Merge branch 'main' into km/beeep/fido2-rust-v2

.github/workflows/build-browser-target.yml

@@ -1,39 +0,0 @@
-name: Build Browser on PR Target
-
-on:
-  pull_request:
-    types: [opened, synchronize]
-    branches-ignore:
-      - 'l10n_master'
-      - 'cf-pages'
-    paths:
-      - 'apps/browser/**'
-      - 'libs/**'
-      - '*'
-      - '!*.md'
-      - '!*.txt'
-  workflow_call:
-    inputs: {}
-  workflow_dispatch:
-    inputs:
-      sdk_branch:
-        description: "Custom SDK branch"
-        required: false
-        type: string
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  check-run:
-    name: Check PR run
-    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
-
-  run-workflow:
-    name: Run Build Browser on PR Target
-    needs: check-run
-    if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
-    uses: ./.github/workflows/build-browser.yml
-    secrets: inherit
-

.github/workflows/build-browser.yml

@@ -1,7 +1,7 @@
 name: Build Browser
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize]
     branches-ignore:
       - 'l10n_master'
@@ -38,14 +38,19 @@ defaults:
     shell: bash
 
 jobs:
+  check-run:
+    name: Check PR run
+    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
+
   setup:
     name: Setup
     runs-on: ubuntu-22.04
+    needs:
+      - check-run
     outputs:
       repo_url: ${{ steps.gen_vars.outputs.repo_url }}
       adj_build_number: ${{ steps.gen_vars.outputs.adj_build_number }}
       node_version: ${{ steps.retrieve-node-version.outputs.node_version }}
-      has_secrets: ${{ steps.check-secrets.outputs.has_secrets }}
     steps:
       - name: Check out repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -69,14 +74,6 @@ jobs:
           NODE_VERSION=${NODE_NVMRC/v/''}
           echo "node_version=$NODE_VERSION" >> $GITHUB_OUTPUT
 
-      - name: Check secrets
-        id: check-secrets
-        env:
-          AZURE_KV_CI_SERVICE_PRINCIPAL: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
-        run: |
-          has_secrets=${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL != '' }}
-          echo "has_secrets=$has_secrets" >> $GITHUB_OUTPUT
-
 
   locales-test:
     name: Locales Test
@@ -284,7 +281,6 @@ jobs:
     needs:
       - setup
       - locales-test
-    if: ${{ needs.setup.outputs.has_secrets == 'true' }}
     env:
       _BUILD_NUMBER: ${{ needs.setup.outputs.adj_build_number }}
       _NODE_VERSION: ${{ needs.setup.outputs.node_version }}

.github/workflows/build-cli-target.yml

@@ -1,39 +0,0 @@
-name: Build CLI on PR Target
-
-on:
-  pull_request:
-    types: [opened, synchronize]
-    branches-ignore:
-      - 'l10n_master'
-      - 'cf-pages'
-    paths:
-      - 'apps/cli/**'
-      - 'libs/**'
-      - '*'
-      - '!*.md'
-      - '!*.txt'
-      - '.github/workflows/build-cli.yml'
-      - 'bitwarden_license/bit-cli/**'
-  workflow_dispatch:
-    inputs:
-      sdk_branch:
-        description: "Custom SDK branch"
-        required: false
-        type: string
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  check-run:
-    name: Check PR run
-    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
-
-  run-workflow:
-    name: Run Build CLI on PR Target
-    needs: check-run
-    if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
-    uses: ./.github/workflows/build-cli.yml
-    secrets: inherit
-

