chore(deps-dev): bump @faker-js/faker from 9.9.0 to 10.5.0

.github/workflows/cs-iam-login.yml

@@ -0,0 +1,82 @@
+name: 🐳 CS-IAM Login Image
+
+# BAUER GROUP fork build: publishes the branded Zitadel Login v2 image to GHCR.
+# Upstream zitadel workflows stay disabled (Actions UI); this is our pipeline.
+# Self-contained build (docker/build-push-action) — robust in a public fork.
+# Production = release line (push); feature/*** PRs are validated build-only.
+
+on:
+  push:
+    branches: [production]
+    paths:
+      - "apps/login/**"
+      - "packages/**"
+      - "proto/**"
+      - "cs-iam-login.Dockerfile"
+      - "cs-iam-login.Dockerfile.dockerignore"
+      - "cs-iam-login.base-version"
+      - "pnpm-lock.yaml"
+      - ".github/workflows/cs-iam-login.yml"
+  pull_request:
+    branches: [production]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: cs-iam-login-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: 🐳 Build & Push login
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Resolve image version
+        id: ver
+        run: |
+          set -euo pipefail
+          V="$(tr -d '[:space:]' < cs-iam-login.base-version)"
+          V="${V#v}" # tag the image with the numeric upstream version (no leading v)
+          echo "version=$V" >> "$GITHUB_OUTPUT"
+          echo "::notice::Building login image version $V"
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Image metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/bauer-group/ep-zitadel/zitadel-login
+          tags: |
+            type=raw,value=${{ steps.ver.outputs.version }}
+            type=raw,value=stable
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=sha
+
+      - name: Build & push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./cs-iam-login.Dockerfile
+          platforms: linux/amd64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/lint_test_build.yml

@@ -55,23 +55,13 @@ jobs:
         run: pnpm install --frozen-lockfile
       - name: Set SHAs for nx affected commands
         uses: nrwl/nx-set-shas@v4
-      # The Depot runner image points /etc/resolv.conf directly at public DNS (8.8.8.8),
-      # bypassing the systemd-resolved stub, so *.integration.localhost (synthesized by
-      # systemd-resolved) no longer resolves and all API integration tests hang.
-      # Route DNS back through the stub until the image is fixed or the tests stop
-      # depending on wildcard localhost DNS.
-      - name: Restore systemd-resolved stub for *.localhost resolution
-        run: |
-          set -ex
-          test -e /run/systemd/resolve/stub-resolv.conf
-          sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
-          getent hosts foo.integration.localhost
       - name: Lint, Test and Build
         env:
           NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }}
+          #          NX_NATIVE_LOGGING: "nx::native::cache,nx::native::db"
           NX_DAEMON: "false"
           NX_DISABLE_DB: "true"
-        run: pnpm nx affected --nxBail --targets test build --exclude @zitadel/docs
+        run: pnpm nx affected --nxBail --targets lint test build --exclude @zitadel/docs
       - name: Check for uncommitted changes (Codegen mismatch)
         run: git diff --exit-code
       - name: Suggest Pipeline Fix By Nx Cloud AI

.github/workflows/pack.yml

@@ -40,7 +40,7 @@ jobs:
       semantic_version: ${{ inputs.semantic_version }}
       dry_run: true
 
