chore(main): release 1.48.0 (#910)

* chore(main): release 1.48.0

* Apply automatic changes

Co-authored-by: rubenfiszel <rubenfiszel@users.noreply.github.com>

.devcontainer/Dockerfile

@@ -0,0 +1,42 @@
+FROM python:3.10-slim-bullseye as nsjail
+
+WORKDIR /nsjail
+
+RUN apt-get -y update \
+    && apt-get install -y \
+    bison \
+    flex \
+    g++ \
+    gcc \
+    git \
+    libprotobuf-dev \
+    libnl-route-3-dev \
+    make \
+    pkg-config \
+    protobuf-compiler \
+    && apt-get clean -y && rm -rf /var/lib/apt/lists/*
+
+RUN git clone -b master --single-branch https://github.com/google/nsjail.git . \
+    && git checkout dccf911fd2659e7b08ce9507c25b2b38ec2c5800
+RUN make
+
+FROM mcr.microsoft.com/vscode/devcontainers/rust:bullseye as rust-deps
+
+RUN cargo install sqlx-cli --no-default-features --features native-tls,postgres 
+RUN cargo install deno --locked
+
+FROM mcr.microsoft.com/vscode/devcontainers/rust:bullseye
+
+RUN apt update \
+    && apt-get install -y \
+    lld \
+    python3 \
+    libprotobuf-dev \ 
+    libnl-route-3-dev \
+    && apt-get clean -y && rm -rf /var/lib/apt/lists/*
+
+USER vscode
+
+COPY --from=rust-deps /usr/local/cargo/bin/sqlx /usr/local/cargo/bin/sqlx
+COPY --from=rust-deps /usr/local/cargo/bin/deno /usr/local/cargo/bin/deno
+COPY --from=nsjail /nsjail/nsjail /bin/nsjail

.devcontainer/docker-compose.yml

@@ -0,0 +1,25 @@
+version: '3.7'
+services:
+  windmill:
+    build:
+      context: .
+      dockerfile: .devcontainer/Dockerfile
+    # image: mcr.microsoft.com/vscode/devcontainers/rust:bullseye
+    environment:
+      - DENO_PATH=/usr/local/cargo/bin/deno
+      - PYTHON_PATH=/usr/bin/python3
+      - NSJAIL_PATH=/bin/nsjail
+    volumes:
+      - .:/workspace:cached
+      - ~/.ssh:/home/vscode/.ssh:ro
+
+    command: /bin/sh -c "while sleep 1000; do :; done"
+ 
+
+  front:
+    image: mcr.microsoft.com/vscode/devcontainers/typescript-node:16
+    volumes:
+      - .:/workspace:cached
+      - ~/.ssh:/home/node/.ssh:ro
+
+    command: /bin/sh -c "while sleep 1000; do :; done"

.env

@@ -1,3 +1,2 @@
-SITE_URL=localhost
 DB_PASSWORD=changeme
-POSTGRES_VERSION=13.3.0
+WM_BASE_URL=localhost

.github/CODEOWNERS

@@ -0,0 +1,4 @@
+*       @rubenfiszel
+
+/community/ @fatonramadani @rubenfiszel
+/frontend/ @fatonramadani @rubenfiszel

.github/DockerfileBackendTests

@@ -0,0 +1,66 @@
+FROM python:3.10-slim-buster as nsjail
+
+WORKDIR /nsjail
+
+RUN apt-get -y update \
+    && apt-get install -y \
+    bison=2:3.3.* \
+    flex=2.6.* \
+    g++=4:8.3.* \
+    gcc=4:8.3.* \
+    git=1:2.20.* \
+    libprotobuf-dev=3.6.* \
+    libnl-route-3-dev=3.4.* \
+    make=4.2.* \
+    pkg-config=0.29-6 \
+    protobuf-compiler=3.6.*
+
+RUN git clone -b master --single-branch https://github.com/google/nsjail.git . \
+    && git checkout dccf911fd2659e7b08ce9507c25b2b38ec2c5800
+RUN make
+
+
+FROM rust:slim-buster as builder
+
+RUN apt-get update && apt-get install -y git libssl-dev pkg-config
+
+RUN apt-get -y update \
+    && apt-get install -y \
+    curl lld
+
+ENV SQLX_OFFLINE=true
+
+
+RUN mkdir -p /frontend/build
+RUN apt-get update \
+    && apt-get install -y ca-certificates tzdata libpq5 \
+    make build-essential libssl-dev zlib1g-dev libbz2-dev libreadline-dev \
+    libsqlite3-dev wget curl llvm libncurses5-dev libncursesw5-dev xz-utils tk-dev libxml2-dev \
+    libxmlsec1-dev libffi-dev liblzma-dev mecab-ipadic-utf8 libgdbm-dev libc6-dev git libprotobuf-dev=3.6.* libnl-route-3-dev=3.4.* \
+    libv8-dev tesseract-ocr nodejs npm\
+    && rm -rf /var/lib/apt/lists/*
+
+RUN wget https://golang.org/dl/go1.19.1.linux-amd64.tar.gz && tar -C /usr/local -xzf go1.19.1.linux-amd64.tar.gz
+ENV PATH="${PATH}:/usr/local/go/bin"
+ENV GO_PATH=/usr/local/go/bin/go
+
+ENV TZ=Etc/UTC
+
+ENV PYTHON_VERSION 3.10.4
+
+RUN wget https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz \
+    && tar -xf Python-${PYTHON_VERSION}.tgz && cd Python-${PYTHON_VERSION}/ && ./configure --enable-optimizations \
+    && make -j 4 && make install
+
+RUN /usr/local/bin/python3 -m pip install pip-tools
+RUN /usr/local/bin/python3 -m pip install nltk
+RUN mkdir -p /nsjail_data/python && HOME=/nsjail_data/python /usr/local/bin/python3 -m nltk.downloader vader_lexicon
+
+COPY --from=nsjail /nsjail/nsjail /bin/nsjail
+
+COPY --from=denoland/deno:latest /usr/bin/deno /usr/bin/deno
+
+RUN apt-get update \
+    && apt-get install -y postgresql-client --allow-unauthenticated
+
+RUN rustup component add rustfmt

.github/DockerfilePypiBuilder

@@ -0,0 +1,7 @@
+FROM nikolaik/python-nodejs:python3.11-nodejs19
+
+RUN python3 -m pip install pipx poetry
+RUN python3 -m pipx ensurepath
+ENV PATH="/root/.local/bin:${PATH}"
+ENV PATH="/usr/local/bin:${PATH}"
+RUN pipx install openapi-python-client==0.11.6 --include-deps

.github/FUNDING.yml

@@ -0,0 +1,3 @@
+# These are supported funding model platforms
+
+github: [rubenfiszel]

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,38 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: ''
-assignees: ''
-
----
-
-**Describe the bug**
-A clear and concise description of what the bug is.
-
-**To Reproduce**
-Steps to reproduce the behavior:
-1. Go to '...'
-2. Click on '....'
-3. Scroll down to '....'
-4. See error
-
-**Expected behavior**
-A clear and concise description of what you expected to happen.
-
-**Screenshots**
-If applicable, add screenshots to help explain your problem.
-
-**Desktop (please complete the following information):**
- - OS: [e.g. iOS]
- - Browser [e.g. chrome, safari]
- - Version [e.g. 22]
-
-**Smartphone (please complete the following information):**
- - Device: [e.g. iPhone6]
- - OS: [e.g. iOS8.1]
- - Browser [e.g. stock browser, safari]
- - Version [e.g. 22]
-
-**Additional context**
-Add any other context about the problem here.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,62 @@
+name: Bug report
+description: Create a report to help us improve.
+title: 'bug:'
+labels: 'bug'
+assignees: 'rubenfiszel'
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Describe the bug
+      description: A clear and concise description of what the bug is.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction-steps
+    attributes:
+      label: To reproduce
+      description: Steps to reproduce the behavior
+      value: |
+        1. Go to '...'
+        2. Click on '....'
+        3. Scroll down to '....'
+        4. See error
+    validations:
+      required: true
+  - type: textarea
+    id: expected-behaviour
+    attributes:
+      label: Expected behavior
+      placeholder: A clear and concise description of what you expected to happen.
+    validations:
+      required: true
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots
+      placeholder: If applicable, add screenshots to help explain your problem.
+    validations:
+      required: false
+  - type: input
+    id: browser
+    attributes:
+      label: Browser information
+      description: Which browser are you using? Which version? 
+      placeholder: e.g. Chromium Version 92.0.4515.131
+    validations:
+      required: false
+  - type: input
+    id: version
+    attributes:
+      label: Application version
+      description: 'Go on the left menu -> <user> -> User Settings and copy the printed version in "Running windmill version (backend): XXX".'
+      placeholder: e.g.  windmill version (backend) v1.35.0-63-ga85302c
+    validations:
+      required: false
+  - type: textarea
+    id: additional-context
+    attributes:
+      label: Additional Context
+      description: Add any other context about the problem here.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,8 @@
+---
+name: Feature Request
+about: Create a feature request
+title: 'feature: '
+labels: 'feature'
+assignees: 'rubenfiszel'
+
+---

.github/change-versions.sh

@@ -4,13 +4,17 @@ VERSION=$1
 echo "Updating versions to: $VERSION"
 
 sed -i -e "/^version =/s/= .*/= \"$VERSION\"/" backend/Cargo.toml
-sed -i -e "/version: /s/: .*/: $VERSION/" backend/openapi.yaml
+sed -i -e "/^const VERSION =/s/= .*/= \"v$VERSION\";/" cli/main.ts
+sed -i -e "/version: /s/: .*/: $VERSION/" backend/windmill-api/openapi.yaml
+sed -i -e "/version: /s/: .*/: $VERSION/" openflow.openapi.yaml
 sed -i -e "/\"version\": /s/: .*,/: \"$VERSION\",/" frontend/package.json
 sed -i -e "/^version =/s/= .*/= \"$VERSION\"/" python-client/wmill/pyproject.toml
 sed -i -e "/^windmill-api =/s/= .*/= \"\\^$VERSION\"/" python-client/wmill/pyproject.toml
 sed -i -e "/^version =/s/= .*/= \"$VERSION\"/" python-client/wmill_pg/pyproject.toml
-sed -i -e "/^wmill =/s/= .*/= \"\\^$VERSION\"/" python-client/wmill_pg/pyproject.toml
-sed -i -e "/^wmill =/s/= .*/= \">=$VERSION\"/" Pipfile
-sed -i -e "/^wmill_pg =/s/= .*/= \">=$VERSION\"/" Pipfile
+# sed -i -e "/^wmill =/s/= .*/= \"\\^$VERSION\"/" python-client/wmill_pg/pyproject.toml
+sed -i -e "/^wmill =/s/= .*/= \">=$VERSION\"/" lsp/Pipfile
+sed -i -e "/^wmill_pg =/s/= .*/= \">=$VERSION\"/" lsp/Pipfile
 
 sed -i -zE "s/name = \"windmill\"\nversion = \"[^\"]*\"\\n(.*)/name = \"windmill\"\nversion = \"$VERSION\"\\n\\1/" backend/Cargo.lock
+
+cd frontend && npm i --package-lock-only