.github/workflows/build-cli.yml

@@ -1,7 +1,7 @@
 name: Build CLI
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize]
     branches-ignore:
       - 'l10n_master'
@@ -27,8 +27,6 @@ on:
       - '!*.txt'
       - '.github/workflows/build-cli.yml'
       - 'bitwarden_license/bit-cli/**'
-  workflow_call:
-    inputs: {}
   workflow_dispatch:
     inputs:
       sdk_branch:
@@ -41,13 +39,18 @@ defaults:
     working-directory: apps/cli
 
 jobs:
+  check-run:
+    name: Check PR run
+    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
+
   setup:
     name: Setup
     runs-on: ubuntu-22.04
+    needs:
+      - check-run
     outputs:
       package_version: ${{ steps.retrieve-package-version.outputs.package_version }}
       node_version: ${{ steps.retrieve-node-version.outputs.node_version }}
-      has_secrets: ${{ steps.check-secrets.outputs.has_secrets }}
     steps:
       - name: Check out repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -68,14 +71,6 @@ jobs:
           NODE_VERSION=${NODE_NVMRC/v/''}
           echo "node_version=$NODE_VERSION" >> $GITHUB_OUTPUT
 
-      - name: Check secrets
-        id: check-secrets
-        env:
-          AZURE_KV_CI_SERVICE_PRINCIPAL: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
-        run: |
-          has_secrets=${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL != '' }}
-          echo "has_secrets=$has_secrets" >> $GITHUB_OUTPUT
-
   cli:
     name: CLI ${{ matrix.os.base }} - ${{ matrix.license_type.readable }}
     strategy:
@@ -122,7 +117,7 @@ jobs:
         working-directory: ./
 
       - name: Download SDK Artifacts
-        if: ${{ inputs.sdk_branch != '' && needs.setup.outputs.has_secrets == 'true' }}
+        if: ${{ inputs.sdk_branch != '' }}
         uses: bitwarden/gh-actions/download-artifacts@main
         with:
           github_token: ${{secrets.GITHUB_TOKEN}}
@@ -135,7 +130,7 @@ jobs:
           if_no_artifact_found: fail
 
       - name: Override SDK
-        if: ${{ inputs.sdk_branch != '' && needs.setup.outputs.has_secrets == 'true' }}
+        if: ${{ inputs.sdk_branch != '' }}
         working-directory: ./
         run: |
           ls -l ../
@@ -277,7 +272,7 @@ jobs:
         working-directory: ./
 
       - name: Download SDK Artifacts
-        if: ${{ inputs.sdk_branch != '' && needs.setup.outputs.has_secrets == 'true' }}
+        if: ${{ inputs.sdk_branch != '' }}
         uses: bitwarden/gh-actions/download-artifacts@main
         with:
           github_token: ${{secrets.GITHUB_TOKEN}}
@@ -290,7 +285,7 @@ jobs:
           if_no_artifact_found: fail
 
       - name: Override SDK
-        if: ${{ inputs.sdk_branch != '' && needs.setup.outputs.has_secrets == 'true' }}
+        if: ${{ inputs.sdk_branch != '' }}
         working-directory: ./
         run: |
           ls -l ../

.github/workflows/build-desktop-target.yml

@@ -1,38 +0,0 @@
-name: Build Desktop on PR Target
-
-on:
-  pull_request:
-    types: [opened, synchronize]
-    branches-ignore:
-      - 'l10n_master'
-      - 'cf-pages'
-    paths:
-      - 'apps/desktop/**'
-      - 'libs/**'
-      - '*'
-      - '!*.md'
-      - '!*.txt'
-      - '.github/workflows/build-desktop.yml'
-  workflow_dispatch:
-    inputs:
-      sdk_branch:
-        description: "Custom SDK branch"
-        required: false
-        type: string
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  check-run:
-    name: Check PR run
-    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
-
-  run-workflow:
-    name: Run Build Desktop on PR Target
-    needs: check-run
-    if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
-    uses: ./.github/workflows/build-desktop.yml
-    secrets: inherit
-

