Repository navigation
Sync master with upstream gravitational/teleport - #11
Merged
Merged
Conversation
* Add ARM Network dependency * Deduplicate scale set names * make go-mod-tidy-all * Add ListAll and address feedback * Limit resource group for scale sets * Add RG check * case-insensitive sub id check
* join: initial tests to support Github scoped join method * proto: add Github to ScopedTokenSpec proto * proto: generate joining.v1.Github * join: normalize GitHub method behind the provision.Token interface This captures that the change adds the getter across the interface layers (types.ProvisionToken, provision.Token, scoped adapter), the validation, and the round-trip/ equivalence tests * join: use interface in lib/join/githubactions instead of literal token type This allows `CheckGithubIDToken` to work with both scoped and non-scoped tokens. * join: add test for Bot with Github scoped token * join: refactor Bot test for bound_keypair to use new helper * join: explicitly disallow single_use tokens on scoped github join method Because delegated OIDC joins do not consume them, allowing unintended unlimited reuse. Proper enforcement requires a separate common Join service change. * lint: exclude lib/join/jointest from "testing/testify" linter rules This is a helper-test package: It can't be `_test` because it needs to be imported by other tests, and it needs the testing/testify package to fulfill its purpose. * tests: add negative bot join test case * Remove testing packages from jointest This removes any testing packages reference from the jointest package, which will instead return errors for the caller to verify. This ensures that no test symbol is leaked into this package. * Revert "Remove testing packages from jointest" This reverts commit ca29de6. * Move new helpers from jointest down to the `join` pkg This moves the new helpers added to `joingtest` to the same package where they are being called (`join`). There's the potential for these helpers to be reused, but we can move them around when/if we get there. * Fix tests the diverged in master and remove jointest exceptions from the golangci.yaml
* MWI: Scope Namespace Bot Instances (2/2) - tctl (gravitational#68391) * Fix up tctl rendering Squash of: - Fix up tctl rendering - tidier * fix up * handle `tctl get bot_instance/scope::bot' form with clear error * address timr feedback * address hugo feedback on consistency * regenerate tctl mdx
* Added pagination to S3 buckets * Added pagination to s3 buckets * discovery: Stop looking up S3 bucket region when we already have it Stop looking up the bucket region as a separate API call during S3 bucket discovery and use what ListS3Buckets returns instead. Since pagination was added with the MaxRequests input parameter, AWS returns the bucket region in the ListS3Buckets result. This means we do not have to look it up separately any more. We still do look up a bucket region if none is returned, but it is not expected that it will be used. This is a safety fallback in case the AWS API has cases where it does not return it, as the result is technically optional. While we're here, rework the region fetching to be a little more straight-forward - the returned closure for looking up region was not really necessary and just made things a more complicated than needed. Also change the lookup of existing buckets for failure handling to use a map as the pagination changes mean we can get a lot more buckets back and the linear slice scan ends up being n^2 complexity. Update and rework the tests for these changes - some parts of this code did not have coverage so the parts that were reworked now have coverage. --------- Co-authored-by: Kenneth Tran <kenneth.tran@goteleport.com>
* Add new CIR fields to audit events * Improve clarity
…tational#68048) * Add support for Linux desktop labels and logins in role editor * test fix
Because of a bug in remark-includes (gravitational/docs-website#650), a partial that begins with partial inclusion syntax does not render the nested partial. This change adds a placeholder line, following the conventions of other partials, to allow three nested partials to render. Since the placeholder line has the same wording across the docs, once we fix the bug, it will be straightforward to remove.
The IdentifierFromPath and IdentifierPolicy functions no longer rely on positional arguments to improve type safety. Path inputs are now combined into a single struct with named fields to better catch mistakes. Return types from IdentifierPolicy functions are now a single struct with named fields instead of returning multiple strings.
