Syncing the forked repo with upstream (whilst keeping the v2 commit)

.copywrite.hcl

@@ -10,7 +10,6 @@ project {
   header_ignore = [
     "helper/pkcs7/**",
     "ui/node_modules/**",
-    "ui/api-client/**",
     "enos/modules/k8s_deploy_vault/raft-config.hcl",
     "plugins/database/postgresql/scram/**",
   ]

.github/actionlint.yml

@@ -6,6 +6,8 @@ self-hosted-runner:
   labels:
     - small
     - medium
+    - large
+    - xlarge
     - ondemand
     - disk_gb=64
     - os=linux

.github/actions/build-vault/action.yml

@@ -70,7 +70,7 @@ runs:
       shell: bash
       run: git config --global url."https://${{ inputs.github-token }}:@github.com".insteadOf "https://github.com"
     - name: Restore UI from cache
-      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+      uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
       with:
         # Restore the UI asset from the UI build workflow. Never use a partial restore key.
         enableCrossOsArchive: true
@@ -90,9 +90,11 @@ runs:
         if [[ '${{ inputs.vault-edition }}' =~ 'ce' ]]; then
           build_step_name='Vault ${{ inputs.goos }} ${{ inputs.goarch }} v${{ inputs.vault-version }}'
           package_version='${{ inputs.vault-version }}'
+          linux_package_license='BUSL-1.1'
         else
           build_step_name='Vault ${{ inputs.goos }} ${{ inputs.goarch }} v${{ inputs.vault-version }}+${{ inputs.vault-edition }}'
           package_version='${{ inputs.vault-version }}+ent' # this should always be +ent here regardless of enterprise edition
+          linux_package_license='IPLA'
         fi
         # Generate a builder cache key that considers anything that might change
         # our build container, including:
@@ -110,7 +112,13 @@ runs:
           echo "build-step-name=${build_step_name}"
           echo "vault-builder-cache-key=${docker_sha}-${build_sha}-${tools_sha}-${github_sha}-$(cat .go-version)"
           echo "package-version=${package_version}"
+          echo "linux_package_license=${linux_package_license}"
         } | tee -a "$GITHUB_OUTPUT"
+    - if: inputs.vault-edition != 'ce'
+      id: build-vault-select-license
+      uses: hashicorp-forge/actions-pao-tool/select-license@6997f7457c338e008506005cc370e7b02f7fb421 # v1.0.3
+      with:
+        arch: ${{ matrix.goarch }}
     - if: inputs.cgo-enabled == '0'
       name: ${{ steps.metadata.outputs.build-step-name }}
       env:
@@ -126,14 +134,38 @@ runs:
       shell: bash
       run: make ci-build
     - if: inputs.cgo-enabled == '1'
-      uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+      uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
       with:
         driver-opts: network=host # So we can run our own little registry
     - if: inputs.cgo-enabled == '1'
       shell: bash
       run: docker run -d -p 5000:5000 --restart always --name registry registry:2
-    - if: inputs.cgo-enabled == '1'
-      name: Build CGO builder image
+    - name: Build CGO builder image
+      if: inputs.cgo-enabled == '1'
+      id: build-push-action-attempt-1
+      continue-on-error: true # we will retry this if it fails
+      uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+      env:
+        DOCKER_BUILD_SUMMARY: false
+      with:
+        context: .
+        build-args: |
+          GO_VERSION=${{ steps.set-up-go.outputs.go-version }}
+        # Only build a container for the host OS since the same container
+        # handles cross building.
+        platforms: linux/amd64
+        push: true
+        target: builder
+        tags: localhost:5000/vault-builder:${{ steps.metadata.outputs.vault-builder-cache-key }}
+        # Upload the resulting minimal image to actions cache. This could
+        # be a problem if the resulting images are too big.
+        cache-from: type=gha,scope=vault-builder-${{ steps.metadata.outputs.vault-builder-cache-key }}
+        cache-to: type=gha,mode=min,scope=vault-builder-${{ steps.metadata.outputs.vault-builder-cache-key }}
+        github-token: ${{ inputs.github-token }}
+    - name: Build CGO builder image
+      id: build-push-action-attempt-2
+      continue-on-error: false
+      if: inputs.cgo-enabled == '1' && steps.build-push-action-attempt-1.outcome != 'success'
       uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
       env:
         DOCKER_BUILD_SUMMARY: false
@@ -176,6 +208,8 @@ runs:
     - if: inputs.vault-edition != 'ce'
       shell: bash
       run: make ci-prepare-ent-legal
+      env:
+        LICENSE_DIR: "${{ steps.build-vault-select-license.outputs.license-path }}/Softcopy"
     - if: inputs.vault-edition == 'ce'
       shell: bash
       run: make ci-prepare-ce-legal
@@ -198,7 +232,7 @@ runs:
         version: ${{ steps.metadata.outputs.package-version }}
         maintainer: HashiCorp
         homepage: https://github.com/hashicorp/vault
-        license: BUSL-1.1
+        license: ${{ steps.metadata.outputs.linux_package_license }}
         binary: ${{ steps.metadata.outputs.binary-path }}
         deb_depends: openssl
         rpm_depends: openssl

