Build the embedded admin UI from CyberCoveLLC/threshold-ui

- internal/ui/VERSION pins the threshold-ui commit
- scripts/uiupdate.sh and scripts/build-ui.sh clone
  https://repo.anhonesthost.net/CyberCoveLLC/threshold-ui.git; the
  GitHub artifact download path (hashicorp/boundary-ui) is removed
- clone/embed directory renamed .tmp/boundary-ui -> .tmp/threshold-ui
  (Makefile, assets.go, .github build.yml paths)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.github/workflows/build.yml

@@ -170,7 +170,7 @@ jobs:
           commit: ${{ steps.set-sha.outputs.sha }}
           repo: "hashicorp/boundary-ui"
           name: admin-ui-${{ needs.product-metadata.outputs.product-edition }}
-          path: internal/ui/.tmp/boundary-ui/ui/admin/dist
+          path: internal/ui/.tmp/threshold-ui/ui/admin/dist
       - name: Go Build
         env:
           CGO_ENABLED: "0"
@@ -246,7 +246,7 @@ jobs:
           commit: ${{ steps.set-sha.outputs.sha }}
           repo: "hashicorp/boundary-ui"
           name: admin-ui-${{ needs.product-metadata.outputs.product-edition }}
-          path: internal/ui/.tmp/boundary-ui/ui/admin/dist
+          path: internal/ui/.tmp/threshold-ui/ui/admin/dist
       - name: Go Build
         env:
           CGO_ENABLED: "0"
@@ -345,7 +345,7 @@ jobs:
           commit: ${{ steps.set-sha.outputs.sha }}
           repo: "hashicorp/boundary-ui"
           name: admin-ui-${{ needs.product-metadata.outputs.product-edition }}
-          path: internal/ui/.tmp/boundary-ui/ui/admin/dist
+          path: internal/ui/.tmp/threshold-ui/ui/admin/dist
       - name: Go Build
         env:
           CGO_ENABLED: "0"

Makefile

@@ -98,7 +98,7 @@ lint-diff:
 # Set env for all UI targets.
 UI_TARGETS := update-ui-version build-ui build-ui-ifne clean-ui
 # Note the extra .tmp path segment in UI_CLONE_DIR is significant and required.
-$(UI_TARGETS): export UI_CLONE_DIR      := internal/ui/.tmp/boundary-ui
+$(UI_TARGETS): export UI_CLONE_DIR      := internal/ui/.tmp/threshold-ui
 $(UI_TARGETS): export UI_VERSION_FILE   := internal/ui/VERSION
 $(UI_TARGETS): export UI_DEFAULT_BRANCH := main
 $(UI_TARGETS): export UI_COMMITISH ?=
@@ -127,7 +127,7 @@ clean-ui:
 
 .PHONY: build-ui-ifne
 build-ui-ifne:
-ifeq (,$(wildcard internal/ui/.tmp/boundary-ui/ui/admin/dist))
+ifeq (,$(wildcard internal/ui/.tmp/threshold-ui/ui/admin/dist))
 	@echo "==> No UI assets found, building..."
 	@$(MAKE) build-ui
 else

