Skip to content

Commit 3322f6f

Browse files
d-csd-cs
authored
Merge branch 'main' into fix/sanitize-auth-failure-messages
2 parents 2bd1bf6 + f261ff2 commit 3322f6f

70 files changed

Lines changed: 5325 additions & 3325 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/publish-webapp.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,13 @@ on:
1414
type: string
1515
required: false
1616
default: ""
17+
outputs:
18+
version:
19+
description: The published image tag
20+
value: ${{ jobs.publish.outputs.version }}
21+
short_sha:
22+
description: Short commit SHA of the published build
23+
value: ${{ jobs.publish.outputs.short_sha }}
1724
secrets:
1825
SENTRY_AUTH_TOKEN:
1926
required: false

‎.github/workflows/publish.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,3 +96,14 @@ jobs:
9696
uses: ./.github/workflows/publish-worker-v4.yml
9797
with:
9898
image_tag: ${{ inputs.image_tag }}
99+
100+
# OS-level CVE scan of the image just published above. Report-only (writes to
101+
# the run summary); runs alongside the worker publishes and never blocks them.
102+
scan-webapp:
103+
needs: [publish-webapp]
104+
permissions:
105+
contents: read
106+
packages: read # pull the just-published image from GHCR
107+
uses: ./.github/workflows/trivy-image-webapp.yml
108+
with:
109+
image-ref: ghcr.io/triggerdotdev/trigger.dev:${{ needs.publish-webapp.outputs.version }}

‎.github/workflows/trivy-image-webapp.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: Trivy Image Scan (webapp)
2+
3+
# OS-level CVE scan of a published webapp image. Called by the publish pipeline
4+
# (publish.yml) to scan each build right after it's pushed to GHCR — so every
5+
# main build and every release is scanned, not rebuilt. Also runnable ad-hoc
6+
# via workflow_dispatch against any image ref.
7+
#
8+
# Report-only: writes a table to the run summary. No SARIF upload, no gate.
9+
# Library/dependency CVEs are covered by Dependabot, so this is restricted to
10+
# OS packages (`vuln-type: os`) to avoid double-reporting.
11+
12+
on:
13+
workflow_call:
14+
inputs:
15+
image-ref:
16+
description: "Full image ref to scan (e.g. ghcr.io/triggerdotdev/trigger.dev:main)"
17+
type: string
18+
required: true
19+
workflow_dispatch:
20+
inputs:
21+
image-ref:
22+
description: "Full image ref to scan"
23+
type: string
24+
required: false
25+
default: "ghcr.io/triggerdotdev/trigger.dev:main"
26+
27+
permissions: {}
28+
29+
concurrency:
30+
group: trivy-image-webapp-${{ inputs.image-ref }}
31+
cancel-in-progress: true
32+
33+
jobs:
34+
scan:
35+
name: Scan
36+
runs-on: ubuntu-latest
37+
permissions:
38+
contents: read
39+
packages: read # pull the image from GHCR
40+
steps:
41+
# Authenticate to GHCR so the scan also works for private images
42+
# (GITHUB_TOKEN isn't forwarded to Docker automatically). Harmless for
43+
# public images. Pairs with the packages: read permission above.
44+
- name: Log in to GitHub Container Registry
45+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
46+
with:
47+
registry: ghcr.io
48+
username: ${{ github.repository_owner }}
49+
password: ${{ secrets.GITHUB_TOKEN }}
50+
51+
- name: Run Trivy image scan
52+
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
53+
with:
54+
scan-type: image
55+
image-ref: ${{ inputs.image-ref }}
56+
# vuln-type maps to --pkg-types: OS packages only (library deps are
57+
# Dependabot's job). ignore-unfixed drops vulns with no patch yet.
58+
vuln-type: os
59+
ignore-unfixed: true
60+
severity: HIGH,CRITICAL
61+
format: table
62+
output: trivy-image-webapp.txt
63+
64+
- name: Job summary
65+
if: always()
66+
env:
67+
IMAGE_REF: ${{ inputs.image-ref }}
68+
run: |
69+
{
70+
echo "## Trivy Image Scan (webapp) — \`${IMAGE_REF}\`"
71+
echo '```'
72+
# GitHub step summary is capped at 1 MiB; truncate large reports.
73+
head -c 900000 trivy-image-webapp.txt 2>/dev/null || echo "(no report produced)"
74+
echo '```'
75+
} >> "$GITHUB_STEP_SUMMARY"

