add workflow

calebdoxsey · calebdoxsey · commit fb2efe4faee6 · 2025-10-10T13:29:44.000-06:00
diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
@@ -1,5 +1,13 @@
 version: 2
 updates:
+  - package-ecosystem: "gitsubmodule"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      gitsubmodule:
+        patterns:
+          - "*"
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
diff --git a/.github/workflows/update.yaml b/.github/workflows/update.yaml
@@ -0,0 +1,16 @@
+name: Update
+
+on:
+  pull_request:
+
+jobs:
+  update-pomerium-core:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        with:
+          ref: ${{ github.head_ref }}
+
+      - run: |
+        ./scripts/update
diff --git a/.gitignore b/.gitignore
@@ -1,3 +1,3 @@
-deps/*
-!deps/.gitkeep
 .vscode/
+deps/bin/
+deps/protoc.zip
diff --git a/.gitmodules b/.gitmodules
@@ -0,0 +1,13 @@
+[submodule "deps/github.com/pomerium/pomerium-console"]
+	path = deps/github.com/pomerium/pomerium-console
+	url = git@github.com:pomerium/pomerium-console
+	branch = main
+[submodule "deps/github.com/envoyproxy/protoc-gen-validate"]
+	path = deps/github.com/envoyproxy/protoc-gen-validate
+	url = git@github.com:envoyproxy/protoc-gen-validate
+[submodule "deps/github.com/googleapis/googleapis"]
+	path = deps/github.com/googleapis/googleapis
+	url = git@github.com:googleapis/googleapis
+[submodule "deps/github.com/protocolbuffers/protobuf"]
+	path = deps/github.com/protocolbuffers/protobuf
+	url = git@github.com:protocolbuffers/protobuf
diff --git a/API.md b/API.md
@@ -1270,12 +1270,13 @@ CreateKeyPairRequest defines a Key Pair to create
 
 | Field | Type | Description |
 | ----- | ---- | ----------- |
-| originator_id | [ string](#string) | none |
 | name | [ string](#string) | none |
 | namespace_id | [ string](#string) | none |
 | format | [ Format](#format) | encoding format of data |
 | certificate | [ bytes](#bytes) | public certificate data |
 | key | [ bytes](#bytes) | private key data |
+| originator_id | [ string](#string) | none |
+| [**oneof**](https://developers.google.com/protocol-buffers/docs/proto3#oneof) _id.id | [optional string](#string) | none |
  <!-- end Fields -->
  <!-- end HasFields -->
 
@@ -1360,9 +1361,10 @@ KeyPairRecord provides existing Key Pair metadata
 | created_at | [ google.protobuf.Timestamp](#googleprotobuftimestamp) | database record creation time |
 | modified_at | [ google.protobuf.Timestamp](#googleprotobuftimestamp) | database record modification time |
 | cert_info | [ CertificateInfo](#certificateinfo) | information about the public certificate |
-| has_private_key | [ bool](#bool) | Key Pair has a private key attached |
+| has_private_key | [ bool](#bool) | Deprecated: This field will be removed in a future release. Use key_sha256 to verify presence of private key. |
 | certificate | [ bytes](#bytes) | public certificate data |
 | originator_id | [ string](#string) | none |
+| [**oneof**](https://developers.google.com/protocol-buffers/docs/proto3#oneof) _key_sha256.key_sha256 | [optional string](#string) | none |
  <!-- end Fields -->
  <!-- end HasFields -->
 