-  pack-archives:
+  pack:
     runs-on:
       group: zitadel-public
     environment: ${{ github.ref_protected == 'true' && 'Protected' || null }}
@@ -67,6 +67,10 @@ jobs:
         with:
           node-version: ${{ inputs.node_version }}
           cache: "pnpm"
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: v0.28.0
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
       - name: Pack API and Login
@@ -84,59 +88,11 @@ jobs:
         with:
           name: zitadel-archives
           path: .artifacts/pack
-
-  docker:
-    runs-on:
-      group: zitadel-public
-    environment: ${{ github.ref_protected == 'true' && 'Protected' || null }}
-    needs: [version, pack-archives]
-    permissions:
-      contents: read
-      packages: write
-    strategy:
-      matrix:
-        include:
-          - gofips140: "off"
-            tag_suffix: ""
-            push_ghcr: true
-          - gofips140: "certified"
-            tag_suffix: "-fips"
-            push_ghcr: false
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          filter: tree:0
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: go.mod
-      - name: Set up pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          run_install: false
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ inputs.node_version }}
-          cache: "pnpm"
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Linux API binaries
-        env:
-          ZITADEL_GOFIPS140: ${{ matrix.gofips140 }}
-          ZITADEL_VERSION: ${{ needs.version.outputs.version }}
-          NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }}
-        run: pnpm nx run-many --nxBail -p @zitadel/api -t pack-linux-amd64,pack-linux-arm64
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-        with:
-          version: v0.28.0
       - name: Login to Docker registry
-        if: matrix.push_ghcr
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -148,36 +104,24 @@ jobs:
           registry: europe-docker.pkg.dev
           username: _json_key_base64
           password: ${{ secrets.GCR_JSON_KEY_BASE64 }}
-      - name: Set API image names
-        id: api-images
-        run: |
-          if [ "${{ matrix.push_ghcr }}" = "true" ]; then
-            {
-              echo "${{ inputs.image_name_github_api }}"
-              echo "${{ inputs.image_name_google_api }}"
-            } > api-images.txt
-          else
-            echo "${{ inputs.image_name_google_api }}" > api-images.txt
-          fi
-          echo "list<<EOF" >> "$GITHUB_OUTPUT"
-          cat api-images.txt >> "$GITHUB_OUTPUT"
-          echo "EOF" >> "$GITHUB_OUTPUT"
       - name: Generate Standard Tags and Labels from the GitHub Context for the API Scratch Container Image
         id: scratch-meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ steps.api-images.outputs.list }}
+          images: |
+            ${{ inputs.image_name_github_api }}
+            ${{ inputs.image_name_google_api }}
           labels: ${{ env.default_labels}}
           tags: |
-            type=sha,prefix=,suffix=${{ matrix.tag_suffix }},format=long
+            type=sha,prefix=,suffix=,format=long
       - name: Build and Push the SHA-tagged API Scratch Container Image
         id: build-scratch
         uses: docker/build-push-action@v6
         timeout-minutes: 3
         with:
           context: .
-          cache-from: type=gha,scope=api-scratch-${{ matrix.gofips140 }}
-          cache-to: type=gha,mode=max,scope=api-scratch-${{ matrix.gofips140 }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
           file: apps/api/Dockerfile
           target: final
           platforms: linux/amd64,linux/arm64
@@ -188,45 +132,28 @@ jobs:
         id: debug-meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ steps.api-images.outputs.list }}
+          images: |
+            ${{ inputs.image_name_github_api }}
+            ${{ inputs.image_name_google_api }}
           labels: ${{ env.default_labels}}
           tags: |
-            type=sha,prefix=,suffix=${{ matrix.tag_suffix }}-debug,format=long
+            type=sha,prefix=,suffix=-debug,format=long
       - name: Build and Push the SHA-tagged API Debug Container Image
-        if: matrix.push_ghcr
         id: build-debug
         uses: docker/build-push-action@v6
         timeout-minutes: 5
         with:
           context: .
-          cache-from: type=gha,scope=api-debug-${{ matrix.gofips140 }}
-          cache-to: type=gha,mode=max,scope=api-debug-${{ matrix.gofips140 }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
           file: apps/api/Dockerfile
           target: builder
           platforms: linux/amd64,linux/arm64
           push: true
           labels: ${{ steps.debug-meta.outputs.labels }}
           tags: ${{ steps.debug-meta.outputs.tags }}
           outputs: type=image,name=${{ inputs.image_name_github_api }},name-canonical=true
-      - name: Build and Push the SHA-tagged API Debug Container Image (GAR only)
-        if: ${{ !matrix.push_ghcr }}
-        uses: docker/build-push-action@v6
-        timeout-minutes: 5
-        with:
-          context: .
-          cache-from: type=gha,scope=api-debug-${{ matrix.gofips140 }}
-          cache-to: type=gha,mode=max,scope=api-debug-${{ matrix.gofips140 }}
-          file: apps/api/Dockerfile
-          target: builder
-          platforms: linux/amd64,linux/arm64
-          push: true
-          labels: ${{ steps.debug-meta.outputs.labels }}
-          tags: ${{ steps.debug-meta.outputs.tags }}
-      - name: Build Login standalone
-        if: matrix.push_ghcr
-        run: pnpm nx run --nxBail @zitadel/login:build
       - name: Generate Standard Tags and Labels from the GitHub Context for the Login Container Image
-        if: matrix.push_ghcr
         id: login-meta
         uses: docker/metadata-action@v5
         with:
@@ -239,42 +166,14 @@ jobs:
           tags: |
             type=sha,prefix=,suffix=,format=long
       - name: Build and Push the SHA-tagged Login Container Image
-        if: matrix.push_ghcr
         id: build-login
         uses: docker/build-push-action@v6
         timeout-minutes: 3
         with:
           context: apps/login
-          cache-from: type=gha,scope=login
-          cache-to: type=gha,mode=max,scope=login
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
           platforms: linux/amd64,linux/arm64
           push: true
           labels: ${{ steps.login-meta.outputs.labels }}
           tags: ${{ steps.login-meta.outputs.tags }}
-      - name: Build Login standalone
-        if: ${{ !matrix.push_ghcr }}
-        run: pnpm nx run --nxBail @zitadel/login:build
-      - name: Generate tags for FIPS Login image
-        if: ${{ !matrix.push_ghcr }}
-        id: login-fips-meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ inputs.image_name_google_login }}
-          labels: |
-            org.opencontainers.image.licenses=MIT
-            ${{ env.default_labels}}
-          tags: |
-            type=sha,prefix=,suffix=-fips,format=long
-      - name: Build and Push FIPS Login image (GAR only)
-        if: ${{ !matrix.push_ghcr }}
-        uses: docker/build-push-action@v6
-        timeout-minutes: 3
-        with:
-          context: apps/login
-          file: apps/login/Dockerfile.fips
-          cache-from: type=gha,scope=login-fips
-          cache-to: type=gha,mode=max,scope=login-fips
-          platforms: linux/amd64,linux/arm64
-          push: true
-          labels: ${{ steps.login-fips-meta.outputs.labels }}
-          tags: ${{ steps.login-fips-meta.outputs.tags }}

