chore(main): release 0.8.3 (#81)

Co-authored-by: garage-ui-release-bot[bot] <285030457+garage-ui-release-bot[bot]@users.noreply.github.com>

.github/workflows/chart-release.yml

@@ -3,11 +3,15 @@ name: chart-release
 on:
   push:
     tags:
-      - 'garage-ui-chart-v*'
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+-*'
+  workflow_dispatch:
 
 permissions:
   contents: write
   pages: write
+  packages: write
+  id-token: write
 
 jobs:
   release:
@@ -26,7 +30,7 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@v4.3.1
         with:
-          version: v3.19.3
+          version: v4.1.3
 
       - name: Run chart-releaser
         uses: helm/chart-releaser-action@v1.7.0
@@ -35,3 +39,43 @@ jobs:
           skip_existing: true
         env:
           CR_TOKEN: ${{ secrets.HELM_RELEASE_TOKEN }}
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v4.1.2
+
+      - name: Log in to ghcr.io for cosign
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Package and push chart to ghcr.io (OCI)
+        id: oci_push
+        env:
+          GHCR_USER: ${{ github.actor }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          chart_version=$(grep -E '^version:' helm/garage-ui/Chart.yaml | awk '{print $2}')
+          echo "Packaging chart version ${chart_version}"
+          helm package helm/garage-ui --destination /tmp/chart
+
+          echo "${GHCR_TOKEN}" | helm registry login ghcr.io \
+            --username "${GHCR_USER}" --password-stdin
+
+          push_output=$(helm push "/tmp/chart/garage-ui-${chart_version}.tgz" \
+            oci://ghcr.io/noooste/charts 2>&1 | tee /dev/stderr)
+
+          digest=$(echo "$push_output" | grep -oE 'sha256:[a-f0-9]{64}' | head -n1)
+          if [ -z "$digest" ]; then
+            echo "Failed to parse pushed digest from helm push output" >&2
+            exit 1
+          fi
+          echo "digest=${digest}" >> "$GITHUB_OUTPUT"
+          echo "Pushed oci://ghcr.io/noooste/charts/garage-ui:${chart_version} (${digest})"
+
+      - name: Sign chart with cosign (keyless)
+        run: |
+          cosign sign --yes \
+            "ghcr.io/noooste/charts/garage-ui@${{ steps.oci_push.outputs.digest }}"

