## Summary
- Added `playwright_regression.yml` with one-shard-per-spec parallelism
(11 regression specs)
- Removed `RegressionSet` shard from main `playwright.yml` (tests now
run via dedicated regression workflow)
- Added `Cache test failures to TestDino` step to regression workflow
(matching main playwright.yml)
- Uses `ubicloud-standard-8` runners for all regression jobs
## Schedule
- Auto-triggers every 4 hours starting from 9 AM IST (3:30, 7:30, 11:30,
15:30, 19:30, 23:30 UTC)
- Manual trigger via `workflow_dispatch`
## Test Plan
- [ ] Confirm `playwright_regression.yml` appears in Actions tab
- [ ] Trigger a manual run to verify all 11 regression specs run in
parallel
- [ ] Verify `playwright.yml` no longer includes RegressionSet shard
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
## Summary
- Fixes Playwright selectors broken by the UX revamp of buttons and tabs
(PRs #11595, #11652)
- The migration from Quasar to Reka UI changed active state from CSS
`selected` class to `data-state="on"`/`data-state="active"` attributes
## Changes
- **themePage.js**: Replace broken `button[data-o2-btn]` with
`[data-test="navbar-theme-toggle-btn"]` for theme switcher
- **logsPage.js**: Replace `toHaveClass(/selected/)` with
`toHaveAttribute('data-state', 'on')` for patterns toggle
- **serviceGraphPage.js**: Same selected→data-state fix for graph/tree
view toggle buttons
- **jobScheduler.js**: Replace `getByRole('cell', ...)` with
`:visible`-filtered `[data-test="tab-more_details"]` to handle
multi-element matches from v-show
- **org.spec.js**: Increase validation message timeout from 3s to 5s
- **jobSearch.spec.js**: Add 10s wait before `viewJobDetails()` for job
processing
## Test plan
- [x] `searchPatterns.spec.js` — 15/15 passed
- [x] `theme-management.spec.js` — 5/5 passed
- [x] `jobSearch.spec.js` — 8/8 passed (parallel)
- [x] `org.spec.js` — 11/11 passed
- [x] `join.spec.js` — 12/12 passed
- [x] `logspage.spec.js` — 22/28 passed (3 pre-existing flaky, all pass
in isolation)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
## Summary
Stabilises alpha1 cloud E2E tests across the Logs-Core shard. Fixes a
UI/API org mismatch root cause, adds env-aware query execution helpers,
and brings all 10 changed spec files into POM compliance.
## Root cause (original)
After Dex login, the Pinia store binds all API calls to the user's
*default* org. The URL `?org_identifier=...` alone does not update the
store. Ingestion went to the `.env` org while UI searches went to the
user's default org → empty results → cascading test failures.
## Changes
### Alpha1 environment / authentication
- **`global-setup-alpha1.js`** — switches active org via the navbar
dropdown after Dex login so the Pinia store adopts the correct org;
`context.storageState` captures the result for all test contexts
- **`playwright-alpha1.config.js`** — `ORGNAME` sourced purely from
`.env`; cloud-config override removed
- **`loginPage.login()` / `unflattened.spec.js`** — include
`?org_identifier=${ORGNAME}` in SPA navigation to prevent defaulting to
`_meta`
- **`unflattened.js openStreamDetail()`** — replaced broken
stream-name-text click with `Stream Detail` action button + Schema-tab
visibility wait
### Auto-run query handling (`auto_query_enabled` flag)
- **`logsPage.js`** — added `runQueryAfterModeChange()`: on alpha1
(`auto_query_enabled=true`) waits for the in-flight auto-query to
complete; on local triggers a fresh query. Fixes
`@interestingFieldsCRUD` and `@quickModeResults` tests that were passing
on alpha1 but failing locally because the old fix clicked Refresh
mid-auto-run (hitting Cancel)
- **`logsQueryPage.js`** — null-guard `textContent()` return in
`_toggleAutoRun()` (`|| ''`) to satisfy Playwright's `string | null`
type contract
### Merge conflict resolution
- **`logsPage.js enableQuickModeIfDisabled()`** — kept HEAD's version
that defines `quickModeIndicator` at the top of the function (used in
the retry loop); discarded main's version that opened the utilities menu
before the variable was defined
### POM compliance (Sentinel audit)
Added three new POM methods to **`logsPage.js`**:
- `watchForNotification(timeout)` — returns a promise for pre-action
race-condition-safe notification watching
- `expectNotificationContainsText(text)` — notification text assertion
- `waitForNotificationWithText(text, timeout)` — notification waiter
with text filter
Removed raw locators from spec files:
- **`logspage.spec.js`** — notification race pattern →
`watchForNotification()` + `expectNotificationContainsText()`; 5-line
