Release 2026.8.0-rc2 #291
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Release - On publish | |
| on: | |
| release: | |
| types: published | |
| jobs: | |
| metadata: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| tag-name: "${{ steps.metadata.outputs.tag-name }}" | |
| version: "${{ steps.metadata.outputs.version }}" | |
| major-version: "${{ steps.metadata.outputs.major-version }}" | |
| release-reason: "${{ steps.metadata.outputs.release-reason }}" | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 | |
| - id: metadata | |
| name: Compute variables | |
| run: | | |
| tag_name="$(echo "$GITHUB_REF" | sed "s;refs/tags/;;")" | |
| echo "tag-name=$tag_name" >> "$GITHUB_OUTPUT" | |
| gh release download "$tag_name" --pattern metadata.json | |
| gh attestation verify metadata.json --owner goauthentik | |
| echo "version=$(jq -r '.version')" >> "$GITHUB_OUTPUT" | |
| echo "major-version=$(jq -r '.major_version')" >> "$GITHUB_OUTPUT" | |
| echo "release-reason=$(jq -r '.release_reason')" >> "$GITHUB_OUTPUT" | |
| echo "changelog-url=$(jq -r '.changelog_url')" >> "$GITHUB_OUTPUT" | |
| publish-containers: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| # Needed to upload container images to ghcr.io | |
| packages: write | |
| # Needed for attestation | |
| id-token: write | |
| attestations: write | |
| strategy: | |
| matrix: | |
| name: | |
| - server | |
| - proxy | |
| - ldap | |
| - radius | |
| - rac | |
| needs: | |
| - metadata | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 | |
| - uses: regclient/actions/regctl-installer@5c882eb04fcca27ebb4f5904e0da01f0780063ea | |
| # logs in to ghcr.io by default | |
| - uses: regclient/actions/regctl-login@5c882eb04fcca27ebb4f5904e0da01f0780063ea | |
| - uses: regclient/actions/regctl-login@5c882eb04fcca27ebb4f5904e0da01f0780063ea | |
| with: | |
| registry: docker.io | |
| username: "${{ secrets.DOCKER_CORP_USERNAME }}" | |
| password: "${{ secrets.DOCKER_CORP_PASSWORD }}" | |
| - name: Download release container artifact | |
| run: | | |
| gh release download "${{ needs.metadata.outputs.tag-name }}" --pattern "${{ matrix.name }}.oci.tar" | |
| gh attestation verify "${{ matrix.name }}.oci.tar" --owner goauthentik | |
| - id: publish | |
| name: Publish container | |
| run: | | |
| regctl image import "ocidir://${{ matrix.name }}:${{ needs.metadata.outputs.version }}" "${{ matrix.name }}.oci.tar" | |
| echo "digest=$(regctl image digest "ocidir://${{ matrix.name }}:${{ needs.metadata.outputs.version }}")" >> "$GITHUB_OUTPUT" | |
| regctl image import "ghcr.io/goauthentik/${{ matrix.name }}:${{ needs.metadata.outputs.version }}" "${{ matrix.name }}.oci.tar" | |
| regctl image import "ghcr.io/goauthentik/${{ matrix.name }}:${{ needs.metadata.outputs.major-version }}" "${{ matrix.name }}.oci.tar" | |
| regctl image import "docker.io/authentik/${{ matrix.name }}:${{ needs.metadata.outputs.version }}" "${{ matrix.name }}.oci.tar" | |
| regctl image import "docker.io/authentik/${{ matrix.name }}:${{ needs.metadata.outputs.major-version }}" "${{ matrix.name }}.oci.tar" | |
| - uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d | |
| with: | |
| subject-name: "ghcr.io/goauthentik/${{ matrix.name }}" | |
| subject-digest: "${{ steps.publish.outputs.digest }}" | |
| push-to-registry: true | |
| publish-docs-container: | |
| needs: | |
| - metadata | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # Needed to upload container images to ghcr.io | |
| packages: write | |
| # Needed for attestation | |
| id-token: write | |
| attestations: write | |
| # Needed for checkout | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - id: build | |
| name: Build Docker Image | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| tags: | | |
| ghcr.io/goauthentik/docs:${{ needs.metadata.outputs.version }} | |
| ghcr.io/goauthentik/docs:${{ needs.metadata.outputs.major-version }} | |
| file: website/Dockerfile | |
| push: true | |
| platforms: linux/amd64,linux/arm64 | |
| context: . | |
| - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v3 | |
| with: | |
| subject-name: ghcr.io/goauthentik/docs | |
| subject-digest: "${{ steps.build.outputs.digest }}" | |
| push-to-registry: true | |
| upload-aws-cfn-template: | |
| permissions: | |
| # Needed for AWS login | |
| id-token: write | |
| contents: read | |
| needs: | |
| - metadata | |
| - publish-containers | |
| env: | |
| AWS_REGION: eu-central-1 | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 | |
| - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 | |
| with: | |
| role-to-assume: "arn:aws:iam::016170277896:role/github_goauthentik_authentik" | |
| aws-region: ${{ env.AWS_REGION }} | |
| - name: Upload template | |
| run: | | |
| aws s3 cp --acl=public-read lifecycle/aws/template.yaml s3://authentik-cloudformation-templates/authentik.ecs.${{ github.ref }}.yaml | |
| aws s3 cp --acl=public-read lifecycle/aws/template.yaml s3://authentik-cloudformation-templates/authentik.ecs.${{ needs.metadata.outputs.tag-name }}.yaml | |