.github/actions/checkout/action.yml

@@ -70,7 +70,7 @@ runs:
           echo "ref=${checkout_ref}"
           echo "depth=${fetch_depth}"
         } | tee -a "$GITHUB_OUTPUT"
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         path: ${{ inputs.path }}
         fetch-depth: ${{ steps.ref.outputs.depth }}

.github/actions/containerize/action.yml

@@ -38,6 +38,11 @@ outputs:
 runs:
   using: composite
   steps:
+    - if: inputs.vault-edition != 'ce' && (inputs.docker == 'true' || inputs.redhat == 'true')
+      uses: hashicorp-forge/actions-pao-tool/select-license@6997f7457c338e008506005cc370e7b02f7fb421 # v1.0.3
+      id: build-vault-select-license
+      with:
+        arch: ${{ matrix.goarch }}
     - id: vars
       shell: bash
       run: |
@@ -48,27 +53,35 @@ runs:
             docker_container_target='default'
             redhat_container_tags='quay.io/redhat-isv-containers/5f89bb5e0b94cf64cfeb500a:${{ inputs.vault-version }}-ubi'
             redhat_container_target='ubi'
+            license_source='LICENSE'
+            license_dest='/usr/share/doc/vault/LICENSE.txt'
           ;;
           "ent")
             container_version='${{ inputs.vault-version }}+${{ inputs.vault-edition }}'
             docker_container_tags='docker.io/hashicorp/vault-enterprise:${{ inputs.vault-version }}-${{ inputs.vault-edition}} public.ecr.aws/hashicorp/vault-enterprise:${{ inputs.vault-version }}-${{ inputs.vault-edition }}'
             docker_container_target='default'
             redhat_container_tags='quay.io/redhat-isv-containers/5f89bb9242e382c85087dce2:${{ inputs.vault-version }}-${{ inputs.vault-edition }}-ubi'
             redhat_container_target='ubi'
+            license_source='${{ steps.build-vault-select-license.outputs.license-path }}/Softcopy'
+            license_dest='/usr/share/doc/vault/Softcopy/'
           ;;
           "ent.hsm")
             container_version='${{ inputs.vault-version }}+${{ inputs.vault-edition }}'
             docker_container_tags='docker.io/hashicorp/vault-enterprise:${{ inputs.vault-version }}-${{ inputs.vault-edition}} public.ecr.aws/hashicorp/vault-enterprise:${{ inputs.vault-version }}-${{ inputs.vault-edition }}'
             docker_container_target='ubi-hsm'
             redhat_container_tags='quay.io/redhat-isv-containers/5f89bb9242e382c85087dce2:${{ inputs.vault-version }}-${{ inputs.vault-edition }}-ubi'
             redhat_container_target='ubi-hsm'
+            license_source='${{ steps.build-vault-select-license.outputs.license-path }}/Softcopy'
+            license_dest='/usr/share/doc/vault/Softcopy/'
           ;;
           "ent.hsm.fips1403")
             container_version='${{ inputs.vault-version }}+${{ inputs.vault-edition }}'
             docker_container_tags='docker.io/hashicorp/vault-enterprise:${{ inputs.vault-version }}-${{ inputs.vault-edition}} public.ecr.aws/hashicorp/vault-enterprise:${{ inputs.vault-version }}-${{ inputs.vault-edition }}'
             docker_container_target='ubi-hsm-fips'
             redhat_container_tags='quay.io/redhat-isv-containers/5f89bb9242e382c85087dce2:${{ inputs.vault-version }}-${{ inputs.vault-edition }}-ubi'
             redhat_container_target='ubi-hsm-fips'
+            license_source='${{ steps.build-vault-select-license.outputs.license-path }}/Softcopy'
