
setup: |
|
name: Setup |
|
runs-on: ubuntu-24.04 |
|
outputs: |
|
server_ref: ${{ steps.set-server-variables.outputs.server_ref }} |
|
web_ref: ${{ steps.set-web-variables.outputs.web_ref }} |
|
steps: |
|
- name: Checkout Repository |
|
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 |
|
with: |
|
persist-credentials: false |
|
|
|
- name: Set Server variables |
|
id: set-server-variables |
|
env: |
|
SERVER_BRANCH: ${{ inputs.server_branch }} |
|
USE_LATEST_CORE_VERSION: ${{ inputs.use_latest_core_version }} |
|
run: | |
|
if [[ "$USE_LATEST_CORE_VERSION" == "true" ]]; then |
|
# Extract coreVersion from version.json |
|
CORE_VERSION=$(jq -r '.versions.coreVersion' version.json) |
|
echo "Server version from version.json: $CORE_VERSION" |
|
echo "server_ref=refs/tags/v$CORE_VERSION" >> "$GITHUB_OUTPUT" |
|
elif [[ -z "${SERVER_BRANCH}" ]]; then |
|
echo "server_ref=refs/heads/main" >> "$GITHUB_OUTPUT" |
|
else |
|
echo "server_ref=refs/tags/${SERVER_BRANCH#refs/heads/}" >> "$GITHUB_OUTPUT" |
|
fi |
|
|
|
- name: Set Web variables |
|
id: set-web-variables |
|
env: |
|
WEB_BRANCH: ${{ inputs.web_branch }} |
|
USE_LATEST_WEB_VERSION: ${{ inputs.use_latest_web_version }} |
|
run: | |
|
if [[ "$USE_LATEST_WEB_VERSION" == "true" ]]; then |
|
# Extract webVersion from version.json |
|
WEB_VERSION=$(jq -r '.versions.webVersion' version.json) |
|
echo "Web version from version.json: $WEB_VERSION" |
|
echo "web_ref=refs/tags/web-v$WEB_VERSION" >> "$GITHUB_OUTPUT" |
|
elif [[ -z "${WEB_BRANCH}" ]]; then |
|
echo "web_ref=refs/heads/main" >> "$GITHUB_OUTPUT" |
|
else |
|
echo "web_ref=refs/tags/${WEB_BRANCH#refs/heads/}" >> "$GITHUB_OUTPUT" |
|
fi |
|
|
|
build-docker: |
|
name: Build Docker image |
|
runs-on: ubuntu-24.04 |
|
timeout-minutes: 60 |
|
needs: setup |
|
permissions: |
|
id-token: write |
|
packages: write |
|
security-events: write |
|
steps: |
|
- name: Checkout Repository |
|
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 |
|
with: |
|
persist-credentials: false |
|
|
|
- name: Set up QEMU emulators |
|
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 |
|
|
|
- name: Set up Docker Buildx |
|
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 |
|
|
|
- name: Login to GitHub Container Registry |
|
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0 |
|
with: |
|
registry: ghcr.io |
|
username: ${{ github.actor }} |
|
password: ${{ secrets.GITHUB_TOKEN }} |
|
|
|
- name: Generate Docker image tag |
|
id: tag |
|
env: |
|
SERVER_REF: ${{ needs.setup.outputs.server_ref }} |
|
run: | |
|
if [[ $SERVER_REF =~ ^refs/tags/v(.+)$ ]]; then |
|
IMAGE_TAG="${BASH_REMATCH[1]}" |
|
else |
|
IMAGE_TAG=$(echo "${SERVER_REF#refs/heads/}" | \ |
|
tr '[:upper:]' '[:lower:]' | \ |
|
sed -E 's/[^a-z0-9._-]+/-/g; s/-+/-/g; s/^-+|-+$//g' | \ |
|
cut -c1-128 | \ |
|
sed -E 's/[.-]$//') |
|
fi |
|
|
|
if [[ "$IMAGE_TAG" == "main" ]]; then |
|
IMAGE_TAG=dev |
|
fi |
|
|
|
if [[ -z "$IMAGE_TAG" ]]; then |
|
echo "ERROR: Failed to generate valid IMAGE_TAG from SERVER_REF: $SERVER_REF" |
|
exit 1 |
|
fi |
|
|
|
echo "Using $IMAGE_TAG for build" |
|
echo "image_tag=${IMAGE_TAG}" >> "$GITHUB_OUTPUT" |
|
|
|
- name: Log in to Azure |
|
uses: bitwarden/gh-actions/azure-login@main |
|
with: |
|
subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} |
|
tenant_id: ${{ secrets.AZURE_TENANT_ID }} |
