Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/actions/release/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ To try the action locally, run the following:
```bash
$ # The list of files for which we compute the sha256
$ # (those file must exist, though they don't need to have meaningful content)
$ export INPUT_ASSETS='internet_identity_production.wasm.gz
$ export INPUT_ASSETS='internet_identity_backend.wasm.gz
internet_identity_frontend.wasm.gz
archive.wasm.gz'
$ export RELEASE_TAG=release-2023-08-11 # Does not need to exist
Expand Down
2 changes: 1 addition & 1 deletion .github/actions/release/run.sh
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ To build the wasm modules yourself and verify their hashes, run the following co
git pull # to ensure you have the latest changes.
git checkout $GITHUB_SHA
./scripts/verify-hash \
--ii-hash $(shasum -a 256 "internet_identity_production.wasm.gz" | cut -d ' ' -f1) \
--ii-hash $(shasum -a 256 "internet_identity_backend.wasm.gz" | cut -d ' ' -f1) \
--iife-hash $(shasum -a 256 internet_identity_frontend.wasm.gz | cut -d ' ' -f1)
\`\`\`

Expand Down
60 changes: 38 additions & 22 deletions .github/workflows/canister-tests.yml
Original file line number Diff line number Diff line change
Expand Up @@ -37,24 +37,24 @@
docker-build-internet_identity:
# NOTE: the display name must contain the asset filename so that the release
# action can map assets to job IDs (see .github/actions/release/run.sh).
name: docker-build-internet_identity (internet_identity_production.wasm.gz)
name: docker-build-internet_identity (internet_identity_backend.wasm.gz)
runs-on: ubuntu-latest
needs: docker-build-base
steps:
- uses: actions/checkout@v4

- name: Infer version
id: version
run: |
version="$(./scripts/version)"
echo "Inferred version: '$version'"
echo "version=$version" >> "$GITHUB_OUTPUT"

- name: Set up docker buildx
uses: docker/setup-buildx-action@v3

- name: Build internet_identity_production.wasm.gz
- name: Build internet_identity_backend.wasm.gz
uses: docker/build-push-action@v5

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Canister tests' step
Uses Step
uses 'docker/build-push-action' with ref 'v5', not a pinned commit hash
with:
context: .
file: Dockerfile
Expand All @@ -65,16 +65,16 @@
outputs: ./out
target: scratch_internet_identity

- run: mv out/internet_identity.wasm.gz internet_identity_production.wasm.gz
- run: sha256sum internet_identity_production.wasm.gz
- name: "Upload internet_identity_production.wasm.gz"
- run: mv out/internet_identity.wasm.gz internet_identity_backend.wasm.gz
- run: sha256sum internet_identity_backend.wasm.gz
- name: "Upload internet_identity_backend.wasm.gz"
uses: actions/upload-artifact@v4
with:
# name is the name used to display and retrieve the artifact
name: internet_identity_production.wasm.gz
name: internet_identity_backend.wasm.gz
# path is the name used as the file to upload and the name of the
# file when downloaded
path: internet_identity_production.wasm.gz
path: internet_identity_backend.wasm.gz

docker-build-archive:

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
runs-on: ubuntu-latest
Expand Down Expand Up @@ -153,12 +153,12 @@
- name: "Download wasm"
uses: actions/download-artifact@v4
with:
name: internet_identity_production.wasm.gz
name: internet_identity_backend.wasm.gz
path: .
- id: record-size
uses: ./.github/actions/file-size
with:
file: internet_identity_production.wasm.gz
file: internet_identity_backend.wasm.gz
save: ${{ github.ref == 'refs/heads/main' }}
- name: "Check canister size"
run: |
Expand Down Expand Up @@ -251,9 +251,9 @@
- name: "Download II wasm"
uses: actions/download-artifact@v4
with:
name: internet_identity_production.wasm.gz
name: internet_identity_backend.wasm.gz
path: .
- run: mv internet_identity_production.wasm.gz internet_identity.wasm.gz
- run: mv internet_identity_backend.wasm.gz internet_identity.wasm.gz
- name: Install PocketIC server
uses: dfinity/pocketic@main
with:
Expand Down Expand Up @@ -375,7 +375,7 @@
- name: "Download II wasm"
uses: actions/download-artifact@v4
with:
name: internet_identity_production.wasm.gz
name: internet_identity_backend.wasm.gz
path: .