.github/workflows/release-please.yml

@@ -25,87 +25,3 @@ jobs:
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
           token: ${{ steps.app-token.outputs.token }}
-
-      - name: Sync Chart.yaml appVersion on release PR
-        if: ${{ steps.rp.outputs.prs_created == 'true' }}
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          PRS: ${{ steps.rp.outputs.prs }}
-          REPO: ${{ github.repository }}
-        run: |
-          set -euo pipefail
-          echo "$PRS" | jq -c '.[]' | while read -r pr; do
-            branch=$(echo "$pr" | jq -r '.headBranchName')
-            workdir=$(mktemp -d)
-            git clone --branch "$branch" --depth 1 \
-              "https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git" "$workdir"
-            cd "$workdir"
-            git config user.email "garage-ui-release-bot[bot]@users.noreply.github.com"
-            git config user.name "garage-ui-release-bot[bot]"
-
-            version=$(jq -r '."."' .release-please-manifest.json)
-            target="v${version}"
-            sed -i -E "s|^appVersion:.*|appVersion: ${target}|" helm/garage-ui/Chart.yaml
-
-            if ! git diff --quiet helm/garage-ui/Chart.yaml; then
-              git add helm/garage-ui/Chart.yaml
-              git commit -m "chore: sync Chart.yaml appVersion to ${target}"
-              git push origin "$branch"
-            fi
-            cd -
-            rm -rf "$workdir"
-          done
-
-      - name: Cut chart patch when backend released without chart
-        if: ${{ steps.rp.outputs.releases_created == 'true' }}
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          REPO: ${{ github.repository }}
-          BACKEND_RELEASED: ${{ steps.rp.outputs.release_created }}
-          CHART_RELEASED: ${{ steps.rp.outputs['helm/garage-ui--release_created'] }}
-          BACKEND_TAG: ${{ steps.rp.outputs.tag_name }}
-          BACKEND_VERSION: ${{ steps.rp.outputs.version }}
-        run: |
-          set -euo pipefail
-          if [ "$BACKEND_RELEASED" != "true" ] || [ "$CHART_RELEASED" = "true" ]; then
-            echo "Backend not released, or chart already released this cycle. Nothing to do."
-            exit 0
-          fi
-
-          workdir=$(mktemp -d)
-          git clone \
-            "https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git" "$workdir"
-          cd "$workdir"
-          git config user.email "garage-ui-release-bot[bot]@users.noreply.github.com"
-          git config user.name "garage-ui-release-bot[bot]"
-
-          chart_old=$(jq -r '."helm/garage-ui"' .release-please-manifest.json)
-          chart_new=$(echo "$chart_old" | awk -F. '{printf "%d.%d.%d", $1, $2, $3+1}')
-          chart_tag="garage-ui-chart-v${chart_new}"
-
-          jq --arg v "$chart_new" '."helm/garage-ui" = $v' \
-            .release-please-manifest.json > .release-please-manifest.json.tmp
-          mv .release-please-manifest.json.tmp .release-please-manifest.json
-
-          sed -i -E "s|^version:.*|version: ${chart_new}|" helm/garage-ui/Chart.yaml
-          sed -i -E "s|^appVersion:.*|appVersion: ${BACKEND_TAG}|" helm/garage-ui/Chart.yaml
-
-          today=$(date -u +%Y-%m-%d)
-          compare_url="https://github.com/${REPO}/compare/garage-ui-chart-v${chart_old}...${chart_tag}"
-          entry=$(printf '## [%s](%s) (%s)\n\n\n### Miscellaneous Chores\n\n* sync chart appVersion to %s\n' \
-            "$chart_new" "$compare_url" "$today" "$BACKEND_TAG")
-          awk -v entry="$entry" 'NR==1 && /^# Changelog/ { print; print ""; print entry; next } { print }' \
-            helm/garage-ui/CHANGELOG.md > helm/garage-ui/CHANGELOG.md.tmp
-          mv helm/garage-ui/CHANGELOG.md.tmp helm/garage-ui/CHANGELOG.md
-
-          git add .release-please-manifest.json helm/garage-ui/Chart.yaml helm/garage-ui/CHANGELOG.md
-          git commit -m "chore: bump chart to ${chart_new} for backend ${BACKEND_TAG}"
-          git push origin main
-
-          git tag "$chart_tag"
-          git push origin "$chart_tag"
-
-          gh release create "$chart_tag" \
-            --repo "$REPO" \
-            --title "$chart_tag" \
-            --notes "Chart patch synced to backend ${BACKEND_TAG}. No chart template changes."

.release-please-manifest.json

@@ -1,4 +1,3 @@
 {
-  ".": "0.8.0",
-  "helm/garage-ui": "0.6.0"
+  ".": "0.8.3"
 }

CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## [0.8.3](https://github.com/Noooste/garage-ui/compare/v0.8.2...v0.8.3) (2026-06-21)
+
+
+### Bug Fixes
+
+* **backend:** improve API version detection with retry logic for health probes ([46aa375](https://github.com/Noooste/garage-ui/commit/46aa3752c81788787388d1c67e29cef786bdabff))
+* **helm:** update version badges in README for Garage UI ([28c186f](https://github.com/Noooste/garage-ui/commit/28c186f3eba1a1c111100712f1eaec22a5d18eb2))
+
+## [0.8.2](https://github.com/Noooste/garage-ui/compare/v0.8.1...v0.8.2) (2026-06-07)
+
+
+### Bug Fixes
+
+* **backend:** prevent OIDC login loop from empty cookie name ([#76](https://github.com/Noooste/garage-ui/issues/76)) ([22be89b](https://github.com/Noooste/garage-ui/commit/22be89b2ff86465abb90dab0344ef9366ab181b3))
+
+## [0.8.1](https://github.com/Noooste/garage-ui/compare/v0.8.0...v0.8.1) (2026-05-31)
+
+
+### Bug Fixes
+
+* **frontend:** align three-dot menu item icon spacing and text alignment ([#72](https://github.com/Noooste/garage-ui/issues/72)) ([45f8770](https://github.com/Noooste/garage-ui/commit/45f87707996e92d0f8f75e79c8f60a13556eaf6e))
+
 ## [0.8.0](https://github.com/Noooste/garage-ui/compare/v0.7.0...v0.8.0) (2026-05-31)
 
