dandri/matrix-authentication-service
1
0
Fork 0
mirror of https://github.com/element-hq/matrix-authentication-service.git synced 2026-09-25 17:44:23 +00:00
Code Issues Packages Projects Releases Wiki Activity
7,522 Commits 78 Branches 109 Tags
64b71bacabee5b052d9674202ebbf34ff79e2d71
Commit Graph
268 Commits
Author SHA1 Message Date
Quentin Gliech f853d96049 build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 (#5790) 2026-07-02 19:45:30 +02:00
dependabot[bot] 5d8182dd3f build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 4.0.0 to 4.1.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd...d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-02 17:17:39 +00:00
dependabot[bot] 8c3f3cc305 build(deps): bump tailscale/github-action from 4.1.1 to 4.1.2 
Bumps [tailscale/github-action](https://github.com/tailscale/github-action) from 4.1.1 to 4.1.2.
- [Release notes](https://github.com/tailscale/github-action/releases)
- [Commits](https://github.com/tailscale/github-action/compare/53acf823325fe9ca47f4cdaa951f90b4b0de5bb9...306e68a486fd2350f2bfc3b19fcd143891a4a2d8)

---
updated-dependencies:
- dependency-name: tailscale/github-action
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-02 17:16:57 +00:00
Quentin Gliech 0a0a59773a build(deps): bump docker/bake-action from 7.1.0 to 7.2.0 (#5776) 2026-07-02 18:29:33 +02:00
Quentin Gliech 4c92e14e90 build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#5779) 2026-07-02 18:27:02 +02:00
dependabot[bot] bcc7f75e4c build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v7...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-02 15:46:42 +00:00
dependabot[bot] 5753b61f3e build(deps): bump taiki-e/install-action from 2.79.2 to 2.82.0 
Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.79.2 to 2.82.0.
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/taiki-e/install-action/compare/213ccc1a076163c093f914550b94feb90fab916d...b8cecb83565409bcc297b2df6e77f030b2a468d5)

---
updated-dependencies:
- dependency-name: taiki-e/install-action
  dependency-version: 2.82.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-02 15:46:27 +00:00
dependabot[bot] 01eada1819 build(deps): bump docker/bake-action from 7.1.0 to 7.2.0 
Bumps [docker/bake-action](https://github.com/docker/bake-action) from 7.1.0 to 7.2.0.
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](https://github.com/docker/bake-action/compare/a66e1c87e2eca0503c343edf1d208c716d54b8a8...6614cfa25eff9a0b2b2697efb0b6159e7680d584)

---
updated-dependencies:
- dependency-name: docker/bake-action
  dependency-version: 7.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-02 15:45:22 +00:00
Quentin Gliech 2a12d67854 build(deps): bump docker/login-action from 4.1.0 to 4.2.0 (#5765) 2026-07-01 17:39:00 +02:00
Quentin Gliech a362c371b0 build(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2 (#5767) 2026-07-01 17:34:38 +02:00
Quentin Gliech 25d9d559c2 build(deps): bump docker/metadata-action from 6.0.0 to 6.1.0 (#5766) 2026-07-01 17:34:19 +02:00
dependabot[bot] d180adebc8 build(deps): bump docker/login-action from 4.1.0 to 4.2.0 
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.1.0 to 4.2.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/4907a6ddec9925e35a0a9e82d7399ccc52663121...650006c6eb7dba73a995cc03b0b2d7f5ca915bee)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-01 15:04:54 +00:00
dependabot[bot] 0c6100f451 build(deps): bump docker/metadata-action from 6.0.0 to 6.1.0 
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 6.0.0 to 6.1.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](https://github.com/docker/metadata-action/compare/030e881283bb7a6894de51c315a6bfe6a94e05cf...80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-01 15:04:44 +00:00
dependabot[bot] 5f315d4611 build(deps): bump actions/checkout from 6.0.2 to 7.0.0 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-01 15:04:27 +00:00
dependabot[bot] e0b15fd772 build(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2 
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 4.1.1 to 4.1.2.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](https://github.com/sigstore/cosign-installer/compare/cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003...6f9f17788090df1f26f669e9d70d6ae9567deba6)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-01 15:04:26 +00:00
dependabot[bot] e56dccdd68 build(deps): bump actions/github-script from 8.0.0 to 9.0.0 
Bumps [actions/github-script](https://github.com/actions/github-script) from 8.0.0 to 9.0.0.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/ed597411d8f924073f98dfc5c65a23a2325f34cd...3a2844b7e9c422d3c10d287c895573f7108da1b3)

