sync: main sync 27 10

App.go

@@ -23,6 +23,7 @@ import (
 	"fmt"
 	"github.com/devtron-labs/common-lib/middlewares"
 	pubsub "github.com/devtron-labs/common-lib/pubsub-lib"
+	"github.com/devtron-labs/common-lib/securestore"
 	posthogTelemetry "github.com/devtron-labs/common-lib/telemetry"
 	"github.com/devtron-labs/devtron/pkg/eventProcessor"
 	"github.com/devtron-labs/devtron/pkg/eventProcessor/in"
@@ -47,6 +48,13 @@ import (
 	"go.uber.org/zap"
 )
 
+func init() {
+	err := securestore.SetEncryptionKey()
+	if err != nil {
+		log.Println("error in setting encryption key", "err", err)
+	}
+}
+
 type App struct {
 	MuxRouter     *router.MuxRouter
 	Logger        *zap.SugaredLogger

CHANGELOG/release-notes-v1.8.1.md

@@ -0,0 +1,8 @@
+## v1.8.1
+
+
+## Bugs
+- fix: unsaved changes popup showing after saving manifest ([#2922](https://github.com/devtron-labs/dashboard/pull/2922))
+
+
+

CHANGELOG/release-notes-v1.8.2.md

@@ -0,0 +1,12 @@
+## v1.8.2
+
+## Enhancements
+- feat: linked ci should have artifacts of parent ci (#6836)
+## Bugs
+- fix: clear cached reference charts for Deployment chart versions 4.18.0, 4.19.0, 1.0.0, and 1.1.0 (#6841)
+- fix: Custom chart with dependencies are not working in Devtron Applications (#6834)
+- fix: Terraform plugin fix in v1.0.1 (#6830)
+## Others
+- misc: Api specs and validations added (#6807)
+
+

Makefile

@@ -2,7 +2,7 @@
 
 all: fetch-all-env build
 
-TARGET_BRANCH?=develop
+TARGET_BRANCH?=main
 TAG?=$(shell bash -c 'git log --pretty=format:'%h' -n 1')
 FLAGS=
 ENVVAR=

api/auth/user/UserRestHandler_ent.go

@@ -25,9 +25,16 @@ func (handler UserRestHandlerImpl) checkRBACForUserCreate(token string, requestS
 					isAuthorised = handler.enforcer.Enforce(token, casbin.ResourceUser, casbin.ActionCreate, filter.Team)
 				case filter.Entity == bean2.CLUSTER_ENTITIY:
 					isAuthorised = handler.userCommonService.CheckRbacForClusterEntity(filter.Cluster, filter.Namespace, filter.Group, filter.Kind, filter.Resource, token, handler.CheckManagerAuth)
-				case filter.Entity == bean2.CHART_GROUP_ENTITY && len(roleFilters) == 1: //if only chartGroup entity is present in request then access will be judged through super-admin access
-					isAuthorised = isActionUserSuperAdmin
-				case filter.Entity == bean2.CHART_GROUP_ENTITY && len(roleFilters) > 1: //if entities apart from chartGroup entity are present, not checking chartGroup access
+				case filter.Entity == bean2.CHART_GROUP_ENTITY && len(roleFilters) == 1:
+					// If only chart group in direct permissions, but user is assigning role groups too,
+					// defer the chart group authorization to the role group check
+					if len(roleGroups) > 0 {
+						isAuthorised = true // Will be validated in role group section
+					} else {
+						isAuthorised = isActionUserSuperAdmin
+					}
+				case filter.Entity == bean2.CHART_GROUP_ENTITY && len(roleFilters) > 1:
+					// If there are other entities in addition to chart group, ignore chart group check
 					isAuthorised = true
 				default:
 					isAuthorised = false