.github/workflows/build-desktop.yml

@@ -1,7 +1,7 @@
 name: Build Desktop
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize]
     branches-ignore:
       - 'l10n_master'
@@ -25,8 +25,6 @@ on:
       - '!*.md'
       - '!*.txt'
       - '.github/workflows/build-desktop.yml'
-  workflow_call:
-    inputs: {}
   workflow_dispatch:
     inputs:
       sdk_branch:
@@ -39,9 +37,15 @@ defaults:
     shell: bash
 
 jobs:
+  check-run:
+    name: Check PR run
+    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
+
   electron-verify:
     name: Verify Electron Version
     runs-on: ubuntu-22.04
+    needs:
+      - check-run
     steps:
       - name: Check out repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -63,6 +67,8 @@ jobs:
   setup:
     name: Setup
     runs-on: ubuntu-22.04
+    needs:
+      - check-run
     outputs:
       package_version: ${{ steps.retrieve-version.outputs.package_version }}
       release_channel: ${{ steps.release-channel.outputs.channel }}
@@ -70,7 +76,6 @@ jobs:
       rc_branch_exists: ${{ steps.branch-check.outputs.rc_branch_exists }}
       hotfix_branch_exists: ${{ steps.branch-check.outputs.hotfix_branch_exists }}
       node_version: ${{ steps.retrieve-node-version.outputs.node_version }}
-      has_secrets: ${{ steps.check-secrets.outputs.has_secrets }}
     defaults:
       run:
         working-directory: apps/desktop
@@ -133,14 +138,6 @@ jobs:
           NODE_VERSION=${NODE_NVMRC/v/''}
           echo "node_version=$NODE_VERSION" >> $GITHUB_OUTPUT
 
-      - name: Check secrets
-        id: check-secrets
-        env:
-          AZURE_KV_CI_SERVICE_PRINCIPAL: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
-        run: |
-          has_secrets=${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL != '' }}
-          echo "has_secrets=$has_secrets" >> $GITHUB_OUTPUT
-
   linux:
     name: Linux Build
     # Note, before updating the ubuntu version of the workflow, ensure the snap base image
@@ -337,14 +334,12 @@ jobs:
           rustup show
 
       - name: Login to Azure
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
         with:
           creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
 
       - name: Retrieve secrets
         id: retrieve-secrets
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         uses: bitwarden/gh-actions/get-keyvault-secrets@main
         with:
           keyvault: "bitwarden-ci"
@@ -359,7 +354,7 @@ jobs:
         working-directory: ./
 
       - name: Download SDK Artifacts
-        if: ${{ inputs.sdk_branch != '' && needs.setup.outputs.has_secrets == 'true' }}
+        if: ${{ inputs.sdk_branch != '' }}
         uses: bitwarden/gh-actions/download-artifacts@main
         with:
           github_token: ${{secrets.GITHUB_TOKEN}}
@@ -372,7 +367,7 @@ jobs:
           if_no_artifact_found: fail
 
       - name: Override SDK
-        if: ${{ inputs.sdk_branch != '' && needs.setup.outputs.has_secrets == 'true' }}
+        if: ${{ inputs.sdk_branch != '' }}
         working-directory: ./
         run: |
           ls -l ../
@@ -392,17 +387,7 @@ jobs:
         working-directory: apps/desktop/desktop_native
         run: node build.js cross-platform
 
-      - name: Build
-        run: |
-          npm run build
-
-      - name: Pack
-        if: ${{ needs.setup.outputs.has_secrets == 'false' }}
-        run: |
-          npm run pack:win
-
-      - name: Pack & Sign (dev)
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
+      - name: Build & Sign (dev)
         env:
           ELECTRON_BUILDER_SIGN: 1
           SIGNING_VAULT_URL: ${{ steps.retrieve-secrets.outputs.code-signing-vault-url }}
@@ -411,10 +396,10 @@ jobs:
           SIGNING_CLIENT_SECRET: ${{ steps.retrieve-secrets.outputs.code-signing-client-secret }}
           SIGNING_CERT_NAME: ${{ steps.retrieve-secrets.outputs.code-signing-cert-name }}
         run: |
+          npm run build
           npm run pack:win
 