raw histogram toggle block → `ensureHistogramState(true)` (POM method
already existed)
- **`logsqueries.spec.js`** —
`pm.logsPage.page.waitForSelector('.q-notification__message:has-text(...)')`
→ `waitForNotificationWithText()`
- **`jobSearch.spec.js`** — added `testLogger` import; replaced 14×
`console.log` with `testLogger.info`; raw Monaco editor locators (lines
158–168) → `logsPage.waitForQueryEditorVisible()` +
`logsPage.getQueryEditorText()` (both already in POM)
### Tags
- **`jobSearch.spec.js`** — all 8 tests now tagged: `@jobSearch,
@P0/@P1` with functional sub-tags (`@smoke`, `@crud`, `@validation`)
- **`logshistogram.spec.js`** — all 5 tests now include `@P1`
## Results
- All `logsquickmode.spec.js` tests pass on both local and alpha1
- Zero Sentinel critical issues remaining across all 10 changed spec
files
- Remaining warnings (old-style auth in `jobSearch.spec.js` /
`pagination.spec.js`, `pm.logsPage.page.reload()` in
`logsquickmode.spec.js`) are pre-existing tech debt deferred to a
separate PR
## Test plan
- [ ] Run `logsquickmode.spec.js` locally and on alpha1 — both should
pass
- [ ] Run full Logs-Core shard on alpha1: `npx playwright test --config
playwright-alpha1.config.js
playwright-tests/Logs/{join,logspage,logsquickmode,pagination,unflattened,logshistogram,jobSearch,logsqueries,logsAnalyzeDimensions}.spec.js`
- [ ] Verify global setup logs: `Switching active org to: <ORGNAME>` →
`Org switch complete`
- [ ] Confirm no `console.log` output in `jobSearch.spec.js` test run
(all replaced by `testLogger`)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
## Summary
- Adds 18 new POM methods to `alertsPage.js` for stream-type/query-mode
coherence verification, chart state assertions, query editor
interaction, and aggregation field filtering
- Adds 5 helper methods to `alertCreationWizard.js` for full editor
open/close, stream switching, and query execution
- Adds new regression spec `alerts-stream-switching-regression.spec.js`
covering 5 closed bugs:
| Bug | Description |
|-----|-------------|
| #11580 | Metrics+PromQL -> Logs, PromQL editor persists |
| #11572 | Logs -> Metrics -> Logs, chart error "No field named value" |
| #11571 | Builder -> SQL, chart blank table instead of line |
| #11573 | Full editor open/close blanks the graph |
| #11578 | Agg functions don't filter to integer fields |
## Test plan
- [ ] Run `alerts-stream-switching-regression.spec.js` against dev
environment
- [ ] All 5 tests pass with no raw selectors in spec (POM-compliant)
- [ ] Chart assertions verify canvas child exists (not just bounding
box)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
## Summary
- Enhanced existing scheduled pipeline query builder tests with exact
default query format assertions (`max(_timestamp)`, `count(_timestamp)`,
`histogram(_timestamp)`)
- Added new P2 test verifying Run Query button transitions from disabled
to enabled after stream selection and default query population
- Verifies behavior described in Issue #11575
## Test plan
- [x] All 4 tests pass (verified on test environment)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
## What changed
Fixed `addFieldTerm` in `SearchBar.vue` so that include/exclude search
terms are inserted at the correct position in SQL aggregation queries.
Previously the code checked for `ORDER BY` before `GROUP BY`, causing
the injected `WHERE` clause to land after `GROUP BY` (invalid SQL). The
fix scans all terminating clauses (`GROUP BY`, `HAVING`, `ORDER BY`,
`LIMIT`) and inserts `WHERE` before whichever appears earliest. The
remaining diff is Prettier-driven reformatting with no logic changes.
## Why
The old sequential `if/else if` checked `ORDER BY` first. On a query
containing both `GROUP BY` and `ORDER BY`, it would split at `ORDER BY`
and produce `… WHERE <filter> ORDER BY … GROUP BY …` — structurally
invalid SQL. The fix enforces correct SQL clause ordering (`FROM → WHERE
→ GROUP BY → HAVING → ORDER BY → LIMIT`).
## Approach
The new algorithm iterates over all four terminating clauses, records
the index of each that is present, picks the one with the smallest index
(`firstClause`), then uses the existing `queryIndexSplit` utility to
splice the `WHERE <filter>` token in before it. If no terminating clause
exists the filter is appended. The spec file was extended with 14 new
unit tests covering the core bug scenario (GROUP BY + ORDER BY
together), each individual clause in isolation, all-clauses-present,
AND-append paths, and edge cases (case-insensitive matching, column
names containing clause keywords, special characters in filter values).