+            license_dest='/usr/share/doc/vault/Softcopy/'
           ;;
           "ent.fips1403")
             # NOTE: For compatibility we still publish the ent.fips1403 containers to different
@@ -81,6 +94,8 @@ runs:
             docker_container_target='ubi-fips'
             redhat_container_tags='quay.io/redhat-isv-containers/6283f645d02c6b16d9caeb8e:${{ inputs.vault-version }}-${{ inputs.vault-edition }}-ubi'
             redhat_container_target='ubi-fips'
+            license_source='${{ steps.build-vault-select-license.outputs.license-path }}/Softcopy'
+            license_dest='/usr/share/doc/vault/Softcopy/'
           ;;
           *)
             echo "Cannot generate container tags for unknown vault edition: ${{ inputs.vault-edition }}" 2>&1
@@ -93,6 +108,8 @@ runs:
           echo "docker-container-target=${docker_container_target}"
           echo "redhat-container-tags=${redhat_container_tags}"
           echo "redhat-container-target=${redhat_container_target}"
+          echo "license_source=${license_source}"
+          echo "license_dest=${license_dest}"
           echo "revision=$(make ci-get-revision)"
         } | tee -a "$GITHUB_OUTPUT"
     - if: inputs.docker == 'true' || inputs.redhat == 'true'
@@ -104,20 +121,28 @@ runs:
         [[ ! -d "$dest_dir" ]] && mkdir -p "$dest_dir"
         [[ ! -f "$dest_path" ]] && cp ${{ inputs.vault-binary-path }} "${dest_path}"
     - if: inputs.docker == 'true'
-      uses: hashicorp/actions-docker-build@v2.1.0
+      uses: hashicorp/actions-docker-build@ryan/VAULT-34830-allow-repo-configuration
       with:
         arch: ${{ inputs.goarch }}
         do_zip_extract_step: 'false' # Don't download and extract an already present binary
-        target: ${{ steps.vars.outputs.docker-container-target }}
-        tags: ${{ steps.vars.outputs.docker-container-tags }}
+        extra_build_args: |
+          LICENSE_SOURCE=${{ steps.vars.outputs.license_source }}
+          LICENSE_DEST=${{ steps.vars.outputs.license_dest }}
+        repo_name: ${{ inputs.vault-edition == 'ce' && 'vault' || 'vault-enterprise' }}
         revision: ${{ steps.vars.outputs.revision }}
+        tags: ${{ steps.vars.outputs.docker-container-tags }}
+        target: ${{ steps.vars.outputs.docker-container-target }}
         version: ${{ steps.vars.outputs.container-version }}
     - if: inputs.redhat == 'true'
-      uses: hashicorp/actions-docker-build@v2.1.0
+      uses: hashicorp/actions-docker-build@ryan/VAULT-34830-allow-repo-configuration
       with:
         arch: ${{ inputs.goarch }}
         do_zip_extract_step: 'false' # Don't download and extract an already present binary
+        extra_build_args: |
+          LICENSE_SOURCE=${{ steps.vars.outputs.license_source }}
+          LICENSE_DEST=${{ steps.vars.outputs.license_dest }}
         redhat_tag: ${{ steps.vars.outputs.redhat-container-tags }}
-        target: ${{ steps.vars.outputs.redhat-container-target }}
+        repo_name: ${{ inputs.vault-edition == 'ce' && 'vault' || 'vault-enterprise' }}
         revision: ${{ steps.vars.outputs.revision }}
+        target: ${{ steps.vars.outputs.redhat-container-target }}
         version: ${{ steps.vars.outputs.container-version }}

