core, web: update translations #62052
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: CI - Main | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - next | |
| - version-* | |
| pull_request: | |
| branches: | |
| - main | |
| - version-* | |
| concurrency: | |
| group: "${{ github.workflow }}-${{ github.ref }}" | |
| cancel-in-progress: "${{ !startsWith(github.ref, 'refs/heads/version-') && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/next' }}" | |
| env: | |
| POSTGRES_DB: authentik | |
| POSTGRES_USER: authentik | |
| POSTGRES_PASSWORD: "EK-5jnKfjrGRm<77" | |
| permissions: | |
| # Needed for checkout | |
| contents: read | |
| # Needed for codecov OIDC token | |
| id-token: write | |
| jobs: | |
| build-compute-tags: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| safe-branch-name: "${{ steps.compute-tags.outputs.safe-branch-name }}" | |
| tag-full: "${{ steps.compute-tags.outputs.tag-full }}" | |
| tag-branch: "${{ steps.compute-tags.outputs.tag-branch }}" | |
| tag-flux: "${{ steps.compute-tags.outputs.tag-flux }}" | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 | |
| - id: compute-tags | |
| uses: ./.github/actions/compute-container-tags | |
| build: | |
| needs: | |
| - build-compute-tags | |
| permissions: | |
| # Needed to upload cache to ghcr.io | |
| packages: write | |
| # Needed for checkout | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: server | |
| dockerfile: Dockerfile | |
| - name: proxy | |
| dockerfile: proxy.Dockerfile | |
| - name: ldap | |
| dockerfile: ldap.Dockerfile | |
| - name: radius | |
| dockerfile: radius.Dockerfile | |
| - name: rac | |
| dockerfile: rac.Dockerfile | |
| uses: ./.github/workflows/_reusable-container-build.yml | |
| secrets: inherit | |
| with: | |
| ref: "${{ github.ref }}" | |
| image-name: "${{ matrix.name }}" | |
| image-dockerfile: "lifecycle/container/${{ matrix.dockerfile }}" | |
| image-build-args: | | |
| GIT_BUILD_HASH=${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} | |
| should-cache: "${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) }}" | |
| cache-suffix: "-${{ needs.build-compute-tags.outputs.safe-branch-name }}" | |
| lint: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - job: bandit | |
| deps: python | |
| - job: black | |
| deps: python | |
| - job: spellcheck | |
| deps: node | |
| - job: catalogs | |
| deps: node | |
| - job: pending-migrations | |
| deps: python,runtime | |
| - job: ruff | |
| deps: python | |
| - job: mypy | |
| deps: python | |
| - job: cargo-deny | |
| deps: rust | |
| - job: cargo-machete | |
| deps: rust | |
| - job: clippy | |
| deps: rust | |
| - job: rustfmt | |
| deps: rust-nightly | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 | |
| - name: Setup authentik env | |
| uses: ./.github/actions/setup | |
| with: | |
| dependencies: ${{ matrix.deps }} | |
| - name: Create required files | |
| run: | | |
| mkdir -p web/dist/standalone/loading | |
| for f in web/robots.txt web/security.txt web/dist/standalone/loading/startup.html; do | |
| echo empty > "$f" | |
| done | |
| - name: run job | |
| run: make ci-lint-${{ matrix.job }} | |
| test-gen: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Setup authentik env | |
| uses: ./.github/actions/setup | |
| with: | |
| dependencies: "system,python,go,node,runtime,rust-nightly" | |
| - name: generate schema | |
| run: make migrate gen-build | |
| - name: generate API clients | |
| run: make gen-clients | |
| - name: ensure schema is up-to-date | |
| run: git diff --exit-code -- schema.yml blueprints/schema.json packages/client-go packages/client-rust packages/client-ts | |
| test-migrations: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 | |
| - name: Setup authentik env | |
| uses: ./.github/actions/setup | |
| - name: run migrations | |
| run: uv run python -m lifecycle.migrate | |
| test-make-seed: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - id: seed | |
| run: | | |
| echo "seed=$(printf "%d\n" "0x$(openssl rand -hex 4)")" >> "$GITHUB_OUTPUT" | |
| outputs: | |
| seed: ${{ steps.seed.outputs.seed }} | |
| test-migrations-from-stable: | |
| name: test-migrations-from-stable - PostgreSQL ${{ matrix.psql }} - Run ${{ matrix.run_id }}/10 | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| needs: test-make-seed | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| psql: | |
| - 14-alpine | |
| - 18-alpine | |
