* Add windmill-operator crate for Kubernetes CRD-based instance config
Introduces a new `windmill-operator` crate that enables declarative
management of Windmill instance configuration via a Kubernetes
`WindmillInstance` CRD. The operator watches CRD resources and performs
full declarative sync of global_settings and worker configs to the
database, supporting GitOps workflows for instance-level configuration.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Add tests for windmill-operator CRD and db_sync
- 9 unit tests for CRD serialization, deserialization, metadata, and
status field behavior
- 15 integration tests for db_sync using #[sqlx::test] with full
declarative sync coverage: upsert, delete, protected keys,
idempotency, worker config prefix handling, and end-to-end sync
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Replace untyped BTreeMap CRD fields with typed structs for schema validation
GlobalSettings, SmtpSettings, IndexerSettings, and WorkerGroupConfig now
have explicit typed fields with serde(flatten) catch-all for forward
compatibility. The generated CRD YAML includes a full OpenAPI v3 schema
that Kubernetes validates on kubectl apply.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Type opaque serde_json::Value CRD fields with real structs
Replace most remaining serde_json::Value fields in WindmillInstance CRD
with properly typed structs derived from the codebase:
- oauths: BTreeMap<String, OAuthClient>
- otel: OtelSettings
- otel_tracing_proxy: OtelTracingProxySettings with ScriptLang enum
- critical_error_channels: Vec<CriticalErrorChannel> (untagged enum)
- critical_alerts_on_db_oversize: DbOversizeAlert
- ducklake_settings: DucklakeSettings with nested catalog/storage types
- custom_instance_pg_databases: CustomInstancePgDatabases
- autoscaling (worker config): AutoscalingConfig with integration struct
- custom_tags, default_tags_workspaces: Vec<String>
- default_tags_per_workspace: bool
Still opaque (serde_json::Value): object_store_cache_config (kube-core
can't generate schemas for internally-tagged enums), secret_backend
(EE-private), slack, teams (no clear struct definitions).
Regenerated CRD YAML with full OpenAPI schema (352→703 lines).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Unify instance config types and add bulk GET/PUT API
Move all typed settings (GlobalSettings, WorkerGroupConfig, etc.) from
windmill-operator/crd.rs into windmill-common/instance_config.rs so both
the API server and operator share a single source of truth. Add diff/apply
logic (Merge mode for UI, Replace mode for operator) and InstanceConfig::from_db().
Add GET/PUT /settings/instance_config endpoints so the frontend loads all
settings in 1 call instead of 42, and saves with a single bulk PUT. The
backend handles the diff internally, running pre-write hooks for changed keys.
Refactor windmill-operator/db_sync.rs to use the shared diff+apply functions
and slim crd.rs down to the CRD wrapper with re-exports.
Includes 32 unit tests and 30 integration tests covering serialization,
diff logic, DB roundtrips, protected settings, and edge cases.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add Form/YAML toggle to instance settings UI
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: show Form/YAML toggle regardless of hideTabs prop
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: replace toggle button group with simple YAML toggle
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: mask sensitive fields in YAML view with show/hide toggle
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: hide internal settings and mask sensitive fields in YAML view
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: hide jwt_secret and min_keep_alive_version from API and config exports
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* all
* feat: add secretKeyRef support for sensitive fields in operator CRD
Allow sensitive fields (license_key, hub_api_secret, scim_token,
smtp_password, OAuthClient.secret, custom PG user_pwd) to reference
Kubernetes Secrets via the standard secretKeyRef pattern instead of
inlining values as plaintext YAML. The reconciler resolves all refs
by reading K8s Secrets before syncing to the database.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
* all
* all
* fix: merge main and update dev environment docs
Resolve merge conflicts from origin/main, fix duplicate
UV_INDEX_STRATEGY_SETTING import, and add Playwright MCP
testing instructions to CLAUDE.md.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
* fix: init tracing for CLI subcommands and deduplicate setting side-effects
Initialize tracing subscriber before early-return CLI paths (sync-config,
operator) so tracing calls are not silently dropped. Refactor
set_global_setting_internal to call run_setting_pre_write_hook instead of
duplicating the side-effect logic.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add `wmill instance get-config` CLI command
Dumps the current instance config (global settings + worker configs) as
YAML. Supports --output-file to write to a file instead of stdout.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat(yaml-validator)!: unify flow, schedule, and trigger validation
- replace FlowValidator with WindmillYamlValidator.validate(doc, target)
- generate schedule/trigger schemas from backend OpenAPI and OpenFlow refs
- add schedule/trigger/filename-target tests and update AI agent fixtures
- bump windmill-yaml-validator to 2.0.0
BREAKING CHANGE: FlowValidator and validateFlow() are replaced by WindmillYamlValidator.validate(doc, target).
* add lint command
* add deno-compat script and docs for local yaml-validator testing
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: make nullable fields pass yaml validation
Add nullable: true to static_asset_config and authentication_resource_path
in HttpTrigger schema. Post-process generated JSON schemas to add null to
enums with nullable: true (AJV doesn't handle OpenAPI 3.0 nullable + enum).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: add nullable to all Option<T> fields in trigger and schedule OpenAPI schemas
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(frontend): handle nullable fields from updated OpenAPI types
Add ?? undefined coalescing at assignment sites where generated types
now include | null from the OpenAPI nullable additions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(lint): show allowed values in enum validation errors
Instead of "must be equal to one of the allowed values", now shows
"must be one of: 'r', 'w', 'rw'" for enum validation failures.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: add nullable to Edit/New trigger and schedule OpenAPI schemas
Ensures create/update request body types accept null for the same
fields that GET response types return as nullable, enabling clean
round-tripping without type mismatches.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* use published package
* publish
* refactor(lint): remove unused --includes/--excludes/--extra-includes CLI options
These options were defined but never wired to the file filtering logic.
