Files
Ruben Fiszel 343ce6e143 fix: derive a raw app's policy on deploy, and default an omitted execution_mode (#10733)
* fix: default an omitted app policy execution_mode to publisher

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs: drop stale comments claiming execution_mode is required

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: derive a raw app's policy on deploy instead of trusting the caller's

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore: pin the ee ref to the companion branch

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: vendor the raw-app policy derivation into the bundle job

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs: note the vendored raw-app policy bundle

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: derive the policy on a value-only raw-source update too

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: reject raw-app runnables whose shape yields an unusable grant

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: cache the new policy query and tighten raw-app runnable validation

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: let the policy bundle drift guard survive a CRLF checkout

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to 23431f5cf1d627051ded89111bbf2e301e9db456

This commit updates the EE repository reference after PR #729 was merged in windmill-ee-private.

Previous ee-repo-ref: 0bdf8818fa115ad6b0d14f3117a18e8a580cce4d

New ee-repo-ref: 23431f5cf1d627051ded89111bbf2e301e9db456

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
2026-08-18 01:52:10 +02:00

202 lines
5.5 KiB
YAML

name: CLI Tests
on:
workflow_dispatch:
push:
branches: [main]
paths:
- "cli/**"
- "windmill-yaml-validator/**"
- "backend/migrations/**"
- ".github/workflows/cli-tests.yml"
# The bundles cli/ vendors from the frontend: their drift guards live in
# cli/test but the edits that break them land here. The policy bundle
# inlines its imports too, so those sources belong in the filter.
- "frontend/src/lib/components/raw_apps/**"
- "frontend/src/lib/components/recording/**"
- "frontend/src/lib/components/apps/editor/commonAppUtils.ts"
- "frontend/src/lib/components/apps/inputType.ts"
pull_request:
branches: [main]
paths:
- "cli/**"
- "windmill-yaml-validator/**"
- "backend/migrations/**"
- ".github/workflows/cli-tests.yml"
# The bundles cli/ vendors from the frontend: their drift guards live in
# cli/test but the edits that break them land here. The policy bundle
# inlines its imports too, so those sources belong in the filter.
- "frontend/src/lib/components/raw_apps/**"
- "frontend/src/lib/components/recording/**"
- "frontend/src/lib/components/apps/editor/commonAppUtils.ts"
- "frontend/src/lib/components/apps/inputType.ts"
env:
CARGO_TERM_COLOR: always
SQLX_OFFLINE: true
jobs:
build-check:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Setup Bun
uses: oven-sh/setup-bun@v2
with:
bun-version: latest
- name: Generate Windmill client
working-directory: cli
run: ./gen_wm_client.sh
- name: Run CLI build
working-directory: cli
run: ./build.sh
test-linux:
runs-on: ubuntu-latest
services:
postgres:
image: postgres:16
env:
POSTGRES_USER: postgres
POSTGRES_PASSWORD: changeme
POSTGRES_DB: windmill
options: >-
--health-cmd pg_isready
--health-interval 10s
--health-timeout 5s
--health-retries 5
ports:
- 5432:5432
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Setup Rust toolchain
uses: actions-rust-lang/setup-rust-toolchain@v1
with:
cache: true
cache-workspaces: backend
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Setup Bun
uses: oven-sh/setup-bun@v2
with:
bun-version: latest
- name: Symlink Bun to /usr/bin/bun
run: sudo ln -sf $(which bun) /usr/bin/bun
- name: Symlink Node to /usr/bin/node
run: sudo ln -sf $(which node) /usr/bin/node
- name: Install dependencies
working-directory: cli
run: bun install
- name: Generate Windmill clients
working-directory: cli
run: |
./gen_wm_client.sh
./windmill-utils-internal/gen_wm_client.sh
- name: Run CLI tests
working-directory: cli
env:
DATABASE_URL: postgres://postgres:changeme@localhost:5432
CI_MINIMAL_FEATURES: "true"
run: bun test --timeout 120000 test/
test-windows:
runs-on: blacksmith-16vcpu-windows-2025
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Setup PostgreSQL
uses: ikalnytskyi/action-setup-postgres@v6
with:
username: postgres
password: changeme
database: windmill
port: 5432
- name: Setup Rust toolchain
uses: actions-rust-lang/setup-rust-toolchain@v1
with:
cache: true
cache-workspaces: backend
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Setup Bun
uses: oven-sh/setup-bun@v2
with:
bun-version: latest
- name: Get Bun and Node paths
id: runtime-paths
shell: pwsh
run: |
$bunPath = (Get-Command bun).Source
$nodePath = (Get-Command node).Source
echo "BUN_PATH=$bunPath" >> $env:GITHUB_OUTPUT
echo "NODE_BIN_PATH=$nodePath" >> $env:GITHUB_OUTPUT
- name: Install dependencies
working-directory: cli
run: bun install
- name: Generate Windmill clients
working-directory: cli
shell: bash
run: |
./gen_wm_client.sh
./windmill-utils-internal/gen_wm_client.sh
- name: Run CLI tests
working-directory: cli
shell: pwsh
env:
DATABASE_URL: postgres://postgres:changeme@localhost:5432
CI_MINIMAL_FEATURES: "true"
BUN_PATH: ${{ steps.runtime-paths.outputs.BUN_PATH }}
NODE_BIN_PATH: ${{ steps.runtime-paths.outputs.NODE_BIN_PATH }}
run: bun test --timeout 120000 test/
# Combined summary job for branch protection
test-summary:
runs-on: ubuntu-latest
needs: [build-check, test-linux, test-windows]
if: always()
steps:
- name: Check test results
run: |
if [ "${{ needs.build-check.result }}" != "success" ]; then
echo "Build check failed"
exit 1
fi
if [ "${{ needs.test-linux.result }}" != "success" ] || [ "${{ needs.test-windows.result }}" != "success" ]; then
echo "Some tests failed"
exit 1
fi
echo "All checks passed"