.github/dependabot.yml

@@ -0,0 +1,39 @@
+# Basic set up for three package managers
+
+version: 2
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  # Maintain dependencies for npm
+  - package-ecosystem: "npm"
+    directory: "/frontend"
+    schedule:
+      interval: "weekly"
+
+  # Maintain dependencies for cargo
+  - package-ecosystem: "cargo"
+    directory: "/backend"
+    schedule:
+      interval: "weekly"
+
+  # Maintain dependencies for Docker
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  # Maintain dependencies for wmill python client
+  - package-ecosystem: "pip"
+    directory: "/python-client/wmill"
+    schedule:
+      interval: "weekly"
+      
+  # Maintain dependencies for wmill_pg python client
+  - package-ecosystem: "pip"
+    directory: "/python-client/wmill_pg"
+    schedule:
+      interval: "weekly"

.github/pull_hub_items.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+RT=$(curl -s https://hub.windmill.dev/resource_types/list | jq -c -r '.[]')
+for item in ${RT[@]}; do
+    name=$(jq -r '.name' <<< "$item")
+    id=$(jq -r '.id' <<< "$item")
+    echo $name $id 
+    body=$(curl -s -H "accept: application/json" https://hub.windmill.dev/resource_types/${id}/${name})
+    jq -r '.resource_type.schema' <<< "$body" > ./tmp
+    description=$(jq -r '.resource_type.description' <<< "$body")
+    description=$(echo -E $description)
+    echo "{\"workspace_id\": \"starter\", \"name\": \"$name\", \"schema\": $(cat ./tmp), \"description\": \"$description\"} " | jq . > community/resource_types/${name}.json
+    rm ./tmp
+done

.github/workflows/automerge-dependabot.yml

@@ -0,0 +1,26 @@
+name: dependabot auto-merge
+
+on: pull_request_target
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  dependabot:
+    runs-on: ubuntu-latest
+    if: ${{ github.actor == 'dependabot[bot]' }}
+    steps:
+      - name: Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v1.3.5
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+      - name: Enable auto-merge for Dependabot PRs
+        if: steps.metadata.outputs.update-type == 'version-update:semver-patch' ||  steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        run: |
+          echo ${{ secrets.RUBEN_PAT }} | gh auth login --with-token
+          gh pr review --approve "$PR_URL"
+          gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}

.github/workflows/backend-test.yml

@@ -0,0 +1,43 @@
+name: Backend only integration tests
+
+on:
+  push:
+    branches:
+      - "main"
+    paths:
+      - "backend/**"
+      - ".github/workflows/backend-test.yml"
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths:
+      - "backend/**"
+      - ".github/workflows/backend-test.yml"
+
+jobs:
+  cargo_test:
+    runs-on: [self-hosted, new]
+    container:
+      image: ghcr.io/windmill-labs/backend-tests
+      options: --privileged
+    services:
+      postgres:
+        image: postgres
+        env:
+          POSTGRES_DB: windmill
+          POSTGRES_PASSWORD: changeme
+
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - uses: actions/checkout@v3
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: |
+            backend
+            backend -> target
+      - name: cargo test
+        timeout-minutes: 10
+        run: mkdir frontend/build && cd backend && DATABASE_URL=postgres://postgres:changeme@postgres:5432/windmill cargo test --all -- --nocapture

.github/workflows/change-versions.yml

@@ -7,8 +7,9 @@ on:
 jobs:
   change_version:
     runs-on: ubuntu-latest
+    container: node:18
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Change versions
         run: ./.github/change-versions.sh "$(cat version.txt)"
       - uses: stefanzweifel/git-auto-commit-action@v4

.github/workflows/deno_on_release.yml

@@ -0,0 +1,48 @@
+name: Publish deno-client
+on:
+  push:
+    tags:
+      - "v*"
+env:
+  repo: windmill-deno-client
+
+jobs:
+  build_deno_and_push_to_repo:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: generate_deno
+        run: |
+          cd deno-client
+          rm .gitignore
+          ./build.sh
+      - name: Pushes to another repository
+        id: push_directory
+        uses: cpina/github-action-push-to-another-repository@devel
+        env:
+          API_TOKEN_GITHUB: ${{ secrets.DENO_PAT }}
+        with:
+          source-directory: deno-client/
+          destination-github-username: ${{ github.repository_owner }}
+          destination-repository-name: ${{ env.repo }}
+          user-email: ruben@windmill.dev
+          commit-message: See ORIGIN_COMMIT from $GITHUB_REF
+          target-branch: main
+
+  tag_repo:
+    needs: [build_deno_and_push_to_repo]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          repository: ${{ github.repository_owner }}/${{ env.repo }}
+          token: ${{ secrets.DENO_PAT }}
+          path: ./client
+
+      - name: Push client
+        run: |
+          cd ./client
+          git config --global user.email "ruben@windmill.dev"
+          git config --global user.name "rubenfiszel[bot]"
+          git tag -a ${{ github.ref_name }} -m "${{ github.ref_name }}"
+          git push --tags

.github/workflows/deploy_to_windmill.yml

@@ -3,6 +3,8 @@ name: Deploy to windmill.dev
 on:
   push:
     branches: [main]
+    paths:
+      - "community/**"
 
 jobs:
   deploy:
@@ -10,7 +12,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: Deploy to windmill.dev
-        uses: windmill-labs/windmill-gh-action-deploy@v1.0.0
+        uses: windmill-labs/windmill-gh-action-deploy@v2.0.0
         with:
           dry_run: false
           input_dir: community

.github/workflows/docker-image-arm.yml

@@ -0,0 +1,62 @@
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+  LOCAL_REGISTRY: registry.wimill.xyz
+
+name: Build and push arm docker image
+on:
+  push:
+    branches: [main]
+    tags: ["*"]
+
+concurrency:
+  group: ${{ github.ref }}-arm
+  cancel-in-progress: true
+
+jobs:
+  publish_arm:
+    runs-on: [self-hosted, new]
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Docker meta
+        id: meta-slim-public
+        uses: docker/metadata-action@v4
+        with:
+          images: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      - name: Login to registry
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push publicly
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+            ${{ steps.meta-slim-public.outputs.tags }}
+          labels: |
+            ${{ steps.meta-slim-public.outputs.labels }}
+            org.opencontainers.image.licenses=AGPLv3
+          cache-from: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-arm:buildcache
+          cache-to: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-arm:buildcache

.github/workflows/docker-image.yml

@@ -1,7 +1,14 @@
-name: Docker Image CI
+env:
+  LOCAL_REGISTRY: registry.wimill.xyz
+  REGISTRY: ghcr.io
+  ECR_REGISTRY: 976079455550.dkr.ecr.us-east-1.amazonaws.com
+  IMAGE_NAME: ${{ github.repository }}
+
+name: Build and push docker image
 on:
   push:
     branches: [main]
+    tags: ["*"]
   pull_request:
     types: [opened, synchronize, reopened]
 
@@ -12,28 +19,216 @@ concurrency:
 jobs:
   build:
     runs-on: [self-hosted, new]
-    env:
-      DOCKER_BUILDKIT: 1
     steps:
-      - name: Wait for release to succeed
-        if: github.ref == 'refs/heads/main'
-        uses: lewagon/wait-on-check-action@v1.0.0
-        with:
-          ref: ${{ github.ref }}
-          check-name: "Release please"
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          wait-interval: 10
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           fetch-depth: 0
-      - name: deploy staging stack
-        run: |
-          docker build . --cache-from "registry.wimill.xyz/windmill:staging" -t "registry.wimill.xyz/windmill:staging" --build-arg BUILDKIT_INLINE_CACHE=1
-          docker push "registry.wimill.xyz/windmill:staging"
-      - name: deploy demo stack
-        if: github.ref == 'refs/heads/main'
-        run: |
-          docker tag registry.wimill.xyz/windmill:staging registry.wimill.xyz/windmill:main
-          docker push registry.wimill.xyz/windmill:main
-      # - name: pruning unused images
-      #   run: sudo docker image prune -a
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Docker meta
+        id: meta-slim
+        if: github.event_name == 'pull_request'
+        uses: docker/metadata-action@v4
+        with:
+          images: |
+            ${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-slim
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      - name: Build and push publicly
+        uses: docker/build-push-action@v3
+        if: github.event_name == 'pull_request'
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-slim:latest
+            ${{ steps.meta-slim.outputs.tags }}
+          labels: |
+            ${{ steps.meta-slim.outputs.labels }}
+          cache-from: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-slim:buildcache
+          cache-to: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-slim:buildcache
+
+
+      - name: Docker meta
+        id: meta-public
+        if: github.event_name != 'pull_request'
+        uses: docker/metadata-action@v4
+        with:
+          images: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      - name: Docker meta
+        id: meta-ee-public
+        if: github.event_name != 'pull_request'
+        uses: docker/metadata-action@v4
+        with:
+          images: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      - name: Login to registry
+        uses: docker/login-action@v2
+        if: github.event_name != 'pull_request'
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push publicly
+        if: github.event_name != 'pull_request'
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+            ${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-slim:latest
+            ${{ steps.meta-public.outputs.tags }}
+          labels: |
+            ${{ steps.meta-public.outputs.labels }}
+            org.opencontainers.image.licenses=AGPLv3
+          cache-from: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-slim:buildcache
+          cache-to: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-slim:buildcache
+
+      - name: Build and push publicly ee
+        if: github.event_name != 'pull_request'
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          push: true
+          build-args: |
+            features=enterprise
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:latest
+            ${{ steps.meta-ee-public.outputs.tags }}
+          labels: |
+            ${{ steps.meta-ee-public.outputs.labels }}
+            org.opencontainers.image.licenses=Windmill-Enterprise-License
+          cache-from: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-ee:buildcache
+          cache-to: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-ee:buildcache
+
+
+  playwright:
+    runs-on: [self-hosted, new]
+    needs: [build]
+    services:
+      postgres:
+        image: postgres
+        env:
+          POSTGRES_DB: windmill
+          POSTGRES_USER: admin
+          POSTGRES_PASSWORD: changeme
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - uses: actions/checkout@v3
+      - name: "Docker"
+        run: echo "::set-output name=id::$(docker run --network=host --rm -d -p 8000:8000 --privileged -it -e DATABASE_URL=postgres://admin:changeme@localhost:5432/windmill -e BASE_INTERNAL_URL=http://localhost:8000 ${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-slim:latest)"
+        id: docker-container
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16
+      - name: "Playwright run"
+        timeout-minutes: 2
+        run: cd frontend && npm ci @playwright/test && npx playwright install && npm run test
+      - name: "Clean up"
+        run: docker kill ${{ steps.docker-container.outputs.id }}
+        if: always()
+
+
+  publish_privately_heavy:
+    needs: [build]
+    runs-on: [self-hosted, new]
+    if: github.event_name != 'pull_request'
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Docker meta
+        id: meta-heavy
+        uses: docker/metadata-action@v4
+        with:
+          images: |
+            ${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}
+            ${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha
+
+      - name: Login to ECR
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ env.ECR_REGISTRY }}
+          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          
+      - name: Build and push privately
+        uses: docker/build-push-action@v3
+        if: github.event_name != 'pull_request'
+        with:
+          context: .
+          push: true
+          file: ./docker/DockerfileHeavy
+          tags: |
+            ${{ steps.meta-heavy.outputs.tags }}
+          labels: ${{ steps.meta-heavy.outputs.labels }}
+          cache-from: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-ee:buildcache
+          cache-to: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-ee:buildcache,mode=max
+
+  publish_privately_helm:
+    runs-on: [self-hosted, new]
+    needs: [build]
+    if: github.event_name != 'pull_request'
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+ 
+
+      - name: Login to ECR
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ env.ECR_REGISTRY }}
+          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          
+      - name: Build and push privately
+        uses: docker/build-push-action@v3
+        if: github.event_name != 'pull_request'
+        with:
+          context: .
+          push: true
+          file: ./docker/DockerfileHelm
+          tags: |
+            ${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}:helm
+          cache-from: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-helm:buildcache
+          cache-to: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-helm:buildcache,mode=max

