* fix(docker): pin frontend build stage to linux/amd64
Rollup selects platform-specific native binaries that can emit different
content-hashed chunk filenames for identical sources. The frontend assets are
embedded into the Rust binary via rust_embed, so building the stage once per
target architecture produced amd64 and arm64 images whose HTML references
`_app/immutable/chunks/<hash>.js` files that only exist in that architecture's
image. In a mixed-architecture cluster, a page served by a pod of one arch 404s
on JS/CSS fetched from a pod of the other.
Pinning the stage makes both image variants embed byte-identical assets. The
stage output is JS/CSS/HTML/WASM only, so the build platform does not leak into
the artifacts.
Fixes WIN-2242
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: tighten frontend platform-pin comment
Vite 8 bundles with rolldown, not rollup; name the right bindings and keep the
constraint to four lines.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(frontend): make the build reproducible so mixed-arch clusters agree on asset names
SvelteKit defaults `kit.version.name` to `Date.now().toString()`, so every build
of the same commit gets a different version string. It is embedded in the client
chunk (and in the `__sveltekit_<hash>` global derived from it), which changes
that chunk's content hash and cascades into new filenames for roughly a quarter
of `_app/immutable`. The assets are baked into the binary via rust_embed, so the
amd64 and arm64 images of one release ship different `chunks/<hash>.js` names:
in a mixed-architecture cluster, HTML served by a pod of one architecture 404s
on assets requested from a pod of the other.
Measured on the published windmill:1.770.0 images: 224 of 863 asset filenames
differ between the two architecture variants, yet 854 of 855 chunks are
byte-identical once chunk-name references are normalized. The single genuinely
differing chunk is the one carrying the timestamp. The bundler is deterministic
across architectures; the timestamp is the whole divergence.
Pinning the version to the package version (overridable via WM_BUILD_VERSION)
makes repeat builds byte-identical. `version.pollInterval` is 0 and nothing
reads the `updated` store, so this has no runtime behavior change.
This supersedes pinning the Docker frontend stage to linux/amd64, which fixed
the symptom by building the stage under emulation on the arm64 builder — that
cost 32 minutes of QEMU time per build and left the underlying non-determinism
in place.
Fixes WIN-2242
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(frontend): key the sveltekit version on the commit sha
The package version only moves on releases, but `:dev` and RHEL images are
published on every main push. Two such deployments would then advertise the same
SvelteKit version, and SvelteKit only recovers from a chunk that 404s after a
redeploy (client.js: "Referenced node could have been removed due to redeploy")
when the deployed version differs from the baked-in one, so an open tab would
render an error page instead of reloading.
Pass the commit sha through WM_BUILD_VERSION from every workflow that builds the
root Dockerfile, so the value is identical across the per-architecture builds of
one commit and distinct between commits. The package version stays the fallback,
which keeps unwired builds architecture-consistent.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(docker): declare WM_BUILD_VERSION in the RHEL frontend stages
The RHEL workflows copy docker/RHEL{8,9}/Dockerfile over the root one before
building, so the build-arg was unconsumed there and those images fell back to
the package version: two RHEL builds between releases would share a SvelteKit
version across different manifests.
Also switch the root declaration to the `ARG name=""` form used by `features`.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: keep the version-arg rationale in one place
The root Dockerfile comment restated what frontend/svelte.config.js already
documents; point at it instead, matching the RHEL Dockerfiles.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: split debug info for EE release builds
Generate line-table debug info in release builds and split it into
a separate .debug file. The shipped binary remains stripped (same
size as before), while the .debug files are attached to GitHub
releases for both amd64 and arm64 EE builds.
This enables production debugging with gdb/perf by copying the
matching .debug file into a running pod.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: extract debug info via separate Docker stage
Use a `FROM scratch AS debuginfo` stage instead of copying the .debug
file to the final image. This keeps the shipped image at exactly the
same size as before. CI extracts the .debug file using depot's
--target debuginfo with cache hits from the main build.