 

backend/internal/auth/auth.go

@@ -322,8 +322,21 @@ func extractRoles(claims map[string]interface{}, path string) []string {
 	return nil
 }
 
-// extractStringArray converts an interface{} to []string if possible
+// extractStringArray converts an interface{} to []string if possible.
+//
+// A scalar string is treated as a single-element list: IdPs commonly emit a
+// single role as a bare string (e.g. "garage_role": "garage-ui-admin") rather
+// than a one-element array, and discarding it would make admin_role checks
+// fail with a spurious 403, see https://github.com/Noooste/garage-ui/issues/75
 func extractStringArray(value interface{}) []string {
+	// Try a scalar string (single role emitted as a bare value)
+	if str, ok := value.(string); ok {
+		if str == "" {
+			return nil
+		}
+		return []string{str}
+	}
+
 	// Try direct string array
 	if strArray, ok := value.([]string); ok {
 		return strArray

backend/internal/auth/auth_test.go

@@ -564,8 +564,11 @@ func TestExtractRolesFromAccessToken_IntermediateNodeNotMap(t *testing.T) {
 	}
 }
 
-func TestExtractRolesFromAccessToken_FinalValueWrongType(t *testing.T) {
-	// Final value is a plain string, not an array — extractStringArray returns nil.
+func TestExtractRolesFromAccessToken_ScalarStringRoleReturnsSingleElement(t *testing.T) {
+	// A role_attribute_path that resolves to a scalar string (common when an IdP
+	// emits a single role, e.g. "garage_role": "garage-ui-admin") must be treated
+	// as a one-element role list, not silently discarded. Discarding it caused
+	// admin_role (singular) + scalar claim to yield roles=[] and a spurious 403.
 	tok := makeAccessToken(t, map[string]any{
 		"roles": "admin",
 	})
@@ -574,8 +577,25 @@ func TestExtractRolesFromAccessToken_FinalValueWrongType(t *testing.T) {
 			OIDC: config.OIDCConfig{RoleAttributePath: "roles"},
 		},
 	}
+	got := svc.ExtractRolesFromAccessToken(tok)
+	if len(got) != 1 || got[0] != "admin" {
+		t.Errorf("got %v, want [admin]", got)
+	}
+}
+
+func TestExtractRolesFromAccessToken_EmptyScalarStringReturnsNil(t *testing.T) {
+	// An empty scalar must not produce a [""] role, which would never match a
+	// configured admin role and only muddies logs.
+	tok := makeAccessToken(t, map[string]any{
+		"roles": "",
+	})
+	svc := &Service{
+		authConfig: &config.AuthConfig{
+			OIDC: config.OIDCConfig{RoleAttributePath: "roles"},
+		},
+	}
 	if got := svc.ExtractRolesFromAccessToken(tok); got != nil {
-		t.Errorf("expected nil for non-array roles, got %v", got)
+		t.Errorf("expected nil for empty scalar role, got %v", got)
 	}
 }
 

backend/internal/config/config.go

@@ -168,6 +168,10 @@ func Load(configPath string, opts ...LoadOption) (*Config, error) {
 	viper.SetDefault("garage.force_path_style", true)
 	viper.SetDefault("logging.level", "info")
 	viper.SetDefault("logging.format", "text")
+	viper.SetDefault("auth.oidc.cookie_name", "garage_session")
+	viper.SetDefault("auth.oidc.cookie_http_only", true)
+	viper.SetDefault("auth.oidc.cookie_same_site", "lax")
+	viper.SetDefault("auth.oidc.session_max_age", 86400)
 
