* test: add E2E git sync integration tests with Gitea
Add 7 end-to-end tests that verify the full git sync pipeline:
deploy objects in Windmill → DeploymentCallback job runs hub sync script →
correct files appear in a Gitea git repository.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: auto-manage git sync script version locked to Windmill release
- Add LATEST_GIT_SYNC_SCRIPT_PATH constant as single source of truth
- Backend auto-fills empty script_path with latest on save
- New repos use empty script_path (auto-managed by backend)
- Existing repos with pinned versions show warning with opt-in button
- cache_hub_scripts always caches the latest constant
- Rename hubPaths.json gitSync entries to deprecated_ prefix
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee-repo-ref.txt for git-sync-tests branch
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: remove upgrade_git_sync_script_paths from save path
Empty script_path is now resolved to latest at job dispatch time in EE,
not on save. Users opt in via the UI button.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: use Option<String> for git sync script_path
None means auto-managed (uses LATEST_GIT_SYNC_SCRIPT_PATH),
Some(path) means pinned to a specific script. Resolution happens
at job dispatch time via effective_script_path().
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: separate git sync tests into dedicated CI workflow
- Remove git_sync_test from default integration test suite
- Move gitea service to dedicated docker-compose.git-sync.yml
- Add run_git_sync.sh script
- New workflow triggers on changes to git sync crate, hub paths,
ee-repo-ref, or the test files themselves
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test: add Rust integration tests for git sync filtering logic
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: run git sync E2E tests via cargo run instead of docker image
Build from source and run Windmill directly, start Gitea as a
standalone container. Tests run against localhost — no pre-built
Docker image needed, works on PRs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: add relevance check before running git sync E2E tests
Only run the expensive build+test when actually relevant:
- Direct git sync file changes: always run
- ee-repo-ref.txt changed: check if EE diff touches windmill-git-sync/
- Unrelated changes to workspaces.rs or other files: skip
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: remove broad path triggers from git sync workflow
Remove workspaces.rs and wmill_integration_test_utils.py from path
triggers - they change too often for unrelated reasons. Keep only
git-sync-specific paths + ee-repo-ref.txt (filtered by check-relevance).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test: rewrite git sync E2E tests with full coverage and fix test infra
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore: remove accidentally committed gen files
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test: remove unit/integration tests for git sync filtering (covered by E2E)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: use correct build features and pass license key to test step in CI
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: add workflow_dispatch trigger to git sync test workflow
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Update commit reference in ee-repo-ref.txt
* fix: update stats_oss stubs to match EE telemetry signature changes
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: disable -D warnings for git sync e2e build step
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: allow test connection button in auto-managed git sync mode
The test connection button was disabled and runTestJob() bailed out
when script_path was unset. The test job uses a separate hub script
(gitSyncTest), not the sync script, so the guard was wrong.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee-repo-ref to include auto-managed script_path fix
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: use full SHA in ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address PR review feedback
- Initialize current_count before loop in wait_for_sync_jobs
- Clean up temp directories in clone helpers with addCleanup
- Fail CI startup steps if Gitea/Windmill never become ready
- Assert exact job count in exclude_path test
- Remove docs/git-sync-tests-plan.md (stale planning doc)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: remove orphaned git_sync.sql fixture
No longer referenced after Rust integration tests were removed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: assert old file removal in rename test
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee-repo-ref to 612d96a66f9d0cfdae335ef3eb4881f3444ce7cd
This commit updates the EE repository reference after PR #442 was merged in windmill-ee-private.
Previous ee-repo-ref: a05004a7c82f3d1ee5f6863bb9f5a33827d30032
New ee-repo-ref: 612d96a66f9d0cfdae335ef3eb4881f3444ce7cd
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Native mode (from DB config) was not accounted for when sizing the
connection pool or setting SLEEP_QUEUE, because both read NUM_WORKERS
from env which is never set when native mode is configured via the
worker group config in the database.
