93bce3be97
Merge pull request #4018 from openziti/backcompat-doc-version-floor
...
Document v1.3.0 router floor in backward-compatibility test
2026-06-29 12:05:05 -04:00
1b180d14e8
fix #3933 add controller to enrollment response ( #3947 )
...
* fix #3933 add controller to enrollment response
- adds the cluster's controllers to ott, ottca, updb, and token enrollment
responses with client and OIDC API addresses only
- synthesizes the running controller with its API addresses in non-HA mode
so the list is never empty
- adds --not-before to ziti pki create for backdated test CAs
- replaces the test PKI with a SPIFFE-capable, ziti pki generated and managed
one and rewires the config sets
- tests the controller list across ott/ottca/updb/token, non-HA, and raft
* fix missing wildcard cert from new PKI
* go mod tidy
2026-06-29 11:44:23 -04:00
1cc9cbbdc4
update triage workflow to add/remove users
2026-06-23 09:26:17 -04:00
d7999da321
Document v1.3.0 router floor in backward-compatibility test
...
- explains why pre-1.3.0 routers (1.1.x/1.2.x) are excluded from the compat
matrix: their JWT session-token handling is gated behind the HA flag, so
hosting SDK terminators against a 2.0 controller fails with "invalid
api-session"
- notes the fix landed in v1.3.0 and was never backported, and that the dial
path and the oidc=false setting are unaffected
2026-06-22 11:46:22 -04:00
aa71cd768c
Add ZET integration tests to release workflow for pre/rc tags ( #3997 )
2026-06-22 10:00:39 -04:00
20c0e596e4
gate :latest tag and CloudFront deploy to GitHub's latest release; skip docker rebuild if it's in dockerhub already
2026-05-29 10:34:41 -04:00
87a2591f65
ensure the cloudfront deployment only ever happens with whatever is actually the github-latest-release
2026-05-29 09:42:24 -04:00
bdc19ba600
Merge pull request #3887 from openziti/remove-publish-gate
...
Add optional tag input to promote-downstreams workflow
2026-05-27 10:22:58 -04:00
ba809e4d26
Keep controller mesh fully connected, as much as possible. Fixes #3684
2026-05-27 10:21:34 -04:00
700689e781
Add optional tag input to promote-downstreams workflow
...
- adds an optional 'tag' workflow_dispatch input so the promote can be
dispatched from a branch (e.g. main) while targeting a specific release
tag, instead of only running against the ref it fires on
- resolves the promoted ref as github.event.inputs.tag || github.ref_name
in the validate and compare steps, so the release-event path is unchanged
- includes the resolved tag in the concurrency group so promoting different
tags from a branch no longer cancel each other
2026-05-27 10:05:45 -04:00
b2986eb2de
Drop release-build wait gate from promote-downstreams workflow
...
- removes the wait_for_release job that waited on every check on the
release commit; unrelated checks sharing the commit (e.g. POST Webhook
with Python, add-to-project) could conclude failure and block promotion
- makes parse_version the entry job and drops its needs: wait_for_release
- relies on artifact existence as the success signal: packages and the
:version image only exist if the release build and tests passed, and the
promote steps already fail closed on missing artifacts (jf rt copy
--fail-no-op=true, docker buildx imagetools create)
2026-05-27 09:45:45 -04:00
8f766114e2
make sure main is forced unless running manually, then respect the selected branch
2026-05-20 19:55:49 -04:00
c9789356e1
fix quickstart release workflow
2026-05-20 17:31:55 -04:00
0b76ee2e65
add some doc around what FORCE_LATEST_FLAG/--force-latest is all about
2026-05-20 15:12:42 -04:00
15170a1f84
rework docker depolyment to triggered by a ziti release. add a manual option to deploy from a release version
2026-05-20 15:06:13 -04:00
040016993e
Fix codespell errors
2026-04-16 09:43:49 -04:00
34022b5fa2
Fix circuit test faults. Add GITHUB_TOKEN to validation tests
2026-04-07 09:25:55 -04:00
20ac5c5771
fix automated quickstart, ops verify panic, getZiti ( #3736 )
...
* don't auth the client api, update getZiti.ps1 to allow version and check hashes, update oidc to yield better error
* quickstart automated tests were passing erroneously
* fix quickstart auto test
2026-03-31 09:15:02 -04:00
cd40424908
Bump actions/cache from 4 to 5 in the all group
...
Bumps the all group with 1 update: [actions/cache](https://github.com/actions/cache ).
Updates `actions/cache` from 4 to 5
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/v4...v5 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-23 15:55:39 +00:00
88d5caa1c9
polish dist tests
2026-03-18 13:59:17 -04:00
5e739dca7a
refine linux packages
2026-03-16 17:08:39 -04:00
73791ac5d6
Added the CLA workflow
2026-03-11 16:34:00 -04:00
34482fea3c
Update to Go 1.26. Fixes #3674
2026-03-11 16:34:00 -04:00
e1638173cd
Fixes for SDK terminator management. Add support for ziti sdk inspection. Fixes #3609
...
