* fix: explain duckdb failures caused by job isolation
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: apply the isolation policy to the schema-sync pre-pass
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: bump ee ref for the out-of-memory hint wording
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: bump the bundled DuckDB engine to 1.5.5
The 1.5.5 duckdb crate no longer hands back a 96-bit `rust_decimal`, so a
DECIMAL wider than that renders instead of panicking inside an `extern "C"`
frame — which, being unable to unwind, aborted the whole worker process and
left the job running as a zombie. `SELECT
'1234567890123456789012345678.9012345678'::DECIMAL(38, 10)` was enough.
Adapting to the crate's API: `Value` is now `#[non_exhaustive]` and gained
`UHugeInt` and `Geometry`, and `rust_decimal` became an optional feature that
the `decimal`/`numeric` argument path still needs.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: address review findings on the duckdb bump
Run the FFI crate's own tests in CI: it is excluded from the workspace, so the
`cargo test --all` in backend-test never reached them and the new guard against
the worker-aborting DECIMAL would not have run. build_dev.sh now honors a
caller-pinned CARGO_TARGET_DIR so the test build reuses that compile instead of
building the bundled engine a second time.
Also pin UHUGEINT rendering, and correct the rust_decimal rationale —
`Decimal::new` is public without the feature, so the reason is that the feature
reproduces the exact binding the crate used to derive, not that nothing else can.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: address review nits on the duckdb bump
Name the unsupported DuckDB type rather than dumping the value, which may be
arbitrarily large or hold data that does not belong in an error message, and
say which column it came from.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: pin the ee ref to the narrowed duckdb extension allowlist
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: keep duckdb spilling behind the local-filesystem fence
* chore: repin the duckdb fork after adding the reset-test exclusion
* docs: stop claiming the duckdb patch has been filed upstream
* docs: point the backend duckdb bullet at the fork's rationale
* fix: place lock_temp_directory so no existing struct member moves
* fix: skip the extension-load guard when the repo is unreachable
* refactor: trim the fork comments and fail the extension guard in CI
* chore: repin the duckdb fork onto upstream duckdb-rs main
* fix: keep the engine patch applying on a CRLF checkout
* docs: link the upstream issue tracking the underlying problem
* chore: repin the duckdb fork onto the patch as filed upstream
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 88568d11162ffa11723e7955e613224bab4f0568
This commit updates the EE repository reference after PR #720 was merged in windmill-ee-private.
Previous ee-repo-ref: 22f075c1164d9dd5a3ba92d682905aabd071d273
New ee-repo-ref: 88568d11162ffa11723e7955e613224bab4f0568
Automated by sync-ee-ref workflow.
* chore: repin the duckdb fork onto the cmake/fmt build fix
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test: pin the immutability half of lock_temp_directory
The spill test proves the exemption works; nothing proved the lock that makes
it sound. A rebase could drop the refusals and leave every other tripwire green.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix(docker): pin frontend build stage to linux/amd64
Rollup selects platform-specific native binaries that can emit different
content-hashed chunk filenames for identical sources. The frontend assets are
embedded into the Rust binary via rust_embed, so building the stage once per
target architecture produced amd64 and arm64 images whose HTML references
`_app/immutable/chunks/<hash>.js` files that only exist in that architecture's
image. In a mixed-architecture cluster, a page served by a pod of one arch 404s
on JS/CSS fetched from a pod of the other.
Pinning the stage makes both image variants embed byte-identical assets. The
stage output is JS/CSS/HTML/WASM only, so the build platform does not leak into
the artifacts.
Fixes WIN-2242
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: tighten frontend platform-pin comment
Vite 8 bundles with rolldown, not rollup; name the right bindings and keep the
constraint to four lines.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(frontend): make the build reproducible so mixed-arch clusters agree on asset names
SvelteKit defaults `kit.version.name` to `Date.now().toString()`, so every build
of the same commit gets a different version string. It is embedded in the client
chunk (and in the `__sveltekit_<hash>` global derived from it), which changes
that chunk's content hash and cascades into new filenames for roughly a quarter
of `_app/immutable`. The assets are baked into the binary via rust_embed, so the
amd64 and arm64 images of one release ship different `chunks/<hash>.js` names:
in a mixed-architecture cluster, HTML served by a pod of one architecture 404s
on assets requested from a pod of the other.
