Skip to content

Release 2026.8.0-rc2 #291

Release 2026.8.0-rc2

Release 2026.8.0-rc2 #291

Workflow file for this run

---
name: Release - On publish
on:
release:
types: published
jobs:
metadata:
runs-on: ubuntu-latest
outputs:
tag-name: "${{ steps.metadata.outputs.tag-name }}"
version: "${{ steps.metadata.outputs.version }}"
major-version: "${{ steps.metadata.outputs.major-version }}"
release-reason: "${{ steps.metadata.outputs.release-reason }}"
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
- id: metadata
name: Compute variables
run: |
tag_name="$(echo "$GITHUB_REF" | sed "s;refs/tags/;;")"
echo "tag-name=$tag_name" >> "$GITHUB_OUTPUT"
gh release download "$tag_name" --pattern metadata.json
gh attestation verify metadata.json --owner goauthentik
echo "version=$(jq -r '.version')" >> "$GITHUB_OUTPUT"
echo "major-version=$(jq -r '.major_version')" >> "$GITHUB_OUTPUT"
echo "release-reason=$(jq -r '.release_reason')" >> "$GITHUB_OUTPUT"
echo "changelog-url=$(jq -r '.changelog_url')" >> "$GITHUB_OUTPUT"
publish-containers:
runs-on: ubuntu-latest
permissions:
contents: read
# Needed to upload container images to ghcr.io
packages: write
# Needed for attestation
id-token: write
attestations: write
strategy:
matrix:
name:
- server
- proxy
- ldap
- radius
- rac
needs:
- metadata
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
- uses: regclient/actions/regctl-installer@5c882eb04fcca27ebb4f5904e0da01f0780063ea
# logs in to ghcr.io by default
- uses: regclient/actions/regctl-login@5c882eb04fcca27ebb4f5904e0da01f0780063ea
- uses: regclient/actions/regctl-login@5c882eb04fcca27ebb4f5904e0da01f0780063ea
with:
registry: docker.io
username: "${{ secrets.DOCKER_CORP_USERNAME }}"
password: "${{ secrets.DOCKER_CORP_PASSWORD }}"
- name: Download release container artifact
run: |
gh release download "${{ needs.metadata.outputs.tag-name }}" --pattern "${{ matrix.name }}.oci.tar"
gh attestation verify "${{ matrix.name }}.oci.tar" --owner goauthentik
- id: publish
name: Publish container
run: |
regctl image import "ocidir://${{ matrix.name }}:${{ needs.metadata.outputs.version }}" "${{ matrix.name }}.oci.tar"
echo "digest=$(regctl image digest "ocidir://${{ matrix.name }}:${{ needs.metadata.outputs.version }}")" >> "$GITHUB_OUTPUT"
regctl image import "ghcr.io/goauthentik/${{ matrix.name }}:${{ needs.metadata.outputs.version }}" "${{ matrix.name }}.oci.tar"
regctl image import "ghcr.io/goauthentik/${{ matrix.name }}:${{ needs.metadata.outputs.major-version }}" "${{ matrix.name }}.oci.tar"
regctl image import "docker.io/authentik/${{ matrix.name }}:${{ needs.metadata.outputs.version }}" "${{ matrix.name }}.oci.tar"
regctl image import "docker.io/authentik/${{ matrix.name }}:${{ needs.metadata.outputs.major-version }}" "${{ matrix.name }}.oci.tar"
- uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d
with:
subject-name: "ghcr.io/goauthentik/${{ matrix.name }}"
subject-digest: "${{ steps.publish.outputs.digest }}"
push-to-registry: true
publish-docs-container:
needs:
- metadata
runs-on: ubuntu-latest
permissions:
# Needed to upload container images to ghcr.io
packages: write
# Needed for attestation
id-token: write
attestations: write
# Needed for checkout
contents: read
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
- name: Set up QEMU
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
- name: Login to GitHub Container Registry
uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
- id: build
name: Build Docker Image
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
tags: |
ghcr.io/goauthentik/docs:${{ needs.metadata.outputs.version }}
ghcr.io/goauthentik/docs:${{ needs.metadata.outputs.major-version }}
file: website/Dockerfile
push: true
platforms: linux/amd64,linux/arm64
context: .
- uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v3
with:
subject-name: ghcr.io/goauthentik/docs
subject-digest: "${{ steps.build.outputs.digest }}"
push-to-registry: true
upload-aws-cfn-template:
permissions:
# Needed for AWS login
id-token: write
contents: read
needs:
- metadata
- publish-containers
env:
AWS_REGION: eu-central-1
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
- uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: "arn:aws:iam::016170277896:role/github_goauthentik_authentik"
aws-region: ${{ env.AWS_REGION }}
- name: Upload template
run: |
aws s3 cp --acl=public-read lifecycle/aws/template.yaml s3://authentik-cloudformation-templates/authentik.ecs.${{ github.ref }}.yaml