 	// If garage.toml path is provided, parse it and set values as viper
 	// defaults. Defaults sit below config-file and env-var values in viper's

backend/internal/config/config_test.go

@@ -490,6 +490,103 @@ func TestLoad_EnvOverridesToml(t *testing.T) {
 	}
 }
 
+// oidcValidYAML is a minimal configuration that enables OIDC and passes
+// Validate, but deliberately omits auth.oidc.cookie_name.
+const oidcValidYAML = `
+server:
+  host: "0.0.0.0"
+  port: 8080
+  root_url: "https://garage.example.com"
+garage:
+  endpoint: http://garage:3900
+  admin_endpoint: http://garage:3903
+  admin_token: supersecret
+auth:
+  oidc:
+    enabled: true
+    client_id: "garage-ui"
+    issuer_url: "https://idp.example.com/realms/main"
+    scopes:
+      - openid
+    admin_roles:
+      - "garage-ui-admin"
+`
+
+func TestLoad_OIDCCookieNameDefaultsWhenUnset(t *testing.T) {
+	resetViper(t)
+	path := writeConfigFile(t, oidcValidYAML)
+
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	// An empty cookie name makes Fiber silently drop the session Set-Cookie
+	// (net/http rejects empty cookie names), which manifests as an OIDC login
+	// loop. A non-empty default prevents that footgun.
+	if cfg.Auth.OIDC.CookieName != "garage_session" {
+		t.Errorf("CookieName = %q, want garage_session (default)", cfg.Auth.OIDC.CookieName)
+	}
+}
+
+func TestLoad_OIDCCookieNameExplicitValueWins(t *testing.T) {
+	resetViper(t)
+	path := writeConfigFile(t, oidcValidYAML+"    cookie_name: \"custom_session\"\n")
+
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.Auth.OIDC.CookieName != "custom_session" {
+		t.Errorf("CookieName = %q, want custom_session (explicit override)", cfg.Auth.OIDC.CookieName)
+	}
+}
+
+func TestLoad_OIDCCookieDefaultsWhenUnset(t *testing.T) {
+	resetViper(t)
+	path := writeConfigFile(t, oidcValidYAML)
+
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	// HTTPOnly must default to true: a session cookie readable from JavaScript
+	// is an XSS token-theft risk.
+	if !cfg.Auth.OIDC.CookieHTTPOnly {
+		t.Errorf("CookieHTTPOnly = false, want true (default)")
+	}
+	// SessionMaxAge must default to a positive value so the cookie's MaxAge
+	// agrees with the 24h JWT instead of becoming a session-only cookie.
+	if cfg.Auth.OIDC.SessionMaxAge != 86400 {
+		t.Errorf("SessionMaxAge = %d, want 86400 (default)", cfg.Auth.OIDC.SessionMaxAge)
+	}
+	if cfg.Auth.OIDC.CookieSameSite != "lax" {
+		t.Errorf("CookieSameSite = %q, want lax (default)", cfg.Auth.OIDC.CookieSameSite)
+	}
+}
+
+func TestLoad_OIDCCookieDefaultsCanBeOverridden(t *testing.T) {
+	resetViper(t)
+	yaml := oidcValidYAML +
+		"    cookie_http_only: false\n" +
+		"    session_max_age: 3600\n" +
+		"    cookie_same_site: \"strict\"\n"
+	path := writeConfigFile(t, yaml)
+
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.Auth.OIDC.CookieHTTPOnly {
+		t.Errorf("CookieHTTPOnly = true, want false (explicit override)")
+	}
+	if cfg.Auth.OIDC.SessionMaxAge != 3600 {
+		t.Errorf("SessionMaxAge = %d, want 3600 (explicit override)", cfg.Auth.OIDC.SessionMaxAge)
+	}
+	if cfg.Auth.OIDC.CookieSameSite != "strict" {
+		t.Errorf("CookieSameSite = %q, want strict (explicit override)", cfg.Auth.OIDC.CookieSameSite)
+	}
+}
+
 func TestEffectiveAdminRoles(t *testing.T) {
 	tests := []struct {
 		name       string

backend/internal/services/admin_factory.go

@@ -39,8 +39,14 @@ type AdminServiceResult struct {
 	APIVersion   string
 }
 
+// errProbeNotFound means the probed route returned 404. Garage v2.x also serves
+// /v1/health, so a 404 on /v2 is the only reliable "this is a v1 server" signal.
+var errProbeNotFound = errors.New("probe endpoint not found")
+
 func NewAdminService(cfg *config.GarageConfig, logLevel string) (*AdminServiceResult, error) {
-	if err := probeEndpoint(cfg, "/v2/GetClusterHealth"); err == nil {
+	// retry so a startup fails doesn't lock us to a v1 client.
+	err := probeEndpointWithRetry(cfg, "/v2/GetClusterHealth")
+	if err == nil {
 		logger.Info().Str("api_version", "v2").Msg("Detected Garage admin API v2")
 		svc := NewGarageV2AdminService(cfg, logLevel)
 		return &AdminServiceResult{
@@ -50,7 +56,17 @@ func NewAdminService(cfg *config.GarageConfig, logLevel string) (*AdminServiceRe
 		}, nil
 	}
 