.github/actions/create-dynamic-config/action.yml

@@ -39,7 +39,7 @@ runs:
         } | tee -a "$GITHUB_ENV"
     - name: Try to restore dynamic config from cache
       id: dyn-cfg-cache
-      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+      uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
       with:
         path: ${{ env.DYNAMIC_CONFIG_PATH }}
         key: dyn-cfg-${{ env.DYNAMIC_CONFIG_KEY }}

.github/actions/metadata/action.yml

@@ -39,12 +39,18 @@ outputs:
   go-tags:
     description: The minimal set of Go tags required to build the correct edition of Vault.
     value: ${{ steps.workflow-metadata.outputs.go-tags }}
+  is-ce-in-enterprise:
+    description: Whether or not the workflow is running CE Vault in the context of Vault Enterprise.
+    value: ${{ steps.workflow-metadata.outputs.is-ce-in-enterprise }}
   is-draft:
     description: Whether or not the workflow is executing in the context of a pull request draft.
     value: ${{ steps.workflow-metadata.outputs.is-draft }}
-  is-enterprise:
-    description: Whether or not the workflow is executing in the context of Vault enterprise.
-    value: ${{ steps.workflow-metadata.outputs.is-enterprise }}
+  is-ent-branch:
+    description: Whether or not the workflow is executing in the context of Vault Enterprise.
+    value: ${{ steps.workflow-metadata.outputs.is-ent-branch }}
+  is-ent-repo:
+    description: Whether or not the workflow is executing in the context of hashicorp/vault-enterprise
+    value: ${{ steps.workflow-metadata.outputs.is-ent-repo }}
   is-fork:
     description: Whether or not the workflow is being triggered on a pull request that is a fork.
     value: ${{ steps.workflow-metadata.outputs.is-fork }}
@@ -102,9 +108,9 @@ runs:
           is_draft='${{ github.event.pull_request.draft }}'
 
           # Determine our pull request labels. We specifically look them up via the pulls API
-          # because at some point they stopped being reliable in the
-          # github.event.pull_request.labels.*.name context.
-
+          # because the github.event.pull_request.labels.*.name context is very inflexible.
+          # This allows people to add labels after inital pull request and/or to re-run this
+          # workflow to reload them.
           labels=$(gh api "/repos/${{ github.repository }}/issues/${{ github.event.number }}/labels" | jq -erc '. | map(.name)')
         else
           # We can assume we're being triggered for a 'push' (a merge)
@@ -145,28 +151,47 @@ runs:
           echo "workflow-trigger=${{ github.event_name }}"
         } | tee -a "$GITHUB_OUTPUT"
 