| run_id: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10] | |
| env: | |
| AUTHENTIK_MIGRATIONS__DANGEROUSLY_ALLOW_MULTIPLE_MAJOR_VERSION_UPGRADES: "true" | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: checkout stable | |
| run: | | |
| set -e -o pipefail | |
| cp -R .github .. | |
| cp -R scripts .. | |
| mkdir -p ../packages | |
| cp -R packages/logger-js ../packages/logger-js | |
| # Previous stable tag | |
| prev_stable=$(git tag --sort=version:refname | grep '^version/' | grep -vE -- '-rc[0-9]+$' | tail -n1) | |
| # Current version family based on | |
| current_version_family=$(cat internal/constants/VERSION | grep -vE -- 'rc[0-9]+$' || true) | |
| if [[ -n $current_version_family ]]; then | |
| prev_stable="version/${current_version_family}" | |
| fi | |
| echo "::notice::Checking out ${prev_stable} as stable version..." | |
| git checkout ${prev_stable} | |
| rm -rf .github/ scripts/ packages/logger-js/ | |
| mv ../.github ../scripts . | |
| mv ../packages/logger-js ./packages/ | |
| - name: Setup authentik env (stable) | |
| uses: ./.github/actions/setup | |
| with: | |
| postgresql_version: ${{ matrix.psql }} | |
| # The stable checkout predates the pnpm migration, so its | |
| # package.json still pins npm as the package manager. Skip node here | |
| # (migrating to stable only needs Python + the database); pnpm/node is | |
| # set up again for the current checkout below. | |
| dependencies: "system,python,runtime" | |
| - name: run migrations to stable | |
| run: | | |
| docker ps | |
| docker logs setup-postgresql-1 | |
| uv run python -m lifecycle.migrate | |
| - name: checkout current code | |
| run: | | |
| set -x | |
| git fetch | |
| git reset --hard HEAD | |
| git clean -d -fx . | |
| git checkout $GITHUB_SHA | |
| - name: Setup authentik env (ensure latest deps are installed) | |
| uses: ./.github/actions/setup | |
| with: | |
| postgresql_version: ${{ matrix.psql }} | |
| - name: migrate to latest | |
| run: | | |
| uv run python -m lifecycle.migrate | |
| - name: run tests | |
| env: | |
| # Test in the main database that we just migrated from the previous stable version | |
| AUTHENTIK_POSTGRESQL__TEST__NAME: authentik | |
| CI_TEST_SEED: ${{ needs.test-make-seed.outputs.seed }} | |
| CI_RUN_ID: ${{ matrix.run_id }} | |
| CI_TOTAL_RUNS: "10" | |
| run: | | |
| uv run make ci-test | |
| - uses: ./.github/actions/test-results | |
| if: ${{ always() }} | |
| with: | |
| flags: unit-migrate | |
| test-unittest: | |
| name: test-unittest - PostgreSQL ${{ matrix.psql }} - Run ${{ matrix.run_id }}/10 | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| needs: test-make-seed | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| psql: | |
| - 14-alpine | |
| - 18-alpine | |
| run_id: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 | |
| - name: Setup authentik env | |
| uses: ./.github/actions/setup | |
| with: | |
| postgresql_version: ${{ matrix.psql }} | |
| - name: run unittest | |
| env: | |
| CI_TEST_SEED: ${{ needs.test-make-seed.outputs.seed }} | |
| CI_RUN_ID: ${{ matrix.run_id }} | |
| CI_TOTAL_RUNS: "10" | |
| run: | | |
| uv run make ci-test | |
| - uses: ./.github/actions/test-results | |
| if: ${{ always() }} | |
| with: | |
| flags: unit | |
| test-integration: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 | |
| - name: Setup authentik env | |
| uses: ./.github/actions/setup | |
| - name: Create k8s Kind Cluster | |
| uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0 | |
| - name: run integration | |
| run: | | |
| uv run coverage run manage.py test tests/integration | |
| uv run coverage combine | |
| uv run coverage xml | |
| - uses: ./.github/actions/test-results | |
| if: ${{ always() }} | |
| with: | |
| flags: integration | |
| test-e2e: | |
| name: test-e2e (${{ matrix.job.name }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| needs: | |
| - build-compute-tags | |
| - build | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| job: | |
| - name: proxy | |
| glob: tests/e2e/test_provider_proxy* | |
| profiles: selenium | |
| - name: oauth | |
| glob: tests/e2e/test_provider_oauth2* tests/e2e/test_source_oauth* | |
| profiles: selenium | |
| - name: oauth-oidc | |
| glob: tests/e2e/test_provider_oidc* | |
| profiles: selenium | |
| - name: saml | |
| glob: tests/e2e/test_provider_saml* tests/e2e/test_source_saml* | |
| profiles: selenium | |
| - name: ldap | |
