Skip to content

Sync with upstream master#6

Open
cruizen wants to merge 1556 commits intoplatform9:masterfrom
dexidp:master
Open

Sync with upstream master#6
cruizen wants to merge 1556 commits intoplatform9:masterfrom
dexidp:master

Conversation

@cruizen
Copy link

@cruizen cruizen commented Oct 17, 2022 •
edited by cursor bot
Loading

Overview

Sync the pf9 fork with dexidp/dex master to bring in all the changes from https://github.com/dexidp/dex/releases/tag/v2.35.3 + this PR dexidp#2708 from master

What this PR does / why we need it

Bring in the upstream fixes to improve security (there is a known CVE), bring in fixes / optimisations
ArgoCD has now released patches for v2.2 and v2.4 that fix this in ArgoCD's dex server pod (by upgrading to v2.25.3 of upstream dex).
We are missing this (just upgrading ArgoCD will not help) since we use our own forked dex

Special notes for your reviewer

Does this PR introduce a user-facing change?

Note

Medium Risk
Touches CI/release pipelines and container build/signing paths; misconfiguration could break publishing, provenance, or image runtime expectations despite limited application logic changes.

Overview
CI and release automation is revamped: introduces reusable artifacts.yaml (called from ci.yaml and new release.yaml) that builds multi-arch images (adds s390x), optionally pushes on release/tag, signs with cosign, creates provenance attestations, and runs Trivy scans with caching + SARIF uploads; adds OpenSSF Scorecard and a scheduled Trivy DB cache workflow, and removes legacy docker.yaml/codeql-analysis.yaml.

Build/tooling inputs are updated: Docker build now uses tonistiigi/xx + newer Go/Alpine/distroless bases, ensures a nonroot dex user exists in images, bumps gomplate, and threads VERSION into builds; Makefile is reorganized with explicit generate/verify targets, updated tool versions (protoc/kind/golangci-lint), and adds go mod tidy across modules.

Repo hygiene/docs updates: dependabot now includes /examples and groups etcd deps; .golangci.yml is replaced with .golangci.yaml; PR/issue/security templates and README/ADOPTERS links/text are refreshed; protobuf-generated Go files are regenerated with newer protoc/plugins (no API shape change, but new generated code layout).

Written by Cursor Bugbot for commit 29c7b6f. This will update automatically on new commits. Configure here.

@cruizen cruizen changed the title Merge master Sync with upstream master Oct 17, 2022
@cruizen cruizen marked this pull request as ready for review October 17, 2022 21:26
@cruizen
Copy link
Author

cruizen commented Oct 17, 2022 •
edited
Loading

Hi @erwinvaneyk , @pshanbhag I don't have write access to the repo and therefore cannot ask for review and / or resolve merge conflicts, it seems.

This PR is in draft state since I see a message that "This branch has conflicts that must be resolved".

@cruizen
Copy link
Author

cruizen commented Oct 4, 2023

This branch has conflicts that must be resolved :-/

@cruizen cruizen marked this pull request as draft October 4, 2023 21:17
mithilarun
mithilarun previously approved these changes Oct 4, 2023
View reviewed changes
@cruizen cruizen marked this pull request as ready for review March 12, 2024 12:47
@cruizen cruizen requested review from a team, gauravgavhane05 and mithilarun March 13, 2024 09:23
mithilarun
mithilarun previously approved these changes Mar 13, 2024
View reviewed changes
@bito-code-review
Copy link

bito-code-review bot commented Feb 1, 2025 •
edited
Loading

Code Review Agent Run Status

  • Limitations and other issues: ❌ Failure - Bito Code Review Agent didn't review this pull request automatically because it exceeded the size limit. No action is needed if you didn't intend for the agent to review it. Otherwise, you can initiate the review by typing /review in a comment below.

14 similar comments
@bito-code-review
Copy link

bito-code-review bot commented Feb 3, 2025 •
edited
Loading

Code Review Agent Run Status

  • Limitations and other issues: ❌ Failure - Bito Code Review Agent didn't review this pull request automatically because it exceeded the size limit. No action is needed if you didn't intend for the agent to review it. Otherwise, you can initiate the review by typing /review in a comment below.

@bito-code-review
Copy link

bito-code-review bot commented Feb 4, 2025 •
edited
Loading

Code Review Agent Run Status

  • Limitations and other issues: ❌ Failure - Bito Code Review Agent didn't review this pull request automatically because it exceeded the size limit. No action is needed if you didn't intend for the agent to review it. Otherwise, you can initiate the review by typing /review in a comment below.

@bito-code-review
Copy link

bito-code-review bot commented Feb 4, 2025 •
edited
Loading

Code Review Agent Run Status

  • Limitations and other issues: ❌ Failure - Bito Code Review Agent didn't review this pull request automatically because it exceeded the size limit. No action is needed if you didn't intend for the agent to review it. Otherwise, you can initiate the review by typing /review in a comment below.

