## What changed
- Passes `matchedSetId` and `chipDimensions` as new computed props from
`IncidentDetailDrawer.vue` to the embedded
`TelemetryCorrelationDashboard`, enabling the "View by" subject tabs in
the incident view
- Adds an `OBadge` showing the selected subject as `label = value` after
the subject toggle tabs in `CorrelationEventHeader.vue`
- Fixes the responsive overflow logic so the first context chip can
overflow when space runs out, and the overflow indicator shows "N
Fields" when all chips are hidden instead of a bare "+N"
- Renders hidden overflow chips as stacked `OBadge` components in
`OTooltip`'s `#content` slot instead of a `\n`-joined string
## Why
Incidents opened without a source trace or log event had no
`matchedSetId` / `chipDimensions` passed to the correlation dashboard,
so the "View by" subject toggle (Pod, Node, etc.) never rendered. The
badge was also missing to visually indicate which subject is active.
🤖 Auto-generated E2E tests for #12607 — **healed to passing** against a
live OpenObserve before this PR was opened.
- Branch `autoe2e/pr-12607` (stacked on `main`), so the tests run
against the feature code and pass before it merges.
- Spec:
`tests/ui-testing/playwright-tests/Metrics/metrics-share-deep-link.spec.js`
The repo Playwright CI re-validates here. Review is for **quality +
coverage** — the tests already pass.
_Generated by the E2E Council pipeline._
**Test cases added / changed:**
| Test case | Type | What it verifies |
|---|---|---|
| `Default state — page loads with defaults, no auto-run` | new |
metrics page loads with default config, no metrics_data blob in URL, and
core UI elements visible |
| `Deep-link with bad metrics_data blob falls back to defaults` | new |
corrupt base64 blob does not crash the page — falls back silently to
default panel state |
| `Deep-link with unknown version blob falls back to defaults` | new |
blob with version 9999 is ignored and page shows default panel
configuration |
| `Deep-link with override params only builds panel from scratch` | new
| chart_type and query override params configure the panel without a
metrics_data blob |
| `URL syncs metrics_data blob after manual query and Apply` | new |
running a query adds a valid metrics_data blob to the URL with correct
version |
| `metrics_data blob excludes volatile data (id, title, description)` |
new | decoded blob does not contain id, title, or description keys |
| `Deep-link restores absolute from/to time range` | new | deep-link
with explicit from/to unix timestamps restores the time range correctly
|
| `Deep-link restores relative time period (period param wins)` | new |
period param takes precedence over from/to and restores relative time
range |
| `Share button disabled state — detects when web_url is not configured`
| new | share button is visible but disabled when web_url is not set |
| `Share button copies shortened URL to clipboard` | new | clicking
share generates a short URL containing /short/ and copies it to
clipboard with success toast |
| `Share button shows loading state during API call` | new | share
button enters loading spinner state during API call and clears after
completion |
| `Deep-link blob restore auto-runs query on mount` | new | valid
metrics_data blob restores panel config and auto-executes query without
manual Apply |
| `Deep-link restores auto-refresh interval` | new | refresh=30s param
sets the auto-refresh interval on the page |
| `Deep-link without stream — query populated, no stream selected` | new
| a deep-link with query but no stream_name does not crash the page |
| `Share URL contains absolute from/to timestamps, not period` | new |
shared URL freezes time to absolute from/to seconds, not relative period
|
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
- [x] ~add sort when to many groups, we can do this, but for now do not
do this~
- [x] remove the unsafe for memory pool
- [x] add approx_distinct improve, already fork, will add in next pr
- [x] fork vortex to add cast fix, and export
`.exclude_schemes([IntDictScheme.id()])`
- [x] ~enable_physical_uncorrelated_scalar_subquery test~
#12703
## What changed
Removed the `showErrorOnly` key from `searchObj.meta` state and replaced
it with a `computed` property that derives from
`activeIncludeFilterValues` — specifically checking whether
`span_status` includes `"ERROR"`. The `SearchResult.vue` component now
receives `showErrorOnly` as a prop from `Index.vue` instead of reading
it from the shared composable state. `TracesMetricsDashboard.vue` had
its own writable `showErrorOnly` computed removed since it no longer
needs to sync a top-level state key.
## Why
The user identified that `showErrorOnly` was redundant state — the
information is already encoded in
`activeIncludeFilterValues["span_status"]`. Keeping both in sync was
unnecessary maintenance burden. Deriving it from the existing filter
state is the single source of truth and eliminates the risk of the flag
and the actual query filters diverging.
**Bug:** reuse never fired after a healed run, so clobber-off re-runs
needlessly **rebuilt** (force-pushed over the prior healed tests + the
playwright.yml registration), and the regenerated tests sometimes failed
heal → `pr_back`/`review_address` skipped → the test PR looked
"reverted".
**Cause:** the `e2e-source-sha` trailer is written **only on the
generate commit**, but heal + review-address commits sit *on top* of it
without the trailer. Triage read the trailer from the **branch HEAD
only** → `storedSha` empty → "feature changed" → `reuse=false`.
**Fix:** scan the last 30 commits of the branch (newest first) for the
most recent `e2e-source-sha` trailer. Now an unchanged-feature re-run
with `force_overwrite` off correctly **reuses** (extend / leave-alone)
instead of rebuilding.