- Resolve native mode early (before connect_db) by querying the config
table with the initial DB connection
- Pass num_workers directly to connect_db instead of re-reading env
- Replace SLEEP_QUEUE lazy_static with sleep_queue() function that
checks NATIVE_MODE_RESOLVED at runtime (returns 300ms for native)
- Set NATIVE_MODE_RESOLVED immediately when is_native_mode_from_env()
- Allow native_mode in CE worker group config (was silently stripped)
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: skip token expiry notifications for debugger and mcp-oauth tokens
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: update frontend isUserToken to match backend filter
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore: add cross-reference comments to token filter functions
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* feat: partition audit log table by day with configurable retention
Introduce daily range partitioning for audit logs to replace expensive
DELETE-based retention with instant DROP TABLE per partition.
- Create `audit_partitioned` table alongside existing `audit` table
- New inserts go to `audit_partitioned`, reads UNION ALL both tables
- Monitor creates future partitions and drops expired ones
- Add `audit_log_retention_days` instance setting (default 365 days)
- Old `audit` table empties naturally via existing DELETE cleanup
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add audit log retention setting to Core instance settings UI
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: bump audit partitioning migration timestamp to avoid collision
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee-repo-ref.txt for audit partitioning
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add RLS/grants to audit_partitioned, run partition mgmt hourly, CE default 14d
- Add grants for windmill_user/windmill_admin and all 5 RLS policies
- Move manage_audit_partitions to hourly via should_run(120)
- Default retention: 14 days CE, 365 days EE
- Download JSON button is now icon-only
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address code review — quote SQL identifiers, add workspace index, deduplicate retention logic
- Quote partition names in dynamic SQL for defense in depth
- Add idx_audit_partitioned_workspace(workspace_id, timestamp DESC) index
- Extract audit_log_retention_days() helper to deduplicate retention logic
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee-repo-ref for audit insert error handling
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee-repo-ref to cef4dfc45e6d6344c5d8d107bd2b4d1bf9bbdd64
This commit updates the EE repository reference after PR #450 was merged in windmill-ee-private.
Previous ee-repo-ref: f09284bb257d461bcbe3c50fe31eb6f1e7eafee5
New ee-repo-ref: cef4dfc45e6d6344c5d8d107bd2b4d1bf9bbdd64
Automated by sync-ee-ref workflow.
* fix: create audit partitions on startup in initial_load
Ensures partitions exist before any requests arrive, closing the gap
between server start and the first hourly monitor run.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: always increment zombie job counter to prevent infinite loop at restart limit
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: force-complete zombie jobs when handle_job_error fails
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: revert counter increment change, keep re-detection for robustness
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: disable schedule when permissioned_as user is not found
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
On backend startup, verify the custom_instance_user can connect to the
database with the stored password. If the connection fails, automatically
refresh the password by calling refresh_custom_instance_user_pwd_inner().
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add token expiration notifications via email, critical alerts, and webhooks
- Monitor loop checks for tokens expiring within 7 days and sends
email notifications to token owners. Tracks notification state via
new `expiry_notified` column on the token table to avoid duplicates.
- When tokens expire and are deleted, owners are also notified.
- Critical alerts (in-app UI) are gated behind a new instance setting
`critical_alerts_on_token_expiry` (off by default); emails are
always sent regardless of the setting.
- Add TokenExpiringSoon and TokenExpired webhook message variants for
workspace webhook integrations.
- Frontend: show expiration badges and a warning banner on the tokens
table for tokens expiring within 30 days.