| glob: tests/e2e/test_provider_ldap* tests/e2e/test_source_ldap* | |
| - name: rac | |
| glob: tests/e2e/test_provider_rac* | |
| profiles: selenium | |
| - name: ws-fed | |
| glob: tests/e2e/test_provider_ws_fed* | |
| profiles: selenium | |
| - name: radius | |
| glob: tests/e2e/test_provider_radius* | |
| - name: scim | |
| glob: tests/e2e/test_source_scim* | |
| - name: flows | |
| glob: tests/e2e/test_flows* | |
| profiles: selenium | |
| - name: endpoints | |
| glob: tests/e2e/test_endpoints_* | |
| profiles: selenium | |
| steps: | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v5 | |
| with: | |
| pattern: container-build-*-amd64 | |
| merge-multiple: true | |
| - name: Load Docker images | |
| run: | | |
| for image in proxy ldap radius rac; do | |
| skopeo copy "oci-archive:container/${image}-amd64.oci.tar" "docker-daemon:ghcr.io/goauthentik/dev-${image}:${{ needs.build-compute-tags.outputs.tag-full }}" | |
| skopeo copy "oci-archive:container/${image}-amd64.oci.tar" "docker-daemon:ghcr.io/goauthentik/dev-${image}:${{ needs.build-compute-tags.outputs.tag-branch }}" | |
| done | |
| rm -rf container/ | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 | |
| - name: Setup authentik env | |
| uses: ./.github/actions/setup | |
| - name: Setup e2e env | |
| env: | |
| COMPOSE_PROFILES: ${{ matrix.job.profiles }} | |
| run: | | |
| docker compose -f tests/e2e/compose.yml up -d --quiet-pull | |
| - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 | |
| - name: Pin pnpm store directory | |
| run: | | |
| echo "PNPM_HOME=${RUNNER_TEMP}/pnpm-home" >> "$GITHUB_ENV" | |
| echo "npm_config_store_dir=${RUNNER_TEMP}/pnpm-home/store" >> "$GITHUB_ENV" | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4 | |
| with: | |
| node-version-file: package.json | |
| cache: pnpm | |
| cache-dependency-path: pnpm-lock.yaml | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - id: cache-web | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4 | |
| if: contains(matrix.job.profiles, 'selenium') | |
| with: | |
| path: web/dist | |
| key: ${{ runner.os }}-web-${{ hashFiles('web/package.json', 'web/pnpm-lock.yaml', 'pnpm-lock.yaml', 'web/src/**', 'web/packages/sfe/src/**') }}-b | |
| - name: prepare web ui | |
| if: steps.cache-web.outputs.cache-hit != 'true' && contains(matrix.job.profiles, 'selenium') | |
| working-directory: web | |
| env: | |
| NODE_ENV: "production" | |
| run: | | |
| pnpm install --frozen-lockfile | |
| pnpm run build | |
| pnpm run build:sfe | |
| - name: run e2e | |
| run: | | |
| uv run coverage run manage.py test ${{ matrix.job.glob }} | |
| uv run coverage combine | |
| uv run coverage xml | |
| - uses: ./.github/actions/test-results | |
| if: ${{ always() }} | |
| with: | |
| flags: e2e | |
| test-openid-conformance: | |
| name: test-openid-conformance (${{ matrix.job.name }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| job: | |
| - name: oidc_basic | |
| glob: tests/openid_conformance/test_oidc_basic.py | |
| - name: oidc_config | |
| glob: tests/openid_conformance/test_oidc_config.py | |
| - name: oidc_implicit | |
| glob: tests/openid_conformance/test_oidc_implicit.py | |
| - name: oidc_rp-initiated | |
| glob: tests/openid_conformance/test_oidc_rp_initiated.py | |
| - name: oidc_frontchannel | |
| glob: tests/openid_conformance/test_oidc_frontchannel.py | |
| - name: oidc_backchannel | |
| glob: tests/openid_conformance/test_oidc_backchannel.py | |
| - name: ssf_transmitter | |
| glob: tests/openid_conformance/test_ssf_transmitter.py | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 | |
| - name: Setup authentik env | |
| uses: ./.github/actions/setup | |
| - name: Setup e2e env (chrome, etc) | |
| env: | |
| COMPOSE_PROFILES: selenium | |
| run: | | |
| docker compose -f tests/e2e/compose.yml up -d --quiet-pull | |
| - name: Setup conformance suite | |
| run: | | |
| docker compose -f tests/openid_conformance/compose.yml up -d --quiet-pull --wait | |
| - id: cache-web | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4 | |
| with: | |
| path: web/dist | |
| key: ${{ runner.os }}-web-${{ hashFiles('web/pnpm-lock.yaml', 'web/src/**', 'web/packages/sfe/src/**') }}-b | |
| - name: prepare web ui | |
| if: steps.cache-web.outputs.cache-hit != 'true' | |
| env: | |
| NODE_ENV: "production" | |
| run: | | |
| pnpm --dir web install --frozen-lockfile | |
| pnpm --dir web run build | |
