From 9ed483ae70b3c1b55d3aa952e45dd5facb00ed59 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 18 Sep 2026 19:38:41 +0200
Subject: [PATCH] perf: key the audit operation index on id with a trailing
 timestamp

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 ...it_partitioned_workspace_operation_index.up.sql |  4 ----
 ...partitioned_workspace_operation_index.down.sql} |  0
 ...it_partitioned_workspace_operation_index.up.sql |  6 ++++++
 backend/windmill-api/src/db.rs                     | 14 +++++++++-----
 4 files changed, 15 insertions(+), 9 deletions(-)
 delete mode 100644 backend/migrations/20260918062854_audit_partitioned_workspace_operation_index.up.sql
 rename backend/migrations/{20260918062854_audit_partitioned_workspace_operation_index.down.sql => 20260918173412_audit_partitioned_workspace_operation_index.down.sql} (100%)
 create mode 100644 backend/migrations/20260918173412_audit_partitioned_workspace_operation_index.up.sql

diff --git a/backend/migrations/20260918062854_audit_partitioned_workspace_operation_index.up.sql b/backend/migrations/20260918062854_audit_partitioned_workspace_operation_index.up.sql
deleted file mode 100644
index c7de75a93c..0000000000
--- a/backend/migrations/20260918062854_audit_partitioned_workspace_operation_index.up.sql
+++ /dev/null
@@ -1,4 +0,0 @@
--- The backend builds this per partition with CREATE INDEX CONCURRENTLY instead,
--- see create_audit_operation_index_concurrently in windmill-api/src/db.rs
-CREATE INDEX IF NOT EXISTS ix_audit_partitioned_workspace_operation
-    ON audit_partitioned (workspace_id, operation, "timestamp" DESC);
diff --git a/backend/migrations/20260918062854_audit_partitioned_workspace_operation_index.down.sql b/backend/migrations/20260918173412_audit_partitioned_workspace_operation_index.down.sql
similarity index 100%
rename from backend/migrations/20260918062854_audit_partitioned_workspace_operation_index.down.sql
rename to backend/migrations/20260918173412_audit_partitioned_workspace_operation_index.down.sql
diff --git a/backend/migrations/20260918173412_audit_partitioned_workspace_operation_index.up.sql b/backend/migrations/20260918173412_audit_partitioned_workspace_operation_index.up.sql
new file mode 100644
index 0000000000..4d07e66f5a
--- /dev/null
+++ b/backend/migrations/20260918173412_audit_partitioned_workspace_operation_index.up.sql
@@ -0,0 +1,6 @@
+-- The backend builds this per partition with CREATE INDEX CONCURRENTLY instead,
+-- see create_audit_operation_index_concurrently in windmill-api/src/db.rs.
+-- id matches list_audit's order and before_id cursor. timestamp trails it so a
+-- time window is checked in the index rather than on every row it reads.
+CREATE INDEX IF NOT EXISTS ix_audit_partitioned_workspace_operation
+    ON audit_partitioned (workspace_id, operation, id DESC, "timestamp");
diff --git a/backend/windmill-api/src/db.rs b/backend/windmill-api/src/db.rs
index 7e627652e3..fd6ee24e56 100644
--- a/backend/windmill-api/src/db.rs
+++ b/backend/windmill-api/src/db.rs
@@ -30,7 +30,8 @@ async fn current_database(conn: &mut PgConnection) -> Result<String, MigrateErro
         .await?)
 }
 
-const AUDIT_OPERATION_INDEX_MIGRATION: i64 = 20260918062854;
+const AUDIT_OPERATION_INDEX_MIGRATION: i64 = 20260918173412;
+const AUDIT_OPERATION_INDEX_KEY: &str = r#"(workspace_id, operation, id DESC, "timestamp")"#;
 
 /// A plain `CREATE INDEX` on the partitioned table holds a SHARE lock on every partition until the
 /// whole build ends, blocking the audit insert each job push makes in its own transaction. Each
@@ -40,8 +41,11 @@ async fn create_audit_operation_index_concurrently(
     conn: &mut PgConnection,
 ) -> Result<(), MigrateError> {
     conn.execute(
-        r#"CREATE INDEX IF NOT EXISTS ix_audit_partitioned_workspace_operation
-           ON ONLY audit_partitioned (workspace_id, operation, "timestamp" DESC)"#,
+        format!(
+            "CREATE INDEX IF NOT EXISTS ix_audit_partitioned_workspace_operation \
+             ON ONLY audit_partitioned {AUDIT_OPERATION_INDEX_KEY}"
+        )
+        .as_str(),
     )
     .await?;
     let partitions: Vec<String> = sqlx::query_scalar(
@@ -57,14 +61,14 @@ async fn create_audit_operation_index_concurrently(
     .await?;
     let quote = |name: &str| format!("\"{}\"", name.replace('"', "\"\""));
     for partition in partitions {
-        let index = quote(&format!("{partition}_workspace_id_operation_timestamp_idx"));
+        let index = quote(&format!("{partition}_workspace_id_operation_id_timestamp_idx"));
         tracing::info!("Building ix_audit_partitioned_workspace_operation on {partition}");
         // An interrupted CONCURRENTLY build leaves an invalid index under this name.
         conn.execute(format!("DROP INDEX CONCURRENTLY IF EXISTS {index}").as_str())
             .await?;
         conn.execute(
             format!(
-                r#"CREATE INDEX CONCURRENTLY {index} ON {} (workspace_id, operation, "timestamp" DESC)"#,
+                "CREATE INDEX CONCURRENTLY {index} ON {} {AUDIT_OPERATION_INDEX_KEY}",
                 quote(&partition)
             )
             .as_str(),