-	if err := probeEndpoint(cfg, "/v1/health"); err == nil {
+	// only fall back to v1 on a real 404
+	// other errors mean the server is up but the probe failed transiently; picking v1 against
+	// a v2.x server breaks /v1/status with "v1/ endpoint is no longer supported" (issue #78).
+	if !errors.Is(err, errProbeNotFound) {
+		return nil, fmt.Errorf(
+			"could not detect Garage admin API version at %s: %w. Ensure Garage v1.1+ is running and the admin API is reachable",
+			cfg.AdminEndpoint, err,
+		)
+	}
+
+	if err := probeEndpointWithRetry(cfg, "/v1/health"); err == nil {
 		logger.Info().
 			Str("api_version", "v1").
 			Msg("Detected Garage admin API v1 — cluster statistics and per-node details will be unavailable")
@@ -68,6 +84,26 @@ func NewAdminService(cfg *config.GarageConfig, logLevel string) (*AdminServiceRe
 	)
 }
 
+const probeAttempts = 4
+
+// probeEndpointWithRetry retries transient failures with backoff, but returns a
+// 404 immediately, a missing route won't appear on a retry.
+func probeEndpointWithRetry(cfg *config.GarageConfig, path string) error {
+	var err error
+	backoff := 250 * time.Millisecond
+	for attempt := range probeAttempts {
+		err = probeEndpoint(cfg, path)
+		if err == nil || errors.Is(err, errProbeNotFound) {
+			return err
+		}
+		if attempt < probeAttempts-1 {
+			time.Sleep(backoff)
+			backoff *= 2
+		}
+	}
+	return err
+}
+
 func probeEndpoint(cfg *config.GarageConfig, path string) error {
 	session := azuretls.NewSession()
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
@@ -86,6 +122,9 @@ func probeEndpoint(cfg *config.GarageConfig, path string) error {
 	}
 	defer resp.RawBody.Close()
 
+	if resp.StatusCode == http.StatusNotFound {
+		return fmt.Errorf("probe %s returned status 404: %w", path, errProbeNotFound)
+	}
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
 		return fmt.Errorf("probe %s returned status %d", path, resp.StatusCode)
 	}

backend/internal/services/admin_factory_test.go

@@ -89,3 +89,61 @@ func TestDetectVersion_Unreachable(t *testing.T) {
 		t.Fatal("expected error for unreachable server")
 	}
 }
+
+// Garage v2.x serves /v1/health too, so a transient failure of the /v2 probe
+// must not cause a permanent downgrade to the (broken on v2.x) v1 client.
+// Regression test for https://github.com/Noooste/garage-ui/issues/78
+func TestDetectVersion_V2_TransientProbeFailure(t *testing.T) {
+	var v2Hits int
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/v2/GetClusterHealth":
+			v2Hits++
+			if v2Hits < 3 { // fail the first two attempts, then recover
+				w.WriteHeader(http.StatusServiceUnavailable)
+				return
+			}
+			w.Header().Set("Content-Type", "application/json")
+			w.Write([]byte(`{"status":"healthy"}`))
+		case "/v1/health": // v2.x still answers this
+			w.Header().Set("Content-Type", "application/json")
+			w.Write([]byte(`{"status":"healthy"}`))
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	t.Cleanup(srv.Close)
+
+	cfg := &config.GarageConfig{AdminEndpoint: srv.URL, AdminToken: "tok"}
+	result, err := NewAdminService(cfg, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.APIVersion != "v2" {
+		t.Fatalf("expected v2 after transient probe failure, got %s", result.APIVersion)
+	}
+}
+
+// A server that answers /v1/health but returns a server error (not 404) for
+// /v2/GetClusterHealth must NOT be detected as v1, because v2.x servers also
+// answer /v1/health. Falling through to v1 here is the issue #78 misdetection.
+func TestDetectVersion_DoesNotDowngradeOnV2ServerError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/v2/GetClusterHealth":
+			w.WriteHeader(http.StatusServiceUnavailable)
+		case "/v1/health":
+			w.Header().Set("Content-Type", "application/json")
+			w.Write([]byte(`{"status":"healthy"}`))
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	t.Cleanup(srv.Close)
+
+	cfg := &config.GarageConfig{AdminEndpoint: srv.URL, AdminToken: "tok"}
+	result, err := NewAdminService(cfg, "")
+	if err == nil && result.APIVersion == "v1" {
+		t.Fatal("must not downgrade to v1 when /v2 returns a server error; v2.x also serves /v1/health")
+	}
+}