- removes legacy v1 terminator code path; all terminators now use v2 flow
- refactors edgeTerminator.close() to decouple SDK notification from control plane notification
- adds pending SDK close notification queue with retry when channel is busy
- adds post-create inspect mechanism that verifies SDK still holds the bind after terminator creation
- queues second post-create inspect when establishment takes >30s to catch SDK timeout races
- detects and discards stale reordered binds on the same connection by comparing connIds
- re-establishes replacement terminators when a delete/create race is detected
- eliminates IsEntityPresent pre-filter in removeTerminatorsHandler to prevent raft ordering races
- fixes ValidateTerminators to query identities from the correct manager with the correct filter field
- adds postCreate flag to ValidateTerminatorsV2Request so routers skip redundant SDK inspect
- returns retry-later (nil result) from router validation when inspect is temporarily unavailable
- blocks SyncAllSubscribers until completion and guards RouterDataModel replacement with in-progress flag
- fixes InheritLocalData to enable service access tracking for all subscribed identities
- adds Services.Has check in GetServiceAccessPolicies to prevent false policy grants
- validates policy-to-identity associations in ValidateServicePolicies
- adds `ziti agent tunnel dump-sdk` command for SDK context inspection via IPC agent
- adds `ziti fabric inspect sdk` command to query SDK context through routers
- fixes --expected-per-host CLI flag binding in validate terminators command
- changes bind-access-lost retry hint from NotRetriable to RetryStartOver
- moves trace route response and xgress close handling off channel handler goroutine
- fixes listTerminators test helper to URL-encode filter parameter
- improves sdk-hosting-test validation resilience with login and query retries
- adds terminator_create_flow.md documenting the full lifecycle across SDK, router, and controller
- adds detailed logging for data model sync, service access tracking, and subscriber change detection
2026-03-11 13:10:28 -04:00
ae7b52f031
Bump the all group with 6 updates
...
Bumps the all group with 6 updates:
| Package | From | To |
| --- | --- | --- |
| [hashicorp/setup-terraform](https://github.com/hashicorp/setup-terraform ) | `3` | `4` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact ) | `6` | `7` |
| [docker/login-action](https://github.com/docker/login-action ) | `3` | `4` |
| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action ) | `3` | `4` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action ) | `3` | `4` |
| [docker/build-push-action](https://github.com/docker/build-push-action ) | `6` | `7` |
Updates `hashicorp/setup-terraform` from 3 to 4
- [Release notes](https://github.com/hashicorp/setup-terraform/releases )
- [Changelog](https://github.com/hashicorp/setup-terraform/blob/main/CHANGELOG.md )
- [Commits](https://github.com/hashicorp/setup-terraform/compare/v3...v4 )
Updates `actions/upload-artifact` from 6 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7 )
Updates `docker/login-action` from 3 to 4
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/v3...v4 )
Updates `docker/setup-qemu-action` from 3 to 4
- [Release notes](https://github.com/docker/setup-qemu-action/releases )
- [Commits](https://github.com/docker/setup-qemu-action/compare/v3...v4 )
Updates `docker/setup-buildx-action` from 3 to 4
- [Release notes](https://github.com/docker/setup-buildx-action/releases )
- [Commits](https://github.com/docker/setup-buildx-action/compare/v3...v4 )
Updates `docker/build-push-action` from 6 to 7
- [Release notes](https://github.com/docker/build-push-action/releases )
- [Commits](https://github.com/docker/build-push-action/compare/v6...v7 )
---
updated-dependencies:
- dependency-name: hashicorp/setup-terraform
dependency-version: '4'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all
- dependency-name: actions/upload-artifact
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all
- dependency-name: docker/login-action
dependency-version: '4'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all
- dependency-name: docker/setup-qemu-action
dependency-version: '4'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all
- dependency-name: docker/setup-buildx-action
dependency-version: '4'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all
- dependency-name: docker/build-push-action
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-09 17:07:06 +00:00
4099951172
Merge pull request #3630 from openziti/dependabot/github_actions/all-138349a845
...
Bump the all group with 4 updates
2026-03-07 00:02:08 -05:00
8e48b0f9da
Backwards compatility workflow should now only be run on demand
2026-03-06 15:09:43 -05:00
35659d5c96
Add backwards compatibility smoketest. Fixes #3571
2026-03-06 09:08:10 -05:00
5afa9e80b7
strip unnecessary perms and pin the commit because the action handles a high value secret
2026-03-03 14:15:28 -05:00
7ed861d154
Bump the all group with 4 updates
...
Bumps the all group with 4 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact ), [hashicorp/setup-terraform](https://github.com/hashicorp/setup-terraform ), [actions/download-artifact](https://github.com/actions/download-artifact ) and [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance ).