Measured on the published windmill:1.770.0 images: 224 of 863 asset filenames
differ between the two architecture variants, yet 854 of 855 chunks are
byte-identical once chunk-name references are normalized. The single genuinely
differing chunk is the one carrying the timestamp. The bundler is deterministic
across architectures; the timestamp is the whole divergence.
Pinning the version to the package version (overridable via WM_BUILD_VERSION)
makes repeat builds byte-identical. `version.pollInterval` is 0 and nothing
reads the `updated` store, so this has no runtime behavior change.
This supersedes pinning the Docker frontend stage to linux/amd64, which fixed
the symptom by building the stage under emulation on the arm64 builder — that
cost 32 minutes of QEMU time per build and left the underlying non-determinism
in place.
Fixes WIN-2242
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(frontend): key the sveltekit version on the commit sha
The package version only moves on releases, but `:dev` and RHEL images are
published on every main push. Two such deployments would then advertise the same
SvelteKit version, and SvelteKit only recovers from a chunk that 404s after a
redeploy (client.js: "Referenced node could have been removed due to redeploy")
when the deployed version differs from the baked-in one, so an open tab would
render an error page instead of reloading.
Pass the commit sha through WM_BUILD_VERSION from every workflow that builds the
root Dockerfile, so the value is identical across the per-architecture builds of
one commit and distinct between commits. The package version stays the fallback,
which keeps unwired builds architecture-consistent.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(docker): declare WM_BUILD_VERSION in the RHEL frontend stages
The RHEL workflows copy docker/RHEL{8,9}/Dockerfile over the root one before
building, so the build-arg was unconsumed there and those images fell back to
the package version: two RHEL builds between releases would share a SvelteKit
version across different manifests.
Also switch the root declaration to the `ARG name=""` form used by `features`.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: keep the version-arg rationale in one place
The root Dockerfile comment restated what frontend/svelte.config.js already
documents; point at it instead, matching the RHEL Dockerfiles.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Update the pinned Rust toolchain from 1.93.0 to 1.97.0 (latest stable,
released 2026-07-09) across the worker/server build Dockerfiles
(Dockerfile, docker/DockerfileFull, docker/DockerfileFullEe) and all CI
workflows that pin a toolchain.
Verified the backend compiles cleanly with 1.97.0 under `-D warnings`
(the default RUSTFLAGS used by actions-rust-lang/setup-rust-toolchain).
Fixes WIN-2155
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The runtime image bundles several Go CLIs whose pinned versions were built
with an outdated Go toolchain (go1.21.7 for kubectl/helm), which image
scanners flag for fixable Go stdlib CVEs. Bump each to the latest release
built on the current patched Go 1.26.4:
- kubectl 1.28.7 (EOL) -> 1.36.2 (latest stable)
- helm 3.14.3 -> 3.21.2 (latest v3; staying on v3 to avoid the Helm 4
breaking changes for a bundled CLI users depend on)
- crane v0.20.6 -> v0.21.7
crane is also updated in DockerfileSlim/DockerfileSlimEe (the slim images
don't bundle kubectl/helm). The docker client comes from the floating
docker:29-dind tag, which already rebuilds to a current Go toolchain.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The apt-package trim in #9783 removed packages that transitively
provided libargon2.so.1. The PHP CLI binary copied from
php:8.3.30-cli-bookworm links against libargon2.so.1 (for argon2
password hashing), so PHP jobs fail at startup with:
/usr/bin/php: error while loading shared libraries: libargon2.so.1:
cannot open shared object file: No such file or directory
Explicitly install libargon2-1 so the dependency no longer relies on
an incidental transitive package.