.github/workflows/go_on_release.yml

@@ -0,0 +1,53 @@
+name: Publish go-client
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+env:
+  repo: windmill-go-client
+
+jobs:
+  build_go_and_push_to_repo:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v3
+      - name: generate_go
+        run: |
+          go install github.com/deepmap/oapi-codegen/cmd/oapi-codegen@v1.11.0
+          cd go-client
+          rm .gitignore
+          ./build.sh
+          go build
+      - name: Pushes to another repository
+        id: push_directory
+        uses: cpina/github-action-push-to-another-repository@devel
+        env:
+          API_TOKEN_GITHUB: ${{ secrets.DENO_PAT }}
+        with:
+          source-directory: go-client/
+          destination-github-username: ${{ github.repository_owner }}
+          destination-repository-name: ${{ env.repo }}
+          user-email: ruben@windmill.dev
+          commit-message: See ORIGIN_COMMIT from $GITHUB_REF
+          target-branch: main
+
+  tag_repo:
+    needs: [build_go_and_push_to_repo]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          repository: ${{ github.repository_owner }}/${{ env.repo }}
+          token: ${{ secrets.DENO_PAT }}
+          path: ./client
+
+      - name: Push client
+        run: |
+          cd ./client
+          git config --global user.email "ruben@windmill.dev"
+          git config --global user.name "rubenfiszel[bot]"
+          git tag -a ${{ github.ref_name }} -m "${{ github.ref_name }}"
+          git push --tags

.github/workflows/on-release.yml

@@ -1,38 +0,0 @@
-name: Build LSP Docker
-on:
-  push:
-    branches: [main]
-    paths:
-      - "python-client/**"
-      - "Pipfile"
-      - ".github/workflows/on-release.yml"
-
-jobs:
-  build_lsp:
-    runs-on: [self-hosted, new]
-    steps:
-      - name: Wait for release to succeed
-        if: github.ref == 'refs/heads/main'
-        uses: lewagon/wait-on-check-action@v1.0.0
-        with:
-          ref: ${{ github.ref }}
-          check-name: "Release please"
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          wait-interval: 10
-      - uses: actions/checkout@v2
-      - name: Upload python client
-        env:
-          PYPI_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-        run: |
-          cd python-client
-          export PATH=$PATH:/usr/local/bin
-          export PATH=$PATH:/root/.local/bin
-          ./publish.sh
-      - name: Build the Docker image
-        run: |
-          cd lsp
-          sudo docker pull "registry.wimill.xyz/lsp:main" || true
-          sudo docker build  .  --cache-from "registry.wimill.xyz/lsp:main" -t "registry.wimill.xyz/lsp:main" --build-arg BUILDKIT_INLINE_CACHE=1
-      - name: push to registry
-        run: |
-          sudo docker push "registry.wimill.xyz/lsp:main"

.github/workflows/pull-hub.yml

@@ -0,0 +1,20 @@
+name: Pull Hub Items
+on:
+  schedule:
+    # * is a special character in YAML so you have to quote this string
+    - cron: "0 0 */1 * *"
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+jobs:
+  change_version:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Pull hub
+        run: ./.github/pull_hub_items.sh
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v4
+        with:
+          title: sync hub items with community
+          commit-message: sync hub items with community

.github/workflows/pypi_on_release.yml

@@ -0,0 +1,76 @@
+env:
+  REGISTRY: ghcr.io
+  ECR_REGISTRY: 976079455550.dkr.ecr.us-east-1.amazonaws.com
+  IMAGE_NAME: ${{ github.repository }}-lsp
+
+name: Publish python-client
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+jobs:
+  publish_pypi:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/windmill-labs/python-client-builder
+    steps:
+      - uses: actions/checkout@v3
+      - name: Upload python client
+        env:
+          PYPI_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
+        run: |
+          cd python-client
+          ./publish.sh
+
+  publish_lsp:
+    needs: [publish_pypi]
+    runs-on: [self-hosted, new]
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+            ${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      - name: Login to registry
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to ECR
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ env.ECR_REGISTRY }}
+          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+      - name: Build and push publicly
+        uses: docker/build-push-action@v3
+        with:
+          context: "{{defaultContext}}:lsp"
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+            ${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+            ${{ steps.metalocal.outputs.tags }}
+            ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.metalocal.outputs.labels }}
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max

.github/workflows/release-please.yml

@@ -1,14 +1,14 @@
 on:
   push:
-    branches:
-      - main
+    branches: [main]
+
 name: release-please
 jobs:
   release-please:
     name: "Release please"
     runs-on: ubuntu-latest
     steps:
-      - uses: GoogleCloudPlatform/release-please-action@v2
+      - uses: GoogleCloudPlatform/release-please-action@v3
         with:
           release-type: simple
           package-name: windmill

.github/workflows/sign-cla.yml

@@ -0,0 +1,34 @@
+name: "CLA Assistant"
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, closed, synchronize]
+
+jobs:
+  CLAssistant:
+    runs-on: ubuntu-latest
+    steps:
+      - name: "CLA Assistant"
+        if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
+        # Beta Release
+        uses: cla-assistant/github-action@v2.2.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PERSONAL_ACCESS_TOKEN: ${{ secrets.CLA_PAT }}
+        with:
+          path-to-signatures: "signatures/cla.json"
+          path-to-document: "https://github.com/windmill-labs/windmill/blob/master/CLA.md"
+          branch: "signatures"
+          allowlist: rubenfiszel,bot*
+
+          #below are the optional inputs - If the optional inputs are not given, then default values will be taken
+          #remote-organization-name: enter the remote organization name where the signatures should be stored (Default is storing the signatures in the same repository)
+          #remote-repository-name:  enter the  remote repository name where the signatures should be stored (Default is storing the signatures in the same repository)
+          #create-file-commit-message: 'For example: Creating file for storing CLA Signatures'
+          #signed-commit-message: 'For example: $contributorName has signed the CLA in #$pullRequestNo'
+          #custom-notsigned-prcomment: 'pull request comment with Introductory message to ask new contributors to sign'
+          #custom-pr-sign-comment: 'The signature to be committed in order to sign the CLA'
+          #custom-allsigned-prcomment: 'pull request comment when all contributors has signed, defaults to **CLA Assistant Lite bot** All Contributors have signed the CLA.'
+          #lock-pullrequest-aftermerge: false - if you don't want this bot to automatically lock the pull request after merging (default - true)
+          #use-dco-flag: true - If you are using DCO instead of CLA

.gitignore

@@ -1,5 +1,6 @@
 target/
 .DS_Store
+nohup.out
 local/
 frontend/src/routes/test.svelte
 CaddyfileRemoteMalo

CLA.md

@@ -0,0 +1,145 @@
+## Contributor Agreement
+
+## Individual Contributor Non-Exclusive License Agreement
+
+Thank you for your interest in contributing to Windmill Labs, Inc's Windmill
+("We" or "Us").
+
+The purpose of this contributor agreement ("Agreement") is to clarify and
+document the rights granted by contributors to Us.
+
+### 1\. Definitions
+
+**"You"** means the individual Copyright owner who Submits a Contribution to Us.
+
+**"Legal Entity"** means an entity that is not a natural person.
+
+**"Affiliate"** means any other Legal Entity that controls, is controlled by, or
+under common control with that Legal Entity. For the purposes of this
+definition, "control" means (i) the power, direct or indirect, to cause the
+direction or management of such Legal Entity, whether by contract or otherwise,
+(ii) ownership of fifty percent (50%) or more of the outstanding shares or
+securities that vote to elect the management or other persons who direct such
+Legal Entity or (iii) beneficial ownership of such entity.
+
+**"Contribution"** means any original work of authorship, including any original
+modifications or additions to an existing work of authorship, Submitted by You
+to Us, in which You own the Copyright.
+
+**"Copyright"** means all rights protecting works of authorship, including
+copyright, moral and neighboring rights, as appropriate, for the full term of
+their existence.
+
+**"Material"** means the software or documentation made available by Us to third
+parties.
+
+**"Submit"** means any act by which a Contribution is transferred to Us by You
+by means of tangible or intangible media, including but not limited to
+electronic mailing lists, source code control systems, and issue tracking
+systems that are managed by, or on behalf of, Us, but excluding any transfer
+that is conspicuously marked or otherwise designated in writing by You as "Not a
+Contribution."
+
+**"Documentation"** means any non-software portion of a Contribution.
+
+### 2\. License grant
+
+#### 2.1 Copyright license to Us
+
+Subject to the terms and conditions of this Agreement, You hereby grant to Us a
+worldwide, royalty-free, NON-exclusive, perpetual and irrevocable (except as
+stated in Section 8.2) license, with the right to transfer an unlimited number
+of non-exclusive licenses or to grant sublicenses to third parties, under the
+Copyright covering the Contribution to use the Contribution by all means,
+including, but not limited to:
+
+- publish the Contribution,
+- modify the Contribution,
+- prepare derivative works based upon or containing the Contribution and/or to
+  combine the Contribution with other Materials,
+- reproduce the Contribution in original or modified form,
+- distribute, to make the Contribution available to the public, display and
+  publicly perform the Contribution in original or modified form.
+
+#### 2.2 Moral rights
+
+Moral Rights remain unaffected to the extent they are recognized and not
+waivable by applicable law. Notwithstanding, You may add your name to the
+attribution mechanism customary used in the Materials you Contribute to, such as
+the header of the source code files of Your Contribution, and We will respect
+this attribution when using Your Contribution.
+
+### 3\. Patents
+
+#### 3.1 Patent license
+
+Subject to the terms and conditions of this Agreement You hereby grant to Us and
+to recipients of Materials distributed by Us a worldwide, royalty-free,
+non-exclusive, perpetual and irrevocable (except as stated in Section 3.2)
+patent license, with the right to transfer an unlimited number of non-exclusive
+licenses or to grant sublicenses to third parties, to make, have made, use,
+sell, offer for sale, import and otherwise transfer the Contribution and the
+Contribution in combination with any Material (and portions of such
+combination). This license applies to all patents owned or controlled by You,
+whether already acquired or hereafter acquired, that would be infringed by
+making, having made, using, selling, offering for sale, importing or otherwise
+transferring of Your Contribution(s) alone or by combination of Your
+Contribution(s) with any Material.
+
+### 4. Disclaimer
+
+THE CONTRIBUTION IS PROVIDED "AS IS". MORE PARTICULARLY, ALL EXPRESS OR IMPLIED
+WARRANTIES INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTY OF SATISFACTORY
+QUALITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT ARE EXPRESSLY
+DISCLAIMED BY YOU TO US AND BY US TO YOU. TO THE EXTENT THAT ANY SUCH WARRANTIES
+CANNOT BE DISCLAIMED, SUCH WARRANTY IS LIMITED IN DURATION AND EXTENT TO THE
+MINIMUM PERIOD AND EXTENT PERMITTED BY LAW.
+
+### 5. Consequential damage waiver
+
+TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL YOU OR WE BE
+LIABLE FOR ANY LOSS OF PROFITS, LOSS OF ANTICIPATED SAVINGS, LOSS OF DATA,
+INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL AND EXEMPLARY DAMAGES ARISING OUT
+OF THIS AGREEMENT REGARDLESS OF THE LEGAL OR EQUITABLE THEORY (CONTRACT, TORT OR
+OTHERWISE) UPON WHICH THE CLAIM IS BASED.
+
+### 6. Approximation of disclaimer and damage waiver
+
+IF THE DISCLAIMER AND DAMAGE WAIVER MENTIONED IN SECTION 4. AND SECTION 5.
+CANNOT BE GIVEN LEGAL EFFECT UNDER APPLICABLE LOCAL LAW, REVIEWING COURTS SHALL
+APPLY LOCAL LAW THAT MOST CLOSELY APPROXIMATES AN ABSOLUTE WAIVER OF ALL CIVIL
+OR CONTRACTUAL LIABILITY IN CONNECTION WITH THE CONTRIBUTION.
+
+### 7. Term
+
+7.1 This Agreement shall come into effect upon Your acceptance of the terms and
+conditions.
+
+7.3 In the event of a termination of this Agreement Sections 4, 5, 6, 7 and 8
+shall survive such termination and shall remain in full force thereafter. For
+the avoidance of doubt, Free and Open Source Software (sub)licenses that have
+already been granted for Contributions at the date of the termination shall
+remain in full force after the termination of this Agreement.
+
+### 8 Miscellaneous
+
+8.1 This Agreement and all disputes, claims, actions, suits or other proceedings
+arising out of this agreement or relating in any way to it shall be governed by
+the laws of France excluding its private international law provisions.
+
+8.2 This Agreement sets out the entire agreement between You and Us for Your
+Contributions to Us and overrides all other agreements or understandings.
+
+8.3 In case of Your death, this agreement shall continue with Your heirs. In
+case of more than one heir, all heirs must exercise their rights through a
+commonly authorized person.
+
+8.4 If any provision of this Agreement is found void and unenforceable, such
+provision will be replaced to the extent possible with a provision that comes
+closest to the meaning of the original provision and that is enforceable. The
+terms and conditions set forth in this Agreement shall apply notwithstanding any
+failure of essential purpose of this Agreement or any limited remedy to the
+maximum extent possible under law.
+
+8.5 You agree to notify Us of any facts or circumstances of which you become
+aware that would make this Agreement inaccurate in any respect.

