Merge branch 'master' into feature/sm-billing

2025-12-17 08:43:33 +00:00 · 2023-06-23 14:27:37 +10:00
parent 86ccff78cb d10741e994
commit 49b6519176
20 changed files with 77 additions and 76 deletions
--- a/.github/workflows/brew-bump-cli.yml
+++ b/.github/workflows/brew-bump-cli.yml
@@ -23,7 +23,7 @@ jobs:

      - name: Retrieve secrets
        id: retrieve-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "brew-bump-workflow-pat"
--- a/.github/workflows/brew-bump-desktop.yml
+++ b/.github/workflows/brew-bump-desktop.yml
@@ -23,7 +23,7 @@ jobs:

      - name: Retrieve secrets
        id: retrieve-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "brew-bump-workflow-pat"
--- a/.github/workflows/build-browser.yml
+++ b/.github/workflows/build-browser.yml
@@ -354,7 +354,7 @@ jobs:

      - name: Retrieve secrets
        id: retrieve-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "crowdin-api-token"
@@ -416,7 +416,7 @@ jobs:
      - name: Retrieve secrets
        id: retrieve-secrets
        if: failure()
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "devops-alerts-slack-webhook-url"
--- a/.github/workflows/build-cli.yml
+++ b/.github/workflows/build-cli.yml
@@ -404,7 +404,7 @@ jobs:
      - name: Retrieve secrets
        id: retrieve-secrets
        if: failure()
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "devops-alerts-slack-webhook-url"
--- a/.github/workflows/build-desktop.yml
+++ b/.github/workflows/build-desktop.yml
@@ -277,7 +277,7 @@ jobs:
          node-gyp install $(node -v)

      - name: Install AST
-        uses: bitwarden/gh-actions/install-ast@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/install-ast@37ffa14164a7308bc273829edfe75c97cd562375

      - name: Set up environmentF
        run: choco install checksum --no-progress
@@ -302,7 +302,7 @@ jobs:

      - name: Retrieve secrets
        id: retrieve-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "code-signing-vault-url,
@@ -1190,7 +1190,7 @@ jobs:

      - name: Retrieve secrets
        id: retrieve-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "crowdin-api-token"
@@ -1269,7 +1269,7 @@ jobs:
      - name: Retrieve secrets
        id: retrieve-secrets
        if: failure()
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "devops-alerts-slack-webhook-url"
--- a/.github/workflows/build-web.yml
+++ b/.github/workflows/build-web.yml
@@ -235,7 +235,7 @@ jobs:

      - name: Retrieve github PAT secrets
        id: retrieve-secret-pat
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "github-pat-bitwarden-devops-bot-repo-scope"
@@ -243,7 +243,7 @@ jobs:
      - name: Setup DCT
        if: ${{ env.is_publish_branch == 'true' }}
        id: setup-dct
-        uses: bitwarden/gh-actions/setup-docker-trust@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/setup-docker-trust@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          azure-creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
          azure-keyvault-name: "bitwarden-ci"
@@ -291,7 +291,7 @@ jobs:

      - name: Retrieve secrets
        id: retrieve-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "crowdin-api-token"
@@ -352,7 +352,7 @@ jobs:
      - name: Retrieve secrets
        id: retrieve-secrets
        if: failure()
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "devops-alerts-slack-webhook-url"
--- a/.github/workflows/crowdin-pull.yml
+++ b/.github/workflows/crowdin-pull.yml
@@ -32,13 +32,13 @@ jobs:

      - name: Retrieve secrets
        id: retrieve-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "crowdin-api-token, github-gpg-private-key, github-gpg-private-key-passphrase"

      - name: Download translations
-        uses: bitwarden/gh-actions/crowdin@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/crowdin@37ffa14164a7308bc273829edfe75c97cd562375
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CROWDIN_API_TOKEN: ${{ steps.retrieve-secrets.outputs.crowdin-api-token }}
--- a/.github/workflows/deploy-eu-prod-web.yml
+++ b/.github/workflows/deploy-eu-prod-web.yml
@@ -1,8 +1,14 @@
 ---
-name: Deploy Web - EU Prod
+name: Deploy Web to EU-PRD Cloud

 on:
  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Branch name to deploy (examples: 'master', 'feature/sm')"
+        required: true
+        type: string
+        default: master

 jobs:
  azure-deploy:
@@ -18,18 +24,18 @@ jobs:

      - name: Retrieve Storage Account connection string
        id: retrieve-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@c86ced0dc8c9daeecf057a6333e6f318db9c5a2b
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: webvault-westeurope-prod
          secrets: "sa-bitwarden-web-vault-dev-key-temp"