aws s3 cp --acl=public-read lifecycle/aws/template.yaml s3://authentik-cloudformation-templates/authentik.ecs.${{ needs.metadata.outputs.tag-name }}.yaml
if [ "$(gh release list --json tagName,isLatest --jq '.[] | select(.tagName=="${{ needs.metadata.outputs.tag-name }} ") | .isLatest')" = "true" ]; then
aws s3 cp --acl=public-read lifecycle/aws/template.yaml s3://authentik-cloudformation-templates/authentik.ecs.latest.yaml
fi
sentry-release:
needs:
- publish-containers
runs-on: ubuntu-latest
steps:
- name: Get static files from docker image
run: |
image="ghcr.io/goauthentik/server:${{ needs.metadata.outputs.version }}"
docker pull "$image"
container=$(docker container create "$image")
docker cp ${container}:web/ .
- name: Create a Sentry.io release
uses: getsentry/action-release@ff07929a6537bac57790c3451cf4d364aca38528 # v3
continue-on-error: true
env:
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
SENTRY_ORG: authentik-security-inc
SENTRY_PROJECT: authentik
with:
release: "authentik@${{ needs.metadata.outputs.version }}"
sourcemaps: "./web/dist"
url_prefix: "~/static/dist"
bump-version:
name: Bump version repository
needs:
- metadata
- publish-containers
if: ${{ needs.metadata.outputs.release-reason != 'prerelease' }}
runs-on: ubuntu-latest
steps:
- id: app-token
name: Generate app token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v2
with:
client-id: ${{ secrets.GH_APP_ID }}
private-key: ${{ secrets.GH_APP_PRIV_KEY }}
repositories: version
- id: get-user-id
name: Get GitHub app user ID
run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
env:
GH_TOKEN: "${{ steps.app-token.outputs.token }}"
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
with:
repository: "${{ github.repository_owner }}/version"
token: "${{ steps.app-token.outputs.token }}"
- name: Bump version
run: |
jq \
--arg version "${{ needs.metadata.outputs.version }}" \
--arg changelog "See ${{ needs.metadata.outputs.changelog-url }}" \
--arg changelog_url "${{ needs.metadata.outputs.changelog-url }}" \
--arg reason "${{ needs.metadata.outputs.release-reason }}" \
'.stable.version = $version | .stable.changelog = $changelog | .stable.changelog_url = $changelog_url | .stable.reason = $reason' version.json > version.new.json
mv version.new.json version.json
- name: Create pull request
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v7
with:
token: "${{ steps.app-token.outputs.token }}"
branch: bump-${{ needs.metadata.outputs.version }}
commit-message: "version: bump to ${{ needs.metadata.outputs.version }}"
title: "version: bump to ${{ needs.metadata.outputs.version }}"
body: "See ${{ needs.metadata.outputs.changelog-url }}"
delete-branch: true
signoff: true
author: "${{ steps.app-token.outputs.app-slug }}[bot] <${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com>"
bump-helm:
name: Bump Helm version
needs:
- metadata
- publish-containers
if: ${{ needs.metadata.outputs.release-reason != 'prerelease' }}
runs-on: ubuntu-latest
steps:
- id: app-token
name: Generate app token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v2
with:
client-id: ${{ secrets.GH_APP_ID }}
private-key: ${{ secrets.GH_APP_PRIV_KEY }}
repositories: helm
- id: get-user-id
name: Get GitHub app user ID
run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
env:
GH_TOKEN: "${{ steps.app-token.outputs.token }}"
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
with:
repository: "${{ github.repository_owner }}/helm"
token: "${{ steps.app-token.outputs.token }}"
- name: Bump version
run: |
sed -i 's/^version: .*/version: ${{ needs.metadata.outputs.version }}/' charts/authentik/Chart.yaml
sed -i 's/^appVersion: .*/appVersion: ${{ needs.metadata.outputs.version }}/' charts/authentik/Chart.yaml
sed -i 's/upgrade to authentik .*/upgrade to authentik ${{ needs.metadata.outputs.version }}/' charts/authentik/Chart.yaml
sed -E -i 's/[0-9]{4}\.[0-9]{1,2}\.[0-9]+$/${{ needs.metadata.outputs.version }}/' charts/authentik/Chart.yaml
./scripts/helm-docs.sh
- name: Create pull request
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v7
with:
token: "${{ steps.app-token.outputs.token }}"
branch: bump-${{ needs.metadata.outputs.version }}
commit-message: "charts/authentik: bump to ${{ needs.metadata.outputs.version }}"
title: "charts/authentik: bump to ${{ needs.metadata.outputs.version }}"
body: "See ${{ needs.metadata.outputs.changelog-url }}"
delete-branch: true
signoff: true
author: "${{ steps.app-token.outputs.app-slug }}[bot] <${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com>"