Caddyfile

@@ -1,4 +1,5 @@
-{$SITE_URL} {  
-  bind {$ADDRESS}
-  reverse_proxy /* server:8000
+{$BASE_URL} {
+        bind {$ADDRESS}
+        reverse_proxy /ws/* http://lsp:3001
+        reverse_proxy /* http://windmill:8000
 }

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.10-slim-buster as nsjail
+FROM debian:buster-slim as nsjail
 
 WORKDIR /nsjail
 
@@ -19,7 +19,24 @@ RUN git clone -b master --single-branch https://github.com/google/nsjail.git . \
     && git checkout dccf911fd2659e7b08ce9507c25b2b38ec2c5800
 RUN make
 
-FROM mhart/alpine-node:14 as frontend
+FROM rust:slim-buster AS rust_base
+
+RUN apt-get update && apt-get install -y git libssl-dev pkg-config npm
+
+RUN apt-get -y update \
+    && apt-get install -y \
+    curl lld nodejs npm
+
+RUN rustup component add rustfmt
+
+RUN CARGO_NET_GIT_FETCH_WITH_CLI=true cargo install cargo-chef 
+
+WORKDIR /windmill
+
+ENV SQLX_OFFLINE=true
+ENV CARGO_INCREMENTAL=1
+
+FROM node:19-alpine as frontend
 
 # install dependencies
 WORKDIR /frontend
@@ -29,67 +46,80 @@ RUN npm ci
 # Copy all local files into the image.
 COPY frontend .
 RUN mkdir /backend
-COPY /backend/openapi.yaml /backend/openapi.yaml
+COPY /backend/windmill-api/openapi.yaml /backend/windmill-api/openapi.yaml
+COPY /openflow.openapi.yaml /openflow.openapi.yaml
 RUN npm run generate-backend-client
+ENV NODE_OPTIONS "--max-old-space-size=8192"
 RUN npm run build
-
-FROM rust:slim-buster as builder
-
-RUN apt-get update && apt-get install -y git libssl-dev pkg-config
-
-RUN USER=root cargo new --bin windmill
-WORKDIR /windmill
-
-COPY ./backend/Cargo.toml .
-COPY ./backend/Cargo.lock .
-COPY ./backend/.cargo/ .cargo/
-
-RUN apt-get -y update \
-    && apt-get install -y \
-    curl
-
-ENV CARGO_INCREMENTAL=1
-
-RUN cargo build --release
-RUN rm src/*.rs
-
-RUN rm ./target/release/deps/windmill*
-ENV SQLX_OFFLINE=true
-
-ADD ./backend ./
-ADD ./nsjail /nsjail
-
-COPY --from=1 /frontend /frontend
-ADD .git/ .git/
-
-RUN cargo build --release
+RUN npm run check
 
 
-FROM debian:buster-slim
+FROM rust_base AS planner
+
+COPY ./openflow.openapi.yaml /openflow.openapi.yaml
+COPY ./backend ./
+
+RUN CARGO_NET_GIT_FETCH_WITH_CLI=true cargo chef prepare --recipe-path recipe.json
+
+FROM rust_base AS builder
+ARG features=""
+
+COPY --from=planner /windmill/recipe.json recipe.json
+
+RUN CARGO_NET_GIT_FETCH_WITH_CLI=true cargo chef cook --release --features "$features" --recipe-path recipe.json
+
+COPY ./openflow.openapi.yaml /openflow.openapi.yaml
+COPY ./backend ./
+
+COPY --from=frontend /frontend /frontend
+COPY .git/ .git/
+
+RUN CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release --features "$features"
+
+
+FROM python:3.11.0-slim-buster
+
 ARG APP=/usr/src/app
 
 RUN apt-get update \
-    && apt-get install -y ca-certificates tzdata libpq5 python3 python3-pip \
-    make build-essential libssl-dev zlib1g-dev libbz2-dev libreadline-dev \
-    libsqlite3-dev wget curl llvm libncurses5-dev libncursesw5-dev xz-utils tk-dev libxml2-dev \
-    libxmlsec1-dev libffi-dev liblzma-dev mecab-ipadic-utf8 libgdbm-dev libc6-dev git libprotobuf-dev=3.6.* libnl-route-3-dev=3.4.* \
-    libv8-dev \
+    && apt-get install -y ca-certificates wget curl git jq libprotobuf-dev libnl-route-3-dev unzip \
+    && apt-get install -y ca-certificates wget curl git jq libprotobuf-dev libnl-route-3-dev unzip build-essential \
     && rm -rf /var/lib/apt/lists/*
 
+RUN arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
+    curl -o rclone.zip "https://downloads.rclone.org/v1.60.1/rclone-v1.60.1-linux-$arch.zip"; \
+    unzip -p rclone.zip rclone-v1.60.1-linux-$arch/rclone > /usr/bin/rclone; rm rclone.zip; \
+    chown root:root /usr/bin/rclone; chmod 755 /usr/bin/rclone
+
+RUN set -eux; \
+    arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
+    url=; \
+    case "$arch" in \
+    'amd64') \
+    targz='go1.19.3.linux-amd64.tar.gz'; \
+    sha256='74b9640724fd4e6bb0ed2a1bc44ae813a03f1e72a4c76253e2d5c015494430ba'; \
+    ;; \
+    'arm64') \
+    targz='go1.19.3.linux-arm64.tar.gz'; \
+    sha256='99de2fe112a52ab748fb175edea64b313a0c8d51d6157dba683a6be163fd5eab'; \
+    ;; \
+    *) echo >&2 "error: unsupported architecture '$arch' (likely packaging update needed)"; exit 1 ;; \
+    esac; \
+    wget "https://golang.org/dl/$targz" -nv && tar -C /usr/local -xzf "$targz" && rm "$targz";
+
+ENV PATH="${PATH}:/usr/local/go/bin"
+ENV GO_PATH=/usr/local/go/bin/go
+
 ENV TZ=Etc/UTC
 
-ENV PYTHON_VERSION 3.10.4
-
-RUN wget https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz \
-    && tar -xf Python-${PYTHON_VERSION}.tgz && cd Python-${PYTHON_VERSION}/ && ./configure --enable-optimizations \
-    && make -j 4 && make install
-
-RUN python3 -m pip install pip-tools
+RUN /usr/local/bin/python3 -m pip install pip-tools
 
 COPY --from=builder /windmill/target/release/windmill ${APP}/windmill
 
 COPY --from=nsjail /nsjail/nsjail /bin/nsjail
 
+COPY --from=denoland/deno:latest /usr/bin/deno /usr/bin/deno
+
 RUN mkdir -p ${APP}
 
 WORKDIR ${APP}

LICENSE

@@ -2,7 +2,7 @@
 Source code in this repository is variously licensed under the Apache License
 Version 2.0 (see file ./LICENSE-APACHE),or the AGPLv3 License (see file ./LICENSE-AGPL)
 
-Every file is under copyright (c) Ruben Fiszel 2021 unless otherwise specified.
+Every file is under copyright (c) Windmill Labs, Inc 2022 unless otherwise specified.
 Every file is under License AGPL unless otherwise specified 
 or belonging to one of the below cases:
 

LICENSE-APACHE

@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2021 Ruben Fiszel
+   Copyright 2022 Windmill Labs, Inc
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

NOTICE

@@ -1,6 +1,4 @@
-Ruben Fiszel
-
-Copyright (c) 2021  Ruben Fiszel
+Copyright (c) 2022  Windmill Labs, Inc
 
 Source code in this repository is variously licensed under the Apache License
 Version 2.0 or the GNU Affero General Public License. Please see

README.md

@@ -1,10 +1,17 @@
 <p align="center">
-  <a href="https://alpha.windmill.dev"><img src="./windmill.svg" alt="windmill.dev"></a>
+  <a href="https://app.windmill.dev"><img src="./imgs/windmill-banner.png" alt="windmill.dev"></a>
 </p>
 <p align="center">
-    <em>Windmill.dev is an OSS developer platform to quickly build production-grade multi-steps automations and internal apps from minimal Python and Typescript scripts.</em>
+    <em>.</em>
 </p>
+<p align=center>
+Open-source developer infrastructure for internal tools. Self-hostable alternative to Airplane, Pipedream, Superblocks and a simplified Temporal with autogenerated UIs to trigger workflows and scripts as internal apps. Scripts are turned into UIs and no-code modules, no-code modules can be composed into very rich flows, and script and flows can be triggered from internal UIs made with a low-code builder. The script languages supported are: Python, Typescript, Go, Bash.
+</p>
+
 <p align="center">
+<a href="https://github.com/windmill-labs/windmill/actions/workflows/docker-image.yml" target="_blank">
+    <img src="https://github.com/windmill-labs/windmill/actions/workflows/docker-image.yml/badge.svg" alt="Docker Image CI">
+</a>
 <a href="https://pypi.org/project/wmill" target="_blank">
     <img src="https://img.shields.io/pypi/v/wmill?color=%2334D058&label=pypi%20package" alt="Package version">
 </a>
@@ -15,81 +22,251 @@
 
 ---
 
-**Join the alpha (personal workspaces are free forever)**:
-<https://alpha.windmill.dev>
+**Join the beta (personal workspaces are free forever)**:
+<https://app.windmill.dev>
 
 **Documentation**: <https://docs.windmill.dev>
 
 **Discord**: <https://discord.gg/V7PM2YHsPB>
 
-**We are hiring**: Software Engineers, DevOps, Solutions Engineers, Growth:
-<https://docs.windmill.dev/hiring>
+**Hub**: <https://hub.windmill.dev>
+
+**Contributor's guide**: <https://docs.windmill.dev/docs/contributors_guide>
+
+**Roadmap**: <https://github.com/orgs/windmill-labs/projects/2>
+
+**[Self-host instruction](#how-to-self-host)**
 
 You can show your support for the project by starring this repo.
 