@@ -2901,7 +2903,6 @@ Next id: 122.
 | [**oneof**](https://developers.google.com/protocol-buffers/docs/proto3#oneof) _timeout_write.timeout_write | [optional google.protobuf.Duration](#googleprotobufduration) | none |
 | [**oneof**](https://developers.google.com/protocol-buffers/docs/proto3#oneof) _timeout_idle.timeout_idle | [optional google.protobuf.Duration](#googleprotobufduration) | none |
 | [**oneof**](https://developers.google.com/protocol-buffers/docs/proto3#oneof) _authenticate_service_url.authenticate_service_url | [optional string](#string) | none |
-| [**oneof**](https://developers.google.com/protocol-buffers/docs/proto3#oneof) _authenticate_callback_path.authenticate_callback_path | [optional string](#string) | none |
 | [**oneof**](https://developers.google.com/protocol-buffers/docs/proto3#oneof) _cookie_name.cookie_name | [optional string](#string) | none |
 | [**oneof**](https://developers.google.com/protocol-buffers/docs/proto3#oneof) _cookie_secret.cookie_secret | [optional string](#string) | none |
 | [**oneof**](https://developers.google.com/protocol-buffers/docs/proto3#oneof) _cookie_domain.cookie_domain | [optional string](#string) | none |
diff --git a/deps/.gitkeep b/deps/.gitkeep
diff --git a/deps/github.com/envoyproxy/protoc-gen-validate b/deps/github.com/envoyproxy/protoc-gen-validate
@@ -0,0 +1 @@
+Subproject commit 7b06248484ceeaa947e93ca2747eccf336a88ecc
diff --git a/deps/github.com/googleapis/googleapis b/deps/github.com/googleapis/googleapis
@@ -0,0 +1 @@
+Subproject commit 1135291431e84c77bad208b5a78b20914cb7f488
diff --git a/deps/github.com/pomerium/pomerium-console b/deps/github.com/pomerium/pomerium-console
@@ -0,0 +1 @@
+Subproject commit 6b6b991fbe4c90a5a806b4b25c0834be58c4eb37
diff --git a/deps/github.com/protocolbuffers/protobuf b/deps/github.com/protocolbuffers/protobuf
@@ -0,0 +1 @@
+Subproject commit 7fcfd66022455635fa29af92987cdc0967efd4f3
diff --git a/protos/pomerium-console/key_chain.proto b/protos/pomerium-console/key_chain.proto
@@ -110,11 +110,12 @@ message KeyPairRecord {
   google.protobuf.Timestamp modified_at = 5;
   // information about the public certificate
   CertificateInfo cert_info = 7;
-  // Key Pair has a private key attached
-  bool has_private_key = 8;
+  // Deprecated: This field will be removed in a future release. Use key_sha256 to verify presence of private key.
+  bool has_private_key = 8 [deprecated = true];
   // public certificate data
   bytes certificate = 9;
   string originator_id = 10;
+  optional string key_sha256 = 11;
 }
 
 message DeleteKeyPairRequest { string id = 1; }
@@ -148,7 +149,6 @@ message ListKeyPairsResponse {
 
 // CreateKeyPairRequest defines a Key Pair to create
 message CreateKeyPairRequest {
-  string originator_id = 6;
   string name = 1;
   string namespace_id = 2;
   // encoding format of data
@@ -157,6 +157,8 @@ message CreateKeyPairRequest {
   bytes certificate = 4;
   // private key data
   bytes key = 5;
+  string originator_id = 6;
+  optional string id = 7;
 }
 
 message CreateKeyPairResponse { KeyPairRecord key_pair = 1; }
diff --git a/protos/pomerium-console/settings.proto b/protos/pomerium-console/settings.proto
@@ -59,7 +59,7 @@ message Settings {
   optional google.protobuf.Duration timeout_write = 12;
   optional google.protobuf.Duration timeout_idle = 13;
   optional string authenticate_service_url = 14;
-  optional string authenticate_callback_path = 15;
+  reserved 15; // authenticate_callback_path
   optional string cookie_name = 16;
   optional string cookie_secret = 17;
   optional string cookie_domain = 18;
diff --git a/scripts/update b/scripts/update
@@ -5,114 +5,80 @@ _scripts_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
 _root_dir="$(dirname "$_scripts_dir")"
 _deps_dir="$_root_dir/deps"
 
-readonly _git_deps=(
-  "pomerium/pomerium-console|0797fe31a0d1a32faaaacbaf1d891102d4984fbb"
-  "envoyproxy/protoc-gen-validate|v1.2.1"
-  "googleapis/googleapis|114a745b2841a044e98cdbb19358ed29fcf4a5f1"
-  "protocolbuffers/protobuf|7a5905db8ebca0df67477082a697ddaaf6045e99"
-)
-
-function clone() {
-  local _name="$1"
-  local _tag="$2"
-  local _dst="$3"
-
-  echo "cloning $_name:$_tag to $_dst"
-  if [ ! -d "$_dst" ]; then
-    mkdir -p "$_dst"
-    (cd "$_dst" && git init && git remote add origin "git@github.com:$_name")
-  fi
-  (
-    cd "$_dst"
-    git fetch --depth=1 origin
-    git switch --force-create dev "$_tag"
-  )
-}
-
-function clone_all() {
-  local _name _tag _dst
-  for _dep in "${_git_deps[@]}"; do
-    IFS=$'|' read -r _name _tag <<<"$_dep"
-    _dst="$_deps_dir/github.com/$_name"
-    clone "$_name" "$_tag" "$_dst"
-  done
-}
-
 function download() {
-  local _url="$1"
-  local _dst="$2"
+	local _url="$1"
+	local _dst="$2"
 