## Risk
The logic change is isolated to the `else` branch of `addFieldTerm` that
handles queries with no existing `WHERE` clause. Queries that already
have a `WHERE` clause follow a separate code path and are unaffected.
Reviewers should confirm the `queryIndexSplit` utility is
case-insensitive-safe (the fix lowercases only for the index scan, then
splits the original string) and verify the preserved trailing
`afterClause` string includes the space/newline that was previously part
of the `" order by"` / `" group by"` literals.
Three fixes in alertCreationWizard.js:
- Align threshold operator dropdown with working SQL method pattern
(q-field__control click + role-based option + q-menu fallback)
- Narrow portal cleanup from all q-portal to q-portal--dialog only to
avoid hiding new dropdown menus
- Fix _switchToTab to target v3 inner tab divs instead of wrapper
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
- API-first methods in alertTemplatesPage.js (_findTemplateViaApi,
createTemplateViaApi, deleteTemplateViaApi) to bypass fragile UI
pagination
- API-first destination lookup in alertDestinationsPage.js
(findDestinationViaApi) resolves cascade failure
- v3-compatible locators for alert type dropdown, condition operators,
deduplication flow in alertCreationWizard.js
- Self-contained test pattern with per-test random suffixes and no
shared state
- URL-based navigation with menu fallback for templates and destinations
pages
- q-portal cleanup before click interactions to prevent interception
- Conditional enterprise feature guards at runtime
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude <noreply@anthropic.com>
## Summary
- In `playwright_summary`, `merge_and_upload_reports` result of
`failure` is now treated as non-blocking (same as `success`/`skipped`)
- The Playwright summary check will pass even if the TestDino
merge/upload job fails (e.g. network issues, bad token, API outage)
- Actual test results (`build_binary`, `ui_integration_tests`) still
gate the summary as before
## Why
The TestDino upload is observability/reporting infrastructure — it
should never cause a PR's required check to fail when the tests
themselves passed. Previously a transient TestDino failure would block
merges.
## Test plan
- [ ] Verify `playwright_summary` passes when `merge_and_upload_reports`
succeeds (existing behavior)
- [ ] Verify `playwright_summary` passes when `merge_and_upload_reports`
fails (new behavior)
- [ ] Verify `playwright_summary` still fails when
`ui_integration_tests` fails (unchanged)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary
- The alpha AKS environment (`alpha.o2aks1.internal.zinclabs.dev`) has a
transparent overlay on the Dex login page that intercepts the submit
button click in `global-setup-alpha1.js`
- This caused all 13 CI shards to fail — global setup timed out on the
30s click wait, preventing any tests from running
- Root cause: `submitButton.click()` found the button visible and stable
but the click was intercepted, so it hung for the full 30000ms timeout
- Fix: add `{ force: true }` to bypass the overlay, with an `Enter` key
fallback if force-click is also blocked
- Verified locally: login completes successfully, 2 cloudLogin tests
pass
## Test plan
- [x] Run `cloudLogin.spec.js` locally against alpha — 2/2 passed
- [ ] Trigger full alpha1 CI run to confirm all 13 shards pass
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Shrinath Rao <undefined@users.noreply.github.com>
## Summary
- Fixed `patternCardDetailsIcon` selector in the page object — the
details icon button was removed from `PatternCard.vue` in PR #11314, so
the test now clicks the card row itself (`pattern-card-N`) which is the
current UX for opening pattern details.
- Added a 15-second grace period in `waitForPatternsToLoad` before
accepting "empty" as the final result. The backend can return "No
patterns found" before async pattern extraction completes, causing the
P0 duplicate-patterns test to fail when patterns exist but haven't been
extracted yet.
## Test plan
- [x] Ran `searchPatterns.spec.js` full suite locally — **15/15 passed**
(was 10 passed, 1 failed, 4 skipped)
- [x] Ran failing test individually — passes
- [x] Verified no regressions in other tests using
`clickPatternDetailsIcon`
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
## Summary
- **Root cause**: `keyboard.type()` types code char-by-char into Monaco
editor. When typing `{`, Monaco auto-inserts `}`. With nested blocks (3
levels in JS row-expansion code), this creates 3 extra closing braces →
invalid JS → QuickJS compilation failure.
- **Fix**: Replace `keyboard.type()` with clipboard paste
(`navigator.clipboard.writeText` + `Ctrl+V`) in `enterFunctionCode()`.
Pasting inserts text as a single operation, bypassing Monaco's
auto-close bracket behavior.
- All 6 row-expansion tests pass locally after this fix.
