Skip to content

Commit 1f7d842

Browse files
Merge branch 'main' into DSPX-1781-use-v2-rewrap
2 parents b4e69b6 + c9d5f21 commit 1f7d842

36 files changed

+1030
-100
lines changed
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
{
2-
".": "0.4.0"
2+
".": "0.5.0"
33
}
Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
name: "Update protos"
2+
3+
on:
4+
schedule:
5+
- cron: "17 0 * * *" # Runs daily at 00:17 UTC
6+
7+
workflow_call:
8+
inputs:
9+
tag:
10+
required: true
11+
type: string
12+
workflow_dispatch:
13+
inputs:
14+
tag:
15+
description: "The new tag for targeting the RPC protocol buffers."
16+
required: true
17+
default: "protocol/go/v0.13.0"
18+
19+
jobs:
20+
update-platform-protos:
21+
runs-on: ubuntu-latest
22+
permissions:
23+
contents: write
24+
pull-requests: write
25+
actions: read
26+
27+
steps:
28+
- name: Checkout web-sdk repository
29+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5
30+
with:
31+
path: web-sdk
32+
persist-credentials: true
33+
34+
- name: Set up GitHub CLI as Actions bot
35+
env:
36+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
37+
run: |
38+
gh auth setup-git
39+
git config --global user.name "github-actions[bot]"
40+
git config --global user.email "github-actions[bot]@users.noreply.github.com"
41+
42+
- name: Fetch latest semver tag for protocol/go
43+
id: fetch-latest-tag
44+
run: |
45+
if [ -z "${{ github.event.inputs.tag }}" ]; then
46+
LATEST_TAG=$(git ls-remote --tags https://github.com/opentdf/platform.git | \
47+
grep "refs/tags/protocol/go" | \
48+
sed 's|.*/||' | \
49+
sort -V | \
50+
tail -n1)
51+
echo "LATEST_TAG=protocol/go/$LATEST_TAG" >> "$GITHUB_ENV"
52+
else
53+
echo "LATEST_TAG=${{ github.event.inputs.tag }}" >> "$GITHUB_ENV"
54+
fi
55+
56+
- name: Check if update is needed
57+
working-directory: ./web-sdk
58+
id: check-update
59+
run: |
60+
CURRENT_TAG=$(jq -r '.["tag"]' lib/platform-proto-version.json)
61+
if [ "$CURRENT_TAG" = "$LATEST_TAG" ]; then
62+
echo "Platform branch is already up-to-date."
63+
echo "no_updates=true" >> "$GITHUB_OUTPUT"
64+
exit 0
65+
fi
66+
echo "CURRENT_TAG=$CURRENT_TAG" >> "$GITHUB_ENV"
67+
68+
- name: Check for existing PR
69+
if: steps.check-update.outputs.no_updates != 'true'
70+
id: check-pr
71+
working-directory: ./web-sdk
72+
run: |
73+
EXISTING_PR=$(gh pr list --head update-platform-protos --json number --jq '.[0].number')
74+
if [ -n "$EXISTING_PR" ]; then
75+
echo "EXISTING_PR=$EXISTING_PR" >> "$GITHUB_OUTPUT"
76+
fi
77+
env:
78+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
79+
80+
- name: Check out existing PR
81+
working-directory: ./web-sdk
82+
if: steps.check-pr.outputs.EXISTING_PR != '' && steps.check-update.outputs.no_updates != 'true'
83+
run: |
84+
git fetch origin update-platform-protos:update-platform-protos
85+
git checkout update-platform-protos
86+
87+
- name: Clone platform repo at protocol/go tag
88+
if: steps.check-update.outputs.no_updates != 'true'
89+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5
90+
with:
91+
path: platform
92+
repository: opentdf/platform
93+
ref: ${{ env.LATEST_TAG }}
94+
persist-credentials: true
95+
96+
- uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 #v5.0.0
97+
if: steps.check-update.outputs.no_updates != 'true'
98+
with:
99+
node-version: '22'
100+
cache: 'npm'
101+
cache-dependency-path: './web-sdk/lib/package-lock.json'
102+
103+
- name: Regen pb files
104+
id: update-platform-protos
105+
if: steps.check-update.outputs.no_updates != 'true'
106+
working-directory: ./web-sdk/lib
107+
run: |
108+
npm ci
109+
cd ..
110+
./scripts/platform.sh
111+
TAG_COMMIT=$(gh api repos/opentdf/platform/git/ref/tags/$LATEST_TAG --jq '.object.sha')
112+
jq --arg tag "$LATEST_TAG" '.["tag"] = $tag' lib/platform-proto-version.json > lib/platform-proto-version.tmp.json
113+
jq --arg commit "$TAG_COMMIT" '.["commit"] = $commit' lib/platform-proto-version.tmp.json > lib/platform-proto-version.json
114+
rm lib/platform-proto-version.tmp.json
115+
# Check for changes after regeneration
116+
if [ -z "$(git status --porcelain)" ]; then
117+
echo "No changes detected after regeneration."
118+
else
119+
echo "Changes detected after regeneration"
120+
echo "changes=true" >> "$GITHUB_OUTPUT"
121+
fi
122+
env:
123+
PLATFORM_SRC: ../platform/service
124+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
125+
126+
- name: Create new branch
127+
working-directory: ./web-sdk
128+
if: steps.check-pr.outputs.EXISTING_PR == '' && steps.update-platform-protos.outputs.changes == 'true'
129+
run: |
130+
git checkout -b $BRANCH_NAME
131+
git push origin $BRANCH_NAME
132+
env:
133+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
134+
BRANCH_NAME: update-platform-protos
135+
136+
- name: Update files
137+
working-directory: ./web-sdk
138+
if: steps.update-platform-protos.outputs.changes == 'true'
139+
run: |
140+
echo "Committing changes..."
141+
FILES_CHANGED=$(git status --porcelain | awk '{print $2}')
142+
for file in $FILES_CHANGED; do
143+
echo "Committing file: $file"
144+
145+
CONTENT=$(base64 -i $file)
146+
FILENAME=$(basename $file)
147+
MESSAGE="Update $FILENAME to match platform tag $LATEST_TAG"
148+
149+
SHA=$( git rev-parse $BRANCH_NAME:$file 2>/dev/null | grep -E '^[0-9a-f]{40}$' || echo "" )
150+
if [ -z "$SHA" ]; then
151+
SHA=""
152+
fi
153+
154+
gh api --method PUT /repos/opentdf/web-sdk/contents/$file \
155+
--field message="$MESSAGE" \
156+
--field content="$CONTENT" \
157+
--field encoding="base64" \
158+
--field branch="$BRANCH_NAME" \
159+
--field sha="$SHA"
160+
done
161+
env:
162+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
163+
BRANCH_NAME: update-platform-protos
164+
165+
- name: Create New PR
166+
working-directory: ./web-sdk
167+
if: steps.check-pr.outputs.EXISTING_PR == '' && steps.update-platform-protos.outputs.changes == 'true'
168+
env:
169+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
170+
run: |
171+
RELEASE_NOTES=$(gh release view $LATEST_TAG --repo opentdf/platform --json body --jq '.body')
172+
cat <<EOF > pr_body.txt
173+
This PR regenerates the platform pb files based on tag: $LATEST_TAG. It also updates the lib/platform-proto-version.json file to reflect the new tag and commit.
174+
175+
See the release: https://github.com/opentdf/platform/releases/tag/$LATEST_TAG
176+
177+
Release Notes:
178+
$RELEASE_NOTES
179+
EOF
180+
gh pr create \
181+
--title "fix(sdk): Updates to proto version $LATEST_TAG" \
182+
--body-file pr_body.txt \
183+
--head update-platform-protos \
184+
--base main
185+