Also adds gnu_debuglink so gdb auto-discovers the debug file when
placed next to the binary.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: make nsjail available in all standard images (CE)
Include nsjail binary and runtime deps in the main Dockerfile and
DockerfileSlim so sandboxing is available out of the box. Flip
DISABLE_NSJAIL default to false so nsjail is enabled by default.
Remove DockerfileNsjail (now redundant) and the build_ee_nsjail CI job,
pointing publish_ecr_s3 at the base EE image instead. Add iptables to
DockerfileFullEe to preserve the functionality from the removed nsjail
image.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* revert: keep DISABLE_NSJAIL default as true
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: pin publish_ecr_s3 to exact commit hash
Add type=sha tag to build_ee so it pushes a commit-pinned image tag.
Restore git hash lookup in publish_ecr_s3 to reference the exact image
for that commit, avoiding race conditions with the mutable dev tag.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: publish_ecr_s3 depends on build_ee_full, uses release tag
Only publish to S3 on tag releases, extracting static frontend from the
ee-full image using the semver tag.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: remove stale windmill-ee-nsjail references, add nsjail to EE slim
The windmill-ee-nsjail image is no longer published since DockerfileNsjail
was deleted. Update all references to use the base EE image (which now
includes nsjail), remove redundant nsjail deps from DockerfileExtra, and
add nsjail build to DockerfileSlimEe for consistency with CE slim.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* check endpoint
* use flag for cred check on worker
* use sdk for auth chat side
* cleaning
* cleaning
* also handle GET
* Add session token support in BedrockClient::from_credentials
Users with temporary STS credentials need session tokens for AWS
authentication. This adds the optional session_token parameter to
support these use cases.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Cache AWS SDK config loading to avoid repeated I/O
aws_config::load_defaults() performs environment variable lookups and
potentially file I/O on each call. Cache the result in a static OnceCell
to improve performance on high-frequency Bedrock requests.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Add debouncing to Bedrock credential check button
Prevent rapid clicks from spawning multiple concurrent flow preview
jobs for the worker credential check.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Remove orphaned SigV4 signing comment
The manual SigV4 signing code was removed in favor of the AWS SDK,
but this documentation comment was left behind.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Remove verbose tracing info and change-related comments
- Remove per-request auth method info logs (too verbose for production)
- Simplify from_env log to single debug-level message
- Remove comments describing future changes rather than current behavior
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* cleaning
* Fix Bedrock feature flag compilation warnings
Gate AWS-specific imports, struct fields, and methods behind the bedrock
feature flag to eliminate dead code warnings when building without the
bedrock feature enabled.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* bedrock flag
* cleaning
* Move BedrockCredentialsCheck from edit drawer to add drawer
The component was incorrectly shown when editing resources instead of
when adding new ones. Moved it from ResourceEditor.svelte to
ApiConnectForm.svelte.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* cleaning
* cleaning
* make aws-config optional
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* clean plate
* npm i
* log in e2e
* global setup login
* set license key
* Revert "set license key"
This reverts commit 86d5db2c48.
* create datatable test
* fix wrong pg_creds
* data table + db manager e2e test
* DbManagerPage class
* small refactor
* create resource test + improvements
* text db manager in resources
* Factor test logic in classes
* refactoring
* refacto
* alter table test
* alter table e2e test
* set schema in test
* nits
* fix wrong schema var
* Correct setup and parallelization
* reducedMotion
* tests passing headless !
* bigger timeout
* start e2e docker compose
* e2e runs on all databases
* nit test uid fix
* refactp
* stash
* Better Workspace Storage settings
* minio setup
* nit
* nit
* super nit
* Permission settings in modal
* badge indicator
* Fetch alter table metadata much faster
* Upgrade duckdb to 1.4.3
* Ducklake tests
* Disable transactional DDL for Ducklake (bug on their side)
* git ignore env
* bigquery tests passes
* getJsonEnv
* load coldef in parallel
* Make Bigquery schema fetching much faster
* makeLoadTableMetaDataQuery for entire db in bigquery
* refactor getDbSchemas to avoid assignment side effect
* fix col def
* Better loading state mgmt
* snowflake
* fix snowflake primary keys
* Test CI
* fix setTimeout type
* remove type node
* test e2e ci
* Revert "test e2e ci"
This reverts commit bf98a755dc.