-        # Set CE and Ent specific workflow metadata
-        is_enterprise='${{ contains(github.repository, 'vault-enterprise') }}'
-        if [ "$is_enterprise" = 'true' ]; then
-          {
-            echo 'compute-build=["self-hosted","ondemand","os=linux","disk_gb=64","type=c6a.4xlarge"]'
-            echo 'compute-build-ui=["self-hosted","ondemand","os=linux", "disk_gb=64", "type=c6a.2xlarge"]'
-            echo 'compute-test-go=["self-hosted","ondemand","os=linux","disk_gb=64","type=c6a.2xlarge"]'
-            echo 'compute-test-ui=["self-hosted","ondemand","os=linux","type=m6a.2xlarge"]'
-            echo 'compute-small=["self-hosted","linux","small"]'
-            echo 'go-tags=ent,enterprise'
-            echo 'is-enterprise=true'
-            echo 'vault-version-metadata=${{ inputs.vault-version }}+ent'
-          } | tee -a "$GITHUB_OUTPUT"
+        # Set CE, Ent, and CE in Ent specific workflow metadata
+        is_enterprise_repo='${{ contains(github.repository, 'vault-enterprise') }}'
+        if [ "$is_enterprise_repo" = 'true' ]; then
+          base_ref='${{ github.event.pull_request.base.ref || github.event.base_ref || github.ref_name || github.event.branch || github.ref }}'
+          is_ent_repo='true'
+          is_ce_in_enterprise=$([[ $base_ref == ce/* ]] && echo "true" || echo "false")
+          if [ "$is_ce_in_enterprise" = 'true' ]; then
+            is_enterprise="false"
+            go_tags=''
+            version_metadata='${{ inputs.vault-version }}'
+          else
+            is_enterprise='true'
+            go_tags='ent,enterprise'
+            version_metadata='${{ inputs.vault-version }}+ent'
+          fi
+          compute_build='["self-hosted","ondemand","os=linux","disk_gb=64","type=c6a.4xlarge"]'
+          compute_build_ui='["self-hosted","ondemand","os=linux", "disk_gb=64", "type=c6a.2xlarge"]'
+          compute_test_go='["self-hosted","ondemand","os=linux","disk_gb=64","type=c6a.2xlarge"]'
+          compute_test_ui='["self-hosted","ondemand","os=linux","type=m6a.2xlarge"]'
+          compute_small='["self-hosted","linux","small"]'
         else
-          {
-            echo 'compute-build="custom-linux-medium-vault-latest"'
-            echo 'compute-build-ui="custom-linux-xl-vault-latest"'
-            echo 'compute-test-go="custom-linux-medium-vault-latest"'
-            echo 'compute-test-ui="custom-linux-medium-vault-latest"'
-            echo 'compute-small="ubuntu-latest"'
-            echo 'go-tags='
-            echo 'is-enterprise=false'
-            echo 'vault-version-metadata=${{ inputs.vault-version }}'
-          } | tee -a "$GITHUB_OUTPUT"
+          compute_build='"custom-linux-medium-vault-latest"'
+          compute_build_ui='"custom-linux-xl-vault-latest"'
+          compute_test_go='"custom-linux-medium-vault-latest"'
+          compute_test_ui='"custom-linux-medium-vault-latest"'
+          compute_small='"ubuntu-latest"'
+          go_tags=''
+          is_ce_in_enterprise='false'
+          is_ent_branch='false'
+          is_ent_repo='false'
+          version_metadata='${{ inputs.vault-version }}'
         fi
+        {
+          echo "compute-build=${compute_build}"
+          echo "compute-build-ui=${compute_test_ui}"
+          echo "compute-test-go=${compute_test_go}"
+          echo "compute-test-ui=${compute_test_ui}"
+          echo "compute-small=${compute_small}"
+          echo "go-tags=${go_tags}"
+          echo "is-ce-in-enterprise=${is_ce_in_enterprise}"
+          echo "is-ent-branch=${is_enterprise}"
+          echo "is-ent-repo=${is_ent_repo}"
+          echo "vault-version-metadata=${version_metadata}"
+        } | tee -a "$GITHUB_OUTPUT"

.github/actions/run-apupgrade-tests/action.yml

@@ -36,7 +36,7 @@ runs:
       run: vault-auth
     - name: Fetch Secrets
       id: secrets
-      uses: hashicorp/vault-action@d1720f055e0635fd932a1d2a48f87a666a57906c # v3.0.0
+      uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
       with:
         url: ${{ steps.vault-auth.outputs.addr }}
         caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
@@ -52,7 +52,7 @@ runs:
       run: |
         git config --global url."https://${{ steps.secrets.outputs.github-token }}@github.com".insteadOf https://github.com
     - name: Check out the .release/versions.hcl file from Vault Enterprise repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         ref: ${{ inputs.checkout-ref }}
     - uses: ./.github/actions/set-up-go
@@ -61,14 +61,14 @@ runs:
     - name: Build external tools
       uses: ./.github/actions/install-external-tools
     - name: Checkout VCM repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         repository: hashicorp/vcm
         ref: 1fcab6591e3bdc81d2921ca77441bfcf913c6a57
         token: ${{ inputs.github-token }}
         path: vcm
     - name: Checkout Vault tools repository to get the Autopilot upgrade tool
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         repository: hashicorp/vault-tools
         token: ${{ inputs.github-token }}