Update the pinned Rust toolchain from 1.93.0 to 1.97.0 (latest stable,
released 2026-07-09) across the worker/server build Dockerfiles
(Dockerfile, docker/DockerfileFull, docker/DockerfileFullEe) and all CI
workflows that pin a toolchain.
Verified the backend compiles cleanly with 1.97.0 under `-D warnings`
(the default RUSTFLAGS used by actions-rust-lang/setup-rust-toolchain).
Fixes WIN-2155
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ci): gate auto-review on non-fork PR not author_association (skips private members)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ci): authorize private org members for command workflows via app-token gate
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* ci for broken links + fix broken links
* ci: replace expiring-PAT org membership gate with author_association
The shared check-org-membership.yml reusable workflow authenticated to the
GitHub API with the ORG_ACCESS_TOKEN PAT to confirm org membership. That PAT
expired ~1 year after issuance, so the API could no longer see private org
members and check-membership emitted is_member=false — silently skipping every
auto-review, command-triggered review, /ai, /plan, and git-command job while
still reporting success.
Gate on the event payload's author_association (OWNER/MEMBER/COLLABORATOR)
instead, which comes from the built-in GITHUB_TOKEN and never expires. The
trusted internal bot and existing draft/fork/command guards are preserved; the
workflow_call paths stay open as trusted upstream. Deletes the now-unused
reusable workflow.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The /updatesqlx workflow was checking out windmill-ee-private at its
default branch HEAD, ignoring the specific commit pinned in
backend/ee-repo-ref.txt. This could cause sqlx metadata to be generated
against a mismatched EE version.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: mssql integrated auth (kerberos/ntlm)
* install krb5 headers
* also make it work for windows
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* add logs
* add logs search + better load tools logic
* use json
* nit
* only add for ee
* nit
* filter out search after first fail
* Revert "filter out search after first fail"
This reverts commit 2abf0db6e5a1be84e67d1a153281b74d448cb5cd.
* call endpoint to know if it is available
* cleaning
* Apply suggestion from @graphite-app[bot]
Co-authored-by: graphite-app[bot] <96075541+graphite-app[bot]@users.noreply.github.com>
* fix
* draft
* call enabled endpoint
* not workspaced
* remove from system prompt if not enterprise
* fix eeref command
* update ee ref
---------
Co-authored-by: graphite-app[bot] <96075541+graphite-app[bot]@users.noreply.github.com>
Ruben Fiszel
Diego Imbert
centdix
Alexander Petric