feat: implement Dex user provisioning and password hashing functionality

.github/workflows/coverage.yml

@@ -19,9 +19,9 @@ jobs:
           fetch-depth: 0
       - name: Set npm token
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.BOT_TOKEN }}
         run: |
-          echo "@linode:registry=https://npm.pkg.github.com/linode" > .npmrc
+          echo "@linode:registry=https://npm.pkg.github.com" > .npmrc
           echo "//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}" >> .npmrc
           echo '::set-output name=diff::1'
 

.github/workflows/main.yml

@@ -2,6 +2,7 @@
 # Required repository/environment secrets:
 #   OCI_USERNAME              - registry login username
 #   DOCKERHUB_LINODEBOT_TOKEN - registry login token
+#   BOT_TOKEN                 - GitHub token with package read access, for npm install of @linode/*-client-grpc packages from GitHub Packages
 name: Build test push release
 on:
   pull_request:
@@ -77,6 +78,8 @@ jobs:
           tags: ${{ env.REGISTRY }}/${{ env.REPO }}:${{ steps.set_tag.outputs.tag }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+          secrets: |
+            NPM_TOKEN=${{ secrets.BOT_TOKEN }}
       - name: Build, test
         if: ${{ env.SHOULD_PUSH != 'true' }}
         uses: docker/build-push-action@v7
@@ -85,3 +88,5 @@ jobs:
           context: .
           tags: not-used:tmp
           cache-from: type=gha
+          secrets: |
+            NPM_TOKEN=${{ secrets.BOT_TOKEN }}

.github/workflows/release-software.yml

@@ -1,6 +1,7 @@
 # Required repository/environment secrets:
 #   OCI_USERNAME              - registry login username
 #   DOCKERHUB_LINODEBOT_TOKEN - registry login token
+#   BOT_TOKEN                 - GitHub token with package read access, for npm install of @linode/*-client-grpc packages from GitHub Packages
 name: Release Software
 
 on:
@@ -110,6 +111,8 @@ jobs:
           build-args: |
             VERSION=${{ env.GIT_TAG }}
           tags: ${{ env.CONTAINER_IMAGE_TAG }}
+          secrets: |
+            NPM_TOKEN=${{ secrets.BOT_TOKEN }}
 
       - name: Create GitHub Release
         uses: linode/apl-gh-actions/actions/release-create-github-release@v0.4.0
@@ -124,6 +127,13 @@ jobs:
         with:
           node-version: 24
 
+      - name: Set npm token
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.BOT_TOKEN }}
+        run: |
+          echo "@linode:registry=https://npm.pkg.github.com" >> .npmrc
+          echo "//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}" >> .npmrc
+
       - name: Build OpenAPI schema
         run: |
           npm ci

.npmrc

@@ -1,3 +1,3 @@
 # The redkubes at github packages is a proxy for all npm packages.
-@redkubes:registry=https://npm.pkg.github.com/redkubes
+@linode:registry=https://npm.pkg.github.com
 engine-strict=true

Dockerfile

@@ -1,4 +1,4 @@
 FROM node:24-alpine as ci
 
 ENV NODE_ENV=test
 ENV BLUEBIRD_DEBUG=0
@@ -9,11 +9,16 @@
 WORKDIR /app
 
 # Install dependencies before copying the full source code to take advantage of Docker layer caching
-COPY package*.json ./
+COPY package*.json .npmrc ./
 # Needed for postinstall (build:models) during npm ci
 COPY src/build-spec.ts ./src/build-spec.ts
 COPY src/openapi ./src/openapi
-RUN npm ci
+# @linode/dex-client-grpc is hosted on GitHub Packages, which requires auth even for public pkg.
+RUN --mount=type=secret,id=NPM_TOKEN \
+  cp .npmrc .npmrc.orig && \
+  echo "//npm.pkg.github.com/:_authToken=$(cat /run/secrets/NPM_TOKEN)" >> .npmrc && \
+  npm ci && \
+  mv .npmrc.orig .npmrc
 
 COPY . .* ./
 RUN npm run build
@@ -21,7 +26,7 @@
 RUN npm run test
 
 # --------------- Cleanup
 FROM ci as clean
 # below command removes the packages specified in devDependencies and set NODE_ENV to production
 RUN npm prune --production
 # --------------- Production stage