Fixes WIN-2101
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(sandbox): pull/extract images with crane instead of podman (+ add to image)
The sandboxed container runtime (`# sandbox <image>`) only ever pulls + flattens an
image (nsjail does the run), so a full container engine is overkill — and podman was
never actually in any Dockerfile, so the merged feature couldn't run in the shipped
image. Switch to crane (google/go-containerregistry): a single ~25MB static binary,
no daemon/store/root/privileged.
- docker_v2.rs: crane export -> flattened rootfs tar, crane config -> OCI config,
crane digest -> content-addressed rootfs+config cache (cross-job dedup + automatic
freshness), crane manifest -> pre-download size guard. DOCKER_CONFIG authfile dir.
Cache eviction prunes the rootfs-tar cache by mtime (LRU). Pull policy honored via a
ref->digest cache (missing/never reuse without a registry hit).
- Dockerfile + docker/DockerfileSlim{,Ee}: install the crane binary (Full/FullEe and
the EE image inherit it via FROM the base image).
- docs + UI text + instance-setting descriptions updated (download size is compressed;
cache is the rootfs-tar cache).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(sandbox): address CI review — digest-pinned fetch, size cap on every job, eviction race
Codex P1s:
- Fetch by the resolved digest (name@digest), not the mutable tag, so content can't
diverge from the digest the cache is keyed under if a tag moves mid-fetch.
- Enforce the size cap on EVERY job via a cached {digest}.size sidecar (no registry call
on cache reuse), so lowering the limit rejects already-cached oversized images.
- Eviction race: hardlink the cache tar into the job dir before tar -xf (pins the inode
against concurrent eviction) and re-fetch if it was evicted first.
Claude P2s: atomic config sidecar (tmp+rename) + tolerate torn parse; soften the LRU
comment (mtime = creation order); sweep orphaned *.tmp.* and .size on eviction.
+digest_key/ref_key unit tests.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(sandbox): P1 cross-fs cache staging (EXDEV), Dockerfile arch fail-fast
CI re-review (Claude + Codex P1): the eviction-race hardlink crosses filesystems in the
shipped deployments — the cache is its own volume (/tmp/windmill/cache) while the job dir
is on the container fs — so hard_link returns EXDEV (not NotFound) and every sandbox job
fails. Fall back to tokio::fs::copy on a non-NotFound link error; copy reads through the
source inode so it still survives a concurrent eviction.
Also: Dockerfiles fail fast with a clear error on an unsupported arch instead of building
a 404 crane URL; ref->digest file written via tmp+rename (no torn read under missing/never).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(sandbox): say 'oldest by creation time' not 'LRU' for cache eviction
Codex P2: the code evicts by tar creation time (cache hits don't touch mtime), so the
user-facing docs + instance-setting text shouldn't claim true LRU.
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Swap the final-stage nsjail dependencies (libprotobuf-dev,
libnl-route-3-dev) for their runtime-only counterparts (libprotobuf32,
libnl-route-3-200, libnl-3-200) across the root Dockerfile, DockerfileSlim,
and DockerfileSlimEe. nsjail is already compiled in the build stage, so the
final image only needs the runtime shared libraries. This shrinks the
images and reduces CVE scan noise from unused dev packages.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(oauth): support per-provider sandbox URLs in registry + instance settings
* fix(oauth): polish sandbox review nits (cc lookup, header label, ee ref)
* refactor(oauth): drop dead build_oauth_clients duplicate in windmill-oauth
* refactor(oauth): derive sandbox-capable provider list from registry
* chore(docker): copy oauth_connect.json into frontend build stage
* test(oauth): cover sandbox helpers (as_sandbox, canonical_name, resolve)
* chore: update ee-repo-ref to 9297d8f790346e6a6ad540c7bca1a67f91ec11a2
This commit updates the EE repository reference after PR #595 was merged in windmill-ee-private.
Previous ee-repo-ref: 3ab3eca9ac15ebab6db991e7964bc5e48ce21f42
New ee-repo-ref: 9297d8f790346e6a6ad540c7bca1a67f91ec11a2
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* export_datatable_schema
* Propose to fork the datatable on ws fork
* dump datatable
* Dockerfile
* Fix import_datatable_dump
* datatable schema fork works!