- Exclude session and ephemeral tokens from all notifications.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: use separate token_expiry_notification table for dedup
- Replace `expiry_notified` column on token table with a dedicated
`token_expiry_notification` table (token, expiration)
- Insert notification row on token creation via shared
`register_token_expiry_notification()` helper
- Delete notification row atomically when sending the notification
- Clean up orphaned rows in `delete_expired_items()`
- No FK constraint to avoid cascade overhead on token deletions
- Add index on expiration column for efficient range queries
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: calendar-based expiration badge and move notification cleanup
- Fix daysUntilExpiration to compare calendar dates instead of time diff
- Move notification row cleanup from delete_expired_items to
check_expiring_tokens to keep it off the hot path
- Use simple expiration <= now() index scan instead of NOT EXISTS join
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: auto-heal corrupted python runtime cache on remote workers
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Revert "fix: auto-heal corrupted python runtime cache on remote workers"
This reverts commit 0ea013a554.
* feat: make WINDMILL_DIR configurable via environment variable
Allow users to configure the base directory for Windmill's tmp/cache files
via the WINDMILL_DIR env var (default: /tmp/windmill). This fixes Python
runtime cache corruption on RHEL systems where systemd-tmpfiles-clean
removes files from /tmp.
Converts TMP_DIR (renamed to WINDMILL_DIR) and all derived cache directory
constants from compile-time const &str (concatcp!) to runtime lazy_static
String values.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee ref
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee ref
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: deref ERROR_DIR lazy_static for AsRef<Path> and Display traits
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee ref to branch name for CI compatibility
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: deref lazy_static constants in all executor files
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee ref
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee ref
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee ref
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: panic if WINDMILL_DIR has trailing slash
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: also reject trailing backslash in WINDMILL_DIR for Windows
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: deref GO_BIN_CACHE_DIR in test utils
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: replace remaining hardcoded /tmp/windmill paths and validate empty WINDMILL_DIR
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: nsjail powershell mount dst, Windows path assumptions, pwsh deref consistency
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: restore Windows /tmp path translation in go and bun executors
The Windows path translation replaces /tmp with the Windows temp dir
(e.g. C:\tmp) before normalizing slashes. Without this, the default
WINDMILL_DIR=/tmp/windmill produces paths without a drive letter on
Windows.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee-repo-ref to 6fd5a2ce908235a17975ad4dbdf0051cd89334f3
This commit updates the EE repository reference after PR #436 was merged in windmill-ee-private.
Previous ee-repo-ref: e8c03e16720833230ebd1878b4c63642ecc6c80f
New ee-repo-ref: 6fd5a2ce908235a17975ad4dbdf0051cd89334f3
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: add .npmrc support for private npm registries
Add a new `npmrc` instance setting that accepts full .npmrc file content
for configuring private npm registries. Works with bun (native .npmrc
support since 1.1.18), deno (native .npmrc support in 2.x), and the npm
proxy (parses default registry + auth token from .npmrc).
Legacy `npm_config_registry` and `bunfig_install_scopes` fields are now
hidden when empty, so new users only see the .npmrc field. Also fixes a
pre-existing race condition where gen_bunfig was called after
start_child_process.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: exclude schedule-triggered jobs from stale job cancellation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: extract object store code into windmill-object-store crate with filesystem backend
Consolidate all object_store-dependent code from windmill-common into a new
windmill-object-store crate. Add a filesystem-backed object store implementation
using LocalFileSystem for dev/testing without cloud credentials. Includes 30
comprehensive tests covering render_endpoint, lfs_to_object_store_resource,
duckdb_connection_settings, error mapping, and filesystem-backed integration tests.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
* all
* all
* all
* fix: fix raw_app hardcoded path, add missing ObjectStoreResource import, and add tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: move S3ModeFormat to windmill-types, make windmill-parser-sql optional, restore debug logs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: switch operator from CRD to ConfigMap
Replace the WindmillInstance CRD with a plain ConfigMap for the K8s
operator. This simplifies deployment (no CRD to install/manage, no
ClusterRole for custom API groups) while keeping the same config schema.
