Files
windmill/backend/migrations/20261012213357_widen_variable_value.down.sql
T
4942149b05 feat: encrypt workspace secrets with AES-256-GCM (#11678)
* feat: encrypt workspace secrets with AES-256-GCM

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* docs: note the aead gate covers workers only and is one-way

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix: skip secrets the upgrade cannot store and clear its guard on panic

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix: start aead secret writes one release after read support

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae

This commit updates the EE repository reference after PR #869 was merged in windmill-ee-private.

Previous ee-repo-ref: 599eae0034b34c5e0d3d42df37cf18bbe01f9b49

New ee-repo-ref: 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae

Automated by sync-ee-ref workflow.

* feat: widen variable.value to fit AES-GCM ciphertext of the longest legacy secret

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix: refuse legacy secrets longer than 15000 chars so every secret can be upgraded

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix: cap legacy secrets at 15000 chars with a check constraint so every writer is covered

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
2026-10-13 08:27:13 +02:00

13 lines
422 B
SQL

DO $$
DECLARE
too_long BIGINT;
BEGIN
SELECT count(*) INTO too_long FROM variable WHERE length(value) > 15000;
IF too_long > 0 THEN
RAISE EXCEPTION 'cannot narrow variable.value to VARCHAR(15000): % row(s) are longer than 15000 characters', too_long;
END IF;
END $$;
ALTER TABLE variable DROP CONSTRAINT IF EXISTS variable_value_length;
ALTER TABLE variable ALTER COLUMN value TYPE VARCHAR(15000);