* remove ci
* fix snowflake pk query in alternate schemas
* nit wait for coldefs
* nit snowflake
* Snowflake fk fix
* UNPROCESSABLE_ENTITY instead of INTERNAL_ERROR
* nits
* fix alter pk in snowflake
* yet other fixes
* snowflake tests pass
* nits
* use tini with unshare to preserve signals (e.g oom)
* fix ci
* ci as nsjail
* simplify
* fix flaky go integration test
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* fix sql query for postgres 14
* deno_core when building backend image in github workflows
* sqlx prepare
---------
Co-authored-by: Diego Imbert <diego@windmill.dev>
* feat: add nu (nushell) support
* add worker tests
* deactivate tables and non-any types below top-level
full support will come in V1
for V0 it's better to keep things minimal and simple
* add syntax highlighting
used python's grammar, since nushell isn't supported by monaco nor svelte-highlights
for V1 nu will get it`s own grammar
* add logo
* partially implement plugin support
* change logo + ability to deploy + nsjail draft
* static variables + get_resource + get_variable
* lsp/dev.nu + initial nu lsp (not working yet)
* make it work with nsjail
* nullguard
* Much more flexible signature parsing and better error-messages
* add init script
* rename nulsp to nu
* install nu to dockerfile
* fix merge
* implement Default for MainArgSignature
* stage NU_CACHE_DIR
* improve dockerfiles
* dev.nu for parser-wasm + flake.nix
* update code for windows
* add nushell to flake
* upload Cargo.lock
* make build.sh work on nixos
* build wasm cli parsers
* add docs to README_DEV.md
* add helper script docker/dev.nu
* improve docker/dev.nu
* fix windows
* commit frontend/package(lock).json
* update cargo.lock
* correctly update cargo.lock
* remove lsp
* update flake.nix to include svelte server and nushell
* Revert base.sql to main
* remove PLUGIN_USE_RE
* make CARGO_PATH private
* add nu to cli
* Change flags to build wasm-nu-parser
* remove flake.nix from parser-wasm
* update wasm-build target
* remove unused import
* add cli support for nu
* update github workflows
* wasm-build 0.17 -> 0.19
* update build script
* update cargo.lock
* Fix typographical error
* start working on java
* do java boilerplate
* implement parser for java
* update Cargo.lock
* update ENV_SETTINGS
* use published nu parser
* update package.lock
* java is S3 + Caching enabled
* install nsjail backup
* commit v0
* fix nsjail
* v0.1
* rewrite parser in tree-sitter
* implement parser from scratch
* polishing
* change init script to match new parser
* fix imports
* fix cli build
* fix cli build
* refactor install phase
* implement .valid.windmill atomic verification
* implement java init functionality
* remove quick-xml
* fix windows not recognizing 'mvn'
* create empty settings.xml if there is no config provided
* clean up
* change default settings.xml
* change classpath format for windows
* docs to helper
* java copy bin cache instead of symlink
* remove comments
* merge
* fix package.json
* fix package.json 2
* minor fixing
* migrate to Coursier
* update misc
* Http(s) Proxy + CA certs
* remove unused .wasm
* make requirements insensitive to spaces
* update handle_child refs
* rework save_cache for directories
* fix s3 bug
* compile .wasm for cli
* remove uuid import
* fix compilation
* use reference
* fix zero-dep failure
* removing unsafe stuff
* remove unneeded imports
* revert: we still need winapi
* remove nix store from nsjail
* do not create cache_nomount
* add java to dnt
* remove duplicated dependency in init script
* fix typos
* fix CI
* use published parser
* feat: add nu (nushell) support
* add worker tests
* deactivate tables and non-any types below top-level
full support will come in V1
for V0 it's better to keep things minimal and simple
* add syntax highlighting
used python's grammar, since nushell isn't supported by monaco nor svelte-highlights
for V1 nu will get it`s own grammar
* add logo
* partially implement plugin support
* change logo + ability to deploy + nsjail draft
* static variables + get_resource + get_variable
* lsp/dev.nu + initial nu lsp (not working yet)
* make it work with nsjail
* nullguard
* Much more flexible signature parsing and better error-messages