 ---
 
+Windmill Labs offers commercial licenses and support to convert your existing
+automation and help you scale it in production. If interested, contact
+ruben@windmill.dev (founder of Windmill).
+
+---
+
 # Windmill
 
 <p align="center">
-<b>Disclaimer: </b>Windmill is in <b>BETA</b>. It is secure to run in production but the API might change,
-especially concerning flows.
+<b>Disclaimer: </b>Windmill is in <b>BETA</b>. It is secure to run in production but we are still <a href="https://github.com/orgs/windmill-labs/projects/2">improving the product fast<a/>.
 </p>
 
-![Windmill](./windmill.webp)
+![Windmill Screenshot](./imgs/windmill.png)
 
-Windmill is <b>fully open-sourced</b>:
+Windmill is <b>fully open-sourced (AGPLv3)</b>:
 
-- `community/` and `python-client/` are Apache 2.0
-- backend, frontend and everything else under AGPLv3.
+## What is the general idea behind Windmill
+
+1. Define a minimal and generic script in Python, Typescript, Go or Bash that solves a
+   specific task. Here sending an email with SMTP. The code can be defined in
+   the provided Web IDE or synchronized with your own github repo:
+   ![Step 1](./imgs/python-script.png)
+
+2. Your scripts parameters are automatically parsed and generate a frontend. You
+   can narrow down the types during task definition to specify regex for string,
+   an enum or a specific format for objects. Each script correspond to an app by
+   itself: ![Step 2](./imgs/arguments.png)
+
+3. Make it flow! You can chain your scripts or scripts made by the community
+   shared on [WindmillHub](https://hub.windmill.dev). There is tight integration
+   between Windmill and the hub to make it easy to build flows from a soon-to-be
+   exhaustive library of generic modules. In flows, one can pipe output to input
+   using rich expressions that are just plain Javascript underneath. Flows
+   support for-loops, branching, approval steps. As such and coupled with
+   inputs being able to refer to any step's output, they are actual DAG rather
+   than just linear sequences. They are backed by an open JSON spec we call
+   [OpenFlow](https://docs.windmill.dev/docs/openflow)
+
+Both scripts and flows are not restricted to be triggered by the UI. They can be
+triggered by a schedule, watch for changes (using
+[internal states](https://docs.windmill.dev/docs/reference#internal-state)) or
+triggered through API with either an async or sync webhook. The latter kind of
+endpoints make Windmill akin to a self-hostable AWS Lambda. Windmill can be the
+central place to host, build and run all of your integrations, automation and
+internal apps. We include credentials management and OAuth integration, groups
+and much more!
+
+## CLI
+
+We have a powerful CLI to interact with the windmill platform and sync your
+scripts from your own github repo. See
+[more details](https://github.com/windmill-labs/windmill/tree/main/cli)
 
 ## Layout
 
-- `backend/`: The whole Rust backend
-- `frontend`: The whole Svelte fronten
-- `community/`: Scripts and resource types created and curated by the community,
-  included in every workspace
-- `lsp/`: The lsp asssistant for the monaco editor
-- `nsjail/`: The nsjail configuration files for sandboxing of the scripts'
-  execution
-- `python-client/`: The wmill python client used within scripts to interact with
-  the windmill platform
+- `backend/`: Rust backend
+- `frontend`: Svelte frontend
+- `lsp/`: Lsp asssistant for the monaco editor
+- `<lang>-client/`: Windmill client for the given `<lang>`
 
 ## Stack
 
-- postgres as the database
-- backend in Rust with the follwing highly-available and horizontally scalable
+- Postgres as the database
+- backend in Rust with the following highly-available and horizontally scalable
   architecture:
   - stateless API backend
-  - workers that pull jobs from a queue
-- frontend in svelte
-- scripts executions are sandboxed using google's nsjail
-- javascript runtime is deno_core rust library (which itself uses the rusty_v8
-  and hence V8 underneath)
+  - workers that pull jobs from a queue in Postgres (and later, Kafka or Redis.
+    Upvote [#173](#https://github.com/windmill-labs/windmill/issues/173) if
+    interested )
+- frontend in Svelte
+- scripts executions are sandboxed using google's
+  [nsjail](https://github.com/google/nsjail)
+- javascript runtime is the
+  [deno_core rust library](https://denolib.gitbook.io/guide/) (which itself uses
+  the [rusty_v8](https://github.com/denoland/rusty_v8) and hence V8 underneath)
 - typescript runtime is deno
 - python runtime is python3
+- golang runtime is 1.19.1
+
+## Security
+
+### Sandboxing and workload isolation
+
+Windmill uses [nsjail](https://github.com/google/nsjail) on top of the deno
+sandboxing. It is production multi-tenant grade secure. Do not take our word for
+it, take [fly.io's one](https://fly.io/blog/sandboxing-and-workload-isolation/)
+
+### Secrets, credentials and sensitive values
+
+There is one encryption key per workspace to encrypt the credentials and secrets
+stored in Windmill's K/V store.
+
+In addition, we strongly recommend that you encrypt the whole Postgres database.
+That is what we do at <https://app.windmill.dev>.
+
+## Performance
+
+The performances are great, as long as you do not exceed the parallelism of the
+workers, we are
+[worse than AWS Lambda for small workloads but not by that much](https://docs.windmill.dev/docs/benchmark)
 
 ## Architecture
 
-A detailed section about Windmill architecture is coming soon
+<p align="center">
 
-### Development stack
+### Big-picture Architecture
 
-- caddy is the reverse proxy used for local development, see frontend's
-  Caddyfile and CaddyfileRemote
+<img src="./imgs/diagram.svg">
+
+### Technical Architecture
+
+<img src="./imgs/architecture.svg">
+
+</p>
 
 ## How to self-host
 
-Complete instructions coming soon
+We only provide docker-compose setup here. For more advanced setups, like
+compiling from source or using without a postgres super user, see
+[documentation](https://docs.windmill.dev/docs/how-tos/self_host)
+
+### Docker compose
+
+`docker compose up` with the following docker-compose is sufficient:
+<https://github.com/windmill-labs/windmill/blob/main/docker-compose.yml>
+
+Go to https://localhost et voilà :)
+
+For older kernels < 4.18, set `DISABLE_NUSER=true` as env variable, otherwise
+nsjail will not be able to launch the isolated scripts.
+
+To disable nsjail altogether, set `DISABLE_NSJAIL=true`.
+
+The default super-admin user is: admin@windmill.dev / changeme
+
+From there, you can create other users (do not forget to change the password!)
+
+### Commercial license
+
+To self-host Windmill, you must respect the terms of the AGPLv3 license which
+you do not need to worry about for personal uses. For business uses, you should
+be fine if you do not re-expose it in any way Windmill to your users and are
+comfortable with AGPLv3.
+
+To re-expose any Windmill parts to your users as a feature of your product, or
+to build a feature on top of Windmill, to comply with AGPLv3 your product must
+be AGPLv3 or you must get a commercial license. Contact us at
+<license@windmill.dev> if you have any doubts.
+
+In addition, a commercial license grants you a dedicated engineer to transition
+your current infrastructure to Windmill, support with tight SLA, audit logs
+export features, SSO, unlimited users creation, advanced permission managing features
+such as groups and the ability to create more than one workspace.
+
+### OAuth for self-hosting (very optional)
+
+To get the same oauth integrations as Windmill Cloud, mount `oauth.json` with
+the following format:
+
+```json
+{
+  "<client>": {
+    "id": "<CLIENT_ID>",
+    "secret": "<CLIENT_SECRET>",
+    "allowed_domains": ["windmill.dev"] //restrict a client OAuth login to some domains
+  }
+}
+```
+
+and mount it at `/usr/src/app/oauth.json`.
+
+[The list of all possible "connect an app" oauth clients](https://github.com/windmill-labs/windmill/blob/main/backend/oauth_connect.json)
+
+To add more "connect an app" OAuth clients to the Windmill project, read the
+[Contributor's guide](https://docs.windmill.dev/docs/contributors_guide). We
+welcome contributions!
+
+### Resource types
+
+You will also want to import all the approved resource types from
+[WindmillHub](https://hub.windmill.dev). There is no automatic way to do this
+automatically currently, but it will be possible using a command with the
+upcoming CLI tool.
+
+## Run a local dev setup
+
+### only Frontend
+
+This will use the backend of <https://app.windmill.dev> but your own frontend
+with hot-code reloading.
+
+1. Install [caddy](https://caddyserver.com)
+2. Go to `frontend/`:
+   1. `npm install`, `npm run generate-backend-client` then `npm run dev`
+   2. In another shell `sudo caddy run --config CaddyfileRemote`
+3. Et voilà, windmill should be available at `http://localhost/`
+
+### Backend + Frontend
+
+See the [./frontend/README_DEV.md](./frontend/README_DEV.md) file for all
+running options.
+
+1. Create a Postgres Database for Windmill and create an admin role inside your
+   Postgres setup.
+   The easiest way to get a working postgres is running `cargo install sqlx-cli && sqlx migrate run`.
+   This will also avoid compile time issue with sqlx's `query!` macro
+2. Install [nsjail](https://github.com/google/nsjail) and have it accessible in
+   your PATH
+3. Install deno and python3, have the bins at `/usr/bin/deno` and
+   `/usr/local/bin/python3`
+4. Install [caddy](https://caddyserver.com)
+5. Install the [lld linker](https://lld.llvm.org/)
+6. Go to `frontend/`:
+   1. `npm install`, `npm run generate-backend-client` then `npm run dev`
+   2. In another shell `npm run build` otherwise the backend will not find the `frontend/build` folder and will crash
+   3. In another shell `sudo caddy run --config Caddyfile`
+7. Go to `backend/`:
+   `DATABASE_URL=<DATABASE_URL_TO_YOUR_WINDMILL_DB> RUST_LOG=info cargo run`
+8. Et voilà, windmill should be available at `http://localhost/`
+
+## Contributors
+
+<a href="https://github.com/windmill-labs/windmill/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=windmill-labs/windmill" />
+</a>
 