* Option to copy both schema and data
* Datatable fork behavior
* nit ui
* use psql instead
* remove fork_datatable route
* feat: add fork_pg_database and export_pg_schema routes with DB Manager UI
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* style: pluralize "schema" to "schemas" in DB Manager export/import UI
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add import mode select (schema only vs schema + data) to DB Manager import
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Select schema or schema+data when important database
* fix: prepend $res: prefix to resource paths in DB Manager import/export
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* style: dynamic import button label based on selected mode
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* nits
* feat: add warning alert when schema+data import mode is selected
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* nit hide on cloud hosted
* refactor: remove fork_behavior from datatable settings
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: split CreateWorkspace into layout wrapper and CreateWorkspaceInner
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: instantiate CreateWorkspaceInner in globalForkModal
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* nit icons
* Data table fork UI
* feat: pass per-datatable fork behaviors from UI to backend during workspace fork
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix fork overwriting all datatables
* UI nits
* custom instance db refactor
* custom instance db wizard btn for all in dropdown
* nit
* Delete custom instance database button
* Disable forking for resource datatables
* Big import buttons when db empty
* Revert "Disable forking for resource datatables"
This reverts commit 9561cc8fd4.
* feat: add non_diffable flag to resource table
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add resource-type datatable fork with CREATE DATABASE
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: tag forked datatables with nonDiffable and forkedFrom
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: diff datatable and ducklake settings individually on workspace merge
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: skip non_diffable resources and datatables in workspace diff
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: default datatable fork behavior to keep_original
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: make grant permissions non-fatal in instance datatable fork
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: make datatable and ducklake diffs visible in workspace comparison
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: remove datatable fork logic from workspace fork route
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: correct ahead/behind logic for datatable and ducklake diffs
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Revert "fix: correct ahead/behind logic for datatable and ducklake diffs"
This reverts commit 6b50884dc6.
* revert: remove datatable and ducklake settings diffing logic
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add datatable clone UI with step-by-step confirmation modal
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: extract datatable fork UI into ForkDatatableSection component
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* nit
* fix: run datatable cloning before workspace fork creation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* nit disable fork admins
* nit fix switching workspace prematurely
* fix: use source workspace for forkPgDatabase calls during fork
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: update forked workspace datatable settings after fork creation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add forked_from field to DataTable and set it for instance forks
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* nit onFinish
* fix: add forked_from to DataTableSettings OpenAPI schema
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: track datatable table DDL changes in workspace_diff
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Revert "feat: track datatable table DDL changes in workspace_diff"
This reverts commit 7526dd68b9.
* feat: add get_datatable_full_schema endpoint and snapshot schema on fork
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix duplicate migration key
* fix: set forked_from on datatable config for both instance and resource types
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* nits
* feat: drop forked databases on workspace deletion with confirmation UI
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: extract drop_forked_datatable_databases from delete_workspace
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: cast pg char columns to text in FK schema query
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: show dbname instead of resource type in fork deletion modal
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* ui nit
* refactor: extract drop_custom_instance_database into windmill-common
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add datatable schema diff section to merge UI
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* UI
* feat: add review drawer with YAML diff and SQL migration runner
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: use Monaco DiffEditor for YAML diff in review drawer
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* nit
* Revert "refactor: use Monaco DiffEditor for YAML diff in review drawer"
This reverts commit a86008ba4c.
* Revert "feat: add review drawer with YAML diff and SQL migration runner"
This reverts commit 0a0deb5ddb.