- Replace crd_ee.rs with configmap_ee.rs (parses data.spec YAML key)
- Rewrite reconciler_ee.rs: ConfigMap watcher + Event recorder instead
of CRD Controller + status subresource
- Add license_key preservation: if absent/empty in ConfigMap but present
in DB, the DB value is kept
- Remove print_crd_yaml() and "operator crd" subcommand
- Drop schemars, chrono, instance_config_schema dependencies
- Delete manifests/crd.yaml
- Update K8s example and README for ConfigMap approach
- RBAC now only needs a namespace-scoped Role (not ClusterRole)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add superadmin YAML export endpoint and remove cache_clear from operator config
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Add read_ee_registry<T> helper that returns None and emits a job log
in CE builds when a private registry is configured. Applied to all
language executors: pip, npm/bun, deno, cargo, go, maven, nuget,
powershell, and ruby. Maven settings.xml file write in monitor.rs
is also gated.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Add windmill-operator crate for Kubernetes CRD-based instance config
Introduces a new `windmill-operator` crate that enables declarative
management of Windmill instance configuration via a Kubernetes
`WindmillInstance` CRD. The operator watches CRD resources and performs
full declarative sync of global_settings and worker configs to the
database, supporting GitOps workflows for instance-level configuration.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Add tests for windmill-operator CRD and db_sync
- 9 unit tests for CRD serialization, deserialization, metadata, and
status field behavior
- 15 integration tests for db_sync using #[sqlx::test] with full
declarative sync coverage: upsert, delete, protected keys,
idempotency, worker config prefix handling, and end-to-end sync
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Replace untyped BTreeMap CRD fields with typed structs for schema validation
GlobalSettings, SmtpSettings, IndexerSettings, and WorkerGroupConfig now
have explicit typed fields with serde(flatten) catch-all for forward
compatibility. The generated CRD YAML includes a full OpenAPI v3 schema
that Kubernetes validates on kubectl apply.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Type opaque serde_json::Value CRD fields with real structs
Replace most remaining serde_json::Value fields in WindmillInstance CRD
with properly typed structs derived from the codebase:
- oauths: BTreeMap<String, OAuthClient>
- otel: OtelSettings
- otel_tracing_proxy: OtelTracingProxySettings with ScriptLang enum
- critical_error_channels: Vec<CriticalErrorChannel> (untagged enum)
- critical_alerts_on_db_oversize: DbOversizeAlert
- ducklake_settings: DucklakeSettings with nested catalog/storage types
- custom_instance_pg_databases: CustomInstancePgDatabases
- autoscaling (worker config): AutoscalingConfig with integration struct
- custom_tags, default_tags_workspaces: Vec<String>
- default_tags_per_workspace: bool
Still opaque (serde_json::Value): object_store_cache_config (kube-core
can't generate schemas for internally-tagged enums), secret_backend
(EE-private), slack, teams (no clear struct definitions).
Regenerated CRD YAML with full OpenAPI schema (352→703 lines).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Unify instance config types and add bulk GET/PUT API
Move all typed settings (GlobalSettings, WorkerGroupConfig, etc.) from
windmill-operator/crd.rs into windmill-common/instance_config.rs so both
the API server and operator share a single source of truth. Add diff/apply
logic (Merge mode for UI, Replace mode for operator) and InstanceConfig::from_db().
Add GET/PUT /settings/instance_config endpoints so the frontend loads all
settings in 1 call instead of 42, and saves with a single bulk PUT. The
backend handles the diff internally, running pre-write hooks for changed keys.
Refactor windmill-operator/db_sync.rs to use the shared diff+apply functions
and slim crd.rs down to the CRD wrapper with re-exports.