api/helm-app/service/HelmAppService.go

@@ -965,10 +965,10 @@ func (impl *HelmAppServiceImpl) TemplateChart(ctx context.Context, templateChart
 		registryCredential = &gRPC.RegistryCredential{
 			RegistryUrl:         appStoreAppVersion.AppStore.DockerArtifactStore.RegistryURL,
 			Username:            appStoreAppVersion.AppStore.DockerArtifactStore.Username,
-			Password:            appStoreAppVersion.AppStore.DockerArtifactStore.Password,
+			Password:            appStoreAppVersion.AppStore.DockerArtifactStore.Password.String(),
 			AwsRegion:           appStoreAppVersion.AppStore.DockerArtifactStore.AWSRegion,
 			AccessKey:           appStoreAppVersion.AppStore.DockerArtifactStore.AWSAccessKeyId,
-			SecretKey:           appStoreAppVersion.AppStore.DockerArtifactStore.AWSSecretAccessKey,
+			SecretKey:           appStoreAppVersion.AppStore.DockerArtifactStore.AWSSecretAccessKey.String(),
 			RegistryType:        string(appStoreAppVersion.AppStore.DockerArtifactStore.RegistryType),
 			RepoName:            appStoreAppVersion.AppStore.Name,
 			IsPublic:            ociRegistryConfig.IsPublic,

charts/devtron/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: devtron-operator
-appVersion: 1.8.0
+appVersion: 1.8.2
 description: Chart to configure and install Devtron. Devtron is a Kubernetes Orchestration system.
 keywords:
   - Devtron
@@ -11,7 +11,7 @@ keywords:
   - argocd
   - Hyperion
 engine: gotpl
-version: 0.22.96
+version: 0.22.98
 sources:
   - https://github.com/devtron-labs/charts
 dependencies:

charts/devtron/devtron-bom.yaml

@@ -15,7 +15,7 @@ global:
     PG_DATABASE: orchestrator
 extraManifests: []
 installer:
-  release: "v1.8.0"
+  release: "v1.8.2"
   registry: ""
   image: "inception"
   tag: "473deaa4-185-21582"
@@ -41,13 +41,13 @@ components:
         FEATURE_CODE_MIRROR_ENABLE: "true"
         FEATURE_GROUPED_APP_LIST_FILTERS_ENABLE: "true"
     registry: ""
-    image: "dashboard:5196e935-690-36024"
+    image: "dashboard:b00aa204-690-36533"
     imagePullPolicy: IfNotPresent
     healthPort: 8080
   devtron:
     registry: ""
-    image: "hyperion:1ae65fbb-280-36074"
-    cicdImage: "devtron:1ae65fbb-434-36069"
+    image: "hyperion:261df88d-280-36531"
+    cicdImage: "devtron:261df88d-434-36530"
     imagePullPolicy: IfNotPresent
     customOverrides: {}
     podSecurityContext:
@@ -117,7 +117,7 @@ components:
       image: postgres_exporter:v0.10.1
   gitsensor:
     registry: ""
-    image: "git-sensor:880420ac-200-36032"
+    image: "git-sensor:b82f5fdb-200-36532"
     imagePullPolicy: IfNotPresent
     serviceMonitor:
       enabled: false

charts/devtron/values.yaml

@@ -42,7 +42,7 @@ nfs:
 extraManifests: []
 installer:
   repo: "devtron-labs/devtron"
-  release: "v1.8.0"
+  release: "v1.8.2"
   registry: ""
   image: inception
   tag: 473deaa4-185-21582
@@ -97,13 +97,13 @@ components:
         FEATURE_CODE_MIRROR_ENABLE: "true"
         FEATURE_GROUPED_APP_LIST_FILTERS_ENABLE: "true"
     registry: ""
-    image: "dashboard:5196e935-690-36024"
+    image: "dashboard:b00aa204-690-36533"
     imagePullPolicy: IfNotPresent
     healthPort: 8080
   devtron:
     registry: ""
-    image: "hyperion:1ae65fbb-280-36074"
-    cicdImage: "devtron:1ae65fbb-434-36069"
+    image: "hyperion:261df88d-280-36531"
+    cicdImage: "devtron:261df88d-434-36530"
     imagePullPolicy: IfNotPresent
     customOverrides: {}
     healthPort: 8080
@@ -200,7 +200,7 @@ components:
       volumeSize: "20Gi"
   gitsensor:
     registry: ""
-    image: "git-sensor:880420ac-200-36032"
+    image: "git-sensor:b82f5fdb-200-36532"
     imagePullPolicy: IfNotPresent
     serviceMonitor:
       enabled: false

cmd/external-app/externalApp.go

@@ -20,6 +20,8 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"github.com/devtron-labs/common-lib/securestore"
+	"log"
 	"net/http"
 	"os"
 	"time"
@@ -35,6 +37,13 @@ import (
 	"go.uber.org/zap"
 )
 