CHANGELOG.md

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,22 @@
11
# Changelog
22

3+
## [0.5.0](https://github.com/opentdf/web-sdk/compare/sdk/v0.4.0...sdk-v0.5.0) (2025-10-17)
4+
5+
6+
### Features
7+
8+
* add system metadata assertion ([#630](https://github.com/opentdf/web-sdk/issues/630)) ([922965c](https://github.com/opentdf/web-sdk/commit/922965c25c0a63b616dc833275152c4c55148ac3))
9+
* Certificates & Obligations ([#755](https://github.com/opentdf/web-sdk/issues/755)) ([688c304](https://github.com/opentdf/web-sdk/commit/688c30490e21d6c2080c187f8915c3eece41251d))
10+
* Get Namespace ([#756](https://github.com/opentdf/web-sdk/issues/756)) ([5b8ef25](https://github.com/opentdf/web-sdk/commit/5b8ef2518f16fbb69cb1d7b5e0297eb87f8e076c))
11+
* **sdk:** initial obligations support in rewrap flow ([#748](https://github.com/opentdf/web-sdk/issues/748)) ([0361361](https://github.com/opentdf/web-sdk/commit/03613617974982fe39cc7ac1362a17f843a40e63))
12+
13+
14+
### Bug Fixes
15+
16+
* `signingKey` should not be part of the computed hash ([#696](https://github.com/opentdf/web-sdk/issues/696)) ([b763278](https://github.com/opentdf/web-sdk/commit/b7632783b17413393db3ff2ac49a2ad9201ed8ef))
17+
* **sdk:** Fix new API not setting nano attributes ([#679](https://github.com/opentdf/web-sdk/issues/679)) ([f0d9719](https://github.com/opentdf/web-sdk/commit/f0d97196ab258122fe9a07b7d7895017299a46c2))
18+
* SEC-4653 prevent ReDoS vulnerability in HTML payload unwrapping regex ([#686](https://github.com/opentdf/web-sdk/issues/686)) ([09d0360](https://github.com/opentdf/web-sdk/commit/09d036055a4eea621d182f04b706fae6dc78c195))
19+
320
## [0.4.0](https://github.com/opentdf/web-sdk/compare/v0.3.2...v0.4.0) (2025-06-26)
421

522

Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11

22
# x-release-please-start-version
3-
version=0.4.0
3+
version=0.5.0
44
# x-release-please-end
55
extras=cli web-app
66
pkgs=lib $(extras)

cli/package-lock.json

Lines changed: 24 additions & 24 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

cli/package.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@opentdf/ctl",
3-
"version": "0.4.0",
3+
"version": "0.5.0",
44
"description": "Node based CLI for opentdf",
55
"repository": {
66
"type": "git",
@@ -51,7 +51,7 @@
5151
"typescript-eslint": "^8.26.0"
5252
},
5353
"dependencies": {
54-
"@opentdf/sdk": "file:../lib/opentdf-sdk-0.4.0.tgz",
54+
"@opentdf/sdk": "file:../lib/opentdf-sdk-0.5.0.tgz",
5555
"yargs": "^17.7.2"
5656
}
5757
}

lib/package-lock.json

Lines changed: 4 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

lib/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@opentdf/sdk",
3-
"version": "0.4.0",
3+
"version": "0.5.0",
44
"description": "OpenTDF for the Web",
55
"homepage": "https://github.com/opentdf/web-sdk",
66
"bugs": {

lib/platform-proto-version.json

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
{
2+
"tag": "",
3+
"commit": ""
4+
}

0 commit comments

Comments
 (0)