 ## Copyright
 
-2021 [Ruben Fiszel](https://github.com/rubenfiszel)
-
-### Acknowledgement
-
-This project is inspired from a previous project called
-[Delightool](https://github.com/windmill-labs/delightool-legacy) which was also
-led by [Ruben](https://github.com/rubenfiszel) and with large contribution on
-the frontend from [Malo Marrec](https://github.com/malomarrec) who gave his
-blessing to Windmill.
+Windmill Labs, Inc 2022

backend/.cargo/config

@@ -1,3 +0,0 @@
-[build]
-rustflags = ["--cfg", "tokio_unstable"]
-incremental = true

backend/.cargo/config.toml

@@ -0,0 +1,10 @@
+[build]
+rustflags = [
+    "--cfg",
+    "tokio_unstable",
+    "-C",
+    "link-arg=-fuse-ld=lld",
+    "-Clink-arg=-Wl,--no-rosegment",
+]
+incremental = true
+

backend/.devcontainer.json

@@ -0,0 +1,27 @@
+// For format details, see https://aka.ms/devcontainer.json. For config options, see the README at:
+// https://github.com/microsoft/vscode-dev-containers/tree/v0.245.2/containers/docker-existing-docker-compose
+// If you want to run as a non-root user in the container, see .devcontainer/docker-compose.yml.
+{
+	"name": "Backend Container",
+	"dockerComposeFile": [
+		"../docker-compose.yml",
+		"../.devcontainer/docker-compose.yml"
+	],
+	"customizations": {
+		"vscode": {
+			"extensions": [
+				"rust-lang.rust-analyzer",
+				"yzhang.markdown-all-in-one"
+			]
+		}
+	},
+	"service": "windmill",
+	"workspaceFolder": "/workspace",
+	// Use 'forwardPorts' to make a list of ports inside the container available locally.
+	"forwardPorts": [
+		8000
+	],
+	// "postCreateCommand": "sudo apt-get update && sudo apt-get install -y lld python3 && cargo install sqlx-cli --no-default-features --features native-tls,postgres && (cd backend && sqlx migrate run) && cargo install deno --locked && rustup toolchain install nightly-2022-05-23 -c rust-src -c rustc-dev -c llvm-tools-preview",
+	"postCreateCommand": "cd backend && sqlx migrate run",
+	"remoteUser": "vscode"
+}

backend/.gitattributes

@@ -0,0 +1 @@
+sqlx-data.json -diff

backend/.gitignore

@@ -1,2 +1,3 @@
 target/
 .env
+oauth.json

backend/Cargo.toml

@@ -1,13 +1,68 @@
 [package]
 name = "windmill"
-version = "1.5.0"
-authors = ["Ruben Fiszel <ruben@rubenfiszel.com>"]
+version = "1.48.0"
+authors.workspace = true
+edition.workspace = true
+
+[workspace]
+members = [
+    "./windmill-api",
+    "./windmill-queue",
+    "./windmill-worker",
+    "./windmill-common",
+    "./windmill-audit",
+    "./windmill-api-client",
+    "./parsers/windmill-parser",
+    "./parsers/windmill-parser-ts",
+    "./parsers/windmill-parser-go",
+    "./parsers/windmill-parser-py",
+]
+
+[workspace.package]
+version = "1.48.0"
+authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
-[build-dependencies]
-deno_core = "^0"
+[[bin]]
+name = "windmill"
+path = "./src/main.rs"
+
+[features]
+enterprise = ["windmill-worker/enterprise"]
 
 [dependencies]
+anyhow.workspace = true
+tokio.workspace = true
+dotenv.workspace = true
+windmill-common = { workspace = true, features = ["tracing_init"] }
+windmill-api.workspace = true
+windmill-api-client.workspace = true
+windmill-worker.workspace = true
+futures.workspace = true
+tracing.workspace = true
+sqlx.workspace = true
+tokio-metrics.workspace = true
+rand.workspace = true
+chrono.workspace = true
+
+[dev-dependencies]
+serde_json.workspace = true
+reqwest.workspace = true
+windmill-queue.workspace = true
+axum.workspace = true
+
+[workspace.dependencies]
+windmill-api = { path = "./windmill-api" }
+windmill-api-client = { path = "./windmill-api-client" }
+windmill-queue = { path = "./windmill-queue" }
+windmill-worker = { path = "./windmill-worker" }
+windmill-common = { path = "./windmill-common" }
+windmill-audit = { path = "./windmill-audit" }
+windmill-parser = { path = "./parsers/windmill-parser" }
+windmill-parser-ts = { path = "./parsers/windmill-parser-ts" }
+windmill-parser-py = { path = "./parsers/windmill-parser-py" }
+windmill-parser-go = { path = "./parsers/windmill-parser-go" }
+windmill-parser-bash = { path = "./parsers/windmill-parser-bash" }
 axum = { version = "^0", features = ["headers"] }
 headers = "^0"
 hyper = { version = "^0", features = ["full"] }
@@ -17,46 +72,69 @@ tower-http = { version = "^0", features = ["trace"] }
 tower-cookies = "^0"
 serde = "^1"
 serde_json = { version = "^1", features = ["preserve_order"] }
-uuid = { version = "^0", features = ["serde", "v4"] }
+uuid = { version = "^1", features = ["serde", "v4"] }
 thiserror = "^1"
 anyhow = "^1"
-chrono = { version = "^0", features = ["serde"]}
+chrono = { version = "^0", features = ["serde"] }
 tracing = "^0"
-tracing-subscriber = { version = "^0", features = ["env-filter", "json"]}
-console-subscriber = "^0"
-
+tracing-subscriber = { version = "^0", features = ["env-filter", "json"] }
+prometheus = { version = "^0", default-features = false }
+cookie = { version = "^0" }
+phf = { version = "0.11", features = ["macros"] }
 rust-embed = "^6"
 mime_guess = "^2"
 hex = "^0"
 sql-builder = "^3"
 argon2 = "^0"
 retainer = "^0"
-rand = "^0.8.4"
-rand_core = { version = "^0.6.3", features = ["std"] }
+rand = "0.8.5"
+rand_core = { version = "^0", features = ["std"] }
 magic-crypt = "^3"
 git-version = "^0"
-rustpython-parser = "^0"
+rustpython-parser = { git = "https://github.com/RustPython/RustPython" }
 cron = "^0"
-external-ip = "^4"
-lettre = { version = "^0.10.0-rc.4", features = ["rustls-tls", "tokio1", "tokio1-rustls-tls", "builder", "smtp-transport"],  default-features = false}
+lettre = { version = "^0", features = [
+    "rustls-tls",
+    "tokio1",
+    "tokio1-rustls-tls",
+    "builder",
+    "smtp-transport",
+], default-features = false }
 urlencoding = "^2"
-oauth2 = "^4"
 url = "^2"
+async-oauth2 = "^0"
 reqwest = { version = "^0", features = ["json"] }
-time = "0.3.7"
-slack-http-verifier = "^0"
+time = "0.3.16"
 serde_urlencoded = "^0"
 tokio-tar = "^0"
 tempfile = "^3"
-tokio-util = { version = "0.7.0", features = ["io"] }
+tokio-util = { version = "^0", features = ["io"] }
 json-pointer = "^0"
 itertools = "^0"
 regex = "^1"
 deno_core = "^0"
-indexmap = "~1.6.2"
 async-recursion = "^1"
-
-sqlx = { version = "^0", features = ["macros", "offline", "migrate", "uuid", "json", "chrono", "postgres", "runtime-tokio-rustls"]}
+swc_common = "^0"
+swc_ecma_parser = "^0"
+swc_ecma_ast = "^0"
+base64 = "^0"
+unicode-general-category = "^0"
+hmac = "0.12.1"
+sha2 = "0.10.6"
+sqlx = { version = "^0", features = [
+    "offline",
+    "macros",
+    "migrate",
+    "uuid",
+    "json",
+    "chrono",
+    "postgres",
+    "runtime-tokio-rustls",
+] }
 dotenv = "^0"
-ulid = { version = "^0", features = ["uuid"] }
+ulid = { version = "^1", features = ["uuid"] }
 futures = "^0"
+tokio-metrics = "0.1.0"
+lazy_static = "1.4.0"
+serde_derive = "1.0.147"
+const_format = { version = "0.2", features = ["rust_1_64", "rust_1_51"] }

backend/NOTICE

@@ -1,5 +1,5 @@
-Ruben Fiszel
+Windmill Labs, Inc
 
-Copyright (c) 2021  Ruben Fiszel
+Copyright (c) 2021  Windmill Labs, Inc
 
 Source code in this directory is licensed the GNU Affero General Public License. 

backend/README.md

@@ -0,0 +1,15 @@
+# Windmill Backend
+
+This folder holds all backend components, the [src/](./src/) folder only contains files used to build the "root" binary.
+
+## Components
+
+| name                                          | description                                                                                               |
+| --------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
+| [windmill-api](./windmill-api/)               | The API server, exposing functionality to other components and the frontend                               |
+| [windmill-api-client](./windmill-api-client/) | An autogenerated Rust API client, used by other components to talk to the API                             |
+| [windmill-audit](./windmill-audit/)           | Contains audit functionality, allowing different components to record important actions                   |
+| [windmill-common](./windmill-common/)         | Common code shared by all crates                                                                          |
+| [windmill-queue](./windmill-queue/)           | Contains job & flow queuing functionality, commonly written to by the API server and read from by workers |
+| [windmill-worker](./windmill-worker/)         | The worker. Used to process and execute flows & jobs.                                                     |
+| [parsers](./parsers/)                         | Contains code to parse signatures in different langauges.                                                 |

backend/build.rs

@@ -1,17 +0,0 @@
-use std::fs::File;
-use std::io::Write;
-
-use deno_core::{JsRuntime, RuntimeOptions};
-
-fn main() {
-    println!("cargo:rerun-if-changed=build.rs");
-    let options = RuntimeOptions {
-        will_snapshot: true,
-        ..Default::default()
-    };
-    let mut runtime = JsRuntime::new(options);
-
-    let mut snap = File::create("v8.snap").expect("can create snap file");
-    snap.write_all(&runtime.snapshot())
-        .expect("can write content to snap");
-}

backend/migrations/20220123221903_first.up.sql

@@ -2,6 +2,7 @@
 create SCHEMA IF NOT exists extensions;
 create extension if not exists "uuid-ossp"      with schema extensions;
 
+
 CREATE TABLE workspace (
     id VARCHAR(50) PRIMARY KEY,
     name VARCHAR(50) NOT NULL,
@@ -205,12 +206,6 @@ CREATE TABLE password (
     company VARCHAR(30)
 );
 
--- CREATE TABLE invite_code (
---     code VARCHAR(20) PRIMARY KEY,
---     seats_left INTEGER NOT NULL DEFAULT 0,
---     seats_given INTEGER NOT NULL DEFAULT 1
--- );
-
 
 CREATE TABLE workspace_settings (
     workspace_id VARCHAR(50) PRIMARY KEY REFERENCES workspace(id),
@@ -277,17 +272,6 @@ CREATE TABLE variable (
     CONSTRAINT proper_id CHECK (path ~ '^[ug](\/[\w-]+){2,}$')
 );
 
--- CREATE TABLE oauth(
---     id VARCHAR(150) NOT NULL PRIMARY KEY,
---     owner VARCHAR(50),
---     workspace_id VARCHAR(50) NOT NULL REFERENCES workspace(id),
---     type VARCHAR(50) NOT NULL,
---     refresh_token VARCHAR(255), 
---     access_token VARCHAR(255) NOT NULL
--- );
-
--- CREATE INDEX index_oauth ON oauth (workspace_id, type, owner);
-
 CREATE TYPE ACTION_KIND AS ENUM ('create', 'update', 'delete', 'execute');
 