Updates `actions/upload-artifact` from 6 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7 )
Updates `hashicorp/setup-terraform` from 3 to 4
- [Release notes](https://github.com/hashicorp/setup-terraform/releases )
- [Changelog](https://github.com/hashicorp/setup-terraform/blob/main/CHANGELOG.md )
- [Commits](https://github.com/hashicorp/setup-terraform/compare/v3...v4 )
Updates `actions/download-artifact` from 7 to 8
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/v7...v8 )
Updates `actions/attest-build-provenance` from 3 to 4
- [Release notes](https://github.com/actions/attest-build-provenance/releases )
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md )
- [Commits](https://github.com/actions/attest-build-provenance/compare/v3...v4 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all
- dependency-name: hashicorp/setup-terraform
dependency-version: '4'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all
- dependency-name: actions/download-artifact
dependency-version: '8'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all
- dependency-name: actions/attest-build-provenance
dependency-version: '4'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-02 17:10:48 +00:00
79ea4a0544
Replace echo test with sim circuit test
2026-02-24 22:05:02 -05:00
2a1a6ed75d
Run go mod tidy for validation tests
2026-02-17 00:03:55 -05:00
c3d4032dc5
Use org GH secret. Exclude dependabot PRs.
2026-02-13 11:14:18 -05:00
c834418cf2
remove invalid ci workflow props
2026-02-10 00:10:51 -05:00
45bf527441
Provide more error context to SDKs for terminator errors. Fixes #3524
2026-02-04 14:36:21 -05:00
d46ddfcf80
add-to-project needs full version number
2026-02-03 09:44:07 -05:00
b3ac43a55a
Add workflow to add new issues and prs to the review board when appropriate
2026-02-02 11:40:54 -05:00
29f62dd2e1
Bump lewagon/wait-on-check-action from 1.4.1 to 1.5.0 in the all group
...
Bumps the all group with 1 update: [lewagon/wait-on-check-action](https://github.com/lewagon/wait-on-check-action ).
Updates `lewagon/wait-on-check-action` from 1.4.1 to 1.5.0
- [Release notes](https://github.com/lewagon/wait-on-check-action/releases )
- [Changelog](https://github.com/lewagon/wait-on-check-action/blob/master/CHANGELOG.md )
- [Commits](https://github.com/lewagon/wait-on-check-action/compare/v1.4.1...v1.5.0 )
---
updated-dependencies:
- dependency-name: lewagon/wait-on-check-action
dependency-version: 1.5.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-01-26 17:06:37 +00:00
054ce5db9d
Merge pull request #3494 from openziti/offline-ctrl-link-fix
...
offline ctrl link fix
2026-01-20 16:02:10 -05:00
1eece38af7
do not set latest image tag on quickstart hotfixes
2026-01-20 08:36:49 -05:00
0286b07139
add manual trigger for quickstart release
2026-01-20 07:56:29 -05:00
7b94e65282
Revert tls handshake rate limited to disabled for now
2026-01-16 14:42:39 -05:00
3cfc8b5cf5
Controller should clear links not in full link sync from router. Fixes #3492
2026-01-16 14:42:39 -05:00
1ea8771528
Update cli tests upload on failure ( #3495 )
...
* fix upload logs on fail
* fix upload logs on fail
* tweak upload on failure
2026-01-13 10:03:19 -05:00
3bca4801b2
Fix router ctrl channel init race condition. Fixes #3484 . ert-hosting-test fixes
2026-01-06 16:37:21 -05:00
d9f08ed1e4
Create generic validation workflow
2025-12-29 17:13:41 -05:00
f3ad7b65ae
Have identity env updates and system authenticator updates happen in the background. Fixes #3477
2025-12-29 12:08:16 -05:00
346fa89ef3
Bump the all group with 4 updates
...
Bumps the all group with 4 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact ), [actions/download-artifact](https://github.com/actions/download-artifact ), [medyagh/setup-minikube](https://github.com/medyagh/setup-minikube ) and [actions/cache](https://github.com/actions/cache ).
Updates `actions/upload-artifact` from 5 to 6
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v5...v6 )
Updates `actions/download-artifact` from 6 to 7
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/v6...v7 )
Updates `medyagh/setup-minikube` from 0.0.20 to 0.0.21
- [Release notes](https://github.com/medyagh/setup-minikube/releases )
- [Commits](https://github.com/medyagh/setup-minikube/compare/v0.0.20...v0.0.21 )
Updates `actions/cache` from 4 to 5
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/v4...v5 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all
- dependency-name: actions/download-artifact
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all
- dependency-name: medyagh/setup-minikube
dependency-version: 0.0.21
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: actions/cache
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all
...
Signed-off-by: dependabot[bot] <support@github.com >
2025-12-22 15:10:58 +00:00
af9ee479bc
ignore prereleases when comparing highest version; resolves #3451
2025-12-16 12:46:46 -05:00
d707edfffb
let repo dispatch fire if promote docker was skipped
2025-12-05 16:30:08 -05:00
Paul Lorenz