+func init() {
+	err := securestore.SetEncryptionKey()
+	if err != nil {
+		log.Println("error in setting encryption key", "err", err)
+	}
+}
+
 type App struct {
 	db             *pg.DB
 	sessionManager *authMiddleware.SessionManager

devtron-images.txt.source

@@ -11,13 +11,13 @@ quay.io/devtron/chart-sync:880420ac-836-36037
 quay.io/devtron/ci-runner:880420ac-138-36030
 quay.io/devtron/clair:4.3.6
 quay.io/devtron/curl:7.73.0
-quay.io/devtron/dashboard:5196e935-690-36024
+quay.io/devtron/dashboard:b00aa204-690-36533
 quay.io/devtron/devtron-utils:dup-chart-repo-v1.1.0
-quay.io/devtron/devtron:1ae65fbb-434-36069
+quay.io/devtron/devtron:261df88d-434-36530
 quay.io/devtron/dex:v2.30.2
-quay.io/devtron/git-sensor:880420ac-200-36032
+quay.io/devtron/git-sensor:b82f5fdb-200-36532
 quay.io/devtron/grafana:7.3.1
-quay.io/devtron/hyperion:1ae65fbb-280-36074
+quay.io/devtron/hyperion:261df88d-280-36531
 quay.io/devtron/image-scanner:f21e02cb-141-34534
 quay.io/devtron/inception:473deaa4-185-21582
 quay.io/devtron/k8s-sidecar:1.1.0

env_gen.md

@@ -187,6 +187,7 @@
  | ECR_REPO_NAME_PREFIX | string |test/ | Prefix for ECR repo to be created in does not exist |  | false |
  | ENABLE_ASYNC_ARGO_CD_INSTALL_DEVTRON_CHART | bool |false | To enable async installation of gitops application |  | false |
  | ENABLE_ASYNC_INSTALL_DEVTRON_CHART | bool |false | To enable async installation of no-gitops application |  | false |
+ | ENABLE_LINKED_CI_ARTIFACT_COPY | bool |false | Enable copying artifacts from parent CI pipeline to linked CI pipeline during creation |  | false |
  | EPHEMERAL_SERVER_VERSION_REGEX | string |v[1-9]\.\b(2[3-9]\|[3-9][0-9])\b.* | ephemeral containers support version regex that is compared with k8sServerVersion |  | false |
  | EVENT_URL | string |http://localhost:3000/notify | Notifier service url |  | false |
  | EXECUTE_WIRE_NIL_CHECKER | bool |false | checks for any nil pointer in wire.go |  | false |
@@ -225,6 +226,7 @@
  | LENS_URL | string |http://lens-milandevtron-service:80 | Lens micro-service URL |  | false |
  | LIMIT_CI_CPU | string |0.5 |  |  | false |
  | LIMIT_CI_MEM | string |3G |  |  | false |
+ | LINKED_CI_ARTIFACT_COPY_LIMIT | int |10 | Maximum number of artifacts to copy from parent CI pipeline to linked CI pipeline |  | false |
  | LOGGER_DEV_MODE | bool |false | Enables a different logger theme. |  | false |
  | LOG_LEVEL | int |-1 |  |  | false |
  | MAX_SESSION_PER_USER | int |5 | max no of cluster terminal pods can be created by an user |  | false |

go.mod

@@ -338,7 +338,7 @@ require (
 replace (
 	github.com/argoproj/argo-workflows/v3 v3.5.13 => github.com/devtron-labs/argo-workflows/v3 v3.5.13
 	github.com/cyphar/filepath-securejoin v0.4.1 => github.com/cyphar/filepath-securejoin v0.3.6 // indirect
-	github.com/devtron-labs/authenticator => github.com/devtron-labs/devtron-services/authenticator v0.0.0-20250910095456-9e49667d03f5
-	github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250910095456-9e49667d03f5
+	github.com/devtron-labs/authenticator => github.com/devtron-labs/devtron-services/authenticator v0.0.0-20251027071349-2031d8107953
+	github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20251027071349-2031d8107953
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 => go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1
 )