 CREATE TABLE audit (
@@ -420,35 +404,6 @@ CREATE INDEX worker_ping_on_ping_at ON worker_ping (ping_at);
 ALTER TABLE audit ENABLE ROW LEVEL SECURITY;
 CREATE POLICY audit_log_see_own ON audit FOR SELECT
 USING(audit.username = current_setting('session.user') or current_setting('session.is_admin')::boolean);
--- USING(current_setting('session.is_admin')::boolean);
-
-
-DO
-$do$
-BEGIN
-   IF NOT EXISTS (
-      SELECT FROM pg_catalog.pg_roles
-      WHERE  rolname = 'app') THEN
-
-      CREATE ROLE app LOGIN PASSWORD 'changeme';
-   END IF;
-END
-$do$;
-
-GRANT SELECT ON audit TO app;
-
-REVOKE ALL
-ON ALL TABLES IN SCHEMA public 
-FROM PUBLIC;
-
-GRANT ALL
-ON ALL TABLES IN SCHEMA public 
-TO admin;
-
-ALTER DEFAULT PRIVILEGES 
-    FOR ROLE admin
-    IN SCHEMA public
-    GRANT ALL ON TABLES TO admin;
 
 
 INSERT INTO usr_to_group
@@ -456,12 +411,10 @@ SELECT workspace_id, 'all', username FROM (SELECT workspace_id, username from us
 ;
 
 DROP POLICY audit_log_see_own on audit;
-GRANT ALL ON audit TO app;
 CREATE POLICY see_own ON audit FOR ALL
 USING (audit.username = current_setting('session.user'));
 
 
-GRANT ALL ON queue TO app;
 ALTER TABLE queue ENABLE ROW LEVEL SECURITY;
 
 CREATE POLICY see_own ON queue FOR ALL
@@ -470,7 +423,6 @@ USING (SPLIT_PART(queue.permissioned_as, '/', 1) = 'u' AND SPLIT_PART(queue.perm
 CREATE POLICY see_member ON queue FOR ALL
 USING (SPLIT_PART(queue.permissioned_as, '/', 1) = 'g' AND SPLIT_PART(queue.permissioned_as, '/', 2) = any(regexp_split_to_array(current_setting('session.groups'), ',')::text[]));
 
-GRANT ALL ON completed_job TO app;
 ALTER TABLE completed_job ENABLE ROW LEVEL SECURITY;
 
 
@@ -483,16 +435,6 @@ USING (SPLIT_PART(completed_job.permissioned_as, '/', 1) = 'u' AND SPLIT_PART(co
 CREATE POLICY see_member ON completed_job FOR ALL
 USING (SPLIT_PART(completed_job.permissioned_as, '/', 1) = 'g' AND SPLIT_PART(completed_job.permissioned_as, '/', 2) = any(regexp_split_to_array(current_setting('session.groups'), ',')::text[]));
 
-GRANT SELECT ON pipenv to app;
-GRANT SELECT (email, username, is_admin, workspace_id) ON usr to app;
-
-GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public to app;
-GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public to admin;
-GRANT SELECT, INSERT ON resource_type to app;
-
-GRANT SELECT ON worker_ping to app;
-GRANT SELECT ON worker_ping to admin;
-
 CREATE POLICY schedule ON audit FOR INSERT
 WITH CHECK (audit.username LIKE 'schedule-%');
 
@@ -508,7 +450,6 @@ $do$
     EXECUTE FORMAT(
       $$
 
-        GRANT ALL ON %1$I TO app;
         ALTER TABLE %1$I ENABLE ROW LEVEL SECURITY;
 
         CREATE POLICY see_starter ON %1$I FOR SELECT
@@ -542,13 +483,11 @@ $do$
   END
 $do$;
 
-GRANT ALL ON group_ TO app;
 ALTER TABLE group_
 ADD COLUMN extra_perms JSONB NOT NULL DEFAULT '{}';
 
 CREATE INDEX group_extra_perms ON group_ USING GIN (extra_perms);
 
-GRANT ALL ON usr_to_group TO app;
 ALTER TABLE usr_to_group ENABLE ROW LEVEL SECURITY;
 
 CREATE POLICY see_extra_perms_user ON usr_to_group FOR ALL
@@ -566,10 +505,62 @@ WITH CHECK (exists(
 DO
 $do$
 BEGIN
-   IF NOT EXISTS (
-      SELECT FROM pg_catalog.pg_roles  -- SELECT list can be empty for this
-      WHERE  rolname = 'admin') THEN
-      CREATE ROLE admin WITH BYPASSRLS LOGIN PASSWORD 'changeme';
-   END IF;
+    IF EXISTS (
+        select usesuper from pg_user where usename = CURRENT_USER AND usesuper = 't') 
+    AND NOT EXISTS (
+        SELECT
+        FROM   pg_catalog.pg_roles
+        WHERE  rolname = 'windmill_user') THEN
+
+        LOCK TABLE pg_catalog.pg_roles;
+
+        CREATE ROLE windmill_user;
+
+        GRANT ALL
+        ON ALL TABLES IN SCHEMA public 
+        TO windmill_user;
+
+        GRANT ALL PRIVILEGES 
+        ON ALL SEQUENCES IN SCHEMA public 
+        TO windmill_user;
+
+        ALTER DEFAULT PRIVILEGES 
+            IN SCHEMA public
+            GRANT ALL ON TABLES TO windmill_user;
+
+        ALTER DEFAULT PRIVILEGES 
+            IN SCHEMA public
+            GRANT ALL ON SEQUENCES TO windmill_user;
+
+    END IF;
+END
+$do$;
+
+DO
+$do$
+BEGIN
+    IF EXISTS (select usesuper from pg_user where usename = CURRENT_USER AND usesuper = 't')
+    AND NOT EXISTS (
+        SELECT
+        FROM   pg_catalog.pg_roles
+        WHERE  rolname = 'windmill_admin') THEN
+        CREATE ROLE windmill_admin WITH BYPASSRLS;
+
+        GRANT ALL
+        ON ALL TABLES IN SCHEMA public 
+        TO windmill_admin;
+
+        GRANT ALL PRIVILEGES 
+        ON ALL SEQUENCES IN SCHEMA public 
+        TO windmill_admin;
+
+        ALTER DEFAULT PRIVILEGES 
+            IN SCHEMA public
+            GRANT ALL ON TABLES TO windmill_admin;
+
+        ALTER DEFAULT PRIVILEGES 
+            IN SCHEMA public
+            GRANT ALL ON SEQUENCES TO windmill_admin;
+    END IF;
 END
 $do$;

backend/migrations/20220321004844_flow_preview.down.sql

@@ -1 +1,2 @@
 -- Add down migration script here
+

backend/migrations/20220428085013_private_key.up.sql

@@ -9,8 +9,5 @@ CREATE TABLE workspace_key (
     PRIMARY KEY (workspace_id, kind)
 );
 
-GRANT SELECT ON workspace_key TO app;
-GRANT SELECT ON workspace_key TO admin;
-
 INSERT INTO workspace_key SELECT id as workspace_id, 'cloud' as kind, 'changeme' as key FROM workspace;
 

backend/migrations/20220504193929_typescript_support.down.sql

@@ -0,0 +1,12 @@
+-- Add down migration script here
+DROP TYPE SCRIPT_LANG;
+
+ALTER TABLE script
+DROP COLUMN language SCRIPT_LANG;
+
+ALTER TABLE queue
+DROP COLUMN language SCRIPT_LANG;
+
+ALTER TABLE completed_job
+DROP COLUMN language SCRIPT_LANG;
+

backend/migrations/20220504193929_typescript_support.up.sql

@@ -0,0 +1,11 @@
+-- Add up migration script here
+CREATE TYPE SCRIPT_LANG AS ENUM ('python3', 'deno');
+
+ALTER TABLE script
+ADD COLUMN language SCRIPT_LANG NOT NULL DEFAULT 'python3';
+
+ALTER TABLE queue
+ADD COLUMN language SCRIPT_LANG NOT NULL DEFAULT 'python3';
+
+ALTER TABLE completed_job
+ADD COLUMN language SCRIPT_LANG NOT NULL DEFAULT 'python3';

backend/migrations/20220508150023_changeme_passwords.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20220508150023_changeme_passwords.up.sql

@@ -0,0 +1,4 @@
+-- Add up migration script here
+UPDATE password 
+SET password_hash = '$argon2id$v=19$m=4096,t=3,p=1$oLJo/lPn/gezXCuFOEyaNw$i0T2tCkw3xUFsrBIKZwr8jVNHlIfoxQe+HfDnLtd12I'
+WHERE password_hash = '$argon2id$v=19$m=4096,t=3,p=1$z0Kg3qyaS14e+YHeihkJLQ$N69flI6yQ/U98pjAHtbNxbdz2f4PrJEi9Tx1VoYk1as';

backend/migrations/20220508152326_create_role_if_not_exists.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20220508152326_create_role_if_not_exists.up.sql

@@ -0,0 +1 @@
+-- Add up migration script here

backend/migrations/20220508155403_delete_starter_scripts.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20220508155403_delete_starter_scripts.up.sql

@@ -0,0 +1,3 @@
+-- Add up migration script here
+DELETE FROM script WHERE lock IS NULL;
+

backend/migrations/20220509191845_started_at_completed_job.down.sql

@@ -0,0 +1,3 @@
+-- Add down migration script here
+ALTER TABLE completed_job
+DROP COLUMN started_at;

backend/migrations/20220509191845_started_at_completed_job.up.sql

@@ -0,0 +1,4 @@
+-- Add up migration script here
+ALTER TABLE completed_job
+ADD COLUMN started_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW();
+

backend/migrations/20220518211432_make_lang_nullable.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20220518211432_make_lang_nullable.up.sql

@@ -0,0 +1,6 @@
+-- Add up migration script here
+ALTER TABLE queue
+ALTER COLUMN language DROP NOT NULL;
+
+ALTER TABLE completed_job
+ALTER COLUMN language DROP NOT NULL;

backend/migrations/20220610181005_add_script_hub.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20220610181005_add_script_hub.up.sql

@@ -0,0 +1,2 @@
+-- Add up migration script here
+ALTER TYPE JOB_KIND ADD VALUE 'script_hub';

backend/migrations/20220615151034_accounts.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20220615151034_accounts.up.sql

@@ -0,0 +1,13 @@
+-- Add up migration script here
+
+CREATE TABLE account (
+    workspace_id VARCHAR(50) NOT NULL REFERENCES workspace(id),
+    id SERIAL NOT NULL,
+    expires_at TIMESTAMP,
+    refresh_token VARCHAR(255),
+    PRIMARY KEY (workspace_id, id)
+);
+
+ALTER TABLE resource ADD COLUMN account INTEGER;
+ALTER TABLE variable ADD COLUMN account INTEGER;
+ALTER TABLE password ALTER COLUMN login_type TYPE VARCHAR(50);

backend/migrations/20220620210708_regex_fix.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20220620210708_regex_fix.up.sql