Found via run 27605717167 on PR #12690.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## What
In the traces **spans-mode** list view, the query was built as:
```sql
SELECT * FROM "<stream>" [WHERE ...] ORDER BY start_time <dir>
```
`start_time` is a regular column, so the engine has to perform a full
re-sort of the result set. This change makes the query order by the
configured timestamp column (`_timestamp`) whenever the active sort
column is the default `start_time`:
```sql
SELECT * FROM "<stream>" [WHERE ...] ORDER BY _timestamp <dir>
```
## Why
- Span data is physically stored sorted by the timestamp column, and the
backend has a dedicated optimizer for timestamp-sorted segments.
- A span's `_timestamp` is monotonically equivalent to its `start_time`,
so the **visible row order is unchanged**.
- This avoids the costly full re-sort that `ORDER BY start_time` forces,
improving query latency for the trace/spans view.
## Scope / Notes
- Change is contained to `web/src/plugins/traces/Index.vue`
(spans-mode query builder in `getQueryData`).
- Only the default `start_time` sort is remapped. Any explicit
non-`start_time` sort column the user picks is passed through
unchanged.
- The `sortBy` UI state still reports `start_time`, so the sort
indicator and reset logic are unaffected.
- Not in scope: the single-trace span fetch in `TraceDetails.vue` still
uses `ORDER BY start_time` (can be addressed separately).
## Testing
- Verified the generated spans SQL now uses the timestamp column for the
default sort and produces the same visible ordering.
Co-authored-by: Hengfei Yang <hengfei.yang@gmail.com>
## Summary
- Fixes 2 hard-failing regression tests (traces autocomplete + pipeline
destination save)
- Improves 6 flaky pipeline timeout tests
## Root causes
### Pipeline destination save test (line 513)
`destinationListAddBtn`, `destinationTypeCard`, `toastError`, and
`toastSuccess` were referenced in the test but never defined in
`PipelinesPage`. Added the four missing locators with their verified
`data-test` attributes.
### Traces autocomplete test (line 139)
The test clicked `.view-lines` (a display-only div) and used
`page.keyboard.type()`, but Monaco only routes keyboard input through
its hidden `.inputarea` textarea. Switched to Monaco's
`editor.trigger('keyboard', 'type', {text})` API which properly updates
the editor model and fires the autocomplete provider.
### Pipeline timeout tests (lines 73, 181, 289, 368, 451, 478)
Reduced `addPipeline` timeout from 30s to 15s so tests fail faster
instead of hanging when the pipeline page doesn't load. Combined with
`slowMo: 500`, the old 30s timeout amplified cascading delays in serial
test mode.
## Verification
Both hard-failure tests pass against the pentest environment:
- `traces-regression-bugs.spec.js:139` — PASSED (editor content:
"select", suggestions: true)
- `pipeline-regression.spec.js:513` — PASSED (no duplicate
notifications)
## Test plan
- [x] Traces autocomplete test passes
- [x] Pipeline destination save test passes
- [ ] Pipeline timeout tests run within CI timeout (improved, not fully
resolved)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Post-PR "enrichment" follow-ups for the E2E test bot, plus a CLA fix.
(Was stacked on #12682; rebased onto `main` after that merged.)
## What this adds
**1. Test-case summary table**
When the test PR opens, the bot posts a **table of the test cases it
added/changed** — in the test PR body *and* the "E2E Council" comment on
the source PR:
| Test case | Type | What it verifies |
|---|---|---|
| `should …` | new / append / extend | one-line intent |
(Engineer emits `test-summary.json`; `pr_back` renders it. No table when
there's nothing to add.)
**2. Auto-address the AI review (OFF by default)**
New final job `review_address`, gated by repo variable
**`E2E_AUTO_REVIEW`** (default off). After the test PR opens it waits ~6
min for the repo's AI review, then a **conservative "Responder" agent**:
- **validates** each finding (the bot is noisy — default is to *not*
change code),
- fixes **only clearly-valid** ones in `tests/ui-testing` (never
`.github` / `.opencode` / `playwright.yml` / source),
- pushes tests-only fixes (the repo's Playwright CI re-validates the
PR),
- posts a rationale on the test PR and minimizes the bot comment.
One bounded pass. Scoped `GITHUB_TOKEN` only. **To enable:** create repo
variable `E2E_AUTO_REVIEW=true`.
**3. CLA fix — commit as `github-actions[bot]`**
The pipeline previously committed generated tests as `openobserve-bot
<bot@openobserve.ai>`, which isn't a GitHub account → CLA assistant
couldn't match/sign it and blocked the test PR. Now it commits as the
canonical **`github-actions[bot]`** identity (a real bot account GitHub
resolves via its noreply email), across generate + verify_heal +
review_address.
> **Admin action:** allowlist `github-actions[bot]` in CLA assistant,
then `recheck`.
---
<details>
<summary>Design notes</summary>
- Responder is deliberately conservative: a wrong "fix" that breaks a
passing test is worse than leaving a nitpick. It dismisses
stale/incorrect/style findings.
- Both auto-features are flag-gated OFF (same posture as
`E2E_AUTO_ON_MERGE`) — auto-acting warrants opt-in.
- No heavy re-build in `review_address`; the repo's existing Playwright
CI re-validates the pushed fix.
- CodeQL untrusted-checkout on the new `review_address` checkout (#416)
dismissed — same allowlist false positive as prior PRs.
</details>
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This PR makes the automated E2E test bot **smarter and easier to use**.