- name: "Download archive wasm"
Expand All @@ -396,7 +396,7 @@

- name: Run Tests
run: |
mv internet_identity_production.wasm.gz internet_identity.wasm.gz
mv internet_identity_backend.wasm.gz internet_identity.wasm.gz
# NOTE: Here we download changing assets (i.e. the latest release) meaning that in some rare cases (after a new release)
# PRs that used to be green may become red (if the new release broke something). While this is not CI best practice, it's
# a relatively small price to pay to make sure PRs are always tested against the latest release.
Expand Down Expand Up @@ -427,7 +427,7 @@
- name: "Download II wasm"
uses: actions/download-artifact@v4
with:
name: internet_identity_production.wasm.gz
name: internet_identity_backend.wasm.gz
path: .

- name: "Download archive wasm"
Expand All @@ -437,7 +437,7 @@
path: .

- name: Move wasms
run: mv internet_identity_production.wasm.gz internet_identity.wasm.gz
run: mv internet_identity_backend.wasm.gz internet_identity.wasm.gz

- name: Create dummy assets
run: |
Expand Down Expand Up @@ -516,7 +516,7 @@
- name: "Download II backend wasm"
uses: actions/download-artifact@v4
with:
name: internet_identity_production.wasm.gz
name: internet_identity_backend.wasm.gz
path: .

- name: "Download II frontend wasm"
Expand Down Expand Up @@ -548,7 +548,7 @@
- name: Deploy canisters
run: |
# NOTE: dfx install will run the postinstall scripts from dfx.json
dfx canister install internet_identity --wasm internet_identity_production.wasm.gz --argument "(opt record { captcha_config = opt record { max_unsolved_captchas= 50:nat64; captcha_trigger = variant {Static = variant { CaptchaDisabled }}}; related_origins = opt vec { \"https://id.ai\"; \"https://identity.ic0.app\"; \"https://identity.internetcomputer.org\" }; new_flow_origins = opt vec { \"https://id.ai\" }; openid_configs = opt vec { ${{ steps.openid-configs.outputs.OPENID_CONFIGS }} } })"
dfx canister install internet_identity --wasm internet_identity_backend.wasm.gz --argument "(opt record { captcha_config = opt record { max_unsolved_captchas= 50:nat64; captcha_trigger = variant {Static = variant { CaptchaDisabled }}}; related_origins = opt vec { \"https://id.ai\"; \"https://identity.ic0.app\"; \"https://identity.internetcomputer.org\" }; new_flow_origins = opt vec { \"https://id.ai\" }; openid_configs = opt vec { ${{ steps.openid-configs.outputs.OPENID_CONFIGS }} } })"
II_CANISTER_ID=$(dfx canister id internet_identity)
dfx canister install internet_identity_frontend --wasm internet_identity_frontend.wasm.gz --argument "(record { backend_canister_id = principal \"$II_CANISTER_ID\"; backend_origin = \"https://backend.id.ai\"; related_origins = opt vec { \"https://id.ai\"; \"https://identity.ic0.app\"; \"https://identity.internetcomputer.org\" }; fetch_root_key = opt true; dev_csp = opt true })"
dfx canister install test_app --wasm demos/test-app/test_app.wasm
Expand Down Expand Up @@ -619,7 +619,7 @@
- name: "Download II wasm"
uses: actions/download-artifact@v4
with:
name: internet_identity_production.wasm.gz
name: internet_identity_backend.wasm.gz
path: .

- name: "Download archive wasm"
Expand All @@ -645,7 +645,7 @@
sha=$(shasum -a 256 ./archive.wasm.gz | cut -d ' ' -f1 | sed 's/../\\&/g')
dfx canister --network ic --wallet "$wallet" install --mode upgrade \
--argument "(opt record {archive_config = record { module_hash = blob \"$sha\"; entries_buffer_limit = 10000:nat64; entries_fetch_limit = 1000:nat16; polling_interval_ns = 60000000000:nat64}; canister_creation_cycles_cost = opt (1000000000000:nat64); })" \
--wasm internet_identity_production.wasm.gz \
--wasm internet_identity_backend.wasm.gz \
y2aaj-miaaa-aaaad-aacxq-cai

- name: "Download test app wasm"
Expand Down Expand Up @@ -704,10 +704,10 @@
steps:
- uses: actions/checkout@v4

- name: "Download production build"
- name: "Download backend build"
uses: actions/download-artifact@v4
with:
name: internet_identity_production.wasm.gz
name: internet_identity_backend.wasm.gz
path: .