|
client_id: ${{ secrets.AZURE_CLIENT_ID }} |
|
|
|
- name: Get Azure Key Vault secrets |
|
id: get-kv-secrets |
|
uses: bitwarden/gh-actions/get-keyvault-secrets@main |
|
with: |
|
keyvault: gh-org-bitwarden |
|
secrets: "BW-GHAPP-ID,BW-GHAPP-KEY" |
|
|
|
- name: Log out from Azure |
|
uses: bitwarden/gh-actions/azure-logout@main |
|
|
|
- name: Generate GH App token |
|
uses: actions/create-github-app-token@0f859bf9e69e887678d5bbfbee594437cb440ffe # v2.1.0 |
|
id: app-token |
|
with: |
|
app-id: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-ID }} |
|
private-key: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-KEY }} |
|
permission-actions: read # for downloading workflow run artifacts |
|
permission-contents: read # for checking out repos |
|
|
|
- name: Checkout server repo |
|
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 |
|
with: |
|
repository: bitwarden/server |
|
token: ${{ steps.app-token.outputs.token }} |
|
ref: ${{ needs.setup.outputs.server_ref }} |
|
path: "server" |
|
persist-credentials: false |
|
|
|
- name: Download web client branch artifacts for dev builds |
|
if: needs.setup.outputs.web_ref == 'refs/heads/main' |
|
uses: bitwarden/gh-actions/download-artifacts@main |
|
with: |
|
github_token: ${{ steps.app-token.outputs.token }} |
|
workflow: build-web.yml |
|
workflow_conclusion: success |
|
branch: main |
|
repo: bitwarden/clients |
|
artifacts: "web-*-selfhosted-DEV.zip" |
|
|
|
- name: Set web artifact path for dev builds |
|
if: needs.setup.outputs.web_ref == 'refs/heads/main' |
|
id: set-web-artifact-path |
|
run: | |
|
WEB_ARTIFACT=$(find . -name "web-*-selfhosted-DEV.zip" | head -1) |
|
if [[ -z "${WEB_ARTIFACT}" ]]; then |
|
echo "ERROR: No web artifact found for dev build" |
|
exit 1 |
|
fi |
|
echo "path=${WEB_ARTIFACT}" >> "$GITHUB_OUTPUT" |
|
|
|
- name: Build and push Docker image |
|
id: build-docker |
|
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 |
|
with: |
|
context: . |
|
file: bitwarden-lite/Dockerfile |
|
platforms: | |
|
linux/amd64, |
|
linux/arm/v7, |
|
linux/arm64/v8 |
|
push: true |
|
tags: ghcr.io/bitwarden/lite:${{ steps.tag.outputs.image_tag }} |
|
build-args: | |
|
WEB_ARTIFACT_PATH=${{ steps.set-web-artifact-path.outputs.path }} |
|
|
|
- name: Install Cosign |
|
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 |
|
|
|
- name: Sign image with Cosign |
|
env: |
|
DIGEST: ${{ steps.build-docker.outputs.digest }} |
|
IMAGE: ghcr.io/bitwarden/lite:${{ steps.tag.outputs.image_tag }} |
|
run: cosign sign --yes "${IMAGE}@${DIGEST}" |
|
|
|
- name: Scan Docker image |
|
id: container-scan |
|
uses: anchore/scan-action@f6601287cdb1efc985d6b765bbf99cb4c0ac29d8 # v7.0.0 |
|
with: |
|
image: ghcr.io/bitwarden/lite:${{ steps.tag.outputs.image_tag }} |
|
fail-build: false |
|
output-format: sarif |
|
|
|
- name: Upload Grype results to GitHub |
|
uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0 |
|
with: |
|
sarif_file: ${{ steps.container-scan.outputs.sarif }} |
|
sha: ${{ contains(github.event_name, 'pull_request') && github.event.pull_request.head.sha || github.sha }} |
|
ref: ${{ contains(github.event_name, 'pull_request') && format('refs/pull/{0}/head', github.event.pull_request.number) || github.ref }} |
|
|
|
- name: Log out of GHCR |
|
run: docker logout ghcr.io
|
|
|