In short: clearer commands, the test PR gets assigned to the right
people automatically, and the bot now **understands tests that already
exist** — it extends them, leaves them alone, or adds new ones, instead
of always starting from scratch.
---
## What changed (plain English)
**1. Two clear commands on a PR**
- `/e2e` → does the whole thing: writes/updates tests, runs & fixes
them, opens a test PR.
- `/e2e-dryrun` → just tells you what it *would* do (no tests, no PR).
**2. The test PR is auto-assigned**
- Assigned to (and review-requested from) the **original feature
developer + Neha + Shrinath**.
**3. It understands existing tests (the big one)**
- Before writing anything it looks at the tests that already exist and
picks the smartest move: **extend** an existing test, **add** one to an
existing file, **create** a new file, or **leave them alone** if they
already cover the change (it posts an "already covered ✅" note instead
of making noise).
- If the developer wrote tests in their own PR, it reads and improves
them instead of ignoring them.
**4. Re-running is smart and safe**
- Running `/e2e` again on a PR **reuses** the existing tests and only
updates what's needed — **unless the feature changed** since last time,
in which case it rebuilds against the latest code. So your manual tweaks
survive, and tests never get extended against stale code.
- Each PR's tests live on a branch tied to the **PR number**, so
renaming your feature branch never confuses the bot.
- (Manual dispatch still has an "overwrite" checkbox to force a clean
rebuild.)
**5. Auto-run on merge — built but switched OFF**
- Later, merging a PR can auto-trigger test generation. It's **off by
default** (`E2E_AUTO_ON_MERGE`) and does nothing until someone turns it
on.
---
<details>
<summary><b>📖 In-depth technical details (for reviewers — click to
expand)</b></summary>
### Triggers
Three entry points, all PR-bound: `/e2e` (full) & `/e2e-dryrun` (triage)
comments, manual `workflow_dispatch` (`pr_number` +
`dry_run`/`force_overwrite` inputs), and `pull_request:[closed]` on
`main` (auto-on-merge, **off** unless `vars.E2E_AUTO_ON_MERGE ==
'true'`). All gated on the engineering allowlist (trigger actor) +
PR-author allowlist (generation). Per-PR `concurrency` group serializes
runs. Comment body is read via env and compared in-shell (no injection
sink).
### Auto-assign
After `pr_back` opens/refreshes the test PR, it assigns + requests
review from `author` + `neha00290` + `Shrinath-O2`, per-user
`if/then/else` so a self/permission edge never fails the job.
### Increment-awareness
- **Triage:** dev-authored tests are no longer auto-skipped
(`existing_tests_in_diff:true` → *enhance*); explicit `tests-added`
label / `skip` comment still wins.
- **Architect coverage-scan:** reads candidate specs (area + keyword)
and the dev's own test changes, then writes `coverage-decision.json`
with `action` = `none` | `extend` | `append` | `new`, `target_spec`,
`needs_registration` (true only for `new`). `action` is normalized +
validated in the workflow.
- **Engineer:** `none` → write nothing; `append`/`extend` → surgical
minimal edit to the existing `target_spec` (other tests untouched,
parallel mode preserved, selectors in page objects), no registration;
`new` → new spec + registration.
- **Wiring:** verify_heal resolves the spec from
`coverage-decision.target_spec`; hand-off validation requires
registration only for `new`; pr_back registration treats a missing
registration file as "already registered."
### Identity, reuse & change detection
- **Branch:** `autoe2e/pr-<number>` (both modes) — rename-proof. Base =
feature branch (open) / `main` (merged).
- **`source_sha` trailer:** generate records `e2e-source-sha: <feature
commit>` in the commit (survives the hand-off strip).
- **Reuse decision (triage):** dispatch honours `force_overwrite`
(default rebuild, untick = reuse); comment/auto-on-merge **default to
reuse**. Reuse happens only when the branch exists **and** the feature
SHA is unchanged vs the stored trailer — otherwise rebuild fresh against
the latest commit (no stale-code extension). In reuse mode generate
checks out the existing branch so the coverage-scan sees prior tests.
- **Leave-alone / no-op:** generate emits `has_changes`; on
`none`/no-diff it posts "already covered ✅" and `verify_heal` +
`pr_back` are skipped (no wasted build/PR).
### Hand-off strip (clean PR)
generate commits the scratch hand-off so verify_heal is self-contained;
verify_heal strips it (`git rm --cached`) before the PR → the test PR
diff and main only ever contain tests. (Squash-merge keeps history clean
too.)
### Auto-on-merge (Trigger 3) — OFF
`pull_request:[closed]` on `main`, gated by `merged==true` +
`vars.E2E_AUTO_ON_MERGE`. Merged mode checks out the merge commit, bases
the test PR on `main`, runs full. Enable via repo variable
`E2E_AUTO_ON_MERGE=true`. ⚠️ This generates a test PR for (potentially)
every merged PR — only enable with review capacity.
### Security
External attacker has no path (actor + author allowlists).
`ORG_ADMIN_TOKEN` (workflow-write) is isolated to `pr_back` (no PR-code
checkout); generate/verify_heal use the scoped `GITHUB_TOKEN`. Spec path
is regex-validated **and** rejects `..`. LLM-written `feature_slug` and
coverage `action` are sanitized/validated before use.
### Not yet validated live
Batches B/C haven't run in a real pipeline yet — a dispatch (or merging
this so the `/e2e` paths activate on `main`) is the next validation
step.