| if [ "$(gh release list --json tagName,isLatest --jq '.[] | select(.tagName=="${{ needs.metadata.outputs.tag-name }} ") | .isLatest')" = "true" ]; then | |
| aws s3 cp --acl=public-read lifecycle/aws/template.yaml s3://authentik-cloudformation-templates/authentik.ecs.latest.yaml | |
| fi | |
| sentry-release: | |
| needs: | |
| - publish-containers | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Get static files from docker image | |
| run: | | |
| image="ghcr.io/goauthentik/server:${{ needs.metadata.outputs.version }}" | |
| docker pull "$image" | |
| container=$(docker container create "$image") | |
| docker cp ${container}:web/ . | |
| - name: Create a Sentry.io release | |
| uses: getsentry/action-release@ff07929a6537bac57790c3451cf4d364aca38528 # v3 | |
| continue-on-error: true | |
| env: | |
| SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} | |
| SENTRY_ORG: authentik-security-inc | |
| SENTRY_PROJECT: authentik | |
| with: | |
| release: "authentik@${{ needs.metadata.outputs.version }}" | |
| sourcemaps: "./web/dist" | |
| url_prefix: "~/static/dist" | |
| bump-version: | |
| name: Bump version repository | |
| needs: | |
| - metadata | |
| - publish-containers | |
| if: ${{ needs.metadata.outputs.release-reason != 'prerelease' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - id: app-token | |
| name: Generate app token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v2 | |
| with: | |
| client-id: ${{ secrets.GH_APP_ID }} | |
| private-key: ${{ secrets.GH_APP_PRIV_KEY }} | |
| repositories: version | |
| - id: get-user-id | |
| name: Get GitHub app user ID | |
| run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT" | |
| env: | |
| GH_TOKEN: "${{ steps.app-token.outputs.token }}" | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 | |
| with: | |
| repository: "${{ github.repository_owner }}/version" | |
| token: "${{ steps.app-token.outputs.token }}" | |
| - name: Bump version | |
| run: | | |
| jq \ | |
| --arg version "${{ needs.metadata.outputs.version }}" \ | |
| --arg changelog "See ${{ needs.metadata.outputs.changelog-url }}" \ | |
| --arg changelog_url "${{ needs.metadata.outputs.changelog-url }}" \ | |
| --arg reason "${{ needs.metadata.outputs.release-reason }}" \ | |
| '.stable.version = $version | .stable.changelog = $changelog | .stable.changelog_url = $changelog_url | .stable.reason = $reason' version.json > version.new.json | |
| mv version.new.json version.json | |
| - name: Create pull request | |
| uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v7 | |
| with: | |
| token: "${{ steps.app-token.outputs.token }}" | |
| branch: bump-${{ needs.metadata.outputs.version }} | |
| commit-message: "version: bump to ${{ needs.metadata.outputs.version }}" | |
| title: "version: bump to ${{ needs.metadata.outputs.version }}" | |
| body: "See ${{ needs.metadata.outputs.changelog-url }}" | |
| delete-branch: true | |
| signoff: true | |
| author: "${{ steps.app-token.outputs.app-slug }}[bot] <${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com>" | |
| bump-helm: | |
| name: Bump Helm version | |
| needs: | |
| - metadata | |
| - publish-containers | |
| if: ${{ needs.metadata.outputs.release-reason != 'prerelease' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - id: app-token | |
| name: Generate app token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v2 | |
| with: | |
| client-id: ${{ secrets.GH_APP_ID }} | |
| private-key: ${{ secrets.GH_APP_PRIV_KEY }} | |
| repositories: helm | |
| - id: get-user-id | |
| name: Get GitHub app user ID | |
| run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT" | |
| env: | |
| GH_TOKEN: "${{ steps.app-token.outputs.token }}" | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 | |
| with: | |
| repository: "${{ github.repository_owner }}/helm" | |
| token: "${{ steps.app-token.outputs.token }}" | |
| - name: Bump version | |
| run: | | |
| sed -i 's/^version: .*/version: ${{ needs.metadata.outputs.version }}/' charts/authentik/Chart.yaml | |
| sed -i 's/^appVersion: .*/appVersion: ${{ needs.metadata.outputs.version }}/' charts/authentik/Chart.yaml | |
| sed -i 's/upgrade to authentik .*/upgrade to authentik ${{ needs.metadata.outputs.version }}/' charts/authentik/Chart.yaml | |
| sed -E -i 's/[0-9]{4}\.[0-9]{1,2}\.[0-9]+$/${{ needs.metadata.outputs.version }}/' charts/authentik/Chart.yaml | |
| ./scripts/helm-docs.sh | |
| - name: Create pull request | |
| uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v7 | |
| with: | |
| token: "${{ steps.app-token.outputs.token }}" | |
| branch: bump-${{ needs.metadata.outputs.version }} | |
| commit-message: "charts/authentik: bump to ${{ needs.metadata.outputs.version }}" | |
| title: "charts/authentik: bump to ${{ needs.metadata.outputs.version }}" | |
| body: "See ${{ needs.metadata.outputs.changelog-url }}" | |
| delete-branch: true | |
| signoff: true | |
| author: "${{ steps.app-token.outputs.app-slug }}[bot] <${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com>" |