Dev to Master

.docker/.env.identitylab.example

@@ -0,0 +1,8 @@
+IDENTITYLAB_IMAGE=ghcr.io/codebeamorg/ultimateauth-identitylab:REPLACE_WITH_SHA
+
+CADDY_PROXY_IP=172.20.0.4
+IDENTITYLAB_CONNECTION_STRING=Host=postgres;Port=5432;Database=identitylab;Username=identitylab_user;Password=REPLACE_WITH_PASSWORD
+
+LAB_ADMIN_USERNAME=Ladmin
+LAB_ADMIN_EMAIL=REPLACE_WITH_EMAIL
+LAB_ADMIN_PASSWORD=REPLACE_WITH_PASSWORD

.docker/Dockerfile

@@ -7,12 +7,12 @@ ENV CI=true
 COPY docs/website/CodeBeam.UltimateAuth.Docs.Wasm/CodeBeam.UltimateAuth.Docs.Wasm/*.csproj CodeBeam.Website/
 COPY docs/website/CodeBeam.UltimateAuth.Docs.Wasm/CodeBeam.UltimateAuth.Docs.Wasm.Client/*.csproj CodeBeam.Website.Client/
 
-RUN dotnet restore CodeBeam.Website/CodeBeam.UltimateAuth.Docs.Wasm.csproj
+RUN dotnet restore CodeBeam.Website/CodeBeam.UltimateAuth.Docs.Wasm.csproj -p:UltimateAuthBuildTargetFrameworks=net10.0
 
 COPY . .
 
 RUN dotnet publish docs/website/CodeBeam.UltimateAuth.Docs.Wasm/CodeBeam.UltimateAuth.Docs.Wasm/CodeBeam.UltimateAuth.Docs.Wasm.csproj \
-    -c Release -o /app/publish
+    -c Release -p:UltimateAuthBuildTargetFrameworks=net10.0 -o /app/publish
 
 # RUNTIME
 FROM mcr.microsoft.com/dotnet/aspnet:10.0

.docker/Dockerfile.identitylab

@@ -0,0 +1,31 @@
+# Build
+FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
+WORKDIR /src
+
+COPY . .
+
+RUN dotnet restore \
+    apps/identity-lab/CodeBeam.UltimateAuth.IdentityLab/CodeBeam.UltimateAuth.IdentityLab.csproj \
+    -p:UltimateAuthBuildTargetFrameworks=net10.0
+
+RUN dotnet publish \
+    apps/identity-lab/CodeBeam.UltimateAuth.IdentityLab/CodeBeam.UltimateAuth.IdentityLab.csproj \
+    -c Release \
+    -p:UltimateAuthBuildTargetFrameworks=net10.0 \
+    --no-restore \
+    -o /app/publish
+
+# Runtime
+FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtime
+WORKDIR /app
+
+ENV ASPNETCORE_HTTP_PORTS=8080
+ENV ASPNETCORE_ENVIRONMENT=Production
+
+COPY --from=build /app/publish .
+
+EXPOSE 8080
+
+USER $APP_UID
+
+ENTRYPOINT ["dotnet", "CodeBeam.UltimateAuth.IdentityLab.dll"]

.docker/docker-compose.identitylab.yml

@@ -0,0 +1,41 @@
+services:
+  identitylab:
+    image: ${IDENTITYLAB_IMAGE:?Identity Lab image is required}
+    container_name: identitylab
+    restart: unless-stopped
+
+    environment:
+      ASPNETCORE_ENVIRONMENT: Production
+      ASPNETCORE_HTTP_PORTS: "8080"
+
+      ReverseProxy__KnownProxy: ${CADDY_PROXY_IP:?Caddy proxy IP is required}
+      ConnectionStrings__IdentityLab: ${IDENTITYLAB_CONNECTION_STRING:?Connection string is required}
+
+      LabAdmin__Username: ${LAB_ADMIN_USERNAME:?Admin username is required}
+      LabAdmin__Email: ${LAB_ADMIN_EMAIL:?Admin email is required}
+      LabAdmin__Password: ${LAB_ADMIN_PASSWORD:?Admin password is required}
+
+      DataProtection__KeysPath: /app/keys
+
+    volumes:
+      - /opt/identitylab/keys:/app/keys:Z
+
+    networks:
+      - edge
+      - postgres-internal
+
+    security_opt:
+      - no-new-privileges:true
+
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+networks:
+  edge:
+    external: true
+
+  postgres-internal:
+    external: true

.github/workflows/deploy.yml

@@ -1,49 +1,90 @@
-name: Deploy UltimateAuth
+name: Docs Site
 
 on:
+  pull_request:
   push:
     branches:
       - master
   workflow_dispatch:
 
 concurrency:
-  group: ultimateauth-deploy
+  # PR updates may cancel their own validation, never a production deployment.
+  group: ${{ github.event_name == 'pull_request' && format('docs-site-pr-{0}', github.event.pull_request.number) || 'ultimateauth-deploy' }}
   cancel-in-progress: true
 
 permissions:
   contents: read
   packages: write
 
 jobs:
-  build-and-deploy:
+  changes:
+    name: Changes
+    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      site: ${{ steps.filter.outputs.site }}
+    steps:
+      - name: Detect changed files
+        id: filter
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            site:
+              - 'docs/**'
+              - 'src/utilities/CodeBeam.UltimateAuth.DocsBuilder/**'
+              - 'Directory.Build.props'
+              - 'Directory.Build.targets'
+              - 'Directory.Packages.props'
+              - 'global.json'
+              - 'NuGet.Config'
+              - 'nuget.config'
+              - '.dockerignore'
+              - '.docker/Dockerfile'
+              - '.docker/docker-compose.yml'
+              - '.github/workflows/deploy.yml'
 