---
updated-dependencies:
- dependency-name: actions/github-script
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-17 17:28:52 +00:00
Quentin Gliech 63ed796441 Use the public registry hostname in release notes (#5725) 2026-06-17 17:42:43 +02:00
Quentin Gliech e1f69b8aa6 Bump mozilla-actions/sccache-action from 0.0.9 to 0.0.10 (#5719) 2026-06-17 10:02:03 +02:00
Quentin Gliech ffcc793a26 Bump taiki-e/install-action from 2.77.0 to 2.79.2 (#5716) 2026-06-17 10:01:31 +02:00
Quentin Gliech 7455110877 Use the public registry hostname in release notes 
The release notes list the Docker image tags straight from the
metadata-action output, which references the internal push registry
(oci-push.vpn.infra.element.io, the only writable endpoint) rather than
the public pull registry (oci.element.io) that users actually pull from.

Rewrite the host when building the release-notes metadata blob, leaving
the tags used for the actual push untouched.
 2026-06-04 15:43:55 +02:00
dependabot[bot] 579b0c8dd6 Bump mozilla-actions/sccache-action from 0.0.9 to 0.0.10 
Bumps [mozilla-actions/sccache-action](https://github.com/mozilla-actions/sccache-action) from 0.0.9 to 0.0.10.
- [Release notes](https://github.com/mozilla-actions/sccache-action/releases)
- [Commits](https://github.com/mozilla-actions/sccache-action/compare/7d986dd989559c6ecdb630a3fd2557667be217ad...9e7fa8a12102821edf02ca5dbea1acd0f89a2696)

---
updated-dependencies:
- dependency-name: mozilla-actions/sccache-action
  dependency-version: 0.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-02 17:35:22 +00:00
dependabot[bot] b59e865b7f Bump hashicorp/vault-action from 3.4.0 to 4.0.0 
Bumps [hashicorp/vault-action](https://github.com/hashicorp/vault-action) from 3.4.0 to 4.0.0.
- [Release notes](https://github.com/hashicorp/vault-action/releases)
- [Changelog](https://github.com/hashicorp/vault-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/hashicorp/vault-action/compare/4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b...892a26828f195e65540a40b4768ae4571f51ebfc)

---
updated-dependencies:
- dependency-name: hashicorp/vault-action
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-02 17:35:02 +00:00
dependabot[bot] c2ad2b3fbe Bump taiki-e/install-action from 2.77.0 to 2.79.2 
Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.77.0 to 2.79.2.
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/taiki-e/install-action/compare/7ea35f098a7369cd23488403f58be9c491a6c55f...213ccc1a076163c093f914550b94feb90fab916d)

---
updated-dependencies:
- dependency-name: taiki-e/install-action
  dependency-version: 2.79.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-02 17:34:56 +00:00
Quentin Gliech cb043e2cd9 build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#5629) 2026-05-25 13:01:00 +02:00
Quentin Gliech 6043fa729c build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0 (#5627) 2026-05-25 13:00:40 +02:00
Quentin Gliech eeea952b55 Add a comment about the artefact collection 2026-05-20 15:24:19 +02:00
Quentin Gliech 7834229784 Re-add DOCKER_METADATA_ANNOTATIONS_LEVELS to narrow annotations to the index 
`docker buildx imagetools create --annotation manifest:KEY=VALUE` errors
out with "manifest annotations are not supported yet". metadata-action
defaults to emitting `manifest:` prefixed entries, so without an explicit
`DOCKER_METADATA_ANNOTATIONS_LEVELS: index` the finalize step blows up
the first time it sees a non-empty annotations list.
 2026-05-20 15:22:56 +02:00
Quentin Gliech 63deb0b1fd Don't specify DOCKER_METADATA_ANNOTATIONS_LEVELS 
We're injecting annotations manually anyway
 2026-05-20 14:42:17 +02:00
Quentin Gliech d88db7deff Simplify the injection of annotations in the final manifest 2026-05-20 14:41:53 +02:00
Quentin Gliech c2dc7c11a9 Split multi-arch Docker build into parallel jobs 
- Modify Dockerfile to build single architecture based on TARGETARCH instead of cross-compiling both targets in one run
- Replace single build-image job with matrix job (amd64, arm64)
- Add finalize-image job that creates multi-arch manifests using `docker buildx imagetools create` and signs the final images
- Each architecture gets its own build cache