* feat: add review drawer with DiffEditor and SQL migration runner
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* ui nits
* fix: show diff between forked_from schema and changed side
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: re-fetch target live schema after migration for correct baseline
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* revert
* nit auto next
* feat: add confirmation modal before deploying migration to parent
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: handle missing columns/foreignKeys in schema conversion
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* nits
* refactor: use temp file on disk for pg_dump instead of in-memory string
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Don't replace postgres dbname
* fix: add validation to drop_custom_instance_database and use source db for CREATE/DROP
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: type DataTable.forked_from as DataTableForkedFrom struct
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: simplify fork_pg_database to take source + target_dbname
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* dead code
* feat: enforce schema_and_data admin-only and extract create_custom_instance_database
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: rename fork_pg_database to import_pg_database with source/target/override params
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* nit
* refactor: remove original_dbname/original_resource from forked_from, resolve from parent
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* nit
* fix: resolve forked dbname from fork workspace when dropping resource databases
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* nits
* fix: always clean up global_settings even if database doesn't exist
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: check datatable resource_type from config instead of URL prefix
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: wrap PG default value expressions in braces to prevent CAST quoting
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Revert "fix: wrap PG default value expressions in braces to prevent CAST quoting"
This reverts commit 77f5a2c4e8.
* refactor: reuse columnDefToTableEditorValuesColumn for default value handling
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: store raw API schema in forked_from to avoid double transformation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Revert "fix: store raw API schema in forked_from to avoid double transformation"
This reverts commit e326197a20.
* Revert "refactor: reuse columnDefToTableEditorValuesColumn for default value handling"
This reverts commit bd8f071d9f.
* fix: validate dbname with strict regex to prevent SQL injection
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix default value
* always validate dbname
* refactor: move get_datatable_full_schema structs and logic to query_builders.rs
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: split import_pg_database into create_pg_database + import_pg_database
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: extract drop_forked_datatable_databases into its own route
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: require admin when using $res: resource paths in import_pg_database
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: use UserDB for $res: resource access and restrict dbname creation
- resolve_pg_source_checked uses UserDB (row-level security) for $res: paths
- transform_json_unchecked is now pub(crate) to prevent misuse
- Non-superadmins can only create databases with wm_fork_ prefix
- datatable:// remains accessible to everyone
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: refuse to drop forked databases unless name starts with wm_fork_
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: remove resolve_pg_source, use resolve_pg_source_checked everywhere
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Fix permissions
* sqlx prepare
* compilation nits
* sqlx prepare
* sqlx prepare
* wrong route syntax
* fix: allow workspace owner to edit datatable config for fork setup
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Revert "fix: allow workspace owner to edit datatable config for fork setup"
This reverts commit ab683e637b.
* refactor: move datatable fork setup into create_workspace_fork backend
Instead of updating datatable settings from the frontend after fork
creation (which required admin/owner access), pass forked_datatables
info to create_workspace_fork and handle it atomically in the same
transaction. Removes applyPostForkDatatableUpdates from frontend.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: snapshot schema in backend during fork instead of frontend
The schema snapshot is now taken by the backend in apply_forked_datatable
via snapshot_datatable_schema, which connects to the parent workspace's
datatable and runs pg_get_full_schema. This removes the need for the
frontend to call getDatatableFullSchema and pass the schema through.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: use get_resource_value_interpolated_internal for $res: to resolve $var: references
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* nit
* sqlx prepare
* fix: add permission check to drop_forked_datatable_databases, validate dbnames, restrict temp file perms
- drop_forked_datatable_databases: same permission as delete_workspace
(fork owner or super admin)
- validate_dbname on target_dbname_override and ForkedDatatableInfo.new_dbname
- Enforce wm_fork_ prefix on forked datatable new_dbname
- DumpFile: set /tmp/windmill/ to 0700 and create files with 0600
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* nit CLI
* Rename to ws_specific
* sqlx prepare
* nit always validate dbname
* fix: include foreign keys in CREATE TABLE migration for added tables
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: detect nextval defaults and use SERIAL/BIGSERIAL types in CREATE TABLE
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Update frontend/src/lib/components/DBManagerDrawer.svelte
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Update backend/windmill-common/src/lib.rs
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Update backend/windmill-common/src/lib.rs
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* fix: sort foreign keys by constraint name for deterministic schema output
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* sqlx prepare
* rename migration to update timestamp
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* chore: split debug info for EE release builds
Generate line-table debug info in release builds and split it into
a separate .debug file. The shipped binary remains stripped (same
size as before), while the .debug files are attached to GitHub
releases for both amd64 and arm64 EE builds.