</details>
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Problem
When **"Correlate without service attribute"** (`service_optional =
true`) is enabled, the same physical service can appear as two (or more)
separate entries in **Discovered Services**.
**Root cause:** `ServiceKey` is always `(service_name, set_id,
disambiguation)`. When a log has no `service.name` attribute, the
processor falls back to the stream name (e.g. `repro_logs`) as
`service_name`. A trace for the same workload carries the real
`service.name` (e.g. `ecs-api-service`). Both entries share identical
`(set_id, disambiguation)` but are stored as separate rows — they never
merge.
**What the DB looks like (bug):**
| service_name | set_id | disambiguation | logs_streams | traces_streams
|
|---|---|---|---|---|
| `ecs-api-service` | `kubernetes` | `{"k8s-namespace":"ecs-prod"}` |
`[]` | `["repro_traces"]` |
| `repro_logs` | `kubernetes` | `{"k8s-namespace":"ecs-prod"}` |
`["repro_logs"]` | `[]` |
Two rows. `disambiguation` is byte-for-byte identical. Only
`service_name` differs.
In production this gets worse — ECS metric streams (which also have no
`service.name`) each become their own phantom row under the same
disambiguation. We observed 85 rows for a single ECS service, with only
2 rows carrying actual streams.
## Fix
`GET /api/:org_id/service_streams` now performs a read-time merge when
`service_optional = true`:
1. Fetches raw rows from the DB (unchanged)
2. Loads the org's service identity config (already cached)
3. If `service_optional = true` — groups rows by `(set_id,
disambiguation)`, unions their `logs_streams` / `metrics_streams` /
`traces_streams` arrays, and picks the real service name (the one that
does NOT appear in its own stream arrays) as the display name
4. Returns the merged list
**After fix — what the API returns:**
```json
[{
"service_name": "ecs-api-service",
"set_id": "kubernetes",
"disambiguation": {"k8s-namespace": "ecs-prod"},
"logs_streams": ["repro_logs"],
"traces_streams": ["repro_traces"]
}]
```
One entry. Real service name. All streams unified.
The DB rows are not changed — merge is purely at read time in the
handler. When `service_optional = false` the handler returns raw rows as
before (no change in behaviour).
Fixes#1848
This PR began as the self-correcting Sentinel fix and grew into **the
bundle that gets Jobs 2–4 (generate → verify/heal → PR-back) actually
working end-to-end**. Each item below was found by a real
`dry_run=false` shakedown run.
## 1. Self-correcting Sentinel loop (don't hard-stop)
The first shakedown hard-stopped when Sentinel flagged 3 critical issues
— no branch, no PR. Wrong behavior: the pipeline should **fix and
continue**.
- Job 2's hard gate → a **fix-and-re-audit loop**: Sentinel audits → if
not clean, the Engineer fixes the findings → re-audit → repeat up to
`FIX_ATTEMPTS` (3) → only stop+report if *still* not clean.
- The deterministic workflow owns the verdict (Sentinel audits, Engineer
fixes — the LLM never self-certifies).
- **Engineer pre-compliance:** a MANDATORY Sentinel-compliance checklist
in `e2e-ci-engineer.md` mirroring Sentinel's critical checks, so
first-pass output usually passes (fewer iterations).
## 2. verify/heal made real
- **OpenCode is installed in `verify_heal`** — it's a separate
job/runner from generate, and without it the healer **and** post-heal
Sentinel died with `opencode: command not found` (so zero healing
happened, then the raw spec failed).
- **Post-heal Sentinel re-audit is advisory** (`continue-on-error`, only
when the final run already passed) — the authoritative final run is the
sole pass/fail gate, so the audit can never abort a green heal.
- **Accurate heal-failure root cause:** the source-PR comment now
distinguishes build / boot / test-env / spec-resolve / heal-timeout /
still-failing (was a useless generic fallback).
## 3. Self-contained hand-off (and a clean merge to main)
- generate force-commits the hand-off (`docs/test_generator/ci/`) onto
the `autoe2e` branch, so `verify_heal` reads it from the checkout — **no
artifact dependency** (kills the artifact-structure bug that broke an
earlier run).
- `verify_heal` **strips the hand-off** (`git rm --cached`) before
pushing healed tests → branch tip is tests-only → since the repo
squash-merges, the PR diff and **main never carry it**.
- Artifact upload reverted to a single deterministic path; debug reports
moved to a separate non-consumed artifact.
## 4. Fully-parallel generated tests
- Engineer now emits `test.describe.configure({ mode: 'parallel' })`
(was `serial`) + a hard rule that every test is independent (own setup,
unique fixtures) so `--workers=4` actually spreads the load.
- Healer runs `--workers=4` and must **preserve** parallel mode
(switching to serial is a last resort with a stated reason, not a quick
fix).
## 5. Testability + control
- **Agents restored from the triggering ref** on `workflow_dispatch`
(trusted: write-access + allowlisted), from main on the `/e2e` comment
path. Lets pipeline/agent changes be tested from a branch **without
merging to main first**.
- **`force_overwrite` dispatch flag** (default true = clobber the
`autoe2e` branch; untick to protect an existing/hand-edited branch).
## 6. Permissions + security fixes from the shakedowns
- `generate` + `verify_heal` got `pull-requests: write` (PR comments
403'd with `issues: write` alone).