Includes 32 unit tests and 30 integration tests covering serialization,
diff logic, DB roundtrips, protected settings, and edge cases.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add Form/YAML toggle to instance settings UI
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: show Form/YAML toggle regardless of hideTabs prop
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: replace toggle button group with simple YAML toggle
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: mask sensitive fields in YAML view with show/hide toggle
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: hide internal settings and mask sensitive fields in YAML view
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: hide jwt_secret and min_keep_alive_version from API and config exports
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* all
* feat: add secretKeyRef support for sensitive fields in operator CRD
Allow sensitive fields (license_key, hub_api_secret, scim_token,
smtp_password, OAuthClient.secret, custom PG user_pwd) to reference
Kubernetes Secrets via the standard secretKeyRef pattern instead of
inlining values as plaintext YAML. The reconciler resolves all refs
by reading K8s Secrets before syncing to the database.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
* all
* all
* fix: merge main and update dev environment docs
Resolve merge conflicts from origin/main, fix duplicate
UV_INDEX_STRATEGY_SETTING import, and add Playwright MCP
testing instructions to CLAUDE.md.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
* fix: init tracing for CLI subcommands and deduplicate setting side-effects
Initialize tracing subscriber before early-return CLI paths (sync-config,
operator) so tracing calls are not silently dropped. Refactor
set_global_setting_internal to call run_setting_pre_write_hook instead of
duplicating the side-effect logic.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add `wmill instance get-config` CLI command
Dumps the current instance config (global settings + worker configs) as
YAML. Supports --output-file to write to a file instead of stdout.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add force_sandboxing global setting and #sandbox bash annotation
Add a new global setting `force_sandboxing` to enable nsjail sandboxing
for all jobs, overriding the DISABLE_NSJAIL environment variable.
Also add a #sandbox annotation for bash scripts to enable sandboxing
on a per-script basis.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: decouple nsjail probing from DISABLE_NSJAIL and apply force_sandboxing to all executors
NSJAIL_AVAILABLE now always probes for the nsjail binary at startup
regardless of the DISABLE_NSJAIL policy flag, fixing #sandbox annotation
and force_sandboxing being unusable in default (DISABLE_NSJAIL=true)
configuration. All language executors now use is_sandboxing_enabled()
instead of checking DISABLE_NSJAIL directly, so force_sandboxing
applies to all job types, not just bash.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: clarify force_sandboxing and DISABLE_NSJAIL relationship
Neither setting overrides the other — sandboxing is enabled when either
force_sandboxing=true OR DISABLE_NSJAIL=false. Updated frontend
description and backend comments to reflect this.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
* all
* revert typo
* all
* all
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Add new BENCHMARK_KIND variants (sequentialflow, scriptlogs, concurrencylimit,
concurrencykey, mixed, mixed_no_cc) for targeted performance testing. Fix shared
iteration counting across workers using a global atomic counter. Add job_perms
inserts and queue diagnostics for benchmark mode.
Move db connection setup to dedicated module and drop the initial connection pool
before creating the main one, preventing connection starvation when PostgreSQL
max_connections is low.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
The test file used old JobPayload/FlowValue field names that were
refactored into DebouncingSettings/ConcurrencySettings structs.
Remove the test file, fixture, feature flag, and cfg gate in monitor.rs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: isolate deno_core into windmill-runtime-nativets subcrate
Remove deno_core from flow eval and isolate nativets V8 runtime into a
dedicated subcrate so deno_core compilation no longer blocks
windmill-worker or windmill-api.