…tational#69206) * Fix missing prerequisite for Teleport user in CA Override doc. Signed-off-by: Chris Thach <chris.thach@goteleport.com> * Apply suggestions from code review Co-authored-by: Alan Parra <12500300+codingllama@users.noreply.github.com> * Add new lines between list items to make lint happy. Signed-off-by: Chris Thach <chris.thach@goteleport.com> --------- Signed-off-by: Chris Thach <chris.thach@goteleport.com> Co-authored-by: Alan Parra <12500300+codingllama@users.noreply.github.com>
…nal#69126) * Support scope filtering/watching for scoped bot instances * tidy * Handle unhealthy state more consistently * Fix up use of t.Context()
- Add deatils about SQNs - Ensures resources are referenced by SQNs - Updates IaC section to cover additional scoped resources. - Fixes a reference to a scoped token with a ~ separator - Add acl users to supported commands - Fix workload_identity permissions
* Move SQLite files into a SQLite subfolder * Add a debug-only user defaults store * Add a client for retrieving the device serial number In debug builds, the serial number is not available (because it's only available through MDM managed configs) so we fake it by reaching into the debug user defaults and storing something there. * Add a debug settings view This is where we can noodle/iterate on settings that only affect debug build behaviors. * Resolve some Xcode 27 warnings * Remove code signing from intermediate build products, deferring them to the final build * Update FakeSerialNumberGenerator doc comment (and change it to an enum)
gravitational#69132) * Extend WorkloadIdentity resource Watch/List to support scope filtering * Fix up codex's complaints * fix incorrect usage of t.Context() * Use correct t.Context90
…ce RBAC to the scopes doc (gravitational#69114)
* Make helm unit tests use hard-coded version to avoid updating snapshots with each release. * Remove helm unittests after version update * Used v99 for tests
…ravitational#69207) * Added unhealthyPodEvictionPolicy to teleport-kube-agent helm chart * updated docs * Fixed wording of docs * fix code review findings * Enabled unhealthyPodEvictionPolicy in 1.27, since it's on by default in beta * replaced forceUnhealthyPodEvictionPolicy with empty value for unhealthyPodEvictionPolicy * Test custom value in 1.26 * Added auto value to unhealthyPodEvictionPolicy * docs update * Removed auto value and support for unhealthyPodEvictionPolicy in k8s <1.27 * updated helm docs * Replaced failure with warning for k8s <1.27 * fixed missing newline * Corrected docs * fixed doc lint issues
…tional#69298) Signed-off-by: Chris Thach <chris.thach@goteleport.com>
…69095) * SKILL: add Azure management groups to discovery skill * do not default to tenant
…ravitational#68961) * feat(Discovery): add Organization support to AWS Discover enrollment * validate included org units is non-empty * update placeholders
* Remove unused acl_command.go * Remove duplication Duplication was kept to prevent enterprise breakage while moving things around
) Export-Source-Commit: 737cdd8
Export-Source-Commit: 8bb674e
Export-Source-Commit: 2b5afd7
…tional#291) Export-Source-Commit: c70a7c5
Export-Source-Commit: 559c880
Export-Source-Commit: 6a8da4b
Export-Source-Commit: 7d8e4ce
…ravitational#287) Export-Source-Commit: b083e8b
…leport Cloud (gravitational#355) Export-Source-Commit: e08bb06
Export-Source-Commit: 1fe740d
Export-Source-Commit: 4962fdf
Export-Source-Commit: 2aca109
…l#68647 (gravitational#239) Export-Source-Commit: 567efff
Export-Source-Commit: 1aff8ca
Export-Source-Commit: d5c3974
Export-Source-Commit: bdc56d9
Export-Source-Commit: 3951436
Export-Source-Commit: 9828625
Export-Source-Commit: 95a13d6
Export-Source-Commit: 047da44
Export-Source-Commit: cd5f6af
Export-Source-Commit: 64bc963
Resets master's tree to upstream master (1283425) and discards the three switchon commits that lived only on master: ad311d9 changed theme db7dbef fix landing page, theme 86eff27 show only the node's linux user in the login list All three have counterparts on v18.10.0-switchon, which is the branch we actually build and deploy. Backup of the old master tip is preserved at origin/master-backup-20260928. Uses `merge -s ours` so origin/master stays an ancestor and the ruleset's pull-request requirement is satisfied without a force-push. Clears 49 of the 160 open Dependabot alerts. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
rachita-17
had a problem deploying
to
docs-amplify
September 28, 2026 12:36 — with 
GitHub Actions
Failure
GitHub Actions
Failure
ayushxbisht
approved these changes
Sep 28, 2026
This was referenced Sep 28, 2026
This branch had an error being deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Resets
master's tree to upstreamgravitational/teleportmaster (1283425b60, 2026-08-25) and discards the three switchon-only commits that lived onmaster.Why
masterhad drifted 347 commits behind upstream while carrying 3 local commits. That drift is what Dependabot scans, since alerts are computed from the default branch. Bringing the tree to upstream parity clears 49 of the 160 open alerts.The work in the discarded commits already exists on
v18.10.0-switchon— the branch we actually build and deploy — adapted to the v18 codebase:ad311d904achanged theme62ada1ae0bdb7dbefa8bfix landing page, theme29b463ad6486eff276d2node linux user in login listeef21a62c7How
git merge -s ours origin/masterfrom a branch atupstream/master. The resulting tree is byte-identical to upstream master (git diff upstream/master HEADis empty), whileorigin/masterremains an ancestor — so this merges through thepull_requestrule without needing a force-push or a ruleset bypass.Safety
Old
mastertip is preserved atorigin/master-backup-20260928(86eff276d2).Not covered
111 alerts survive this sync because upstream itself is still on the vulnerable versions — mostly grpc (39) and otel (45) across 13
go.modfiles. Upstream's last commit predates most of those advisories. Those need explicit bumps on top of upstream, tracked separately.🤖 Generated with Claude Code