       - name: Rename appx files for store
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         run: |
           Copy-Item "./dist/Bitwarden-${{ env._PACKAGE_VERSION }}-ia32.appx" `
             -Destination "./dist/Bitwarden-${{ env._PACKAGE_VERSION }}-ia32-store.appx"
@@ -424,7 +409,6 @@ jobs:
             -Destination "./dist/Bitwarden-${{ env._PACKAGE_VERSION }}-arm64-store.appx"
 
       - name: Package for Chocolatey
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         run: |
           Copy-Item -Path ./stores/chocolatey -Destination ./dist/chocolatey -Recurse
           Copy-Item -Path ./dist/nsis-web/Bitwarden-Installer-${{ env._PACKAGE_VERSION }}.exe `
@@ -436,7 +420,6 @@ jobs:
           choco pack ./dist/chocolatey/bitwarden.nuspec --version "$env:_PACKAGE_VERSION" --out ./dist/chocolatey
 
       - name: Fix NSIS artifact names for auto-updater
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         run: |
           Rename-Item -Path .\dist\nsis-web\Bitwarden-${{ env._PACKAGE_VERSION }}-ia32.nsis.7z `
             -NewName bitwarden-${{ env._PACKAGE_VERSION }}-ia32.nsis.7z
@@ -453,7 +436,6 @@ jobs:
           if-no-files-found: error
 
       - name: Upload installer exe artifact
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: Bitwarden-Installer-${{ env._PACKAGE_VERSION }}.exe
@@ -461,7 +443,6 @@ jobs:
           if-no-files-found: error
 
       - name: Upload appx ia32 artifact
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: Bitwarden-${{ env._PACKAGE_VERSION }}-ia32.appx
@@ -469,7 +450,6 @@ jobs:
           if-no-files-found: error
 
       - name: Upload store appx ia32 artifact
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: Bitwarden-${{ env._PACKAGE_VERSION }}-ia32-store.appx
@@ -477,7 +457,6 @@ jobs:
           if-no-files-found: error
 
       - name: Upload NSIS ia32 artifact
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: bitwarden-${{ env._PACKAGE_VERSION }}-ia32.nsis.7z
@@ -485,7 +464,6 @@ jobs:
           if-no-files-found: error
 
       - name: Upload appx x64 artifact
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: Bitwarden-${{ env._PACKAGE_VERSION }}-x64.appx
@@ -493,7 +471,6 @@ jobs:
           if-no-files-found: error
 
       - name: Upload store appx x64 artifact
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: Bitwarden-${{ env._PACKAGE_VERSION }}-x64-store.appx
@@ -501,7 +478,6 @@ jobs:
           if-no-files-found: error
 
       - name: Upload NSIS x64 artifact
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: bitwarden-${{ env._PACKAGE_VERSION }}-x64.nsis.7z
@@ -509,7 +485,6 @@ jobs:
           if-no-files-found: error
 
       - name: Upload appx ARM64 artifact
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: Bitwarden-${{ env._PACKAGE_VERSION }}-arm64.appx
@@ -517,7 +492,6 @@ jobs:
           if-no-files-found: error
 
       - name: Upload store appx ARM64 artifact
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: Bitwarden-${{ env._PACKAGE_VERSION }}-arm64-store.appx
@@ -525,7 +499,6 @@ jobs:
           if-no-files-found: error
 
       - name: Upload NSIS ARM64 artifact
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: bitwarden-${{ env._PACKAGE_VERSION }}-arm64.nsis.7z
@@ -533,7 +506,6 @@ jobs:
           if-no-files-found: error
 
       - name: Upload nupkg artifact
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: bitwarden.${{ env._PACKAGE_VERSION }}.nupkg
@@ -541,7 +513,6 @@ jobs:
           if-no-files-found: error
 