- Create windmill-jseval crate: QuickJS-based JS eval for flow
expressions and batch rerun, extracted from windmill-worker
- Create windmill-runtime-nativets crate: all deno_core/V8 deps and
nativets script execution, with build.rs snapshot generation
- Simplify windmill-worker: remove all deno_* direct deps, empty
build.rs, gate nativets behind optional dep
- Update windmill-api: use windmill-jseval for batch rerun instead of
deno_core, remove deno_core feature entirely
- Add nativets integration tests (nativets_jobs.rs) and parallel
stress test (nativets_stress.rs, 8 workers x 200 jobs)
- Remove dead code: deno flow eval path, USE_QUICKJS env var,
parity tests (replaced with 63 standalone expected-value tests)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address PR review feedback for deno_core isolation
- Deduplicate unsafe_raw() into windmill-common/src/utils.rs (single source)
- Delete orphaned runtime.js and windmill-client.js from windmill-worker/src/
- Fix operator precedence in windmill-jseval with explicit parentheses
- Remove unnecessary return keyword in heap limit callback
- Remove redundant as usize casts
- Remove ~150 lines of commented-out code from runtime.js
- Remove commented-out #[cfg] in build.rs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* otel ee
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: extract windmill-dep-map crate for parallel api/worker compilation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: resolve WebhookShared type mismatch and missing enterprise propagation
- Make windmill-api webhook_util re-export from windmill-common instead of
duplicating types, fixing Extension<WebhookShared> mismatch between
windmill-store and windmill-api
- Add windmill-api-jobs/enterprise to windmill-trigger enterprise feature
so check_license_key_valid is available when trigger subcrates enable
enterprise on windmill-trigger
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: stop trigger features from unconditionally enabling enterprise
Move enterprise propagation for all trigger subcrates from individual
trigger feature definitions to the enterprise feature itself, so
enterprise is only enabled when explicitly requested.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: remove unused pub use re-exports and disable CI cargo cache
- Remove unused re-exports from windmill-worker/src/lib.rs:
trigger_dependents_to_recompute_dependencies, handle_job_error,
and unused bun/otel items
- Fix callers to use direct module paths instead
- Add windmill-dep-map as dev-dependency for tests
- Disable cargo cache in backend-check CI (faster from-scratch builds)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: restore bun re-exports used by tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
* chore: re-enable cargo cache for check_ee_full CI job
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* iam
* fix occupancy + log settings change
* ee ref
* ee ref
* sqlx
* chore: update ee-repo-ref to 7f93a13e96c77292ed4b1e63bc1e8ff1e341d283
This commit updates the EE repository reference after PR #408 was merged in windmill-ee-private.
Previous ee-repo-ref: 5b6a4b2f990b7e5bdf6dea14645c787b42a4d9a6
New ee-repo-ref: 7f93a13e96c77292ed4b1e63bc1e8ff1e341d283
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: replace LISTEN/NOTIFY with polling-based event system
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* test: add exhaustive tests for polling-based notify events
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: add missing triggers and fix tests for polling-based events
- Add variable/resource cache invalidation triggers to migration
- Fix flow test to UPDATE flow table instead of INSERT into flow_version
- Improve test isolation with unique channel names per test
- All 26 tests now pass
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* test: add multi-server polling tests for cross-server event propagation
Add 4 tests simulating independent server instances with separate DB
connections and polling state:
- test_two_servers_both_receive_trigger_event: both servers see same event
- test_two_servers_cross_trigger_visibility: each triggers a change, both see both
- test_server_catches_up_after_being_offline: server catches up on missed events
- test_two_servers_incremental_polling: multi-round polling with cursor advancement
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add LISTEN_NEW_EVENTS_INTERVAL_SEC env var and e2e server test
- Make poll interval configurable via LISTEN_NEW_EVENTS_INTERVAL_SEC
(defaults to 30s)
- Make migration idempotent with IF NOT EXISTS
- Replace mock multi-server tests with actual e2e test that starts two
windmill server processes on ports 19100/19200 with 1s poll interval,
triggers a DB change, and verifies both servers log the event
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* test: ignore notify_events tests in CI
These tests require a running database, like other integration tests
in the codebase. Run with --ignored flag locally.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* test: only ignore slow e2e test, not fast DB tests
Only test_two_server_processes_both_receive_event is slow (~10s,
starts two server processes). The other 26 tests run in <0.2s.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: ignore all notify_events tests in CI
All tests depend on the notify_event table from the polling-based
events migration, which is not applied in CI.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: use sqlx::test for notify_events tests so they work in CI
Convert all 26 fast tests from #[tokio::test] + manual get_db() to
#[sqlx::test(fixtures("base"))], which creates temporary databases
with all migrations applied. This ensures the notify_event table
exists in CI without manual setup. Only the slow e2e multi-server
test retains #[tokio::test] + #[ignore].