## Test plan
- [x] Run `row-expansion.spec.js` locally — all 6 tests pass
- [ ] CI passes on this PR
## Summary
- Migrate `landingPage.spec.js` and `languageTranslation.spec.js`
(GeneralTests) for alpha1 cloud compatibility
- Migrate `alerts-regression.spec.js` and `logs-9754.spec.js`
(RegressionSet) for alpha1 cloud compatibility
- Replace all `process.env["ORGNAME"]` / `process.env.ORGNAME` with
`getOrgIdentifier()` from `cloud-auth.js`
- Add `waitForStreamAvailable` to `logs-9754.spec.js` for cloud indexing
delays
- Fix `playwright-alpha1.config.js` to override `INGESTION_URL` when
`.env` sets it to localhost
## Test plan
- [x] All 4 spec files run against alpha1 cloud — 21/22 passed
- [x] 1 flaky failure in alerts-regression (PromQL alert list visibility
timeout — not migration-related)
- [ ] CI run on `playwright_alpha1.yml` workflow with both branches
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Following fixes and enhancements have been made:
**Service Discovery**:
- default field tracker is now used to distinguish services as well in
absence of a user config, the system works out of box
- UI issues
- incorrect field was displayed when a card in recommendation was
clicked
- scope/workload selectors were leftover
- stream based service search
**Incidents**:
- AI Analysis failure now emits a failure event correctly, avoiding
false-positive and preventing UI from getting stuck when a prior
`AIAnalysisBegin` event remained in place
- correlate alerts by alert ID, this was a regression after correlation
revamp, useful for correlation in absence of alert ID
- fix sqlx issue wherein `u64` wasn't supported for sqlite, now turned
into `i64`
**Service graph**:
- now ingests using HTTP bulk API. Was failing since recently moved
service graph daemon to alertmanager, which used internal ingest call,
which was unsupported on alertmanager
- Also add Python 2.0 license support for JS
---------
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: ByteBaker <undefined@users.noreply.github.com>
Co-authored-by: Shrinath Rao <shnath@openobserve.ai>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary
Implement automatic provisioning and lifecycle management of
per-organization system service accounts for the AI-powered SRE Agent.
These accounts serve as the identity for RCA (Root Cause Analysis) agent
API interactions and are created automatically for each organization.
## Key Features
### Service Account Provisioning
- Database migration creates SRE Agent accounts for all existing
organizations
- Deterministic email format:
`o2-sre-agent.org-<ORG_ID>@openobserve.internal`
- System accounts are automatically created on organization creation
- Idempotent operations ensure safe re-runs and self-healing
### System Account Protection
- API endpoints prevent modification/deletion of system service accounts
(403 Forbidden)
- User responses include `is_system` flag to identify system accounts
- Protection enforced at HTTP handler layer
### RCA Agent Client Refactoring
- Singleton pattern: global client initialized once at startup
- Per-request user credential forwarding for better audit trails and
scoping
- Lazy initialization: returns None if agent service not configured
- Updated all query methods to accept and forward auth credentials
### Incident Correlation Enhancement
- Query `ServiceIdentityConfig` to get configured semantic dimension
groups
- Extract only `distinguish_by` fields from matched identity sets
- Use parallel correlation execution (Service Discovery + semantic
extraction)
- Improved accuracy by using configured groups instead of fallback label
extraction
### Improved Token Redaction
- Consistent 12-character format: first 4 visible characters + 8
asterisks
- Better security for token display in UI
- Updated tests for new redaction format
## Technical Details
### Database Changes
- New migration:
`m20260331_000001_create_sys_rca_agent_service_accounts`
- Creates accounts with organization and RUM tokens
- Safe pagination (100 orgs at a time) with idempotency checks
- System accounts use role type 6 (SreAgent, distinct from
ServiceAccount)
### Authorization
- System accounts added to OpenFGA with standard org membership tuples
- SRE-specific read-only role for permission control
- Self-healing: runtime ensures OpenFGA state is consistent with
database state
### API Changes
- GET /users: Returns `is_system` and `description` fields
- PUT/DELETE /users: Reject modification/deletion of system accounts
## Test Coverage
- Token redaction tests updated for new format
- System service account protection verified
- User list pagination tested with system accounts
## Feature Flag
This is an enterprise feature gated behind `#[cfg(feature =
"enterprise")]`. System accounts are always created, but RCA integration
only works if the agent service is configured.
## Deployment
- Zero-downtime: migration is additive
- Opt-in for OSS deployments
- Automatic provisioning on upgrade and org creation
---------
Co-authored-by: Shrinath Rao <shnath@openobserve.ai>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Hengfei Yang <hengfei.yang@gmail.com>
Shrinath RaoandClaude Opus 4.7
ktx-akshay
Neha PandClaude Opus 4.7
Bhargav
Abhay Padamani
Omkar Kesarkhane
ktx-kirtan
dependabot[bot]
