Skip to content

Commit b1d5778

Browse files
gbouvgbouv
authored
chore: SAML EE (windmill-labs#3176)
* Extract SAML logic into its own file * Remove saml.rs core logic * hello * Add substitute_ee_code.sh and check_no_symlink.sh scripts * dry-run docker image build * test hook * add setup-hooks.sh script * Update pre-commit hook * Update substitution script * revert docker-image action yaml * revert Cargo.lock * publish custom image * swap for ce build as well * empty * revert temp action override * fix docker-image.yml
1 parent 52790e4 commit b1d5778

File tree

11 files changed

+242
-209
lines changed

11 files changed

+242
-209
lines changed

‎.githooks/pre-commit

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/bin/sh
2+
#
3+
# This file is symlinked to local .git/hooks/pre-commit by the setup-hooks.sh script
4+
# It wil run before every commit, so it needs to be quick and efficient. If it returns
5+
# a non-zero exit code, the commit will be aborted.
6+
7+
echo "Running pre-commit hook"
8+
9+
# This checks that there is no symlinks in the backend directory among the EE files
10+
./backend/check_no_symlink.sh > /dev/null
11+
if [ $? -ne 0 ]; then
12+
echo "/!\ Symlinks detected in the backend directory. Please run './backend/substitute_ee_code.sh --revert' before committing."
13+
exit 1
14+
fi

‎.github/workflows/docker-image.yml

+25-2
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,13 @@ jobs:
2626
with:
2727
fetch-depth: 0
2828

29+
- uses: actions/checkout@v3
30+
with:
31+
repository: windmill-labs/windmill-ee-private
32+
path: ./windmill-ee-private
33+
token: ${{ secrets.WINDMILL_EE_PRIVATE_ACCESS }}
34+
fetch-depth: 0
35+
2936
# - name: Set up Docker Buildx
3037
# uses: docker/setup-buildx-action@v2
3138
- uses: depot/setup-action@v1
@@ -37,6 +44,10 @@ jobs:
3744
username: ${{ github.actor }}
3845
password: ${{ secrets.GITHUB_TOKEN }}
3946

47+
- name: Substitute EE code (EE logic is behind feature flag)
48+
run: |
49+
./backend/substitute_ee_code.sh --copy --dir ./windmill-ee-private
50+
4051
- name: Docker meta
4152
id: meta-public
4253
uses: docker/metadata-action@v4
@@ -69,9 +80,16 @@ jobs:
6980
- uses: actions/checkout@v3
7081
with:
7182
fetch-depth: 0
83+
84+
- uses: actions/checkout@v3
85+
with:
86+
repository: windmill-labs/windmill-ee-private
87+
path: ./windmill-ee-private
88+
token: ${{ secrets.WINDMILL_EE_PRIVATE_ACCESS }}
89+
fetch-depth: 0
90+
7291
# - name: Set up Docker Buildx
7392
# uses: docker/setup-buildx-action@v2
74-
7593
- uses: depot/setup-action@v1
7694

7795
- name: Docker meta
@@ -94,6 +112,10 @@ jobs:
94112
username: ${{ github.actor }}
95113
password: ${{ secrets.GITHUB_TOKEN }}
96114

115+
- name: Substitute EE code
116+
run: |
117+
./backend/substitute_ee_code.sh --copy --dir ./windmill-ee-private
118+
97119
- name: Build and push publicly ee
98120
uses: depot/build-push-action@v1
99121
with:
@@ -143,7 +165,7 @@ jobs:
143165
username: ${{ secrets.AWS_ACCESS_KEY_ID }}
144166
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
145167

146-
- name: Build and push publicly ee
168+
- name: Build and push publicly ee reports
147169
uses: depot/build-push-action@v1
148170
with:
149171
context: .
@@ -393,6 +415,7 @@ jobs:
393415
- uses: actions/checkout@v3
394416
with:
395417
fetch-depth: 0
418+
396419
# - name: Set up Docker Buildx
397420
# uses: docker/setup-buildx-action@v2
398421

‎backend/Cargo.lock

+24-25
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎backend/Cargo.toml

+3-1
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,9 @@ tokio-postgres = {version = "^0.7", features = ["array-impls", "with-serde_json-
198198
mysql_async = { version = "*", default-features = false, features = ["minimal", "default", "native-tls-tls"]}
199199
postgres-native-tls = "^0"
200200
native-tls = "^0"
201-
samael = { version = "0.0.14", features = ["xmlsec"] }
201+
# samael will break compilation on MacOS. Use this fork instead to make it work
202+
# samael = { git="https://github.com/gbouv/samael", rev="2344211ed0ac041a86222b38b928adfc1030cb94", features = ["xmlsec"] }
203+
samael = { version="0.0.14", features = ["xmlsec"] }
202204
gcp_auth = "0.9.0"
203205
rust_decimal = { version = "^1", features = ["db-postgres"]}
204206
jsonwebtoken = "8.3.0"

