mirror of
https://github.com/bitwarden/self-host.git
synced 2026-06-27 13:55:46 +00:00
1821ae8710
Prevents build-bitwarden-lite from overwriting existing production container image tags by checking both GHCR and ACR registries. Changes: - Check both GHCR and ACR before building - Distinguish 'not found' from 'error' to fail closed - Only validates version tags (X.Y.Z format) - Skips check for dev/branch tags to allow rebuilds - Fails with clear error if tag exists or check fails Security: Prevents silent failures from registry errors, rate limits, auth failures, or network timeouts from allowing overwrites. This provides defense-in-depth protection against tag overwrites from any workflow source, regardless of how it was triggered.
Self-Host Release Repository
Bitwarden's dedicated self-hosted release repository. This holds the installation scripts and container images for our self-host project.
For any issues regarding a specific client application, please visit bitwarden/clients
Container Images
Bitwarden provides OCI-Compliant container images in our ghcr.io repository.
All images published to ghcr.io are
signed by using Cosign's keyless signing. The images can be
verified with the following command (where $IMAGE_NAME is set to an image in our repository):
$ cosign verify ghcr.io/bitwarden/$IMAGE_NAME:latest --certificate-identity-regexp="https://github\.com/bitwarden/self-host/\.github/workflows/release\.yml@.*" --certificate-oidc-issuer="https://token.actions.githubusercontent.com"
Quick Deploy