-  echo "downloading $_url to $_dst"
-  curl \
-    --silent \
-    --compressed \
-    --fail \
-    --location \
-    --time-cond "$_dst" \
-    --output "$_dst" \
-    "$_url"
+	echo "downloading $_url to $_dst"
+	curl \
+		--silent \
+		--compressed \
+		--fail \
+		--location \
+		--time-cond "$_dst" \
+		--output "$_dst" \
+		"$_url"
 }
 
 function download_all() {
-  if [ "$(uname -s)" == "Darwin" ]; then
-    download "https://github.com/protocolbuffers/protobuf/releases/download/v21.5/protoc-21.5-osx-universal_binary.zip" "$_deps_dir/protoc.zip"
-  else
-    download "https://github.com/protocolbuffers/protobuf/releases/download/v21.5/protoc-21.5-linux-x86_64.zip" "$_deps_dir/protoc.zip"
-  fi
-  (cd "$_deps_dir" && unzip -o protoc.zip bin/protoc)
+	if [ "$(uname -s)" == "Darwin" ]; then
+		download "https://github.com/protocolbuffers/protobuf/releases/download/v21.5/protoc-21.5-osx-universal_binary.zip" "$_deps_dir/protoc.zip"
+	else
+		download "https://github.com/protocolbuffers/protobuf/releases/download/v21.5/protoc-21.5-linux-x86_64.zip" "$_deps_dir/protoc.zip"
+	fi
+	(cd "$_deps_dir" && unzip -o protoc.zip bin/protoc)
 }
 
 function join_by() {
-  local IFS="$1"
-  shift
-  echo "$*"
+	local IFS="$1"
+	shift
+	echo "$*"
 }
 
-clone_all
 download_all
 
 _imports=()
 while read -r _proto; do
-  if [[ "$_proto" == envoy/* ]]; then
-    _imports+=("M${_proto}=github.com/envoyproxy/go-control-plane/$(dirname "$_proto")")
-  elif [[ "$_proto" == xds/* || "$_proto" == udpa/* ]]; then
-    _imports+=("M${_proto}=github.com/cncf/xds/go/$(dirname "$_proto")")
-  fi
+	if [[ "$_proto" == envoy/* ]]; then
+		_imports+=("M${_proto}=github.com/envoyproxy/go-control-plane/$(dirname "$_proto")")
+	elif [[ "$_proto" == xds/* || "$_proto" == udpa/* ]]; then
+		_imports+=("M${_proto}=github.com/cncf/xds/go/$(dirname "$_proto")")
+	fi
 done <"$_deps_dir/github.com/pomerium/pomerium-console/scripts/proto-dependencies.txt"
 _import_paths=$(join_by , "${_imports[@]}")
 
 _proto_files=(
-  activity_log.proto
-  clusters.proto
-  devices.proto
-  external_data_sources.proto
-  key_chain.proto
-  namespaces.proto
-  policy.proto
-  route_health_check.proto
-  route_redirect_action.proto
-  routes.proto
-  settings.proto
-  types.proto
-  users.proto
+	activity_log.proto
+	clusters.proto
+	devices.proto
+	external_data_sources.proto
+	key_chain.proto
+	namespaces.proto
+	policy.proto
+	route_health_check.proto
+	route_redirect_action.proto
+	routes.proto
+	settings.proto
+	types.proto
+	users.proto
 )
 
 (
-  cd "$_root_dir"
+	cd "$_root_dir"
 
-  echo "generating pomerium-console protobuf code"
-  "$_deps_dir/bin/protoc" \
-    --plugin="protoc-gen-doc=$_scripts_dir/protoc-gen-doc" \
-    -I "$_deps_dir" \
-    -I "$_deps_dir/github.com/googleapis/googleapis" \
-    -I "$_deps_dir/github.com/protocolbuffers/protobuf/src" \
-    -I "$_deps_dir/github.com/envoyproxy/protoc-gen-validate" \
-    -I "$_deps_dir/github.com/pomerium/pomerium-console/pkg/pb" \
-    --doc_out=./ \
-    --doc_opt=.template.mustache,API.md \
-    "${_proto_files[@]}"
+	echo "generating pomerium-console protobuf code"
+	"$_deps_dir/bin/protoc" \
+		--plugin="protoc-gen-doc=$_scripts_dir/protoc-gen-doc" \
+		-I "$_deps_dir" \
+		-I "$_deps_dir/github.com/googleapis/googleapis" \
+		-I "$_deps_dir/github.com/protocolbuffers/protobuf/src" \
+		-I "$_deps_dir/github.com/envoyproxy/protoc-gen-validate" \
+		-I "$_deps_dir/github.com/pomerium/pomerium-console/pkg/pb" \
+		--doc_out=./ \
+		--doc_opt=.template.mustache,API.md \
+		"${_proto_files[@]}"
 )
 
 for proto_file in "${_proto_files[@]}"; do
-  cp -f "$_deps_dir/github.com/pomerium/pomerium-console/pkg/pb/$proto_file" "$_root_dir/protos/pomerium-console/"
+	cp -f "$_deps_dir/github.com/pomerium/pomerium-console/pkg/pb/$proto_file" "$_root_dir/protos/pomerium-console/"
 done