@bito-code-review
Copy link

bito-code-review bot commented Feb 6, 2025 •
edited
Loading

Code Review Agent Run Status

  • Limitations and other issues: ❌ Failure - Bito Code Review Agent didn't review this pull request automatically because it exceeded the size limit. No action is needed if you didn't intend for the agent to review it. Otherwise, you can initiate the review by typing /review in a comment below.

@bito-code-review
Copy link

bito-code-review bot commented Feb 6, 2025 •
edited
Loading

Code Review Agent Run Status

  • Limitations and other issues: ❌ Failure - Bito Code Review Agent didn't review this pull request automatically because it exceeded the size limit. No action is needed if you didn't intend for the agent to review it. Otherwise, you can initiate the review by typing /review in a comment below.

@bito-code-review
Copy link

bito-code-review bot commented Feb 14, 2025 •
edited
Loading

Code Review Agent Run Status

  • Limitations and other issues: ❌ Failure - Bito Code Review Agent didn't review this pull request automatically because it exceeded the size limit. No action is needed if you didn't intend for the agent to review it. Otherwise, you can initiate the review by typing /review in a comment below.

@bito-code-review
Copy link

bito-code-review bot commented Feb 15, 2025 •
edited
Loading

Code Review Agent Run Status

  • Limitations and other issues: ❌ Failure - Bito Code Review Agent didn't review this pull request automatically because it exceeded the size limit. No action is needed if you didn't intend for the agent to review it. Otherwise, you can initiate the review by typing /review in a comment below.

@bito-code-review
Copy link

bito-code-review bot commented Feb 16, 2025 •
edited
Loading

Code Review Agent Run Status

  • Limitations and other issues: ❌ Failure - Bito Code Review Agent didn't review this pull request automatically because it exceeded the size limit. No action is needed if you didn't intend for the agent to review it. Otherwise, you can initiate the review by typing /review in a comment below.

@bito-code-review
Copy link

bito-code-review bot commented Feb 17, 2025 •
edited
Loading

Code Review Agent Run Status

  • Limitations and other issues: ❌ Failure - Bito Code Review Agent didn't review this pull request automatically because it exceeded the size limit. No action is needed if you didn't intend for the agent to review it. Otherwise, you can initiate the review by typing /review in a comment below.

@bito-code-review
Copy link

bito-code-review bot commented Feb 18, 2025 •
edited
Loading

Code Review Agent Run Status

  • Limitations and other issues: ❌ Failure - Bito Code Review Agent didn't review this pull request automatically because it exceeded the size limit. No action is needed if you didn't intend for the agent to review it. Otherwise, you can initiate the review by typing /review in a comment below.

@bito-code-review
Copy link

bito-code-review bot commented Feb 19, 2025 •
edited
Loading

Code Review Agent Run Status

  • Limitations and other issues: ❌ Failure - Bito Code Review Agent didn't review this pull request automatically because it exceeded the size limit. No action is needed if you didn't intend for the agent to review it. Otherwise, you can initiate the review by typing /review in a comment below.

@bito-code-review
Copy link

bito-code-review bot commented Feb 20, 2025 •
edited
Loading

Code Review Agent Run Status

  • Limitations and other issues: ❌ Failure - Bito Code Review Agent didn't review this pull request automatically because it exceeded the size limit. No action is needed if you didn't intend for the agent to review it. Otherwise, you can initiate the review by typing /review in a comment below.

@bito-code-review
Copy link

bito-code-review bot commented Feb 28, 2025 •
edited
Loading

Code Review Agent Run Status

  • Limitations and other issues: ❌ Failure - Bito Code Review Agent didn't review this pull request automatically because it exceeded the size limit. No action is needed if you didn't intend for the agent to review it. Otherwise, you can initiate the review by typing /review in a comment below.

@bito-code-review
Copy link

bito-code-review bot commented Mar 5, 2025 •
edited
Loading

Code Review Agent Run Status

  • Limitations and other issues: ❌ Failure - Bito Code Review Agent didn't review this pull request automatically because it exceeded the size limit. No action is needed if you didn't intend for the agent to review it. Otherwise, you can initiate the review by typing /review in a comment below.

nabokihms and others added 30 commits March 5, 2026 13:29
@nabokihms
feat(gitlab): implement TokenIdentity method (#4606)
a11b3cd 
Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>
@dependabot
build(deps): bump golang from 1.26.0-alpine3.22 to 1.26.1-alpine3.22 (#…
7870871 
…4612)

Bumps golang from 1.26.0-alpine3.22 to 1.26.1-alpine3.22.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.26.1-alpine3.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 (#4616
91bf627 
)

Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.12.0 to 4.0.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@8d2750c...4d04d5d)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump docker/build-push-action from 6.19.2 to 7.0.0 (#4613)
8dce952 
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.19.2 to 7.0.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@10e90e3...d08e5c3)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump docker/metadata-action from 5.10.0 to 6.0.0 (#4614)
976e45e 
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.10.0 to 6.0.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c299e40...030e881)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump github/codeql-action from 4.32.5 to 4.32.6 (#4615)
f4c3102 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.5 to 4.32.6.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@c793b71...0d579ff)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.32.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@nabokihms
feat(tests): add MySQL 8 support in CI and tests (#4617)
591a201 
Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>
@mark-liu
fix(server): handle double-submit on approval endpoint (#4620)
c03a687 
When GetAuthRequest returns ErrNotFound in handleApproval, render a 400
"User session error." instead of logging + rendering a 500 "Database
error.". Covers the double-submit race where sendCodeResponse deletes
the auth request on first approval and the second request finds nothing.
---
Signed-off-by: Mark Liu <mark@prove.com.au>
Signed-off-by: mark-liu <mark-liu@users.noreply.github.com>
@dependabot
build(deps): bump golang.org/x/oauth2 from 0.35.0 to 0.36.0 in /examp…
e2462a2 
…les (#4627)

Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.35.0 to 0.36.0.
- [Commits](golang/oauth2@v0.35.0...v0.36.0)

---
updated-dependencies:
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump aquasecurity/trivy-action from 0.34.2 to 0.35.0 (#4622
9ba3c3f 
)

Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.34.2 to 0.35.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](aquasecurity/trivy-action@97e0b38...57a97c7)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-version: 0.35.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.2 (#4623)
74dd7ee 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.79.1 to 1.79.2.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.79.1...v1.79.2)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump golang.org/x/oauth2 from 0.35.0 to 0.36.0 (#4624)
e67c47c 
Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.35.0 to 0.36.0.
- [Commits](golang/oauth2@v0.35.0...v0.36.0)

---
updated-dependencies:
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump google.golang.org/grpc in /examples (#4626)
01b6822 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.79.1 to 1.79.2.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.79.1...v1.79.2)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump google.golang.org/grpc in /api/v2 (#4625)
a4136db 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.79.1 to 1.79.2.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.79.1...v1.79.2)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 (#4628)
35c0b56 
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 4.0.0 to 4.1.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@faadad0...ba7bc0a)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump google.golang.org/api from 0.269.0 to 0.270.0 (#4630)
7bd3c2a 
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.269.0 to 0.270.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.269.0...v0.270.0)

---
updated-dependencies:
- dependency-name: google.golang.org/api
  dependency-version: 0.270.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump anchore/sbom-action from 0.23.0 to 0.23.1 (#4629)
ae8c5af
@nabokihms
test: add concurrency tests for storage implementations (#4631)
3d97c59 
Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>
@dependabot
build(deps): bump google.golang.org/api from 0.270.0 to 0.271.0 (#4633)
47b6454 
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.270.0 to 0.271.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.270.0...v0.271.0)

---
updated-dependencies:
- dependency-name: google.golang.org/api
  dependency-version: 0.271.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@nabokihms
feat(connector): connectors for grants (#4619)
7777773 
Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>
@nabokihms
feat(client): add allowed connectors field to client configuration (#…
f80a89d 
…4610)

Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>
@nabokihms
feat: update CSS for improved theming and button styles (#4634)
80d297b
@dependabot
build(deps): bump golang.org/x/crypto from 0.48.0 to 0.49.0 (#4636)
734d60f
@dependabot
build(deps): bump golang.org/x/net from 0.51.0 to 0.52.0 (#4635)
13f012f 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.51.0 to 0.52.0.
- [Commits](golang/net@v0.51.0...v0.52.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@nabokihms
test: fix token introspection tests to use consistent timestamps (#4639)
2bda646 
Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>
@nabokihms
feat: add PKCE (Proof Key for Code Exchange) configuration to OAuth2 …
5bbfbbe 
…settings (#4638)

Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>
@nabokihms
DEP: CEL integration (#4601)
0568abe 
Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>
Signed-off-by: Maksim Nabokikh <max.nabokih@gmail.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
@nabokihms
feat(cel): implement CEL compiler with library (#4607)
175dc57 
Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>
@nabokihms
DEP: Auth Sessions - Introduce (#4561)
e8f79fe 
Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>
Signed-off-by: Maksim Nabokikh <max.nabokih@gmail.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
@nabokihms
feat: add UserIdentity entity and CRUD operations (#4643)
5a4395f 
Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>
Signed-off-by: Maksim Nabokikh <max.nabokih@gmail.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jayanth-tjvrr jayanth-tjvrr Awaiting requested review from jayanth-tjvrr

@gauravgavhane05 gauravgavhane05 Awaiting requested review from gauravgavhane05

2 more reviewers

@cursor cursor[bot] cursor[bot] left review comments

@mithilarun mithilarun mithilarun left review comments

Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.