- playwright.yml registration moved to `pr_back` (GITHUB_TOKEN can't
push workflow files) and done via the **Contents API with no PR-code
checkout** (closes the untrusted-checkout finding); ORG_ADMIN_TOKEN
stays isolated to `pr_back`, which never builds/runs PR code.
- Triage-comment rationale cap raised (was truncating at 600 chars).
Scope: **OpenCode agents + this workflow only** — the Claude slash
commands are unchanged (later).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Summary
- Adds `alerts-metrics-notification.spec.js` — a 3-test UI suite
verifying the full metrics alert chain
- Test 1 (P1): PromQL alert triggers via scheduler, verified in history
UI — self-contained using `ensureMetricsIngested()`
- Test 2 (P2): Template body contains required alert variables
(`{alert_url}`, `{alert_name}`, `{stream_name}`)
- Test 3 (P1): Manual trigger from alert list more-options menu sends
notification
- Includes `alert-metrics-notification-findings.md` documenting manual
testing results (API schema, PromQL vs SQL, trigger indicators)
## Test plan
- [ ] Test 1: Alert triggers on freshly ingested `cpu_usage` metrics and
history rows appear in UI
- [ ] Test 2: Template editor (Monaco) shows expected variables
- [ ] Test 3: Manual trigger menu option calls PATCH /trigger and
succeeds
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Follow-up to #12657. Builds out the **entire generation pipeline** (Jobs
2–4) plus access control and failure handling. Everything still runs
only with `dry_run=false`, so dry-run/triage behavior is unchanged.
## The full flow (dry_run=false)
`/e2e` or dispatch → **triage** → **generate** → **verify/heal (heavy)**
→ **open test PR** — the PR only ever contains **working, healed
tests**, so review is about quality + coverage, not debugging.
## Access control (allowlist)
- **Trigger gate:** only the engineering-team allowlist (mirrors
`auto-assign-metadata.yml`) can start a run.
- **PR-author gate:** generation only runs when the **PR author** is
also on the allowlist. A stranger's PR short-circuits the whole AI path
in triage (no DeepSeek call) → just a "skipped, external" comment.
## Job 2 — generate
Analyst → Architect → Engineer → Sentinel. Checkout is **SHA-pinned +
`persist-credentials:false`**; pipeline files
(`.opencode`/`opencode.jsonc`) restored from trusted `main`
(anti-hijack). **Hand-off validation gate** confirms each agent wrote
its artifact (spec + registration) and fails fast with a clear message
otherwise. Sentinel verdict is **fail-closed**. A **deterministic,
non-LLM** step (`yq`) registers the spec in `playwright.yml`, creates
**`autoe2e/<orig-branch>`** stacked on the dev's branch, commits, and
force-pushes (idempotent re-runs). **No PR yet.**
## Job 3 — verify/heal (HEAVY)
On `ubicloud-standard-16`, mirrors `playwright.yml`: builds + boots a
**real OpenObserve**, runs **only the generated spec** (`--workers=4`),
runs the Healer to fix it, then an **authoritative final run decides
pass/fail (not the LLM)**, Sentinel re-audits, pushes fixes. **Loop
gating:** hard `timeout-minutes: 30` on the heal step +
`continue-on-error` (a hung healer is killed and the pipeline proceeds
to the final run → fails → no PR), job backstop 90 min.
## Job 4 — open the test PR
Opens the stacked test PR **only if healed (passing)**, via
**`ORG_ADMIN_TOKEN`** so the repo's existing `playwright.yml`
re-validates it (a `GITHUB_TOKEN`-created PR wouldn't trigger CI).
Sticky comment links the test PR on the source PR.
## Failure handling (never silent, never junk)
Any failure is reported **on the source PR by the job where it
happens**, with a root cause + run link:
- **generate** → agent error / broken hand-off / Sentinel block.
- **verify/heal** → build failed / boot failed / **healer timed out
(hung)** / still-failing after retries.
No PR is opened on failure — only a comment — so the PR never carries
broken tests, and the dev is always notified.
## Security / CodeQL
SHA-pinned + no-persisted-creds checkouts, allowlist on trigger +
author, anti-hijack config restore, deterministic `playwright.yml` edit,
and untrusted paths passed via `env:` (no `${{ }}` in shell). CodeQL on
this PR: **4 code-injection FIXED**, **3 untrusted-checkout DISMISSED**
(allowlist-author false positive — generation runs only on
trusted-teammate code, dispatch-only). Note: each push shifts lines, so
CodeQL may re-raise the same toctou under new alert numbers — dismiss
with the same justification.
## Status
- ✅ All 4 jobs implemented + gating + failure handling.
- ⚠️ **Untested end-to-end** — Jobs 2–4 only run on a real
`dry_run=false` dispatch; the first live run is the shakedown.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- alert history title truncate and drawer width increase
- management page content left align and padding
- horizontal scroll in table without resizing columns
- print dashboard header and back button reset print mode
- x-axis name overlapping tick labels and legend
- print dashboard header sticky and scroll fix
---------
Co-authored-by: ktx-vaidehi <vaidehi.akhani@kiara.tech>
This adds a UI and API based trigger for re triggering license check
limits, so we do not have to restart nodes
---------
Signed-off-by: Yashodhan Joshi <yjdoc2@gmail.com>
Co-authored-by: Yashodhan Joshi <yjdoc2@gmail.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
## Summary
Follow-up to #12652 that makes the **E2E Council** workflow correct and
pleasant for real use, after the first live dry-run triages exposed
gaps. v1 scope is unchanged: **OSS-only, manual-first, dry-run** (only
Job 1 triage runs; Jobs 2–4 are gated scaffolds).