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore: reduce default polling interval from 30s to 10s
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: address review feedback on polling-based events
- Remove redundant notify_event_id_idx index (id is already PRIMARY KEY)
- Add LIMIT 1000 to poll_notify_events to bound memory per poll cycle
- Fix potential UTF-8 panic in token log truncation using str::get
- Remove var/resource cache triggers that were re-enabled by mistake
(they were intentionally dropped in migration 20250902085504)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
- Add AgentConfig struct to validate required env vars on startup
- Change build_agent_http_client to require explicit token and URL
- Remove DEFAULT_BASE_INTERNAL_URL fallback (no more silent localhost:8000)
- Exit immediately if agent cannot connect to server on initial load
- Update integration tests to use dynamic port for BASE_INTERNAL_URL
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: workspace dedicated workers
* ref
* chore: update ee-repo-ref to a18ac31062ac092cb9a5fc87629e217d97f4911d
This commit updates the EE repository reference after PR #398 was merged in windmill-ee-private.
Previous ee-repo-ref: 98cfe3fef764d9d815d326d5056c734a03689d33
New ee-repo-ref: a18ac31062ac092cb9a5fc87629e217d97f4911d
Automated by sync-ee-ref workflow.
* fix(frontend): workspace script in flow steps
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: do not quit indexer when receiving handoff during pull
* update
* Add correct return type
* update ee-repo-ref [CI only]
* chore: update ee-repo-ref to c05572e93739e2697ab310d87efe2744cd0e1aaf
This commit updates the EE repository reference after PR #394 was merged in windmill-ee-private.
Previous ee-repo-ref: 4358aa9c5b3b38ba74d7ea52cafd49899d338a07
New ee-repo-ref: c05572e93739e2697ab310d87efe2744cd0e1aaf
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
SERVER_BIND_ADDR now works for both server and worker modes with
different defaults: 0.0.0.0 for server/indexer/mcp, 127.0.0.1 for workers.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(cli): add GitHub Actions CI and raw app sync tests
- Add CLI tests GitHub Action that runs on Linux and Windows
- Add build check job that runs on CLI and openapi.yaml changes
- Uses Rust cargo backend instead of Docker for better CI compatibility
- Add cargo_backend.ts and test_backend.ts for test infrastructure
- Fix Windows path separator bug in raw_apps.ts (use "/" for relative paths)
- Fix PostgreSQL URL parsing in cargo_backend.ts
- Update tests to use gitBranches format instead of deprecated overrides
- Add raw_app_sync.test.ts for raw app sync workflow testing (ignored for now - needs EE)
- Skip tests that require EE features (git sync settings, raw apps)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): Fix Windows path compatibility issues in tests
- Use fromFileUrl() in cargo_backend.ts for proper Windows path handling
- Normalize path separators to forward slashes in resource_folders.ts
- Fix readDirRecursive to return normalized paths in test helper
- Use forward slashes consistently in buildMetadataPath and detection functions
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): Use SEP in test assertions instead of modifying logic
- Revert resource_folders.ts to use SEP as intended
- Update test assertions to use SEP for platform-specific paths
- Keep readDirRecursive normalization for consistent test comparisons
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): Use SEP for all path separators in test assertions
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): Use resolve() for proper cross-platform path handling in cargo_backend
String concatenation with path separators creates malformed paths on Windows.