This enables production debugging with gdb/perf by copying the
matching .debug file into a running pod.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: extract debug info via separate Docker stage
Use a `FROM scratch AS debuginfo` stage instead of copying the .debug
file to the final image. This keeps the shipped image at exactly the
same size as before. CI extracts the .debug file using depot's
--target debuginfo with cache hits from the main build.
Also adds gnu_debuglink so gdb auto-discovers the debug file when
placed next to the binary.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat(cli): add consistent get/list/new subcommands for all item types
Make the CLI consistent so every item type (script, flow, app, resource,
resource-type, variable, schedule, folder, trigger) supports get/list/new
subcommands, enabling the CLI to be used as a full API client in bash
scripts with jq piping.
- Add --json flag to all list commands for machine-readable output
- Register explicit "list" subcommand alongside default action
- Add "get <path> [--json]" subcommand to fetch single items from API
- Rename "bootstrap" to "new" for script/flow, keep "bootstrap" as alias
- Add "new" subcommand for resource, resource-type, variable, schedule,
folder, and trigger to create local template YAML files
- Update cli-commands skill documentation for wmill init
- Add integration tests for all new commands
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
* feat: install wmill CLI in Docker images and use it for bash variable/resource access
- Install windmill-cli via bun in all Dockerfiles that include bun
- DockerfileCli: switch from node:slim to oven/bun:slim
- CLI: auto-configure from WM_WORKSPACE/WM_TOKEN/BASE_INTERNAL_URL env vars
as last-resort fallback when no workspace is configured
- Frontend: replace curl-based bash snippets with wmill variable/resource get
- Add backend integration tests for wmill CLI in bash scripts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(ci): install windmill-cli in backend test workflow
Ensures wmill is available on PATH for bash integration tests
that use `wmill variable get` and `wmill resource get`.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor(cli): replace @std/* Deno dependencies with Node.js equivalents
Replace @std/log with a lightweight custom logger (core/log.ts),
@std/path with node:path, and @std/yaml with the yaml npm package.
Also fix process hang on exit, add --node option to install_dev.sh,
and add missing hasRequiredPermissions to NpmProvider.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
* all
* all
* refactor(cli): replace @ayonli/jsext and @std/encoding with lightweight alternatives
Replace @ayonli/jsext (8.4MB) with tar-stream (32kB) for tar creation,
replace @std/encoding with Node.js Buffer.toString("hex"), and fix
@windmill-labs/shared-utils to use direct npm instead of JSR mirror.
Also resolve merge conflicts in sync.ts and fix pre-existing type errors.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(cli): use singleQuote YAML output and pass yamlOptions in gitsync pull
The yaml library defaults to double quotes, but the codebase (and tests)
expect single-quoted strings. Add singleQuote: true to yamlOptions and
pass yamlOptions to gitsync-settings pull writeFile calls.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
* all
* fix(cli): address code review feedback
- Install CLI from source in backend tests instead of npm
- Fix script bootstrap catch block to re-throw "File already exists"
- Add type-safe local variable after trigger kind validation
- Use created_by instead of policy.on_behalf_of for app get output
- Note --kind is recommended for faster trigger lookup in help text
- Document node symlink purpose in Dockerfiles
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(ci): use /usr/bin for wmill wrapper to ensure it's in PATH
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(ci): install wmill to ~/.local/bin to avoid permission issues
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* ci(backend): switch to Blacksmith runner and add cargo caching
- Switch from ubicloud-standard-16 to blacksmith-16vcpu-ubuntu-2404 for faster NVMe-backed builds
- Add stickydisk for cargo target directory (persistent NVMe cache across runs)
- Add cache for cargo registry and git dependencies
- Upgrade DuckDB FFI cache from actions/cache@v3 to useblacksmith/cache@v1
- Enable CARGO_INCREMENTAL=1 to benefit from persistent target cache
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix ci
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
The .cargo/config.toml uses mold linker for x86_64-linux (all profiles).
Install mold+clang in the main Dockerfile. For RHEL images where mold
isn't available, override via env vars to use the default linker.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: kafka trigger kerberos/gssapi support
* chore: update ee-repo-ref to bb32d562120dc34bbd8d659d92a0d4b8824b8c4c
This commit updates the EE repository reference after PR #405 was merged in windmill-ee-private.