       - name: Upload auto-update artifact
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: ${{ needs.setup.outputs.release_channel }}.yml
@@ -604,13 +575,11 @@ jobs:
           key: ${{ runner.os }}-${{ github.run_id }}-safari-extension
 
       - name: Login to Azure
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
         with:
           creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
 
       - name: Download Provisioning Profiles secrets
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         env:
           ACCOUNT_NAME: bitwardenci
           CONTAINER_NAME: profiles
@@ -623,7 +592,6 @@ jobs:
             --output none
 
       - name: Get certificates
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         run: |
           mkdir -p $HOME/certificates
 
@@ -646,7 +614,6 @@ jobs:
             jq -r .value | base64 -d > $HOME/certificates/macdev-cert.p12
 
       - name: Set up keychain
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         env:
           KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
         run: |
@@ -676,7 +643,6 @@ jobs:
           security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $KEYCHAIN_PASSWORD build.keychain
 
       - name: Set up provisioning profiles
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         run: |
           cp $HOME/secrets/bitwarden_desktop_appstore.provisionprofile \
             $GITHUB_WORKSPACE/apps/desktop/bitwarden_desktop_appstore.provisionprofile
@@ -696,7 +662,7 @@ jobs:
         working-directory: ./
 
       - name: Download SDK Artifacts
-        if: ${{ inputs.sdk_branch != '' && needs.setup.outputs.has_secrets == 'true' }}
+        if: ${{ inputs.sdk_branch != '' }}
         uses: bitwarden/gh-actions/download-artifacts@main
         with:
           github_token: ${{secrets.GITHUB_TOKEN}}
@@ -709,7 +675,7 @@ jobs:
           if_no_artifact_found: fail
 
       - name: Override SDK
-        if: ${{ inputs.sdk_branch != '' && needs.setup.outputs.has_secrets == 'true' }}
+        if: ${{ inputs.sdk_branch != '' }}
         working-directory: ./
         run: |
           ls -l ../
@@ -736,7 +702,6 @@ jobs:
   browser-build:
     name: Browser Build
     needs: setup
-    if: ${{ needs.setup.outputs.has_secrets == 'true' }}
     uses: ./.github/workflows/build-browser.yml
     secrets: inherit
 
@@ -744,7 +709,6 @@ jobs:
   macos-package-github:
     name: MacOS Package GitHub Release Assets
     runs-on: macos-13
-    if: ${{ needs.setup.outputs.has_secrets == 'true' }}
     needs:
       - browser-build
       - macos-build
@@ -986,7 +950,6 @@ jobs:
   macos-package-mas:
     name: MacOS Package Prod Release Asset
     runs-on: macos-13
-    if: ${{ needs.setup.outputs.has_secrets == 'true' }}
     needs:
       - browser-build
       - macos-build
@@ -1254,7 +1217,6 @@ jobs:
   macos-package-dev:
     name: MacOS Package Dev Release Asset
     runs-on: macos-13
-    if: ${{ needs.setup.outputs.has_secrets == 'true' }}
     needs:
       - browser-build
       - macos-build

.github/workflows/build-web-target.yml

@@ -1,41 +0,0 @@
-name: Build Web on PR Target
-
-on:
-  pull_request:
-    types: [opened, synchronize]
-    branches-ignore:
-      - 'l10n_master'
-      - 'cf-pages'
-    paths:
-      - 'apps/web/**'
-      - 'libs/**'
-      - '*'
-      - '!*.md'
-      - '!*.txt'
-      - '.github/workflows/build-web.yml'
-  workflow_dispatch:
-    inputs:
-      custom_tag_extension:
-        description: "Custom image tag extension"
-        required: false
-      sdk_branch:
-        description: "Custom SDK branch"
-        required: false
-        type: string
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  check-run:
-    name: Check PR run
-    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
-
-  run-workflow:
-    name: Run Build Web on PR Target
-    needs: check-run
-    if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
-    uses: ./.github/workflows/build-web.yml
-    secrets: inherit
-