Use path.resolve() instead for proper cross-platform path resolution.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(backend): Add cfg attributes for Windows compatibility
- Add #[cfg(unix)] to anyhow::anyhow import (only used in unix cfg block)
- Add #[cfg(not(windows))] to parse_file function (uses cat, only for cgroups)
- Remove unused std::io import, use std::io::Result directly
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: Windows compilation + convert integration tests to withTestBackend
- Fix unused import SYSTEM_ROOT in csharp_executor.rs on Windows by
requiring both windows and csharp feature
- Fix unused variable id in handle_child.rs on Windows by adding
#[allow(unused_variables)] since id is only used in cfg(unix) code
- Convert all RUN_INTEGRATION_TESTS dependent tests in sync_pull_push.test.ts
to use withTestBackend pattern for automatic backend setup
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: configurable test features with CI_MINIMAL_FEATURES env var
- Default: full features (zip, private, enterprise) for local development
- CI mode: minimal features (zip only) when CI_MINIMAL_FEATURES=true
- Add shouldSkipOnCI() helper for tests requiring EE features
- Update EE-dependent tests to use shouldSkipOnCI()
- Add test instructions to cli/README.md
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: enable raw app tests (not EE-dependent)
Raw apps work with minimal features. 2 tests pass, 2 have test logic
bugs to investigate separately:
- "delete file and push" - file deletion not syncing correctly
- "dry-run push shows expected changes" - JSON output parsing issue
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: gate cgroups module to Linux only
cgroups are Linux-specific, the module was causing dead_code warnings
on Windows compilation.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(ci): add CI_MINIMAL_FEATURES env var to CLI tests workflow
Set CI_MINIMAL_FEATURES=true in both Linux and Windows test jobs so
the backend compiles with minimal features (zip only) and EE-dependent
tests self-skip via shouldSkipOnCI().
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): raw app tests and backend startup timing
- Add 5s delay after backend ready for migrations to complete
- Fix dry-run JSON output parsing (handle pretty-printed JSON)
- Temporarily ignore "delete file" test (needs isSuperset fix)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): raw app file deletion sync
- Add deepEqual check for files in raw_apps.ts isSuperset comparison
- Handle raw_app file deletions in sync.ts by re-pushing the entire app
- Fix test to remove CSS import before deleting the file
When deleting a file from a raw app, the sync now properly updates
the backend with the new file list (excluding the deleted file).
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): Windows path separators in tests
Normalize paths for cross-platform comparison by converting
backslashes to forward slashes before path assertions.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): normalize featurePaths in multi_instance_workspace test
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* test(cli): add mixed case paths sync tests for Windows compatibility
Add comprehensive tests for sync pull/push with capitalized folder paths
to catch Windows case-insensitivity issues:
- Scripts in f/MyFolder/MyScript
- Flows in f/MyFlows/DataProcessor
- Apps in f/MyApps/Dashboard
- Variables in f/MyVars/ApiKey
- Deeply nested paths with mixed case
- Multiple resources in same capitalized folder
- CamelCase folder names with numbers
Each test verifies the full pull -> modify -> push -> verify cycle.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* test(cli): add idempotency check to mixed case paths tests
After each push, pull again with --dry-run --json-output and verify
that no changes are detected. This ensures the sync is stable and
catches issues where pull/push cycles cause spurious diffs.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add cache-rt command and SYNC_CACHED_RT env variable for resource types
Add a new CLI command `cache-rt` that fetches resource types from the hub
and caches them locally. This command is run during Docker image build to
pre-populate the cache.
Add `SYNC_CACHED_RT` environment variable that, when set to true, syncs
cached resource types to the admins workspace's resource_type table on
server startup. The sync is incremental - it only updates resource types
that have changed.
Changes:
- Add HUB_RT_CACHE_DIR constant for resource type cache location
- Add cache-rt CLI command to fetch and cache resource types from hub
- Add sync_cached_resource_types() to sync cached types to database
- Update all Dockerfiles to run cache-rt during image build
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: parse schema string from hub into proper JSONB
The hub API returns schema as a JSON string that needs to be parsed
into a proper JSON value before inserting into the database.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* use pgoptions
* fix: use pgoptions for iam rds connection
* ee ref
* chore: update ee-repo-ref to 1549849fadc4e5634334a384bfe52343eb1e93f0
This commit updates the EE repository reference after PR #388 was merged in windmill-ee-private.
Previous ee-repo-ref: ffc1de1498a8018a9cbc2daba846e6c57d500a1c
New ee-repo-ref: 1549849fadc4e5634334a384bfe52343eb1e93f0
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