go.sum

@@ -237,10 +237,10 @@ github.com/denisenkom/go-mssqldb v0.0.0-20200428022330-06a60b6afbbc h1:VRRKCwnzq
 github.com/denisenkom/go-mssqldb v0.0.0-20200428022330-06a60b6afbbc/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
 github.com/devtron-labs/argo-workflows/v3 v3.5.13 h1:3pINq0gXOSeTw2z/vYe+j80lRpSN5Rp/8mfQORh8SmU=
 github.com/devtron-labs/argo-workflows/v3 v3.5.13/go.mod h1:/vqxcovDPT4zqr4DjR5v7CF8ggpY1l3TSa2CIG3jmjA=
-github.com/devtron-labs/devtron-services/authenticator v0.0.0-20250910095456-9e49667d03f5 h1:NpkOPkaqVYWTArDgnwmhyh4W/qLppSE3VNqSZ27Z3/E=
-github.com/devtron-labs/devtron-services/authenticator v0.0.0-20250910095456-9e49667d03f5/go.mod h1:9LCkYfiWaEKIBkmxw9jX1GujvEMyHwmDtVsatffAkeU=
-github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250910095456-9e49667d03f5 h1:DNyGQjgukvQ7cA0Dwd6+4DR5rKr5SFxv+eANWbFIc8o=
-github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250910095456-9e49667d03f5/go.mod h1:BPvuxIUW9TNYZ3+9r39nMzeORMcLqTwNkakirqp9AzU=
+github.com/devtron-labs/devtron-services/authenticator v0.0.0-20251027071349-2031d8107953 h1:LE08yoM+m/HgSXr8/aLwWUr0S6FBmC/853qpkZtrrkY=
+github.com/devtron-labs/devtron-services/authenticator v0.0.0-20251027071349-2031d8107953/go.mod h1:9LCkYfiWaEKIBkmxw9jX1GujvEMyHwmDtVsatffAkeU=
+github.com/devtron-labs/devtron-services/common-lib v0.0.0-20251027071349-2031d8107953 h1:gKhFrhn+XVAunhJdZHrpQF6Q6HR81kux1ugqlcsyJRA=
+github.com/devtron-labs/devtron-services/common-lib v0.0.0-20251027071349-2031d8107953/go.mod h1:BPvuxIUW9TNYZ3+9r39nMzeORMcLqTwNkakirqp9AzU=
 github.com/devtron-labs/go-bitbucket v0.9.60-beta h1:VEx1jvDgdtDPS6A1uUFoaEi0l1/oLhbr+90xOwr6sDU=
 github.com/devtron-labs/go-bitbucket v0.9.60-beta/go.mod h1:GnuiCesvh8xyHeMCb+twm8lBR/kQzJYSKL28ZfObp1Y=
 github.com/devtron-labs/protos v0.0.3-0.20250323220609-ecf8a0f7305e h1:U6UdYbW8a7xn5IzFPd8cywjVVPfutGJCudjePAfL/Hs=

internal/sql/repository/CiArtifactRepository.go

@@ -124,6 +124,7 @@ type CiArtifactRepository interface {
 	GetArtifactsByCDPipelineAndRunnerType(cdPipelineId int, runnerType bean.WorkflowType) ([]CiArtifact, error)
 	SaveAll(artifacts []*CiArtifact) ([]*CiArtifact, error)
 	GetArtifactsByCiPipelineId(ciPipelineId int) ([]CiArtifact, error)
+	GetLatestArtifactsByCiPipelineId(ciPipelineId, limit int) ([]CiArtifact, error)
 	GetArtifactsByCiPipelineIds(ciPipelineIds []int) ([]CiArtifact, error)
 	FinDByParentCiArtifactAndCiId(parentCiArtifact int, ciPipelineIds []int) ([]*CiArtifact, error)
 	GetLatest(cdPipelineId int) (int, error)
@@ -680,6 +681,19 @@ func (impl CiArtifactRepositoryImpl) GetArtifactsByCiPipelineId(ciPipelineId int
 	return artifacts, err
 }
 