| pnpm --dir web run build:sfe | |
| - name: run conformance | |
| run: | | |
| uv run coverage run manage.py test ${{ matrix.job.glob }} | |
| uv run coverage combine | |
| uv run coverage xml | |
| - uses: ./.github/actions/test-results | |
| if: ${{ always() }} | |
| with: | |
| flags: conformance | |
| - if: ${{ !cancelled() }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: conformance-certification-${{ matrix.job.name }} | |
| path: tests/openid_conformance/exports/ | |
| test-rust: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 | |
| - name: Setup authentik env | |
| uses: ./.github/actions/setup | |
| with: | |
| dependencies: system,python,rust,runtime | |
| - name: Prepare database | |
| run: | | |
| uv run make migrate | |
| - name: Create required files | |
| run: | | |
| mkdir -p web/dist/standalone/loading | |
| for f in web/robots.txt web/security.txt web/dist/standalone/loading/startup.html; do | |
| echo empty > "$f" | |
| done | |
| - name: run tests | |
| run: | | |
| cargo llvm-cov --no-report nextest --workspace | |
| cargo llvm-cov report --codecov --output-path target/llvm-cov-target/rust.json | |
| - uses: ./.github/actions/test-results | |
| if: ${{ always() }} | |
| with: | |
| files: target/llvm-cov-target/rust.json | |
| flags: rust | |
| - if: ${{ !cancelled() }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: test-rust | |
| path: target/llvm-cov-target/rust.json | |
| ci-core-mark: | |
| if: always() | |
| needs: | |
| - build | |
| - lint | |
| - test-gen | |
| - test-migrations | |
| - test-migrations-from-stable | |
| - test-unittest | |
| - test-integration | |
| - test-e2e | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # release/v1 | |
| with: | |
| jobs: ${{ toJSON(needs) }} | |
| publish: | |
| if: "${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) }}" | |
| needs: | |
| - build-compute-tags | |
| - build | |
| - ci-core-mark | |
| permissions: | |
| # Needed to upload container images to ghcr.io | |
| packages: write | |
| # Needed for attestation | |
| id-token: write | |
| attestations: write | |
| artifact-metadata: write | |
| # Needed for checkout | |
| contents: read | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| name: | |
| - server | |
| - proxy | |
| - ldap | |
| - radius | |
| - rac | |
| steps: | |
| - uses: regclient/actions/regctl-installer@78eb729dbdb4ef6480e85ff697b4410e22112583 | |
| # logs in to ghcr.io by default | |
| - uses: regclient/actions/regctl-login@78eb729dbdb4ef6480e85ff697b4410e22112583 | |
| # Docker login is required for attestations | |
| - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f | |
| with: | |
| registry: ghcr.io | |
| username: "${{ github.actor }}" | |
| password: "${{ secrets.GITHUB_TOKEN }}" | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v5 | |
| with: | |
| name: "container-build-${{ matrix.name }}" | |
| - id: publish | |
| name: publish | |
| run: | | |
| regctl image import "ocidir://${{ matrix.name }}:${{ needs.build-compute-tags.outputs.tag-full }}" "container/${{ matrix.name }}.oci.tar" | |
| echo "digest=$(regctl image digest "ocidir://${{ matrix.name }}:${{ needs.build-compute-tags.outputs.tag-full }}")" >> "$GITHUB_OUTPUT" | |
| regctl image import "ghcr.io/goauthentik/dev-${{ matrix.name }}:${{ needs.build-compute-tags.outputs.tag-full }}" "container/${{ matrix.name }}.oci.tar" | |
| regctl image import "ghcr.io/goauthentik/dev-${{ matrix.name }}:${{ needs.build-compute-tags.outputs.tag-branch }}" "container/${{ matrix.name }}.oci.tar" | |
| regctl image import "ghcr.io/goauthentik/dev-${{ matrix.name }}:${{ needs.build-compute-tags.outputs.tag-flux }}" "container/${{ matrix.name }}.oci.tar" | |
| - uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 | |
| with: | |
| subject-name: "ghcr.io/goauthentik/dev-${{ matrix.name }}" | |
| subject-digest: "${{ steps.publish.outputs.digest }}" | |
| push-to-registry: true | |
| pr-comment: | |
| if: "${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}" | |
| needs: | |
| - build-compute-tags | |
| - publish | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # Needed to write comments on PRs | |
| pull-requests: write | |
| timeout-minutes: 120 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 | |
| - name: Comment on PR | |
| uses: ./.github/actions/comment-pr-instructions | |
| with: | |
| tag: "${{ needs.build-compute-tags.outputs.tag-full }}" |