+  build:
+    name: Docker Build
+    needs: changes
+    # Master and manual builds do not depend on a PR-only detector succeeding.
+    if: >-
+      !cancelled() &&
+      (github.event_name != 'pull_request' ||
+       (needs.changes.result == 'success' && needs.changes.outputs.site == 'true'))
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-
       - name: Login to GitHub Container Registry
+        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/master'
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Setup Docker Buildx
         uses: docker/setup-buildx-action@v3
-
       - name: Build and push image
         uses: docker/build-push-action@v6
         with:
           context: .
           file: .docker/Dockerfile
-          push: true
+          push: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/master' }}
           tags: |
             ghcr.io/codebeamorg/ultimateauth:master
             ghcr.io/codebeamorg/ultimateauth:${{ github.sha }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+  deploy:
+    name: Deploy
+    needs: build
+    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    steps:
       - name: Deploy to Server
         uses: appleboy/ssh-action@v1.0.3
         with:

.github/workflows/identitylab-image.yml

@@ -0,0 +1,123 @@
+name: Identity Lab
+
+on:
+  pull_request:
+  push:
+    branches:
+      - lab
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  # PR validation cannot block or replace a production deployment run.
+  group: ${{ github.event_name == 'pull_request' && format('identitylab-pr-{0}', github.event.pull_request.number) || 'identitylab-deploy' }}
+  cancel-in-progress: false
+
+jobs:
+  changes:
+    name: Changes
+    if: github.event_name != 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      image: ${{ steps.filter.outputs.image }}
+    steps:
+      - name: Checkout for push comparison
+        if: github.event_name != 'pull_request'
+        uses: actions/checkout@v4
+      - name: Detect changed files
+        id: filter
+        uses: dorny/paths-filter@v3
+        with:
+          base: ${{ github.ref }}
+          filters: |
+            image:
+              - 'apps/identity-lab/**'
+              - 'src/**'
+              - 'samples/**'
+              - 'Directory.Build.props'
+              - 'Directory.Build.targets'
+              - 'Directory.Packages.props'
+              - 'global.json'
+              - 'NuGet.Config'
+              - 'nuget.config'
+              - '.dockerignore'
+              - '.docker/Dockerfile.identitylab'
+              - '.docker/docker-compose.identitylab.yml'
+              - '.github/workflows/identitylab-image.yml'
+
+  build:
+    name: Docker Build
+    needs: changes
+    # Manual image builds must also run when the PR/push detector is skipped.
+    if: >-
+      !cancelled() &&
+      (github.event_name == 'workflow_dispatch' ||
+       (needs.changes.result == 'success' && needs.changes.outputs.image == 'true'))
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Log in to GHCR
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push Identity Lab
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: .docker/Dockerfile.identitylab
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ghcr.io/codebeamorg/ultimateauth-identitylab:${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  deploy:
+    name: Deploy
+    needs: build
+    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/lab'
+    runs-on: ubuntu-latest
+    environment: identitylab
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Upload Identity Lab Compose
+        uses: appleboy/scp-action@v1
+        with:
+          host: ${{ secrets.SERVER_HOST }}
+          username: ${{ secrets.SERVER_USER }}
+          key: ${{ secrets.SSH_PRIVATE_KEY }}
+          source: ".docker/docker-compose.identitylab.yml"
+          target: "/home/deploy/.identitylab-deploy/${{ github.sha }}"
+          strip_components: 1
+
+      - name: Deploy Identity Lab
+        uses: appleboy/ssh-action@v1.0.3
+        env:
+          IMAGE_TAG: ghcr.io/codebeamorg/ultimateauth-identitylab:${{ github.sha }}
+        with:
+          host: ${{ secrets.SERVER_HOST }}
+          username: ${{ secrets.SERVER_USER }}
+          key: ${{ secrets.SSH_PRIVATE_KEY }}
+          envs: IMAGE_TAG
+          command_timeout: 10m
+          script: |
+            SHA="${IMAGE_TAG##*:}"
+            COMPOSE_SOURCE="/home/deploy/.identitylab-deploy/$SHA/docker-compose.identitylab.yml"
+
+            sudo -n /usr/local/sbin/deploy-identitylab \
+              "$IMAGE_TAG" "$COMPOSE_SOURCE"
+
+            rm -rf -- "/home/deploy/.identitylab-deploy/$SHA"

.github/workflows/javascript-tests.yml

@@ -0,0 +1,50 @@
+name: JS Client
+
+on:
+  pull_request:
+  push:
+    branches:
+      - dev
+      - master
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    name: Changes
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      javascript: ${{ steps.filter.outputs.javascript }}
+    steps:
+      - name: Checkout for push comparison
+        if: github.event_name != 'pull_request'
+        uses: actions/checkout@v4
+      - name: Detect changed files
+        id: filter
+        uses: dorny/paths-filter@v3
+        with:
+          base: ${{ github.ref }}
+          filters: |
+            javascript:
+              - 'src/client/CodeBeam.UltimateAuth.Client.Blazor/TScripts/**'
+              - 'tests/CodeBeam.UltimateAuth.Tests.Unit/javascript/**'
+              - '.github/workflows/javascript-tests.yml'
+
+  tests:
+    name: Tests
+    needs: changes
+    if: needs.changes.outputs.javascript == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - name: Run JavaScript tests
+        run: node --test tests/CodeBeam.UltimateAuth.Tests.Unit/javascript/*.test.cjs