.github/workflows/build-web.yml

@@ -1,7 +1,7 @@
 name: Build Web
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize]
     branches-ignore:
       - 'l10n_master'
@@ -27,8 +27,6 @@ on:
       - '.github/workflows/build-web.yml'
   release:
     types: [published]
-  workflow_call:
-    inputs: {}
   workflow_dispatch:
     inputs:
       custom_tag_extension:
@@ -43,13 +41,18 @@ env:
   _AZ_REGISTRY: bitwardenprod.azurecr.io
 
 jobs:
+  check-run:
+    name: Check PR run
+    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
+
   setup:
     name: Setup
     runs-on: ubuntu-22.04
+    needs:
+      - check-run
     outputs:
       version: ${{ steps.version.outputs.value }}
       node_version: ${{ steps.retrieve-node-version.outputs.node_version }}
-      has_secrets: ${{ steps.check-secrets.outputs.has_secrets }}
     steps:
       - name: Check out repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -67,14 +70,6 @@ jobs:
           NODE_VERSION=${NODE_NVMRC/v/''}
           echo "node_version=$NODE_VERSION" >> $GITHUB_OUTPUT
 
-      - name: Check secrets
-        id: check-secrets
-        env:
-          AZURE_KV_CI_SERVICE_PRINCIPAL: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
-        run: |
-          has_secrets=${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL != '' }}
-          echo "has_secrets=$has_secrets" >> $GITHUB_OUTPUT
-
   build-artifacts:
     name: Build artifacts
     runs-on: ubuntu-22.04
@@ -133,7 +128,7 @@ jobs:
         run: npm ci
 
       - name: Download SDK Artifacts
-        if: ${{ inputs.sdk_branch != '' && needs.setup.outputs.has_secrets == 'true' }}
+        if: ${{ inputs.sdk_branch != '' }}
         uses: bitwarden/gh-actions/download-artifacts@main
         with:
           github_token: ${{secrets.GITHUB_TOKEN}}
@@ -146,7 +141,7 @@ jobs:
           if_no_artifact_found: fail
 
       - name: Override SDK
-        if: ${{ inputs.sdk_branch != '' && needs.setup.outputs.has_secrets == 'true' }}
+        if: ${{ inputs.sdk_branch != '' }}
         working-directory: ./
         run: |
           ls -l ../
@@ -215,23 +210,19 @@ jobs:
 
       ########## ACRs ##########
       - name: Login to Prod Azure
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
         with:
           creds: ${{ secrets.AZURE_PROD_KV_CREDENTIALS }}
 
       - name: Log into Prod container registry
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         run: az acr login -n bitwardenprod
 
       - name: Login to Azure - CI Subscription
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
         with:
           creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
 
       - name: Retrieve github PAT secrets
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         id: retrieve-secret-pat
         uses: bitwarden/gh-actions/get-keyvault-secrets@main
         with:
@@ -279,7 +270,6 @@ jobs:
         run: echo "name=$_AZ_REGISTRY/${PROJECT_NAME}:${IMAGE_TAG}" >> $GITHUB_OUTPUT
 
       - name: Build Docker image
-        if: ${{ needs.setup.outputs.has_secrets == 'true' }}
         uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
         with:
           context: apps/web

.github/workflows/lint.yml

@@ -1,20 +1,12 @@
 name: Lint
 
 on:
-  pull_request:
-    types: [opened, synchronize]
+  push:
     branches-ignore:
       - 'l10n_master'
       - 'cf-pages'
     paths-ignore:
       - '.github/workflows/**'
-  push:
-    branches:
-      - 'main'
-      - 'rc'
-      - 'hotfix-rc-*'
-    paths-ignore:
-      - '.github/workflows/**'
   workflow_dispatch:
     inputs: {}