      - name: Download latest cloud asset
-        uses: bitwarden/gh-actions/download-artifacts@850faad0cf6c02a8c0dc46eddde2363fbd6c373a
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-web.yml
          path: apps/web
          workflow_conclusion: success
-          branch: ${{ github.ref_name }}
+          branch: ${{ github.event.inputs.tag }}
          artifacts: ${{ env._WEB_ARTIFACT }}

      - name: Unzip build asset
--- a/.github/workflows/deploy-non-prod-web.yml
+++ b/.github/workflows/deploy-non-prod-web.yml
@@ -64,7 +64,7 @@ jobs:
        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2

      - name: Download latest cloud asset
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-web.yml
          path: apps/web
--- a/.github/workflows/release-browser.yml
+++ b/.github/workflows/release-browser.yml
@@ -41,7 +41,7 @@ jobs:

      - name: Check Release Version
        id: version
-        uses: bitwarden/gh-actions/release-version-check@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/release-version-check@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          release-type: ${{ github.event.inputs.release_type }}
          project-type: ts
@@ -103,7 +103,7 @@ jobs:

      - name: Download latest Release build artifacts
        if: ${{ github.event.inputs.release_type != 'Dry Run' }}
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-browser.yml
          workflow_conclusion: success
@@ -116,7 +116,7 @@ jobs:

      - name: Dry Run - Download latest master build artifacts
        if: ${{ github.event.inputs.release_type == 'Dry Run' }}
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-browser.yml
          workflow_conclusion: success
--- a/.github/workflows/release-cli.yml
+++ b/.github/workflows/release-cli.yml
@@ -57,7 +57,7 @@ jobs:

      - name: Check Release Version
        id: version
-        uses: bitwarden/gh-actions/release-version-check@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/release-version-check@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          release-type: ${{ github.event.inputs.release_type }}
          project-type: ts
@@ -78,7 +78,7 @@ jobs:

      - name: Download all Release artifacts
        if: ${{ github.event.inputs.release_type != 'Dry Run' }}
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-cli.yml
          path: apps/cli
@@ -87,7 +87,7 @@ jobs:

      - name: Dry Run - Download all artifacts
        if: ${{ github.event.inputs.release_type == 'Dry Run' }}
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-cli.yml
          path: apps/cli
@@ -150,7 +150,7 @@ jobs:

      - name: Retrieve secrets
        id: retrieve-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "snapcraft-store-token"
@@ -162,7 +162,7 @@ jobs:

      - name: Download artifacts
        if: ${{ github.event.inputs.release_type != 'Dry Run' }}
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-cli.yml
          path: apps/cli
@@ -172,7 +172,7 @@ jobs:

      - name: Dry Run - Download artifacts
        if: ${{ github.event.inputs.release_type == 'Dry Run' }}
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-cli.yml
          path: apps/cli
@@ -204,7 +204,7 @@ jobs:

      - name: Retrieve secrets
        id: retrieve-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "cli-choco-api-key"
@@ -220,7 +220,7 @@ jobs:

      - name: Download artifacts
        if: ${{ github.event.inputs.release_type != 'Dry Run' }}
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-cli.yml
          path: apps/cli/dist
@@ -230,7 +230,7 @@ jobs:

      - name: Dry Run - Download artifacts
        if: ${{ github.event.inputs.release_type == 'Dry Run' }}
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-cli.yml
          path: apps/cli/dist
@@ -263,14 +263,14 @@ jobs:

      - name: Retrieve secrets
        id: retrieve-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "npm-api-key"

      - name: Download artifacts
        if: ${{ github.event.inputs.release_type != 'Dry Run' }}
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-cli.yml
          path: apps/cli/build
@@ -280,7 +280,7 @@ jobs:

      - name: Dry Run - Download artifacts
        if: ${{ github.event.inputs.release_type == 'Dry Run' }}
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-cli.yml
          path: apps/cli/build
--- a/.github/workflows/release-desktop-beta.yml
+++ b/.github/workflows/release-desktop-beta.yml
@@ -47,7 +47,7 @@ jobs:

      - name: Check Release Version
        id: version
-        uses: bitwarden/gh-actions/release-version-check@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/release-version-check@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          release-type: 'Initial Release'
          project-type: ts
@@ -231,7 +231,7 @@ jobs:
          node-gyp install $(node -v)

      - name: Install AST
-        uses: bitwarden/gh-actions/install-ast@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/install-ast@37ffa14164a7308bc273829edfe75c97cd562375

      - name: Set up environment
        run: choco install checksum --no-progress
@@ -249,7 +249,7 @@ jobs:

      - name: Retrieve secrets
        id: retrieve-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "code-signing-vault-url,
@@ -932,7 +932,7 @@ jobs:

      - name: Retrieve secrets
        id: retrieve-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "aws-electron-access-id,
--- a/.github/workflows/release-desktop.yml
+++ b/.github/workflows/release-desktop.yml
@@ -67,7 +67,7 @@ jobs:

      - name: Check Release Version
        id: version
-        uses: bitwarden/gh-actions/release-version-check@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/release-version-check@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          release-type: ${{ github.event.inputs.release_type }}
          project-type: ts
@@ -110,7 +110,7 @@ jobs:

      - name: Retrieve secrets
        id: retrieve-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "aws-electron-access-id,
@@ -123,7 +123,7 @@ jobs:

      - name: Download all artifacts
        if: ${{ github.event.inputs.release_type != 'Dry Run' }}
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-desktop.yml
          workflow_conclusion: success
@@ -132,7 +132,7 @@ jobs:

      - name: Dry Run - Download all artifacts
        if: ${{ github.event.inputs.release_type == 'Dry Run' }}
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-desktop.yml
          workflow_conclusion: success
@@ -185,7 +185,7 @@ jobs:
          --endpoint-url https://${CF_ACCOUNT}.r2.cloudflarestorage.com

      - name: Get checksum files
-        uses: bitwarden/gh-actions/get-checksum@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-checksum@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          packages_dir: "apps/desktop/artifacts"
          file_path: "apps/desktop/artifacts/sha256-checksums.txt"
@@ -263,7 +263,7 @@ jobs:

      - name: Retrieve secrets
        id: retrieve-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "snapcraft-store-token"
@@ -279,7 +279,7 @@ jobs:

      - name: Download Snap artifact
        if: ${{ github.event.inputs.release_type != 'Dry Run' }}
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-desktop.yml
          workflow_conclusion: success
@@ -289,7 +289,7 @@ jobs:

      - name: Dry Run - Download Snap artifact
        if: ${{ github.event.inputs.release_type == 'Dry Run' }}
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-desktop.yml
          workflow_conclusion: success
@@ -329,7 +329,7 @@ jobs:

      - name: Retrieve secrets
        id: retrieve-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "cli-choco-api-key"
@@ -347,7 +347,7 @@ jobs:

      - name: Download choco artifact
        if: ${{ github.event.inputs.release_type != 'Dry Run' }}
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-desktop.yml
          workflow_conclusion: success
@@ -357,7 +357,7 @@ jobs:

      - name: Dry Run - Download choco artifact
        if: ${{ github.event.inputs.release_type == 'Dry Run' }}
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-desktop.yml
          workflow_conclusion: success
@@ -368,5 +368,5 @@ jobs:
      - name: Push to Chocolatey
        if: ${{ github.event.inputs.release_type != 'Dry Run' }}
        shell: pwsh
-        run: choco push
+        run: choco push --source=https://push.chocolatey.org/
        working-directory: apps/desktop/dist
--- a/.github/workflows/release-qa-web.yml
+++ b/.github/workflows/release-qa-web.yml
@@ -23,7 +23,7 @@ jobs:
        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2

      - name: Download latest cloud asset
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-web.yml
          path: apps/web
--- a/.github/workflows/release-web.yml
+++ b/.github/workflows/release-web.yml
@@ -38,7 +38,7 @@ jobs:

      - name: Check Release Version
        id: version
-        uses: bitwarden/gh-actions/release-version-check@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/release-version-check@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          release-type: ${{ github.event.inputs.release_type }}
          project-type: ts
@@ -70,7 +70,7 @@ jobs:
      ########## DockerHub ##########
      - name: Setup DCT
        id: setup-dct
-        uses: bitwarden/gh-actions/setup-docker-trust@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/setup-docker-trust@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          azure-creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
          azure-keyvault-name: "bitwarden-ci"
@@ -156,7 +156,7 @@ jobs:

      - name: Retrieve bot secrets
        id: retrieve-bot-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: bitwarden-ci
          secrets: "github-pat-bitwarden-devops-bot-repo-scope"
@@ -170,7 +170,7 @@ jobs:

      - name: Download latest cloud asset
        if: ${{ github.event.inputs.release_type != 'Dry Run' }}
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-web.yml
          path: assets
@@ -180,7 +180,7 @@ jobs:

      - name: Dry Run - Download latest cloud asset
        if: ${{ github.event.inputs.release_type == 'Dry Run' }}
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-web.yml
          path: assets
@@ -253,7 +253,7 @@ jobs:

      - name: Download latest build artifacts
        if: ${{ github.event.inputs.release_type != 'Dry Run' }}
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-web.yml
          path: apps/web/artifacts
@@ -264,7 +264,7 @@ jobs:

      - name: Dry Run - Download latest build artifacts
        if: ${{ github.event.inputs.release_type == 'Dry Run' }}
-        uses: bitwarden/gh-actions/download-artifacts@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/download-artifacts@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          workflow: build-web.yml
          path: apps/web/artifacts
--- a/.github/workflows/staged-rollout-desktop.yml
+++ b/.github/workflows/staged-rollout-desktop.yml
@@ -26,7 +26,7 @@ jobs:

      - name: Retrieve secrets
        id: retrieve-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "aws-electron-access-id,
--- a/.github/workflows/version-bump.yml
+++ b/.github/workflows/version-bump.yml
@@ -49,7 +49,7 @@ jobs:

      - name: Retrieve secrets
        id: retrieve-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/get-keyvault-secrets@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          keyvault: "bitwarden-ci"
          secrets: "github-gpg-private-key, github-gpg-private-key-passphrase"
@@ -86,14 +86,14 @@ jobs:

      - name: Bump Browser Version - Manifest
        if: ${{ github.event.inputs.client == 'Browser' || github.event.inputs.client == 'All' }}
-        uses: bitwarden/gh-actions/version-bump@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/version-bump@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          version: ${{ github.event.inputs.version_number }}
          file_path: "apps/browser/src/manifest.json"

      - name: Bump Browser Version - Manifest v3
        if: ${{ github.event.inputs.client == 'Browser' || github.event.inputs.client == 'All' }}
-        uses: bitwarden/gh-actions/version-bump@72594be690a4e7bfa87b1402b2aedc75acdbff12
+        uses: bitwarden/gh-actions/version-bump@37ffa14164a7308bc273829edfe75c97cd562375
        with:
          version: ${{ github.event.inputs.version_number }}
          file_path: "apps/browser/src/manifest.v3.json"
--- a/.github/workflows/workflow-linter.yml
+++ b/.github/workflows/workflow-linter.yml
@@ -8,4 +8,4 @@ on:

 jobs:
  call-workflow:
-    uses: bitwarden/gh-actions/.github/workflows/workflow-linter.yml@72594be690a4e7bfa87b1402b2aedc75acdbff12
+    uses: bitwarden/gh-actions/.github/workflows/workflow-linter.yml@37ffa14164a7308bc273829edfe75c97cd562375
--- a/apps/cli/src/commands/serve.command.ts
+++ b/apps/cli/src/commands/serve.command.ts
@@ -245,6 +245,10 @@ export class ServeCommand {
    });

    router.post("/unlock", async (ctx, next) => {
+      // Do not allow guessing password location through serve command
+      delete ctx.request.query.passwordFile;
+      delete ctx.request.query.passwordEnv;
+
      const response = await this.unlockCommand.run(
        ctx.request.body.password == null ? null : (ctx.request.body.password as string),
        ctx.request.query
--- a/apps/web/src/app/vault/individual-vault/vault.component.ts
+++ b/apps/web/src/app/vault/individual-vault/vault.component.ts
@@ -38,7 +38,6 @@ import { OrganizationService } from "@bitwarden/common/admin-console/abstraction
 import { Organization } from "@bitwarden/common/admin-console/models/domain/organization";
 import { TokenService } from "@bitwarden/common/auth/abstractions/token.service";
 import { DEFAULT_PBKDF2_ITERATIONS, EventType, KdfType } from "@bitwarden/common/enums";
-import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
 import { ServiceUtils } from "@bitwarden/common/misc/serviceUtils";
 import { TreeNode } from "@bitwarden/common/models/domain/tree-node";
 import { BroadcasterService } from "@bitwarden/common/platform/abstractions/broadcaster.service";
@@ -857,17 +856,9 @@ export class VaultComponent implements OnInit, OnDestroy {
  }

  async isLowKdfIteration() {
-    const showLowKdfEnabled = await this.configService.getFeatureFlagBool(
-      FeatureFlag.DisplayLowKdfIterationWarningFlag
-    );
-
-    if (showLowKdfEnabled) {
-      const kdfType = await this.stateService.getKdfType();
-      const kdfOptions = await this.stateService.getKdfConfig();
-      return kdfType === KdfType.PBKDF2_SHA256 && kdfOptions.iterations < DEFAULT_PBKDF2_ITERATIONS;
-    }
-
-    return showLowKdfEnabled;
+    const kdfType = await this.stateService.getKdfType();
+    const kdfOptions = await this.stateService.getKdfConfig();
+    return kdfType === KdfType.PBKDF2_SHA256 && kdfOptions.iterations < DEFAULT_PBKDF2_ITERATIONS;
  }

  protected async repromptCipher(ciphers: CipherView[]) {