Previous ee-repo-ref: 128c6549d4557895a362fb720f56afa54d6f566b
New ee-repo-ref: bb32d562120dc34bbd8d659d92a0d4b8824b8c4c
Automated by sync-ee-ref workflow.
* adding kafka-gssapi to all_sqlx_features
* ee ref
* ee ref
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: mssql integrated auth (kerberos/ntlm)
* install krb5 headers
* also make it work for windows
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: make nsjail available in all standard images (CE)
Include nsjail binary and runtime deps in the main Dockerfile and
DockerfileSlim so sandboxing is available out of the box. Flip
DISABLE_NSJAIL default to false so nsjail is enabled by default.
Remove DockerfileNsjail (now redundant) and the build_ee_nsjail CI job,
pointing publish_ecr_s3 at the base EE image instead. Add iptables to
DockerfileFullEe to preserve the functionality from the removed nsjail
image.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* revert: keep DISABLE_NSJAIL default as true
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: pin publish_ecr_s3 to exact commit hash
Add type=sha tag to build_ee so it pushes a commit-pinned image tag.
Restore git hash lookup in publish_ecr_s3 to reference the exact image
for that commit, avoiding race conditions with the mutable dev tag.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: publish_ecr_s3 depends on build_ee_full, uses release tag
Only publish to S3 on tag releases, extracting static frontend from the
ee-full image using the semver tag.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: remove stale windmill-ee-nsjail references, add nsjail to EE slim
The windmill-ee-nsjail image is no longer published since DockerfileNsjail
was deleted. Update all references to use the base EE image (which now
includes nsjail), remove redundant nsjail deps from DockerfileExtra, and
add nsjail build to DockerfileSlimEe for consistency with CE slim.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* test: add bun executor tests with minimal production code changes
- Add comprehensive bun job tests (bun_jobs.rs) covering:
- Basic execution, error handling, annotation modes
- Relative imports, deeply nested imports
- Dedicated worker protocol for both Node.js and Bun runtimes
- Builder tests for lockfile generation (import scanning)
- Minimize changes to bun_executor.rs by exposing:
- RELATIVE_BUN_LOADER and RELATIVE_BUN_BUILDER constants
- build_loader() function and LoaderMode enum
- BUN_DEDICATED_WORKER_ARGS constant
- generate_dedicated_worker_wrapper() function
- Tests call production code directly (build_loader) instead of
duplicating script generation logic
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* nit
* fix: reuse BUN_PATH/NODE_BIN_PATH from windmill-worker, add node to CI
- Tests now use exported BUN_PATH and NODE_BIN_PATH constants instead
of duplicating env var logic
- Update backend-test.yml:
- Upgrade bun to v1.3.8
- Add setup-node action
- Add NODE_BIN_PATH to cargo test command
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* add private repo test
* fix private repo test
* try fix again
* fix
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add cache-rt command and SYNC_CACHED_RT env variable for resource types
Add a new CLI command `cache-rt` that fetches resource types from the hub
and caches them locally. This command is run during Docker image build to
pre-populate the cache.
Add `SYNC_CACHED_RT` environment variable that, when set to true, syncs
cached resource types to the admins workspace's resource_type table on
server startup. The sync is incremental - it only updates resource types
that have changed.
Changes:
- Add HUB_RT_CACHE_DIR constant for resource type cache location
- Add cache-rt CLI command to fetch and cache resource types from hub
- Add sync_cached_resource_types() to sync cached types to database
- Update all Dockerfiles to run cache-rt during image build
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: parse schema string from hub into proper JSONB
The hub API returns schema as a JSON string that needs to be parsed
into a proper JSON value before inserting into the database.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* use tini with unshare to preserve signals (e.g oom)
* fix ci
* ci as nsjail
* simplify
* fix flaky go integration test
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Ruben Fiszel
hugocasa
Diego Imbert
Fred Reimer
Alexander Petric
Pyra
centdix