.github/workflows/release.yml

@@ -103,24 +103,15 @@ jobs:
         docker buildx imagetools create \
           --tag ${{ inputs.image_name_google_api }}:${{ needs.version.outputs.version }} \
           ${{ inputs.image_name_google_api }}:${{ github.sha }}
-        docker buildx imagetools create \
-          --tag ${{ inputs.image_name_google_api }}:${{ needs.version.outputs.version }}-fips \
-          ${{ inputs.image_name_google_api }}:${{ github.sha }}-fips
-        docker buildx imagetools create \
-          --tag ${{ inputs.image_name_google_api }}:${{ needs.version.outputs.version }}-fips-debug \
-          ${{ inputs.image_name_google_api }}:${{ github.sha }}-fips-debug
         docker buildx imagetools create \
           --tag ${{ inputs.image_name_github_login }}:${{ needs.version.outputs.version }} \
           ${{ inputs.image_name_github_login }}:${{ github.sha }}
         docker buildx imagetools create \
           --tag ${{ inputs.image_name_google_login }}:${{ needs.version.outputs.version }} \
           ${{ inputs.image_name_google_login }}:${{ github.sha }}
-        docker buildx imagetools create \
-          --tag ${{ inputs.image_name_google_login }}:${{ needs.version.outputs.version }}-fips \
-          ${{ inputs.image_name_google_login }}:${{ github.sha }}-fips
     -
       name: Publish latest
-      if: ${{ github.ref_name == 'v4.x' }}
+      if: ${{ github.ref_name == 'next' }}
       run: |
         docker buildx imagetools create \
           --tag ${{ inputs.image_name_github_api }}:latest \
@@ -131,20 +122,11 @@ jobs:
         docker buildx imagetools create \
           --tag ${{ inputs.image_name_github_login }}:latest \
           ${{ inputs.image_name_github_login }}:${{ github.sha }}
-        docker buildx imagetools create \
-          --tag ${{ inputs.image_name_google_api }}:latest-fips \
-          ${{ inputs.image_name_google_api }}:${{ github.sha }}-fips
-        docker buildx imagetools create \
-          --tag ${{ inputs.image_name_google_api }}:latest-fips-debug \
-          ${{ inputs.image_name_google_api }}:${{ github.sha }}-fips-debug
-        docker buildx imagetools create \
-          --tag ${{ inputs.image_name_google_login }}:latest-fips \
-          ${{ inputs.image_name_google_login }}:${{ github.sha }}-fips
 
   homebrew-tap:
     runs-on: ubuntu-22.04
     needs: version
-    if: needs.version.outputs.published == 'true' && github.ref_name == 'v4.x'
+    if: needs.version.outputs.published == 'true' && github.ref_name == 'next'
     continue-on-error: true
     steps:
     - name: generate token
@@ -164,7 +146,7 @@ jobs:
   helm-chart:
     runs-on: ubuntu-22.04
     needs: version
-    if: needs.version.outputs.published == 'true' && github.ref_name == 'v4.x'
+    if: needs.version.outputs.published == 'true' && github.ref_name == 'next'
     continue-on-error: true
     steps:
       - name: generate token
@@ -184,7 +166,7 @@ jobs:
   npm-packages:
     runs-on: ubuntu-latest
     needs: version
-    if: needs.version.outputs.published == 'true' && github.ref_name == 'v4.x'
+    if: needs.version.outputs.published == 'true' && github.ref_name == 'next'
     continue-on-error: true
     steps:
       - name: Checkout code