fix: resolve schedule update deadlock (#8701)

* feat: add --main flag to write_latest_ee_ref.sh to point to latest EE main

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: resolve schedule update deadlock by fixing lock ordering in edit_schedule

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/windmill-api-schedule/src/lib.rs

@@ -417,8 +417,6 @@ async fn edit_schedule(
         validate_dynamic_skip(&mut tx, &w_id, handler_path).await?;
     }
 
-    clear_schedule(&mut tx, path, &w_id).await?;
-
     let resolved_edited_by = resolve_edited_by(&authed);
 
     let resolved_permissioned_as = resolve_permissioned_as(
@@ -545,6 +543,11 @@ async fn edit_schedule(
     .await
     .map_err(|e| Error::internal_err(format!("updating schedule in {w_id}: {e:#}")))?;
 
+    // clear_schedule must come AFTER UPDATE schedule to maintain consistent lock ordering
+    // (schedule row first, then v2_job_queue) and avoid deadlocks with concurrent operations
+    // like set_enabled, flow updates, and worker job completions.
+    clear_schedule(&mut tx, path, &w_id).await?;
+
     audit_log(
         &mut *tx,
         &authed,

backend/write_latest_ee_ref.sh

@@ -15,11 +15,17 @@ else
     echo "Directory not found"; exit 1
 fi
 
-# Get the current commit hash
-commit_hash=$(git rev-parse HEAD)
+# If --main is passed, fetch and use latest main
+if [ "$1" = "--main" ]; then
+    git fetch origin main
+    commit_hash=$(git rev-parse origin/main)
+else
+    # Get the current commit hash
+    commit_hash=$(git rev-parse HEAD)
+fi
 
 # Navigate back to the original directory
-cd - || exit
+cd - > /dev/null || exit
 
 # Write the commit hash to ./ee-repo-ref.txt
 echo -n "$commit_hash" > ./ee-repo-ref.txt