README.md

@@ -186,8 +186,13 @@ make build        # builds bin/threshold (requires the embedded UI, see Makefile
 make build-no-ui  # builds bin/threshold without the embedded admin UI
 ```
 
-The embedded admin UI is built from the upstream `boundary-ui` project and is
-not part of this repository.
+The embedded admin UI is built from
+[`CyberCoveLLC/threshold-ui`](https://repo.anhonesthost.net/CyberCoveLLC/threshold-ui),
+a rebranded community fork of HashiCorp's `boundary-ui`, and is not part of this
+repository. `internal/ui/VERSION` pins the UI commit; `make build-ui` clones that
+commit into `internal/ui/.tmp/threshold-ui` and builds `ui/admin/dist`
+(requires Node 22+ and pnpm 10). `make update-ui-version` moves the pin
+(`UI_COMMITISH=<sha|branch>`).
 
 ## Contributing
 

internal/ui/VERSION

@@ -1,4 +1,4 @@
-2766be2c2e941020878f837af6188eb500579e31
+3f2be6fab0990d9d63ae6cd7fa58cbf367e72067
 # This file determines the version of the UI to embed in the boundary binary.
 # Update this file by running 'make update-ui-version' from the root of this repo.
 # Set UI_COMMITISH when running the above target to update to a specific version.

internal/ui/assets.go

@@ -13,11 +13,11 @@ import (
 )
 
 // Sadly we can't embed this into the embed line, but we use it elsewhere
-const contentDir = ".tmp/boundary-ui/ui/admin/dist"
+const contentDir = ".tmp/threshold-ui/ui/admin/dist"
 
 // content is our static web server content.
 //
-//go:embed .tmp/boundary-ui/ui/admin/dist
+//go:embed .tmp/threshold-ui/ui/admin/dist
 var content embed.FS
 
 func Handler() http.Handler {

scripts/build-ui.sh

@@ -14,24 +14,9 @@ if [ -z "$UI_VERSION_FILE" ]; then
 fi
 
 UI_EDITION=$(make --no-print-directory edition)
-# allow override for the source of ui files
-# used by end-to-end tests to build enterprise edition from community files
-# UI_SRC_OVERRIDE will override which edition is pulled
-# but UI_EDITION_SRC will still determine the build version
-if [ -n "$UI_SRC_OVERRIDE" ]; then
-  UI_SRC=$UI_SRC_OVERRIDE
-else
-  UI_SRC=$UI_EDITION
-fi
-
-if [ $UI_SRC == "oss" ]; then
-  UI_REPO=https://github.com/hashicorp/boundary-ui
-  REPO_NAME=boundary-ui
-else
-  UI_VERSION_FILE="${UI_VERSION_FILE}_ent"
-  UI_REPO=https://github.com/hashicorp/boundary-ui-enterprise
-  REPO_NAME=boundary-ui-enterprise
-fi
+# Threshold ships a single (community) edition of the admin UI, built from the
+# CyberCoveLLC/threshold-ui fork of hashicorp/boundary-ui.
+UI_REPO=${UI_REPO:-https://repo.anhonesthost.net/CyberCoveLLC/threshold-ui.git}
 
 UI_CURRENT_COMMIT=$(head -n1 < "${UI_VERSION_FILE}" | cut -d' ' -f1)
 
@@ -42,31 +27,6 @@ else
   echo "==> Building custom UI version $UI_COMMITISH"
 fi;
 
-if which gh &> /dev/null;  then
-    echo "Found gh cli, attempting to download ui assets"
-
-    artifact_id=$(gh api "repos/hashicorp/${REPO_NAME}/actions/artifacts" --paginate | \
-        jq ".artifacts[] | select(.workflow_run.head_sha == \"${UI_COMMITISH}f\" and .name == \"admin-ui-${UI_SRC}\")" | \
-        jq --slurp '.[0]' | \
-        jq -r '.id')
-
-    if [[ "${artifact_id}" != "null" ]]; then
-        echo "Downloading artifact: ${artifact_id} for admin-ui-${UI_SRC} ${UI_COMMITISH}"
-        tmp_dir=$(mktemp -d)
-        gh api "repos/hashicorp/${REPO_NAME}/actions/artifacts/${artifact_id}/zip" > "${tmp_dir}/boundary-ui.zip"
-        trap 'rm -rf ${tmp_dir}' EXIT
-
-        # remove any previous artifact download or git clone
-        rm -rf "${UI_CLONE_DIR}"
-
-        mkdir -p "${UI_CLONE_DIR}/ui/admin/dist"
-        unzip "${tmp_dir}/boundary-ui.zip" -d "${UI_CLONE_DIR}/ui/admin/dist"
-        exit $?
-    else
-        echo "could not find artifact: admin-ui-${UI_SRC} ${UI_COMMITISH}, falling back to git clone"
-    fi
-fi
-
 if ! which pnpm &> /dev/null; then
     echo "Pnpm must be installed to build ui assets from a git clone.\nPlease ensure Node v20+ and Pnpm v10+ are installed."
     exit 1
@@ -90,6 +50,6 @@ git checkout "${UI_COMMITISH}"
 git pull --ff-only origin "${UI_COMMITISH}"
 git reset --hard "${UI_COMMITISH}"
 
-pnpm install
+pnpm install --frozen-lockfile --filter "admin..."
 EDITION=${UI_EDITION} pnpm build
 popd

scripts/uiupdate.sh

@@ -13,14 +13,9 @@ if [ -z "$UI_COMMITISH" ]; then
 	echo "Must set UI_COMMITISH"; exit 1
 fi
 
-UI_EDITION=$(make --no-print-directory edition)
-
-if [ "$UI_EDITION" == "oss" ]; then
-  UI_REPO=https://github.com/hashicorp/boundary-ui
-else
-  UI_VERSION_FILE="${UI_VERSION_FILE}_ent"
-  UI_REPO=https://github.com/hashicorp/boundary-ui-enterprise
-fi
+# Threshold ships a single (community) edition of the admin UI, built from the
+# CyberCoveLLC/threshold-ui fork of hashicorp/boundary-ui.
+UI_REPO=${UI_REPO:-https://repo.anhonesthost.net/CyberCoveLLC/threshold-ui.git}
 
 shafileabs="$(pwd)/${UI_VERSION_FILE}"
 V="$(git ls-remote ${UI_REPO} ${UI_COMMITISH})"