This enables parallel builds of each architecture, reducing total build time by running both simultaneously rather than sequentially.
 2026-05-20 12:57:22 +02:00
Quentin Gliech 6946e57ffd Fix the release notes reference to the image 2026-05-20 10:58:01 +02:00
Quentin Gliech e833483070 Bump OCI login action to v4.1.0 to match the GHCR login 2026-05-20 10:44:20 +02:00
Quentin Gliech c52161d420 Merge remote-tracking branch 'origin/main' into devon/element-docker 2026-05-20 10:14:18 +02:00
Quentin Gliech 815e9ef19a Skip oci.element.io push on PR-labelled builds 
Tailscale + Vault JWT auth needs a `push`-event OIDC token, so gate the
oci-push registry image and its login steps on `github.event_name == 'push'`.
PR-labelled builds (`Z-Build-Workflow`) push only to ghcr.io.
 2026-05-20 09:50:18 +02:00
Quentin Gliech f0100c4fa8 Disable provenance in the metadata output 2026-05-20 09:34:26 +02:00
Quentin Gliech f99f4f5fba Fix the transformation of the Docker build metadata in CI 
This broke in #5664 due to STEPS_BAKE_OUTPUTS_METADATA being too large
to be passed as an argument to a shell script.

This replaces the `jq` call with a javascript action which transforms
the output.
 2026-05-15 13:29:55 +02:00
dependabot[bot] e3c7375ca4 build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-13 14:10:09 +00:00
dependabot[bot] 10a0a197cc build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.6.1 to 3.0.0.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/153bb8e04406b158c6c84fc1615b65b24149a1fe...b4309332981a82ec1c5618f44dd2e27cc8bfbfda)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-13 14:10:07 +00:00
Andrew Morgan c69b4e0cc2 Correct STEPS_BAKE_OUTPUTS_METADATA line 
Looks like this is an edge case in zizmor.
 2026-05-13 12:49:06 +02:00
Andrew Morgan 34153e03ac Switch rust install GH action to rustup 2026-05-05 12:55:12 +01:00
Andrew Morgan cd9e54cc89 Replace steps.bake.outputs.metadata with an env var 
So the bake job's output can't be used to run arbitrary shell commands. See https://docs.zizmor.sh/audits/#template-injection
 2026-05-05 12:36:20 +01:00
Andrew Morgan fdf8dde38a Tell actions/checkout not to persist credentials 
Recommended by `zizmor`. See https://docs.zizmor.sh/audits/#artipacked
for an explanation.
 2026-05-05 12:34:58 +01:00
Andrew Morgan b99023662a Pin versions of github actions using zizmor 
To eliminate risk of supply chain attacks.
 2026-05-05 12:32:07 +01:00
dependabot[bot] a804d3ecb7 build(deps): bump docker/bake-action from 7.0.0 to 7.1.0 
Bumps [docker/bake-action](https://github.com/docker/bake-action) from 7.0.0 to 7.1.0.
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](https://github.com/docker/bake-action/compare/v7.0.0...v7.1.0)

---
updated-dependencies:
- dependency-name: docker/bake-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-10 13:54:10 +00:00
dependabot[bot] a325b44827 build(deps): bump docker/login-action from 4.0.0 to 4.1.0 
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.0.0 to 4.1.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v4.0.0...v4.1.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-03 13:53:42 +00:00
dependabot[bot] da156aaf07 build(deps): bump sigstore/cosign-installer from 4.1.0 to 4.1.1 
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 4.1.0 to 4.1.1.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](https://github.com/sigstore/cosign-installer/compare/v4.1.0...v4.1.1)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-26 14:02:19 +00:00
Quentin Gliech 30a5dc0a76 build(deps): bump docker/metadata-action from 5.10.0 to 6.0.0 (#5558) 2026-03-24 11:47:28 +01:00
Quentin Gliech c820e7e630 build(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 (#5559) 2026-03-24 11:47:11 +01:00
dependabot[bot] c6a2eb73e0 build(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.5.0 to 2.6.1.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/v2.5.0...v2.6.1)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 2.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-18 13:54:56 +00:00
dependabot[bot] 5aa0b6baa0 build(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 4.0.0 to 4.1.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](https://github.com/sigstore/cosign-installer/compare/v4.0.0...v4.1.0)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-18 13:54:50 +00:00