Merge branch 'main' into mk/kill-32-bit

.github/workflows/docker-publish-hardened.yaml

@@ -33,7 +33,7 @@ env:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.runner }}
     permissions:
       contents: read
       packages: write
@@ -43,10 +43,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        platform:
-          - linux/amd64
-          - linux/arm64
-          - linux/arm/v7
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-latest
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
 
     steps:
       - name: Enable Debug Logs

.github/workflows/docker-publish-rootless.yaml

@@ -37,7 +37,7 @@ env:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.runner }}
     permissions:
       contents: read
       packages: write
@@ -47,10 +47,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        platform:
-          - linux/amd64
-          - linux/arm64
-          - linux/arm/v7
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-latest
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
 
     steps:
       - name: Enable Debug Logs

.github/workflows/docker-publish.yaml

@@ -37,7 +37,7 @@ permissions:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.runner }}
     permissions:
       contents: read     # Allows access to repository contents (read-only)
       packages: write    # Allows pushing to GHCR
@@ -47,10 +47,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        platform:
-          - linux/amd64
-          - linux/arm64
-          - linux/arm/v7
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-latest
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
 
     steps:
       - name: Checkout repository

backend/.goreleaser.yaml

@@ -17,8 +17,6 @@ builds:
       - freebsd
     goarch:
       - amd64
-      - "386"
-      - arm
       - arm64
       - riscv64
     flags:
@@ -28,20 +26,9 @@ builds:
       - -X main.version={{.Version}}
       - -X main.commit={{.Commit}}
       - -X main.date={{.Date}}
-    ignore:
-      - goos: windows
-        goarch: arm
-      - goos: windows
-        goarch: "386"
-      - goos: freebsd
-        goarch: arm
-      - goos: freebsd
-        goarch: "386"
     tags:
       - >-
         {{- if eq .Arch "riscv64" }}nodynamic
-        {{- else if eq .Arch "arm" }}nodynamic
-        {{- else if eq .Arch "386" }}nodynamic
         {{- else if eq .Os "freebsd" }}nodynamic
         {{ end }}
 
@@ -62,7 +49,6 @@ archives:
       {{ .ProjectName }}_
       {{- title .Os }}_
       {{- if eq .Arch "amd64" }}x86_64
-      {{- else if eq .Arch "386" }}i386
       {{- else }}{{ .Arch }}{{ end }}
       {{- if .Arm }}v{{ .Arm }}{{ end }}
     # use zip for windows archives

backend/internal/data/migrations/sqlite3/20250907000000_make_password_nullable.sql

@@ -1,4 +1,5 @@
 -- +goose Up
+-- +goose StatementBegin
 -- SQLite doesn't support ALTER COLUMN directly, so we need to recreate the table
 -- Create a temporary table with the new schema
 CREATE TABLE users_temp (
@@ -20,7 +21,7 @@ CREATE TABLE users_temp (
 );
 
 -- Copy data from the original table
-INSERT INTO users_temp SELECT id, created_at, updated_at, name, email, password, is_superuser, superuser, role, activated_on, group_users FROM users;
+INSERT INTO users_temp SELECT * FROM users;
 
 -- Drop the original table
 DROP TABLE users;
@@ -29,4 +30,39 @@ DROP TABLE users;
 ALTER TABLE users_temp RENAME TO users;
 
 -- Recreate the unique index
-CREATE UNIQUE INDEX users_email_key on users (email);
+CREATE UNIQUE INDEX users_email_key on users (email);
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+-- Create the original table structure
+CREATE TABLE users_temp (
+    id           uuid                not null
+        primary key,
+    created_at   datetime            not null,
+    updated_at   datetime            not null,
+    name         text                not null,
+    email        text                not null,
+    password     text                not null,
+    is_superuser bool default false  not null,
+    superuser    bool default false  not null,
+    role         text default 'user' not null,
+    activated_on datetime,
+    group_users  uuid                not null
+        constraint users_groups_users
+            references groups
+            on delete cascade
+);
+
+-- Copy data from the current table (this will fail if there are NULL passwords)
+INSERT INTO users_temp SELECT * FROM users;
+
+-- Drop the current table
+DROP TABLE users;
+
+-- Rename the temporary table
+ALTER TABLE users_temp RENAME TO users;
+
+-- Recreate the unique index
+CREATE UNIQUE INDEX users_email_key on users (email);
+-- +goose StatementEnd

backend/internal/data/migrations/sqlite3/20251226154700_fix_roles_and_superuser.sql

@@ -1,4 +0,0 @@
--- +goose Up
--- Force the role and superuser flags, previous nullable password migration (prior to v0.22.2)
--- caused them to flip-flop during migration for some users.
-UPDATE users SET role = 'owner', is_superuser = 0, superuser = 0;