* feat: make nsjail available in all standard images (CE)
Include nsjail binary and runtime deps in the main Dockerfile and
DockerfileSlim so sandboxing is available out of the box. Flip
DISABLE_NSJAIL default to false so nsjail is enabled by default.
Remove DockerfileNsjail (now redundant) and the build_ee_nsjail CI job,
pointing publish_ecr_s3 at the base EE image instead. Add iptables to
DockerfileFullEe to preserve the functionality from the removed nsjail
image.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* revert: keep DISABLE_NSJAIL default as true
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: pin publish_ecr_s3 to exact commit hash
Add type=sha tag to build_ee so it pushes a commit-pinned image tag.
Restore git hash lookup in publish_ecr_s3 to reference the exact image
for that commit, avoiding race conditions with the mutable dev tag.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: publish_ecr_s3 depends on build_ee_full, uses release tag
Only publish to S3 on tag releases, extracting static frontend from the
ee-full image using the semver tag.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: remove stale windmill-ee-nsjail references, add nsjail to EE slim
The windmill-ee-nsjail image is no longer published since DockerfileNsjail
was deleted. Update all references to use the base EE image (which now
includes nsjail), remove redundant nsjail deps from DockerfileExtra, and
add nsjail build to DockerfileSlimEe for consistency with CE slim.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* test: add bun executor tests with minimal production code changes
- Add comprehensive bun job tests (bun_jobs.rs) covering:
- Basic execution, error handling, annotation modes
- Relative imports, deeply nested imports
- Dedicated worker protocol for both Node.js and Bun runtimes
- Builder tests for lockfile generation (import scanning)
- Minimize changes to bun_executor.rs by exposing:
- RELATIVE_BUN_LOADER and RELATIVE_BUN_BUILDER constants
- build_loader() function and LoaderMode enum
- BUN_DEDICATED_WORKER_ARGS constant
- generate_dedicated_worker_wrapper() function
- Tests call production code directly (build_loader) instead of
duplicating script generation logic
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* nit
* fix: reuse BUN_PATH/NODE_BIN_PATH from windmill-worker, add node to CI
- Tests now use exported BUN_PATH and NODE_BIN_PATH constants instead
of duplicating env var logic
- Update backend-test.yml:
- Upgrade bun to v1.3.8
- Add setup-node action
- Add NODE_BIN_PATH to cargo test command
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* add private repo test
* fix private repo test
* try fix again
* fix
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add cache-rt command and SYNC_CACHED_RT env variable for resource types
Add a new CLI command `cache-rt` that fetches resource types from the hub
and caches them locally. This command is run during Docker image build to
pre-populate the cache.
Add `SYNC_CACHED_RT` environment variable that, when set to true, syncs
cached resource types to the admins workspace's resource_type table on
server startup. The sync is incremental - it only updates resource types
that have changed.
Changes:
- Add HUB_RT_CACHE_DIR constant for resource type cache location
- Add cache-rt CLI command to fetch and cache resource types from hub
- Add sync_cached_resource_types() to sync cached types to database
- Update all Dockerfiles to run cache-rt during image build
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: parse schema string from hub into proper JSONB
The hub API returns schema as a JSON string that needs to be parsed
into a proper JSON value before inserting into the database.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* Update `shell.nix`
- Replace pip-compile with uv packages
- Pin rust version
- Add var to trigger windmill print more info in stdout
* Replace `pip-compile` with `uv` (dirty + untested)
* Fix arguments passed to uv
Some of the flags are included by default in UV and can be safely removed:
- --resolver=backtracking
- --no-emit-index-url
Also uv does not support `--pip-args` and suggests to directly pass args to uv.
* Remove extra `dbg!`
* Replace 'pip-compile' with 'uv' in Dockerfile
* Add fallback option to `pip-compile` (Disabled)
* Add `uv` to `docker/DockerfileSlim*`
* Add `get_annotation_python` and rename `get_annotation` to `get_annotation_ts`
* Add option to fallback to pip-compile
Put `# no_uv` on top the file for specific python script
Or set `USE_PIP_COMPILE` variable to `true`
* Put back `pip-tools` into shell.nix
* Make sure lockfile resolves again if `#no_uv` used
Add #no_uv to the end of requirements (requirements.in)
That way if something breaks for customer, then they put #no_uv and new lockfile will be resolved
* Put `pip install pip-tools` in original spot
* Fix compilation error
* Fix EE compilation error
error[E0658]: attributes on expressions are experimental
--> windmill-worker/src/python_executor.rs:144:5
|
144 | #[cfg(feature = "enterprise")]
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
= note: see issue #15701 <https://github.com/rust-lang/rust/issues/15701> for more information
* Add `no_cache` annotation
Will force recalculation of lockfile
And block uv from using cached values
* Target uv cache to /tmp/windmill/cache
* Prohibit uv from managing python
* Add uv to DockerfileBackendTests
* Pin uv version to 0.4.18 in Dockerfiles
* Dont put `#no_uv` in requirements.in
Instead postfix hash for requirements.in with `-no_uv`
* Push Warning to logs if fallbacked to pip-compile
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* Add rust on frontend
* Add parser for rust
* Handle rust job execution
* Main has to return a result that is serializable
* Update parser: parse many rust types
* Rust parser dependencies
* Frontend wasm parser
* Add windmill parser rust to windmill parser wasm (temporarily)
* Add rust as a tag on worker__default
* Change init code for rust
* Cleanup rust_executor.rs
* Remove tree-sitter dep and fix unused imports
* Add lockfile and build logic
* Add cargo and rustup to windmill image
* Fix env var to work on docker image and dev env
* modify package.json
* Deps after parser publish
* Add stashed migration
* Unify rust versions
* Add error message when php or cargo are not present to use another image
* Error message conditionally on feature flag
* all ci/cd changes
* all ci/cd changes
---------
Co-authored-by: Ruben Fiszel <ruben@rubenfiszel.com>