frontend/package-lock.json

@@ -21,7 +21,7 @@
         "react-dom": "^19.2.0",
         "react-dropzone": "^14.3.8",
         "react-hook-form": "^7.66.1",
-        "react-router-dom": "^7.14.1",
+        "react-router-dom": "^7.16.0",
         "recharts": "^3.5.0",
         "sonner": "^2.0.7",
         "tailwind-merge": "^3.4.0",
@@ -4839,9 +4839,9 @@
       }
     },
     "node_modules/react-router": {
-      "version": "7.14.1",
-      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.14.1.tgz",
-      "integrity": "sha512-5BCvFskyAAVumqhEKh/iPhLOIkfxcEUz8WqFIARCkMg8hZZzDYX9CtwxXA0e+qT8zAxmMC0x3Ckb9iMONwc5jg==",
+      "version": "7.16.0",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.16.0.tgz",
+      "integrity": "sha512-wArC8lVyJb3+jM9OpDyW6hLCizACWkvQR/sSGqSs+o5uEXEtGlqdZ4v8hENR3Jad6i+LRkK93q/+bQAcvl6V1A==",
       "license": "MIT",
       "dependencies": {
         "cookie": "^1.0.1",
@@ -4861,12 +4861,12 @@
       }
     },
     "node_modules/react-router-dom": {
-      "version": "7.14.1",
-      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.14.1.tgz",
-      "integrity": "sha512-ZkrQuwwhGibjQLqH1eCdyiZyLWglPxzxdl5tgwgKEyCSGC76vmAjleGocRe3J/MLfzMUIKwaFJWpFVJhK3d2xA==",
+      "version": "7.16.0",
+      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.16.0.tgz",
+      "integrity": "sha512-kMUAbimWB5FVbF4Bce4bJsiKJWLIUHq/mEG8+CFDnCSgltptBiG5nguducmsJeGKytlCvQud9Qhzpn49iduTlA==",
       "license": "MIT",
       "dependencies": {
-        "react-router": "7.14.1"
+        "react-router": "7.16.0"
       },
       "engines": {
         "node": ">=20.0.0"

frontend/package.json

@@ -23,7 +23,7 @@
     "react-dom": "^19.2.0",
     "react-dropzone": "^14.3.8",
     "react-hook-form": "^7.66.1",
-    "react-router-dom": "^7.14.1",
+    "react-router-dom": "^7.16.0",
     "recharts": "^3.5.0",
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.4.0",

frontend/src/components/ui/dropdown-menu.tsx

@@ -151,7 +151,7 @@ const DropdownMenuItem = React.forwardRef<HTMLDivElement, React.HTMLAttributes<H
       <div
         ref={ref}
         className={cn(
-          'relative flex cursor-pointer select-none items-center rounded-sm px-2 py-1.5 text-sm outline-none transition-colors hover:bg-accent hover:text-accent-foreground focus:bg-accent focus:text-accent-foreground data-[disabled]:pointer-events-none',
+          'relative flex cursor-pointer select-none items-center gap-2 rounded-sm px-2 py-1.5 text-sm outline-none transition-colors hover:bg-accent hover:text-accent-foreground focus:bg-accent focus:text-accent-foreground data-[disabled]:pointer-events-none [&_svg]:h-4 [&_svg]:w-4 [&_svg]:shrink-0',
           className
         )}
         onClick={(e) => {