## Changes
**Trigger is strictly PR-bound**
- Removed the free-form `oss_branch` input (it let you generate tests
detached from a PR, and dispatching from `main` diffed
main-against-itself = nothing).
- `pr_number` is now **required** for manual dispatch and accepts a
**number, `#123`, or a full PR URL** (normalized to an integer).
- A test is only ever generated for a PR. No PR ⇒ no run (empty/missing
diff fails fast with a clear message).
**`/e2e` is an exact match**
- Triggers only when the comment body is exactly `/e2e`. `Generate
/e2e`, `/e2e please`, etc. do **not** fire anything (the job's `if` is
false → no reaction, no comment, no run).
**Agent discovery fixed (the important one)**
- The first live run logged `agent "e2e-ci-triage" not found. Falling
back to default agent` — OpenCode does not auto-discover agents nested
under `.opencode/agents/<subdir>/`. It only worked by luck (the default
agent read the spec file).
- Fixed by registering all six agents in `opencode.jsonc` under the
`agent` key with `prompt: "{file:...}"`. **Confirmed working** on the
next run (`> e2e-ci-triage · deepseek-v4-pro`, no fallback).
**Immediate user feedback on a run**
- Posts a 👀 reaction on the `/e2e` comment and an "⏳ triage in
progress…" comment within seconds, then **edits that same comment in
place** with the decision (no second comment). Runs with `always()` so a
failed/empty run still updates it (never stuck on "in progress").
**Form/docs polish**
- Decluttered the Run-workflow form (short input labels; full guidance
lives in the workflow header).
## Verified live (dry-run triages on this PR)
- OpenCode installs (v1.17.7); DeepSeek model `deepseek/deepseek-v4-pro`
works.
- Secure path confirmed: PR read as a **diff via API**, no untrusted
PR-head checkout.
- Triage decisions correct + conservative (CI-only change → skip).
- Agent discovery fix confirmed (named agent loads as the system
prompt).
## Not in scope (still scaffolds)
Jobs 2–4 (generate → heal → PR-back). Build those once the triage gate
is trusted over a dry-run period.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Summary
- Changes the stranger-issue triage in `auto-assign-metadata` to assign
**only `simranquirky`**, replacing the previous `Shrinath-O2` +
`Manazsharma` + `neha00290` set
- Stranger **PR** assignment (`oasisk` + `hengfeiyang`) is unchanged
## Test plan
- [ ] Open an issue as an external contributor → verify only
`simranquirky` is assigned
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Problem
The **Logs-Builder-Basic** e2e shard is frequently flaky — it times out
on `unflattened.spec.js` and, because it's a big shard, a single timeout
re-runs the whole thing. Example: [run
27521591530](https://github.com/openobserve/openobserve/actions/runs/27521591530/job/81341218030).
In that run:
- `unflattened.spec.js:205` — hard failure, **timed out (300s) on all 3
retries**
- `unflattened.spec.js:100` and `logsQueryBuilder-chart.spec.js:148` —
flaky (passed on retry)
## Root cause
The failures are **timeouts, not assertion bugs**. The unflattened
tests:
1. Slept **~76s of fixed `waitForTimeout`** across the file (pure dead
time).
2. Ran a retry loop that **re-ingested 3,848 records up to 5×/test**
while waiting for the `_o2_id` field to index after enabling *Store
Original Data*.
Each test + setup is ~80s on a fast local machine; CI runners are ~3-4×
slower **and** run all 4 specs in the shard in parallel against one
backend. That pushes individual tests right onto the 300s/test ceiling.
The re-ingestion balloon also hammered the shared backend, slowing the
other specs (`logsQueryBuilder`, `pagination`) — which is why they
flaked as collateral.
## Fix
- Add `waitForO2IdQueryable()` to the unflattened page object: **polls
the search API until `_o2_id` is actually queryable** instead of
sleeping a fixed interval and hoping indexing caught up.
- Gate the UI scan on that readiness signal, removing the 15s/5s blind
schema-propagation sleeps.
- Turn the expensive **re-ingest** retry loop into a cheap **re-query**
loop (attempts 5 → 3) — the gate guarantees the data is already in the
backend, so a UI miss is only render lag.
No change to what the tests actually assert.
## Verification (local, against self-hosted OpenObserve)
| Check | Result |
|---|---|
| Unflattened solo ×2 (cleanup between) | 2 passed each, `_o2_id` on
**row 0 / attempt 1** every time, **2.3m** (was 2.8m) |
| `logsQueryBuilder-chart:148` isolated ×5 | **5/5 passed** → not
independently flaky (collateral) |
| **Full 4-spec shard, 4 workers (CI scenario)** | **52 passed, 0
failed, 0 flaky** |
The retry loop now never fires — the readiness gate makes the first UI
scan succeed every run, killing both the timeout and the cross-spec
contention.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## What this adds
A CI-side **E2E test-generation pipeline** (Council of Agents) that runs
in GitHub Actions via **OpenCode on DeepSeek-V4-Pro**, fronting the
existing Playwright + TestDino CI.
**v1 scope: OSS-only, manual-first, dry-run.** On this first cut the
workflow does **only triage** — it classifies a change and posts the
decision as a PR comment. It does **not** generate tests, edit
`playwright.yml`, run anything, or open PRs.
