Merge commit '5d4cf8198cc0e479c08479ffe76129cf6c75d2f2' of https://gi…

…thub.com/gravitational/teleport into branch/v14

.github/ISSUE_TEMPLATE/test-plan-docs.md

@@ -67,7 +67,7 @@ to select "Version 12.0" in the documentation version switcher.
 ### Installation
 
 - [ ] General [installation page](../../docs/pages/installation.mdx): ensure that
-  installation methods support the new release candidate. 
+  installation methods support the new release candidate.
 - [ ] Enterprise Cloud [downloads
   page](../../docs/pages/choose-an-edition/teleport-cloud/downloads.mdx): ensure that
   the release cnadidate is available at the repositories we link to.
@@ -80,7 +80,7 @@ to select "Version 12.0" in the documentation version switcher.
 - [ ] [Teleport Enterprise with
   Helm](../../docs/pages/deploy-a-cluster/helm-deployments/kubernetes-cluster.mdx)
 - [ ] [Teleport Enterprise with
-  Terraform](../../docs/pages/deploy-a-cluster/deployments/aws-terraform.mdx)
+  Terraform](../../docs/pages/deploy-a-cluster/deployments/aws-ha-autoscale-cluster-terraform.mdx)
 
 ### New feature docs
 

.github/ISSUE_TEMPLATE/testplan.md

@@ -793,7 +793,7 @@ tsh bench web sessions --max=5000 --web user ls
 ### AWS
 
 - [ ] Deploy Teleport to AWS. Using DynamoDB & S3
-- [ ] Deploy Teleport Enterprise to AWS. Using HA Setup https://gravitational.com/teleport/docs/aws-terraform-guide/
+- [ ] Deploy Teleport Enterprise to AWS. Using HA Setup https://goteleport.com/docs/deploy-a-cluster/deployments/aws-ha-autoscale-cluster-terraform/
 
 ### GCP
 

.github/workflows/bloat.yaml

@@ -29,15 +29,15 @@ jobs:
 
     steps:
       - name: Checkout base
-        uses: actions/checkout@v3
+        uses: actions/checkout@v3 # Cannot upgrade to v4 while this runs in centos:7 due to nodejs GLIBC incompatibility
         with:
-          ref: ${{ github.event.push.before }}
+          ref: ${{ github.event.before }}
 
       - name: Prepare workspace
         uses: ./.github/actions/prepare-workspace
 
       - name: Checkout shared-workflow
-        uses: actions/checkout@v3
+        uses: actions/checkout@v3 # Cannot upgrade to v4 while this runs in centos:7 due to nodejs GLIBC incompatibility
         with:
           repository: gravitational/shared-workflows
           path: .github/shared-workflows
@@ -49,11 +49,11 @@ jobs:
         with:
           path: |
             ~/teleport_base_build_stats
-          key: ${{ runner.os }}-${{ github.event.push.before }}
+          key: ${{ github.job }}-${{ runner.os }}-${{ github.event.before }}
 
       - name: Generate GitHub Token
         id: generate_token
-        uses: tibdex/github-app-token@b62528385c34dbc9f38e5f4225ac829252d1ea92 # v1.8.0
+        uses: actions/create-github-app-token@v1.0.5 # Cannot upgrade past v1.1 while this runs in centos:7 due to nodejs GLIBC incompatibility
         with:
           app_id: ${{ secrets.REVIEWERS_APP_ID }}
           private_key: ${{ secrets.REVIEWERS_PRIVATE_KEY }}
@@ -66,14 +66,15 @@ jobs:
           cd .github/shared-workflows/bot && go run main.go -workflow=binary-sizes --artifacts="tbot,tctl,teleport,tsh" --builddir="../../../base_build" -token="${{ steps.generate_token.outputs.token }}" -reviewers="${{ secrets.reviewers }}"  >> ~/teleport_base_build_stats
           echo "base_stats_file=~/teleport_base_build_stats" >> $GITHUB_OUTPUT
           echo "base_stats=$(cat ~/teleport_base_build_stats)" >> $GITHUB_ENV
+
       - if: ${{ steps.cache-build-restore.outputs.cache-hit != 'true' }}
         name: Save base build
         id: base-build-save
         uses: actions/cache/save@v3
         with:
           path: |
             ${{ steps.build_base.outputs.base_stats_file }}
-          key: ${{ runner.os }}-${{ github.event.push.before }}
+          key: ${{ github.job }}-${{ runner.os }}-${{ github.event.before }}
 