frontend/src/pages/AccessControl.tsx

@@ -635,7 +635,7 @@ export function AccessControl() {
                                   setDeleteDialogOpen(true);
                                 }}
                               >
-                                <Trash2 className="mr-2 h-4 w-4" />
+                                <Trash2 className="h-4 w-4" />
                                 Delete
                               </DropdownMenuItem>
                             </DropdownMenuContent>

helm/garage-ui/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.6.1](https://github.com/Noooste/garage-ui/compare/garage-ui-chart-v0.6.0...garage-ui-chart-v0.6.1) (2026-05-31)
+
+
+### Features
+
+* Publish Helm chart to GHCR ([#70](https://github.com/Noooste/garage-ui/issues/70)) ([1c9043c](https://github.com/Noooste/garage-ui/commit/1c9043c6973c3ffc3fc29cc65b342b35dfa84ae0))
+
 ## [0.6.0](https://github.com/Noooste/garage-ui/compare/garage-ui-chart-v0.5.0...garage-ui-chart-v0.6.0) (2026-05-31)
 
 

helm/garage-ui/Chart.yaml

@@ -3,8 +3,8 @@ name: garage-ui
 description: A Helm chart for Garage UI - Web interface for Garage S3 object storage
 icon: https://helm.noste.dev/garage.png
 type: application
-version: 0.6.0
-appVersion: v0.8.0
+version: 0.8.3
+appVersion: v0.8.2
 keywords:
   - garage
   - s3

helm/garage-ui/README.md

@@ -2,8 +2,8 @@
 
 A Helm chart for deploying [Garage UI](https://github.com/Noooste/garage-ui), a modern web interface for managing [Garage](https://garagehq.deuxfleurs.fr/) distributed object storage systems.
 
-[![Version](https://img.shields.io/badge/version-0.3.0-blue.svg)](Chart.yaml)
-[![App Version](https://img.shields.io/badge/app%20version-v0.5.0-green.svg)](Chart.yaml)
+[![Version](https://img.shields.io/badge/version-0.8.3)](Chart.yaml) <!-- x-release-please-version -->
+[![App Version](https://img.shields.io/badge/app%20version-v0.8.3)](Chart.yaml) <!-- x-release-please-version -->
 
 ## Table of Contents
 
@@ -93,6 +93,28 @@ If you've cloned the repository:
 helm install garage-ui ./helm/garage-ui -f my-values.yaml
 ```
 
+### Installing from the OCI registry (ghcr.io)
+
+The chart is published as an OCI artifact to GitHub Container Registry. No
+`helm repo add` is required:
+
+```bash
+helm install garage-ui oci://ghcr.io/noooste/charts/garage-ui \
+  --version <x.y.z> -f my-values.yaml
+```
+
+The chart is signed with [cosign](https://docs.sigstore.dev/) using keyless
+signing. To verify the signature before installing:
+
+```bash
+cosign verify ghcr.io/noooste/charts/garage-ui:<x.y.z> \
+  --certificate-identity-regexp 'https://github.com/Noooste/garage-ui/.+' \
+  --certificate-oidc-issuer https://token.actions.githubusercontent.com
+```
+
+The chart also remains available from the classic Helm repository at
+`https://helm.noste.dev`.
+
 ### Installing with inline values
 
 You can also set values directly on the command line:

release-please-config.json

@@ -2,21 +2,16 @@
   "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
   "bump-minor-pre-major": true,
   "bump-patch-for-minor-pre-major": false,
-  "separate-pull-requests": false,
   "packages": {
     ".": {
       "release-type": "go",
       "component": "garage-ui",
       "include-component-in-tag": false,
       "changelog-path": "CHANGELOG.md",
-      "exclude-paths": ["helm/garage-ui"]
-    },
-    "helm/garage-ui": {
-      "release-type": "helm",
-      "component": "garage-ui-chart",
-      "package-name": "garage-ui",
-      "include-component-in-tag": true,
-      "changelog-path": "CHANGELOG.md"
+      "extra-files": [
+        "helm/garage-ui/Chart.yaml",
+        "helm/garage-ui/README.md"
+      ]
     }
   }
 }