## Files
- `.opencode/agents/e2e_ci_council_of_agents/` — 6 CI-adjusted agents
(triage, analyst, architect, engineer, sentinel, healer) + README.
`mode: primary`, file-based handoff, non-interactive. Engineer also
gains `playwright.yml` registration. Scribe excluded; ENT skipped at
triage.
- `opencode.jsonc` — DeepSeek provider.
- `.github/workflows/e2e-council.yml` — Job 1 (triage + dry-run comment)
is **live**; Jobs 2–4 (generate / heal / PR-back) are **gated
scaffolds** for when we flip the switch.
- `.gitignore` — track only the CI agent folder under `.opencode`.
## Triggers
- `workflow_dispatch` (pick branch) and `/e2e` comment on a PR.
Auto-on-merge is **off**.
- Both read the workflow from the **default branch**, so they only
activate after this merges.
## Before first run
- [ ] Add repo secret **`DEEPSEEK_API_KEY`**.
- [ ] Merge to main.
- [ ] Trigger via Actions → "E2E Council (Test Generation)" → Run, or
`/e2e` on a PR.
## Verify on first run (deferred by design)
- OpenCode install command/version.
- Whether `--agent e2e-ci-*` resolves agents nested under
`.opencode/agents/<subdir>/`.
- DeepSeek model id `deepseek/deepseek-v4-pro`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Currently, on the roles edit page, the frontend makes role permission
api for each and every resources. So, for current 41 resources, there
are 41 concurrent api calls, each going through the openfga rbac check
middleware. That means, there are 41 concurrent redundant openfga
checks, and then 41 openfga query to get the role permissions.
This pr adds another api `org_id/roles/role_name/permissions` that
combines all the resource permissions of the given role name and return
the same eliminating the need for making api calls for each rbac
resource.
## What
Removes `tests/ui-testing/playwright-tests/API/` and its sole file,
`dashboards-multi-window-vrl-api.spec.js` (708 lines).
## Why it is safe to remove
**1. It is never run.**
- Absent from the Playwright CI matrix in
[.github/workflows/playwright.yml](https://github.com/openobserve/openobserve/blob/main/.github/workflows/playwright.yml)
— CI runs only the per-folder `run_files` lists, and there is no `API`
`testfolder`.
- Not referenced by any config, script, `package.json`, or workflow in
the repo (only self-references inside the file).
- It would execute solely via a bare local `npx playwright test`, never
in CI.
**2. It is not actually a UI test.**
It drives no browser UI — it uses `page.request.*` to call REST
endpoints directly (`/api/{org}/dashboards`, `/_search_multi_stream`)
and parses SSE. It lived under `ui-testing/` only to borrow the
Playwright auth/fixtures.
**3. Coverage is fully duplicated by the pytest API suite, which does
run in CI.**
The pytest twin was added in the same PR and runs via
[.github/workflows/api-testing.yml](https://github.com/openobserve/openobserve/blob/main/.github/workflows/api-testing.yml)
(`rye run pytest` over `tests/`; `dashboards/` is not ignored). The 10
JS tests map 1:1 to
`tests/api-testing/tests/dashboards/test_multi_window_vrl.py`:
| JS spec test | pytest equivalent |
|---|---|
| multi-window no VRL | `test_create_dashboard_multi_window_no_vrl` |
| multi-window + non-ResultArray VRL |
`test_create_dashboard_multi_window_non_result_array_vrl` |
| multi-window + ResultArray VRL |
`test_create_dashboard_multi_window_result_array_vrl` |
| all 3 panel types | `test_create_dashboard_all_panel_types_combined` |
| `_search_multi_stream` no VRL | `test_search_multi_stream_no_vrl` |
| `_search` baseline VRL | `test_search_single_stream_vrl_baseline` |
| non-ResultArray VRL per hit |
`test_search_multi_stream_non_result_array_vrl` |
| ResultArray VRL diff | `test_search_multi_stream_result_array_vrl` |
| ResultArray VRL SSE structure |
`test_search_multi_stream_result_array_vrl_response_structure` |
| per_query_response=false |
`test_search_multi_stream_without_per_query_response` |
`test_multi_window_vrl_v2.py` adds 5 further cases. Both the JS and
pytest files originated together in PR #10860 (multi-window dashboard
VRL fix); this removes the unused JS duplicate and keeps the maintained
pytest version.
## Risk
None to test coverage — the underlying behavior remains covered (and
exceeded) by the CI-executed pytest suite.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## Summary
- Preserve canonical/resource-derived trace fields when resource or span
attributes collide with flattened span fields like `service_name`.
- Keep resource `service.name` as the canonical `service_name` while
moving colliding resource fields such as resource `name` to
`service_attr_name`.
- Prefix colliding span attributes with `attr_` before serde flattening.
- Add regression coverage for span/resource `service_name` collisions
and normalized resource-field collisions.
Fixes#12448
## Testing
- `git diff --check`
Not run: cargo test, because this local environment does not have
rustc/cargo installed.
---------
Co-authored-by: Hengfei Yang <hengfei.yang@gmail.com>
## What
Fixes the failing **Logs-Regression** test `should show correct error
message identifying the problematic field @errorMessage @P0 @regression`
([logs-regression-bugs.spec.js:330](tests/ui-testing/playwright-tests/RegressionSet/logs-regression-bugs.spec.js#L330)).