@@ -0,0 +1,9 @@
+-- Add up migration script here
+
+ALTER TABLE usr DROP CONSTRAINT proper_email;
+ALTER TABLE usr ADD CONSTRAINT proper_email
+CHECK (email ~* '^(?:[a-z0-9!#$%&''*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&''*+/=?^_`{|}~-]+)*|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])*")@(?:(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?|\[(?:(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\.){3}(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9])|[a-z0-9-]*[a-z0-9]:(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21-\x5a\x53-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])+)\])$');
+
+ALTER TABLE workspace_invite DROP CONSTRAINT proper_email;
+ALTER TABLE workspace_invite ADD CONSTRAINT proper_email
+CHECK (email ~* '^(?:[a-z0-9!#$%&''*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&''*+/=?^_`{|}~-]+)*|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])*")@(?:(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?|\[(?:(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\.){3}(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9])|[a-z0-9-]*[a-z0-9]:(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21-\x5a\x53-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])+)\])$');

backend/migrations/20220624170622_workspace_premium.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20220624170622_workspace_premium.up.sql

@@ -0,0 +1,2 @@
+-- Add up migration script here
+ALTER TABLE workspace ADD COLUMN premium BOOLEAN NOT NULL DEFAULT false;

backend/migrations/20220624180013_workspace_premium_grant.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20220624180013_workspace_premium_grant.up.sql

@@ -0,0 +1,2 @@
+-- Add up migration script here
+

backend/migrations/20220707094935_add_client_to_account.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20220707094935_add_client_to_account.up.sql

@@ -0,0 +1,20 @@
+-- Add up migration script here
+ALTER TABLE account ADD COLUMN owner VARCHAR(50) NOT NULL;
+ALTER TABLE account ADD COLUMN client VARCHAR(50) NOT NULL;
+ALTER TABLE resource ADD COLUMN is_oauth BOOLEAN NOT NULL DEFAULT false;
+ALTER TABLE variable ADD COLUMN is_oauth BOOLEAN NOT NULL DEFAULT false;
+ALTER TABLE resource DROP COLUMN account;
+
+ALTER TABLE account ALTER COLUMN expires_at TYPE TIMESTAMP WITH TIME ZONE;
+
+ALTER TABLE account ALTER COLUMN expires_at SET NOT NULL;
+ALTER TABLE account ALTER COLUMN refresh_token SET NOT NULL;
+
+ALTER TABLE account ENABLE ROW LEVEL SECURITY;
+
+
+CREATE POLICY see_own ON account FOR ALL
+USING (SPLIT_PART(account.owner, '/', 1) = 'u' AND SPLIT_PART(account.owner, '/', 2) = current_setting('session.user'));
+
+CREATE POLICY see_member ON account FOR ALL
+USING (SPLIT_PART(account.owner, '/', 1) = 'g' AND SPLIT_PART(account.owner, '/', 2) = any(regexp_split_to_array(current_setting('session.groups'), ',')::text[]));

backend/migrations/20220713142758_script_trigger.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20220713142758_script_trigger.up.sql

@@ -0,0 +1,3 @@
+-- Add up migration script here
+ALTER TABLE script ADD COLUMN trigger_reco_interval INTEGER;
+ALTER TABLE completed_job ADD COLUMN is_skipped BOOLEAN NOT NULL DEFAULT FALSE;

backend/migrations/20220719101639_script_trigger_2.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20220719101639_script_trigger_2.up.sql

@@ -0,0 +1,4 @@
+-- Add up migration script here
+ALTER TABLE script DROP COLUMN trigger_reco_interval;
+ALTER TABLE script ADD COLUMN is_trigger BOOLEAN NOT NULL DEFAULT false;
+

backend/migrations/20220728222351_job_duration_ms.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20220728222351_job_duration_ms.up.sql

@@ -0,0 +1,4 @@
+ALTER TABLE completed_job
+     RENAME duration to duration_ms;
+UPDATE completed_job
+   SET duration_ms = duration_ms * 1000;

backend/migrations/20220802211304_capture.down.sql

@@ -0,0 +1 @@
+DROP TABLE capture;

backend/migrations/20220802211304_capture.up.sql

@@ -0,0 +1,21 @@
+CREATE TABLE capture (
+    workspace_id  VARCHAR(50)   NOT NULL,
+    path          VARCHAR(255)  NOT NULL,
+    created_at    TIMESTAMPTZ   NOT NULL DEFAULT now(),
+    created_by    VARCHAR(50)   NOT NULL,
+    payload       JSONB         NOT NULL DEFAULT 'null'::jsonb
+                                CHECK (length(payload::text) < 10 * 1024),
+
+    PRIMARY KEY (workspace_id, path),
+    FOREIGN KEY (workspace_id)  REFERENCES workspace(id)
+);
+
+ALTER TABLE capture ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY see_own ON capture FOR ALL
+USING (    SPLIT_PART(capture.path, '/', 1) = 'u'
+       AND SPLIT_PART(capture.path, '/', 2) = current_setting('session.user'));
+
+CREATE POLICY see_member ON capture FOR ALL
+USING (    SPLIT_PART(capture.path, '/', 1) = 'g'
+       AND SPLIT_PART(capture.path, '/', 2) = any(regexp_split_to_array(current_setting('session.groups'), ',')::text[]));

backend/migrations/20220816185849_remove_non_admin_users.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20220816185849_remove_non_admin_users.up.sql

@@ -0,0 +1,2 @@
+-- Add up migration script here
+DELETE FROM password WHERE email = 'user@windmill.dev' OR email = 'ruben@windmill.dev';

backend/migrations/20220818125523_longername.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20220818125523_longername.up.sql

@@ -0,0 +1,3 @@
+-- Add up migration script here
+ALTER TABLE queue ALTER COLUMN created_by TYPE varchar(255);
+ALTER TABLE completed_job ALTER COLUMN created_by TYPE varchar(255);

backend/migrations/20220901174503_openflow_changes.down.sql

@@ -0,0 +1,2 @@
+-- The corresponding migrate up isn't really reversible but should be
+-- idempotent...

backend/migrations/20220901174503_openflow_changes.up.sql

@@ -0,0 +1,56 @@
+-- https://github.com/windmill-labs/windmill/pull/491
+CREATE FUNCTION migrate_flow(flow jsonb)
+       RETURNS jsonb
+AS $$
+DECLARE module jsonb;
+        i integer := 0;
+BEGIN
+    if flow->'value'?'modules' THEN
+        flow = JSONB_SET(flow, ARRAY['modules'], flow->'value'->'modules') - 'value';
+    END IF;
+
+    FOR module IN SELECT JSONB_ARRAY_ELEMENTS(flow->'modules') LOOP
+        flow = JSONB_SET(flow, ARRAY['modules', i::text], migrate_flow_module(module));
+        i = i + 1;
+    END LOOP;
+
+    RETURN flow;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION migrate_flow_module(module jsonb)
+       RETURNS jsonb
+AS $$
+BEGIN
+    IF module?'input_transform' AND module->'input_transform' != 'null'::jsonb THEN
+        module = JSONB_SET(module, ARRAY['input_transforms'], module->'input_transform')
+               - 'input_transform';
+    END IF;
+
+    IF module?'stop_after_if_expr' AND module->'stop_after_if_expr' != 'null'::jsonb THEN
+        IF NOT module?'stop_after_if' THEN
+            module = JSONB_SET(module, ARRAY['stop_after_if'], '{}'::jsonb);
+        END IF;
+        module = JSONB_SET(module, ARRAY['stop_after_if', 'expr'], module->'stop_after_if_expr')
+               - 'stop_after_if_expr';
+    END IF;
+
+    IF module?'skip_if_stopped' AND module->'skip_if_stopped' != 'null'::jsonb THEN
+        IF NOT module?'stop_after_if' THEN
+            module = JSONB_SET(module, ARRAY['stop_after_if'], '{}'::jsonb);
+        END IF;
+        module = JSONB_SET(module, ARRAY['stop_after_if', 'skip_if_stopped'], module->'skip_if_stopped')
+               - 'skip_if_stopped';
+    END IF;
+
+    if module->'value'->>'type' = 'forloopflow' THEN
+        module = JSONB_SET(module, ARRAY['value'], migrate_flow(module->'value'));
+    END IF;
+
+    RETURN module;
+END;
+$$ LANGUAGE plpgsql;
+
+UPDATE flow SET value = migrate_flow(value);
+
+DROP FUNCTION migrate_flow_module, migrate_flow;

backend/migrations/20220902211654_job-resume.down.sql

@@ -0,0 +1,5 @@
+DROP TABLE resume_job;
+
+ALTER TABLE queue
+DROP COLUMN suspend,
+DROP COLUMN suspend_until;

backend/migrations/20220902211654_job-resume.up.sql

@@ -0,0 +1,16 @@
+CREATE TABLE resume_job (
+    id            uuid          NOT NULL,
+    job           uuid          NOT NULL,
+    flow          uuid          NOT NULL,
+    created_at    TIMESTAMPTZ   NOT NULL DEFAULT now(),
+    value         JSONB         NOT NULL DEFAULT 'null'::jsonb
+                                CHECK (length(value::text) < 10 * 1024),
+    is_cancel     boolean       NOT NULL default false,
+
+    PRIMARY KEY (id),
+    FOREIGN KEY (flow)  REFERENCES queue(id) ON DELETE CASCADE
+);
+
+ALTER TABLE queue
+ ADD COLUMN suspend        INTEGER      NOT NULL  DEFAULT 0,
+ ADD COLUMN suspend_until  TIMESTAMPTZ;

backend/migrations/20220903220634_audit_username.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20220903220634_audit_username.up.sql

@@ -0,0 +1,11 @@
+-- Add up migration script here
+DROP POLICY see_own ON audit;
+DROP POLICY schedule ON audit;
+
+ALTER TABLE audit ALTER COLUMN username TYPE varchar(255);
+
+CREATE POLICY see_own ON audit FOR ALL
+USING (audit.username = current_setting('session.user'));
+CREATE POLICY schedule ON audit FOR INSERT
+WITH CHECK (audit.username LIKE 'schedule-%');
+

backend/migrations/20220904123027_script_kind.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20220904123027_script_kind.up.sql

@@ -0,0 +1,5 @@
+-- Add up migration script here
+CREATE TYPE SCRIPT_KIND AS ENUM ('script', 'trigger', 'failure', 'command');
+
+ALTER TABLE script ADD COLUMN kind SCRIPT_KIND NOT NULL DEFAULT 'script';
+ALTER TABLE script DROP COLUMN is_trigger;

backend/migrations/20220905175719_go_lang.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20220905175719_go_lang.up.sql

@@ -0,0 +1,2 @@
+-- Add up migration script here
+ALTER TYPE SCRIPT_LANG ADD VALUE 'go';

backend/migrations/20221005022757_same_worker.down.sql

@@ -0,0 +1,2 @@
+-- Add down migration script here
+ALTER TABLE queue DROP COLUMN same_worker;

backend/migrations/20221005022757_same_worker.up.sql

@@ -0,0 +1,2 @@
+-- Add up migration script here
+ALTER TABLE queue ADD COLUMN same_worker BOOLEAN DEFAULT FALSE;

backend/migrations/20221020164416_approval_script.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20221020164416_approval_script.up.sql

@@ -0,0 +1,2 @@
+-- Add up migration script here
+ALTER TYPE SCRIPT_KIND ADD VALUE 'approval';

backend/migrations/20221023162721_remove_iscancel_resumejob.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20221023162721_remove_iscancel_resumejob.up.sql

@@ -0,0 +1,3 @@
+-- Add up migration script here
+ALTER TABLE resume_job DROP COLUMN is_cancel;
+ALTER TABLE resume_job ADD COLUMN approver VARCHAR(50);