‎backend/check_no_symlink.sh

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
#!/bin/bash
2+
set -euo pipefail
3+
script_dirpath="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
4+
root_dirpath="$(cd "${script_dirpath}/.." && pwd)"
5+
6+
EE_CODE_DIR="../windmill-ee-private/"
7+
8+
while [[ $# -gt 0 ]]; do
9+
case $1 in
10+
-d|--dir)
11+
EE_CODE_DIR="$2"
12+
shift # past argument
13+
shift # past value
14+
;;
15+
-*|--*)
16+
echo "Unknown option $1"
17+
exit 1
18+
;;
19+
*)
20+
POSITIONAL_ARGS+=("$1") # save positional arg
21+
shift # past argument
22+
;;
23+
esac
24+
done
25+
26+
if [[ $EE_CODE_DIR == /* ]]; then
27+
EE_CODE_DIR="${EE_CODE_DIR}"
28+
else
29+
EE_CODE_DIR="${root_dirpath}/${EE_CODE_DIR}"
30+
fi
31+
echo "EE code directory = ${EE_CODE_DIR}"
32+
33+
if [ ! -d "${EE_CODE_DIR}" ]; then
34+
echo "Windmill EE repo not found, nothing to do"
35+
exit 0
36+
fi
37+
38+
for ee_file in $(find "${EE_CODE_DIR}" -name "*.rs"); do
39+
ce_file="${ee_file/${EE_CODE_DIR}/.}"
40+
ce_file="${root_dirpath}/backend/${ce_file}"
41+
echo "Checking if '${ce_file}' is a symlink"
42+
if [[ -L "${ce_file}" ]]; then
43+
echo "File ${ce_file} is a symlink, cannot commit symlinks"
44+
exit 1
45+
fi
46+
done
47+
echo "All good!"

‎backend/substitute_ee_code.sh

+86
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
#!/bin/bash
2+
set -euo pipefail
3+
script_dirpath="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
4+
root_dirpath="$(cd "${script_dirpath}/.." && pwd)"
5+
6+
REVERT="NO"
7+
COPY="NO"
8+
EE_CODE_DIR="../windmill-ee-private/"
9+
10+
while [[ $# -gt 0 ]]; do
11+
case $1 in
12+
-r|--revert)
13+
# If EE files have been substituted, this will revert them to their initial content.
14+
# This relies on `git restore` so the EE files must not be committed to the repo for
15+
# this to work (commit hooks should prevent this from happening, as well as the fact
16+
# that we're using symlinks by default).
17+
REVERT="YES"
18+
shift
19+
;;
20+
-c|--copy)
21+
# By default, EE files are symlinked. Pass this option to do a real copy instead.
22+
# This might be necessary if you want to build the Docker Image as Docker COPY seems
23+
# to not follow symlinks. For local development, symlinks should be preferred as they
24+
# adds a safeguards EE files can't be commited to the OSS repo.
25+
COPY="YES"
26+
shift # past argument
27+
;;
28+
-d|--dir)
29+
# Path to the local directory of the windmill-ee-private repository. By defaults, it
30+
# assumes it is cloned next to the Windmill OSS repo.
31+
EE_CODE_DIR="$2"
32+
shift # past argument
33+
shift # past value
34+
;;
35+
-*|--*)
36+
echo "Unknown option $1"
37+
exit 1
38+
;;
39+
*)
40+
POSITIONAL_ARGS+=("$1") # save positional arg
41+
shift # past argument
42+
;;
43+
esac
44+
done
45+
46+
if [[ $EE_CODE_DIR == /* ]]; then
47+
EE_CODE_DIR="${EE_CODE_DIR}"
48+
else
49+
EE_CODE_DIR="${root_dirpath}/${EE_CODE_DIR}"
50+
fi
51+
echo "EE code directory = ${EE_CODE_DIR} | Revert = ${REVERT}"
52+
53+
54+
if [ ! -d "${EE_CODE_DIR}" ]; then
55+
echo "Windmill EE repo not found, please clone it next to this repository (or use the --dir option) and try again"
56+
echo "> git clone [email protected]:windmill-labs/windmill-ee-private.git"
57+
echo ""
58+
exit 0
59+
fi
60+
61+
if [ "$REVERT" == "YES" ]; then
62+
for ee_file in $(find ${EE_CODE_DIR} -name "*.rs"); do
63+
ce_file="${ee_file/${EE_CODE_DIR}/.}"
64+
ce_file="${root_dirpath}/backend/${ce_file}"
65+
git restore --staged ${ce_file} || true
66+
git restore ${ce_file} || true
67+
done
68+
else
69+
# This replaces all files in current repo with alternative EE files in windmill-ee-private
70+
for ee_file in $(find "${EE_CODE_DIR}" -name "*.rs"); do
71+
ce_file="${ee_file/${EE_CODE_DIR}/.}"
72+
ce_file="${root_dirpath}/backend/${ce_file}"
73+
if [[ -f "${ce_file}" ]]; then
74+
rm "${ce_file}"
75+
if [ "$COPY" == "YES" ]; then
76+
cp "${ee_file}" "${ce_file}"
77+
echo "File copied '${ee_file}' -->> '${ce_file}'"
78+
else
79+
ln -s "${ee_file}" "${ce_file}"
80+
echo "Symlink created '${ee_file}' -->> '${ce_file}'"
81+
fi
82+
else
83+
echo "File ${ce_file} is not a file, ignoring"
84+
fi
85+
done
86+
fi

0 commit comments

Comments
 (0)