+func (impl CiArtifactRepositoryImpl) GetLatestArtifactsByCiPipelineId(ciPipelineId, limit int) ([]CiArtifact, error) {
+	var artifacts []CiArtifact
+	err := impl.dbConnection.
+		Model(&artifacts).
+		Column("ci_artifact.*").
+		Join("INNER JOIN ci_pipeline cp on cp.id=ci_artifact.pipeline_id").
+		Where("ci_artifact.pipeline_id = ?", ciPipelineId).
+		Where("cp.deleted = ?", false).
+		Order("ci_artifact.id DESC").Limit(limit).
+		Select()
+	return artifacts, err
+}
+
 func (impl CiArtifactRepositoryImpl) GetArtifactsByCiPipelineIds(ciPipelineIds []int) ([]CiArtifact, error) {
 	var artifacts []CiArtifact
 	if len(ciPipelineIds) == 0 {

internal/sql/repository/GitOpsConfigRepository.go

@@ -17,6 +17,7 @@
 package repository
 
 import (
+	"github.com/devtron-labs/common-lib/securestore"
 	"github.com/devtron-labs/devtron/pkg/sql"
 	"github.com/go-pg/pg"
 	"go.uber.org/zap"
@@ -41,24 +42,24 @@ type GitOpsConfigRepositoryImpl struct {
 }
 
 type GitOpsConfig struct {
-	tableName             struct{} `sql:"gitops_config" pg:",discard_unknown_columns"`
-	Id                    int      `sql:"id,pk"`
-	Provider              string   `sql:"provider"`
-	Username              string   `sql:"username"`
-	Token                 string   `sql:"token"`
-	GitLabGroupId         string   `sql:"gitlab_group_id"`
-	GitHubOrgId           string   `sql:"github_org_id"`
-	AzureProject          string   `sql:"azure_project"`
-	Host                  string   `sql:"host"`
-	Active                bool     `sql:"active,notnull"`
-	AllowCustomRepository bool     `sql:"allow_custom_repository,notnull"`
-	BitBucketWorkspaceId  string   `sql:"bitbucket_workspace_id"`
-	BitBucketProjectKey   string   `sql:"bitbucket_project_key"`
-	EmailId               string   `sql:"email_id"`
-	EnableTLSVerification bool     `sql:"enable_tls_verification"`
-	TlsCert               string   `sql:"tls_cert"`
-	TlsKey                string   `sql:"tls_key"`
-	CaCert                string   `sql:"ca_cert"`
+	tableName             struct{}                    `sql:"gitops_config" pg:",discard_unknown_columns"`
+	Id                    int                         `sql:"id,pk"`
+	Provider              string                      `sql:"provider"`
+	Username              string                      `sql:"username"`
+	Token                 securestore.EncryptedString `sql:"token"`
+	GitLabGroupId         string                      `sql:"gitlab_group_id"`
+	GitHubOrgId           string                      `sql:"github_org_id"`
+	AzureProject          string                      `sql:"azure_project"`
+	Host                  string                      `sql:"host"`
+	Active                bool                        `sql:"active,notnull"`
+	AllowCustomRepository bool                        `sql:"allow_custom_repository,notnull"`
+	BitBucketWorkspaceId  string                      `sql:"bitbucket_workspace_id"`
+	BitBucketProjectKey   string                      `sql:"bitbucket_project_key"`
+	EmailId               string                      `sql:"email_id"`
+	EnableTLSVerification bool                        `sql:"enable_tls_verification"`
+	TlsCert               string                      `sql:"tls_cert"`
+	TlsKey                string                      `sql:"tls_key"`
+	CaCert                string                      `sql:"ca_cert"`
 	sql.AuditLog
 }
 
@@ -71,15 +72,24 @@ func (impl *GitOpsConfigRepositoryImpl) GetConnection() *pg.DB {
 }
 
 func (impl *GitOpsConfigRepositoryImpl) CreateGitOpsConfig(model *GitOpsConfig, tx *pg.Tx) (*GitOpsConfig, error) {
-	err := tx.Insert(model)
+	var err error
+	model.Token, err = securestore.EncryptString(model.Token.String())
+	if err != nil {
+		return model, err
+	}
+	err = tx.Insert(model)
 	if err != nil {
 		impl.logger.Error(err)
 		return model, err
 	}
 	return model, nil
 }
-func (impl *GitOpsConfigRepositoryImpl) UpdateGitOpsConfig(model *GitOpsConfig, tx *pg.Tx) error {
-	err := tx.Update(model)
+func (impl *GitOpsConfigRepositoryImpl) UpdateGitOpsConfig(model *GitOpsConfig, tx *pg.Tx) (err error) {
+	model.Token, err = securestore.EncryptString(model.Token.String())
+	if err != nil {
+		return err
+	}
+	err = tx.Update(model)
 	if err != nil {
 		impl.logger.Error(err)
 		return err