* add init script
* rename nulsp to nu
* install nu to dockerfile
* fix merge
* implement Default for MainArgSignature
* stage NU_CACHE_DIR
* improve dockerfiles
* dev.nu for parser-wasm + flake.nix
* update code for windows
* add nushell to flake
* upload Cargo.lock
* make build.sh work on nixos
* build wasm cli parsers
* add docs to README_DEV.md
* add helper script docker/dev.nu
* improve docker/dev.nu
* fix windows
* commit frontend/package(lock).json
* update cargo.lock
* correctly update cargo.lock
* remove lsp
* update flake.nix to include svelte server and nushell
* Revert base.sql to main
* remove PLUGIN_USE_RE
* make CARGO_PATH private
* add nu to cli
* Change flags to build wasm-nu-parser
* remove flake.nix from parser-wasm
* update wasm-build target
* remove unused import
* add cli support for nu
* update github workflows
* wasm-build 0.17 -> 0.19
* update build script
* update cargo.lock
* Fix typographical error
* update Cargo.lock
* update ENV_SETTINGS
* use published nu parser
* update package.lock
* rewrite parser in tree-sitter
* implement parser from scratch
* polishing
* change init script to match new parser
* fix imports
* fix cli build
* fix cli build
* merge
* update wasm
* use MiniPulledJob
* update cli
* change cli wasm schema
* change cli
* update deno.json
* make wasm modules load lazily
* regenerate parsers
* remove leftover
* update cargo.lock
* clean up dnt.ts
* add docs to cli/test.nu
* add schema validation option
* add Nu to try_validate_schema
* reference frontend to new parser version
* feat: first commit
* fix: npm check
* fix: openapi file
* feat: update openapi and migration
* feat: basic implementation done
* fix: fix: no used function when no feature
* feat: capture done
* Update capture.rs
* nits: change sqs trigger
* fix: make migration great again
* feat: add message attributes
* feat: nits: fix error messages, remove console.log and add try catch
* update sqs icon and ee feature for sqs_trigger
* update: change sqs name casing and added test connection button
* nits: update Icon and add create from template button
* fix: ci build and error compilation
* update migration type sqs
* update link on create from template button for sqs, add archive in workspace export and update sqlx
* fix: ci
* Update SqsTriggerEditorInner.svelte
* add link to docs, use generic function for resource and fix import error
* chore: update .github ci
* nits: remove empty
* update to match ee repo changement
* Update backend/windmill-api/src/resources.rs
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
* add sqs handling for the cli and refacoring sqsEditorInner
* Update cli/sync.ts
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
* fix: add break to switch statement for sqs case
* fix: display aws_resource_path when retrieve or create a new trigger
* rework sqs ui, fix postgres optional port
* fix: ci
* update ui for trigger
* update repo ref and specific
* feat: add ready endpoints for workers to enterprise
* update ref
* Update frontend/src/lib/script_helpers.ts
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
---------
Co-authored-by: HugoCasa <hugo@casademont.ch>
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* Add csharp stuff and merge after the rewrite
* Add csharp, boilerplate + minimal execution
* Add initial parser
* Frontend + wasm export of the tree sitter parser
* Arg spread and use cache
* More types and req parsing
* Add logo
* Parse async and void to fit the wrapper to the main sig
* Csharp editor resource and var buttons
* Lockfile generation
* Add default parsing using serde_json::from_str
* Update init code for c#
* Nsjail for c#
* Remove c_variadic feature
* Remove unused imports
* Add c_variadic only for wasm32 assembly
* Fix c# test
* Add dotnet to the images
* Update dockerfiles
* Update dockerfile again
* Touch Dockerfile
* npm install c# parser
* Add opt mount in nsjail
* Update ee repo ref
* Add csharp to backend image for tests
* Add setting to set nuget package
* Windows compatibility
* Disable csharp test
* ADd feature flag
Ruben Fiszel
hugocasa
dieriba
centdix
Diego Imbert
Alexander Petric
pyranota
Ruben Fiszel
wendrul