The lint command still respects includes/excludes from wmill.yaml via
mergeConfigWithConfigFile.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(lint): handle additionalProperties errors and expand test coverage
Add formatting for AJV additionalProperties keyword to show the unknown
property name. Add unit tests for all formatValidationError branches and
integration tests for --json report shape, --fail-on-warn with mixed
files, non-existent directory, and enum error output.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test: add realistic validator tests for schedules, triggers, and edge cases
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add email trigger validation support
Add email trigger schema generation, validation, and linting. Email
triggers are no longer skipped with a warning — they are validated
like all other trigger types.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore(cli): bump windmill-yaml-validator to 1.1.1 (email trigger support)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* publish
* rm
* fix: address PR review feedback for lint command
- Add email to trigger kinds test loop instead of separate test
- Add email to ValidationTarget docs in README
- Type formatYamlDiagnostics param directly instead of unsafe cast
- Destructure json option before mergeConfigWithConfigFile for clarity
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(cli): add --lint option to sync push command
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* use skills
* add prompts
* update system prompts
* generate skills on init
* add prompts in cli
* better for raw apps
* nit
* test pipeline draft
* better
* yaml for triggers and schedules
* cleaning
* better
* add descriptions to ai agent fileds
* adjust
* better openapi
* better
* nit
* feat: add typed provider and memory schemas for ai agent in openapi
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: improve zod validation errors with dynamic schema extraction
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* regen
* fix
* cleaning
* refactor: deduplicate skill descriptions in generate_skills_ts_export
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* cleaning
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: cache lockfile results for scripts with same raw_workspace_dependencies
Extract fetchScriptLock from updateScriptLock to isolate the remote API
call behind a module-level in-memory cache. When multiple scripts share
the same content, language, and raw_workspace_dependencies, only one
remote call is made and subsequent lookups return the cached lock.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: only use lock cache when raw_workspace_dependencies are present
Skip caching entirely when rawWorkspaceDependencies is empty so the
cache is only active for scripts that actually use workspace deps.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: cache key uses only language+deps, not script content
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: use annotation parser for lock cache key instead of full script content
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* test: add mixed annotated/non-annotated scripts cache test
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
The elementsToMap function was incorrectly skipping remote base files that
were configured as branch-specific, causing pull to mark them for deletion.
Root cause: PR #7643 added a check to skip base files when configured as
branch-specific, but this was applied to both local AND remote sources.
Remote workspace files only have base paths (e.g., TestVar.variable.yaml),
not branch-specific paths (e.g., TestVar.staging.variable.yaml).
Fix: Add isRemote parameter to elementsToMap to distinguish remote vs local
processing. Only skip base files for local sources where we expect the
branch-specific version to exist.
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* fix: prevent sql migration modal from closing when next migration arrives
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* nit
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): revert findCodebase relative_path check that broke ../shared codebases
The previous change added a check to ensure script paths start with the
codebase's relative_path. However, this broke cases where relative_path
uses parent directory references (e.g., "../shared") because:
1. path.join normalizes paths, so "/project/../shared/f/script.ts" becomes
"/shared/f/script.ts"
2. FSFSElement strips the cwd prefix, resulting in "f/script.ts"
3. The check "f/script.ts".startsWith("../shared/") failed
The original behavior was correct - relative_path indicates where to find
codebase files, while includes/excludes patterns match against the normalized
paths that get passed during sync.
Fixes regression reported in #7729 comments.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* test(cli): add preview test for codebase with imports
Tests that codebase bundling correctly includes imported modules,
which is the key functionality needed for ../shared codebases.
The test creates a helper module and a main script that imports
from it, then verifies the bundled script executes correctly.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Enable running the dev command from any directory by specifying the
target .raw_app folder as an argument. Workspace resolution and
authentication still happen from the original cwd to find wmill.yaml.
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
- Fix standalone bundle path lookup in worker to not add redundant file
extension (the path already contains .tar/.esm suffixes from the API)
- Fix CLI preview tar bundle handling to preserve binary data correctly
(was using btoa(blob.text()) which corrupted binary tar data)
- Add integration tests for script/flow preview commands covering:
- Regular scripts (non-codebase)
- Codebase scripts (CJS and ESM formats)
- Codebase scripts with assets (tar bundles)
- Flow preview
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add `wmill script preview <path> [--data <json>]` command to test scripts against remote workspace without deploying
- Add `wmill flow preview <path> [--data <json>]` command to test flows against remote workspace without deploying
- Support codebase scripts with automatic bundling via esbuild
- Add `--silent` flag to suppress logs and only output final result
- Fix `findCodebase` to properly check if path is within codebase relative_path before pattern matching
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Previously, getCurrentGitBranch() was called inside loops for every
file processed during sync pull/push operations. For workspaces with
1900+ files, this spawned thousands of git subprocesses, causing a ~2x
performance regression.
This fix caches the git branch at the start of:
- elementsToMap() for pull operations
- push() for push operations
Expected improvement: ~3.2s -> ~1.6s for large workspaces.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The dnt polyfill's import-meta-ponyfill doesn't resolve symlinks when
comparing process.argv[1] with import.meta.url. When npm creates a
symlink for the `wmill` bin (e.g., /usr/bin/wmill -> .../main.js),
the paths don't match and isMain() incorrectly returns false, causing
the CLI to silently exit without running.
This fix resolves symlinks using fs.realpathSync() before comparison,
ensuring the CLI works correctly when invoked via npm-installed symlinks.
Tested with Node.js 20 and 25.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
