release: on-prem 2026-07-15-001

[twk3]

Summary

On-prem release 2026-07-15-001.

Compose File Changes

• Added SSO volume mount to compose templates (requires ./scripts/generate-compose.sh if using custom templates)

New Environment Variables

• SSO_SAML_IDP_METADATA_FILE, SSO_SAML_ISSUER — required to enable SAML SSO
• SSO_SAML_PROVIDER_ID, SSO_SAML_DEFAULT_ROLE, SSO_SAML_AUTHN_REQUESTS_SIGNED, SSO_SAML_SP_CERT_FILE, SSO_SAML_SP_KEY_FILE — optional SAML SSO configuration
• DC_SSO_VOLUME — SAML SSO files directory (IdP metadata + optional SP PEMs)

Added

• SAML SSO support — delegate sign-in to your SAML 2.0 identity provider (Okta, Entra ID, etc.)
• GitHub Container Registry (GHCR) as an alternative image source for customer accounts without AWS IAM access
• Version discrepancy check in check-env.sh — warns when DC_CURRENTS_IMAGE_TAG does not match on-prem/VERSION

Test plan

• CI compose validation passes
• CI smoke tests pass
• After merge, tag release per README (on-prem/2026-07-15-001)

Summary by CodeRabbit

• New Features
  • Added SAML-based single sign-on for on-premises deployments.
  • Added GHCR image support for non-AWS accounts.
• Documentation
  • Documented new SSO configuration options and compose volume requirements.
  • Updated backup/restore guidance for MongoDB database-scoped backups.
• Bug Fixes
  • Improved smoke-test MongoDB backups to target the configured database.
• Release
  • Updated on-premises release version to 2026-07-15-001 and refreshed related compose references.

[coderabbitai]

📝 Walkthrough

Walkthrough

The on-prem release metadata was updated to 2026-07-15-001. MongoDB backup commands now explicitly target the configured database, and the changelog documents compose, SSO, GHCR, and version-warning changes.

Changes

On-prem release and backup update

Layer / File(s)	Summary
Release version and metadata on-prem/VERSION, on-prem/.env.example, on-prem/docker-compose.*.yml, on-prem/CHANGELOG.md	Release identifiers and compose metadata were updated to 2026-07-15-001; the changelog records compose, SAML SSO, GHCR image, and version-warning changes.
Database-specific backup commands .github/workflows/smoke-test-services.yml, docs/backup-restore.md	The smoke-test backup command and native backup documentation now pass MONGODB_DATABASE to mongodump.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise and accurately identifies the on-prem release version.
Description check	✅ Passed	The description is user-friendly and covers the release summary, changes, and test plan, though it does not mirror the template checklist exactly.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release-on-prem/2026-07-15-001

---

_{Comment @coderabbitai help to get the list of available commands.}