       - if: ${{ steps.cache-build-restore.outputs.cache-hit == 'true' }}
         name: Restore base stats
@@ -82,21 +83,35 @@ jobs:
           echo "base_stats=$(cat ~/teleport_base_build_stats)" >> $GITHUB_ENV
 
       - name: Checkout branch
-        uses: actions/checkout@v3
+        uses: actions/checkout@v3 # Cannot upgrade to v4 while this runs in centos:7 due to nodejs GLIBC incompatibility
         with:
           clean: false
-          ref: ${{ github.event.push.after }}
+          ref: ${{ github.event.after }}
 
       - name: Checkout shared-workflow
-        uses: actions/checkout@v3
+        uses: actions/checkout@v3 # Cannot upgrade to v4 while this runs in centos:7 due to nodejs GLIBC incompatibility
         with:
           repository: gravitational/shared-workflows
           path: .github/shared-workflows
-          ref: tross/skip_items_on_pr
+          ref: main
 
-      - name: Check branch for bloat
+      - name: Build Binaries
         id: build_branch
         run: |
-          make WEBASSETS_SKIP_BUILD=1 binaries
+          BUILD_SECRET=FAKE_SECRET make WEBASSETS_SKIP_BUILD=1 binaries
+
+      - name: Check for Environment Leak
+        id: check_branch_env_leak
+        run: |
+          for binary in $(pwd)/build/*; do \
+            if strings $binary | grep -q 'FAKE_SECRET'; then \
+              echo "Error: $binary contains FAKE_SECRET"; \
+              exit 1; \
+            fi; \
+          done
+
+      - name: Check for bloat
+        id: check_branch_bloat
+        run: |
           current=$(pwd)/build
-          cd .github/shared-workflows/bot && go run main.go -workflow=bloat --artifacts="tbot,tctl,teleport,tsh" --base="${base_stats}" --builddir="${current}" -token="${{ steps.generate_token.outputs.token }}" -reviewers="${{ secrets.reviewers }}" > $GITHUB_STEP_SUMMARY
+          cd .github/shared-workflows/bot && go run main.go -workflow=bloat --artifacts="tbot,tctl,teleport,tsh" --base="${base_stats}" --builddir="${current}" -token="${{ steps.generate_token.outputs.token }}" -reviewers="${{ secrets.reviewers }}" > $GITHUB_STEP_SUMMARY

.github/workflows/lint.yaml

@@ -23,6 +23,9 @@ jobs:
     container:
       image: ghcr.io/gravitational/teleport-buildbox:teleport14
 
+    env:
+      GOLANGCI_LINT_VERSION: v1.55.2
+
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -39,38 +42,38 @@ jobs:
       - name: golangci-lint (api)
         uses: golangci/golangci-lint-action@v3
         with:
-          version: latest
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
           working-directory: api
           skip-cache: true
       - name: golangci-lint (teleport)
         uses: golangci/golangci-lint-action@v3
         with:
-          version: latest
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
           args: --build-tags libfido2,piv
           skip-cache: true
       - name: golangci-lint (kube-agent-updater)
         uses: golangci/golangci-lint-action@v3
         with:
-          version: latest
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
           working-directory: integrations/kube-agent-updater
           skip-cache: true
       - name: golangci-lint (assets/backport)
         uses: golangci/golangci-lint-action@v3
         with:
-          version: latest
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
           working-directory: assets/backport
           skip-cache: true
       - name: golangci-lint (build.assets/tooling)
         uses: golangci/golangci-lint-action@v3
         with:
-          version: latest
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
           working-directory: build.assets/tooling
           skip-cache: true
 
       - uses: bufbuild/buf-setup-action@v1
         with:
           github_token: ${{ github.token }}
-          version: latest
+          version: v1.28.0
       - uses: bufbuild/buf-lint-action@v1
       - name: buf breaking from parent to self
         uses: bufbuild/buf-breaking-action@v1