Failed identically in the latest scheduled runs:
- OSS:
https://github.com/openobserve/openobserve/actions/runs/27405296335
- ENT:
https://github.com/openobserve/o2-enterprise/actions/runs/27405221785
(The spec is shared from OSS and merged into the enterprise test tree,
so this single OSS fix covers both.)
## Root cause
Not a product bug — the test wasn't updated after the query-error UI
redesign (`QueryErrorState.vue` + `ErrorDetailPanel.vue` /
`useQueryError`). The backend message `No field named
nonexistent_field_xyz_12345. Valid fields are e2e_automate._timestamp.`
is now split at the first `". "`:
- **summary line** (`data-test="error-detail-summary"`, always visible)
→ `No field named nonexistent_field_xyz_12345.` — carries the field name
- **detail body** (`data-test="error-detail-body"`, behind the expand
toggle) → `Valid fields are e2e_automate._timestamp.`
The page-object helper `getDetailedErrorDialogText()` read **only** the
expanded detail body, so it never captured the field name the assertion
checks for (`Received string: "valid fields are
e2e_automate._timestamp."`).
## Fix
Rewrote `getDetailedErrorDialogText()` in
[logsPage.js](tests/ui-testing/pages/logsPages/logsPage.js) to expand
the detail panel and return the **whole** `logs-search-error-state`
container text (summary line + detail body), falling back to the detail
body if the container is unavailable. Test-only change — no assertion or
product code touched; the assertion was always correct.
## Verification
Run locally against a hosted instance (`http://localhost:5080`):
- `should show correct error message identifying the problematic field`
→ **PASS** (21.7s)
- Stability `--repeat-each=2` → **PASS x2**, no flakiness
Only one caller of `getDetailedErrorDialogText()` exists (this test), so
the change is fully contained.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
## Review feedback addressed
- **Robust fallback:** when the full error container isn't visible (e.g.
a rendering race), the helper now stitches the summary line
(`error-detail-summary`) + detail body (`error-detail-body`) together
explicitly, instead of falling back to the detail body alone — so the
field name can never be dropped.
- **JSDoc:** `@returns` now documents that the value is the full error
text (summary line + detail body).
No change to the test flow or assertion — only the page-object helper
that reads the error text was touched.
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Design at: #12620Closes#12620Fixes#12564
## What
Rewrites both tantivy histogram optimize-rule collectors following the
same approach as the recent `TopNCollector` /
`SingleSegmentDocIdCollector` rewrites, and adds timezone support to
both rules.
- `MultiHistogramCollector` (replaces the aggregation framework for
`SimpleMultiHistogram`)
- `SimpleHistogramCollector` (replaces
`tantivy::collector::HistogramCollector` for `SimpleHistogram`)
### Timezone support (#12564)
`histogram(ts, interval, tz)` rewrites to `date_bin(interval,
to_timestamp_micros(_timestamp + offset), origin)`; the optimizer's
`get_column_name` hit the `BinaryExpr` and silently skipped both rules.
Now:
- the visitors extract the fixed offset from that shape
(`get_timestamp_offset`), so the rules fire with a timezone
- `IndexOptimizeMode::SimpleHistogram` / `SimpleMultiHistogram` carry a
`ts_offset` field (no proto change — histogram modes never cross gRPC,
they're re-derived per node)
- bucket edges are computed in shifted wall-clock space and the
collectors bucket on `_timestamp + ts_offset`, so emitted keys match
`date_bin` exactly when merging with non-tantivy partials
## Testing
- New collector unit tests: dense vs sparse equality, ts_offset
shifting, bounds filtering, missing column / missing breakdown docs,
per-bucket truncation with tie-breaks
- Visitor tests now include real-DataFusion-plan timezone cases
(`'+08:00'` simple, `'-05:30'` multi) asserting the extracted shifted
bounds and offset
- `cargo test -p config` (1936 passed), plus `index_optimizer` /
`search::tantivy` / `tantivy_optimize_exec` suites in the main crate;
clippy clean
- Low cardinality: fast `20%` than main
```
histogram(_timestamp, '1h') AS ts, count(*) FROM default GROUP BY ts ORDER BY ts ASC
```
- Low cardinality: fast `30%` than main
```
histgoram(_timestamp, '1h') AS ts, breakdown, count(*) FROM default GROUP BY ts, breakdown ORDER BY ts ASC
```
- High cardinality: faster `5x` than main
```
histgoram(_timestamp, '1h') AS ts, breakdown, count(*) FROM default GROUP BY ts, breakdown ORDER BY ts ASC
```
## What changed
Adds stream-change confirmation dialogs across Traces tabs. When a user
changes the stream in **Service Graph** or **Services Catalog**, the
change is no longer applied silently — instead an `ODialog` prompts the
user to confirm, since changing the stream clears the existing query in
the Traces/Spans tabs.
## Why
Previously, stream selection was only synced one-way: changing the
stream in Traces/Spans propagated to all other tabs. Changing the stream
in Service Graph or Services Catalog did not sync back because those
tabs don't show a query — so doing so could erase an active query in
Traces/Spans without user awareness. This change ensures the user is
explicitly asked before clearing their query.
Omkar Kesarkhane
Huaijin
Shrinath Raoandgithub-actions[bot]
Bhargav
Neha PandClaude Opus 4.7
Hengfei Yang
Windforce17andHengfei Yang
Loakesh Indiran
ktx-mihirandktx-vaidehi
udev
Subhra264
Rohith MatamandHengfei Yang
Abhay Padamani