- name: "Download archive"
Expand Down Expand Up @@ -784,7 +784,7 @@
id: prepare-release
with:
assets: |
internet_identity_production.wasm.gz
internet_identity_backend.wasm.gz
internet_identity_frontend.wasm.gz
archive.wasm.gz
changelog: ${{ steps.changelog.outputs.result }}
Expand All @@ -793,12 +793,24 @@
- name: Release notes
run: cat ${{ steps.prepare-release.outputs.notes-file }}

# Create backward-compatible copies of the backend wasm
- name: Create backward-compatible copies
run: |
cp internet_identity_backend.wasm.gz internet_identity_production.wasm.gz
cp internet_identity_backend.wasm.gz internet_identity_dev.wasm.gz

# Create a sha file for dfx pull, referenced by the metadata set in the build
- name: Create sha for dfx pull
run: |
shasum -a 256 \
./internet_identity_backend.wasm.gz > \
./internet_identity_backend.wasm.gz.sha256
shasum -a 256 \
./internet_identity_production.wasm.gz > \
./internet_identity_production.wasm.gz.sha256
shasum -a 256 \
./internet_identity_dev.wasm.gz > \
./internet_identity_dev.wasm.gz.sha256
shasum -a 256 \
./internet_identity_frontend.wasm.gz > \
./internet_identity_frontend.wasm.gz.sha256
Expand All @@ -810,8 +822,12 @@
--tag ${{ github.ref }} \
--notes-file ${{ steps.prepare-release.outputs.notes-file }} \
-- \
internet_identity_backend.wasm.gz \
internet_identity_backend.wasm.gz.sha256 \
internet_identity_production.wasm.gz \
internet_identity_production.wasm.gz.sha256 \
internet_identity_dev.wasm.gz \
internet_identity_dev.wasm.gz.sha256 \
internet_identity_frontend.wasm.gz \
internet_identity_frontend.wasm.gz.sha256 \
src/internet_identity/internet_identity.did \
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/deploy-rc.yml
Original file line number Diff line number Diff line change
Expand Up @@ -23,11 +23,11 @@ jobs:
uses: actions/github-script@v7
with:
script: |
// Find all artifacts for the production build, and filter for non-expired main artifacts
// Find all artifacts for the backend build, and filter for non-expired main artifacts
const allArtifacts = await github.paginate(github.rest.actions.listArtifactsForRepo, {
owner: context.repo.owner,
repo: context.repo.repo,
name: "internet_identity_production.wasm.gz",
name: "internet_identity_backend.wasm.gz",
});
const artifactsByBranch = {};
const mainArtifacts = allArtifacts
Expand Down Expand Up @@ -56,7 +56,7 @@ jobs:
await exec.exec('rm', ["artifact.zip" ]);

- name: "Print shasum of found build"
run: shasum -a 256 ./internet_identity_production.wasm.gz
run: shasum -a 256 ./internet_identity_backend.wasm.gz

- uses: dfinity/setup-dfx@e50c04f104ee4285ec010f10609483cf41e4d365

Expand All @@ -75,7 +75,7 @@ jobs:
# Needed to surpass dfx error to use the insecure plaintext identity
export DFX_WARNING=-mainnet_plaintext_identity
dfx canister --network ic --wallet "$wallet" install --mode upgrade \
--wasm internet_identity_production.wasm.gz \
--wasm internet_identity_backend.wasm.gz \
${{ env.ii_canister_id }}

- name: Send RC link to slack
Expand Down
2 changes: 1 addition & 1 deletion scripts/build
Original file line number Diff line number Diff line change
Expand Up @@ -178,7 +178,7 @@ function build_canister() {
release="${version_parts[1]}"
if [ -n "$release" ]
then
asset_name="internet_identity_production.wasm.gz"
asset_name="internet_identity_backend.wasm.gz"
wasm_url="https://github.com/dfinity/internet-identity/releases/download/$release/$asset_name"
wasm_hash_url="https://github.com/dfinity/internet-identity/releases/download/$release/$asset_name.sha256"

Expand Down
2 changes: 1 addition & 1 deletion scripts/deploy-pr-to-beta
Original file line number Diff line number Diff line change
Expand Up @@ -161,7 +161,7 @@ fi
# is resilient to changes in matrix keys/order or GitHub's display-name formatting.
DEPLOYMENTS=()
if [ "$DEPLOY_BACK" = true ]; then
DEPLOYMENTS+=("internet_identity_production.wasm.gz:$STAGING_CANISTER_ID:docker-build-internet_identity:internet_identity_production.wasm.gz")
DEPLOYMENTS+=("internet_identity_backend.wasm.gz:$STAGING_CANISTER_ID:docker-build-internet_identity:internet_identity_backend.wasm.gz")
fi
if [ "$DEPLOY_FRONT" = true ]; then
DEPLOYMENTS+=("internet_identity_frontend.wasm.gz:$FRONTEND_CANISTER_ID:docker-build-internet_identity_frontend:docker-build-internet_identity_frontend")
Expand Down
Loading