‎.github/workflows/unit-tests-internal.yml‎

Lines changed: 21 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,11 @@ jobs:
1616
name: "🧪 Unit Tests: Internal"
1717
runs-on: ubuntu-latest
1818
strategy:
19+
# one flaky shard shouldn't cancel its siblings - lets us re-run only the failed shard
20+
fail-fast: false
1921
matrix:
20-
shardIndex: [1, 2, 3, 4, 5, 6, 7, 8]
21-
shardTotal: [8]
22+
shardIndex: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12]
23+
shardTotal: [12]
2224
env:
2325
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
2426
SHARD_INDEX: ${{ matrix.shardIndex }}
@@ -53,7 +55,7 @@ jobs:
5355
- name: ⬇️ Checkout repo
5456
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5557
with:
56-
fetch-depth: 0
58+
fetch-depth: 1
5759
persist-credentials: false
5860

5961
- name: ⎔ Setup pnpm
@@ -81,12 +83,22 @@ jobs:
8183
- name: 🐳 Pre-pull testcontainer images
8284
if: ${{ env.DOCKERHUB_USERNAME }}
8385
run: |
86+
# Retry each pull - DockerHub registry timeouts are a recurring transient CI flake.
87+
pull() {
88+
for attempt in 1 2 3; do
89+
docker pull "$1" && return 0
90+
echo "::warning::docker pull $1 failed (attempt ${attempt}/3); retrying in 10s"
91+
sleep 10
92+
done
93+
echo "::error::docker pull $1 failed after 3 attempts"
94+
return 1
95+
}
8496
echo "Pre-pulling Docker images with authenticated session..."
85-
docker pull postgres:14
86-
docker pull clickhouse/clickhouse-server:25.4-alpine
87-
docker pull redis:7-alpine
88-
docker pull testcontainers/ryuk:0.11.0
89-
docker pull electricsql/electric:1.2.4
97+
pull postgres:14
98+
pull clickhouse/clickhouse-server:25.4-alpine
99+
pull redis:7.2
100+
pull testcontainers/ryuk:0.14.0
101+
pull electricsql/electric:1.2.4
90102
echo "Image pre-pull complete"
91103
92104
- name: 📥 Download deps
@@ -123,7 +135,7 @@ jobs:
123135
- name: ⬇️ Checkout repo
124136
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
125137
with:
126-
fetch-depth: 0
138+
fetch-depth: 1
127139
persist-credentials: false
128140

129141
- name: ⎔ Setup pnpm

‎.github/workflows/unit-tests-packages.yml‎

Lines changed: 21 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,11 @@ jobs:
1616
name: "🧪 Unit Tests: Packages"
1717
runs-on: ubuntu-latest
1818
strategy:
19+
# one flaky shard shouldn't cancel its siblings - lets us re-run only the failed shard
20+
fail-fast: false
1921
matrix:
20-
shardIndex: [1]
21-
shardTotal: [1]
22+
shardIndex: [1, 2, 3]
23+
shardTotal: [3]
2224
env:
2325
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
2426
SHARD_INDEX: ${{ matrix.shardIndex }}
@@ -53,7 +55,7 @@ jobs:
5355
- name: ⬇️ Checkout repo
5456
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5557
with:
56-
fetch-depth: 0
58+
fetch-depth: 1
5759
persist-credentials: false
5860

5961
- name: ⎔ Setup pnpm
@@ -81,12 +83,22 @@ jobs:
8183
- name: 🐳 Pre-pull testcontainer images
8284
if: ${{ env.DOCKERHUB_USERNAME }}
8385
run: |
86+
# Retry each pull - DockerHub registry timeouts are a recurring transient CI flake.
87+
pull() {
88+
for attempt in 1 2 3; do
89+
docker pull "$1" && return 0
90+
echo "::warning::docker pull $1 failed (attempt ${attempt}/3); retrying in 10s"
91+
sleep 10
92+
done
93+
echo "::error::docker pull $1 failed after 3 attempts"
94+
return 1
95+
}
8496
echo "Pre-pulling Docker images with authenticated session..."
85-
docker pull postgres:14
86-
docker pull clickhouse/clickhouse-server:25.4-alpine
87-
docker pull redis:7-alpine
88-
docker pull testcontainers/ryuk:0.11.0
89-
docker pull electricsql/electric:1.2.4
97+
pull postgres:14
98+
pull clickhouse/clickhouse-server:25.4-alpine
99+
pull redis:7.2
100+
pull testcontainers/ryuk:0.14.0
101+
pull electricsql/electric:1.2.4
90102
echo "Image pre-pull complete"
91103
92104
- name: 📥 Download deps
@@ -123,7 +135,7 @@ jobs:
123135
- name: ⬇️ Checkout repo
124136
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
125137
with:
126-
fetch-depth: 0
138+
fetch-depth: 1
127139
persist-credentials: false
128140

129141
- name: ⎔ Setup pnpm

‎.github/workflows/unit-tests-webapp.yml‎

Lines changed: 22 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,11 @@ jobs:
1616
name: "🧪 Unit Tests: Webapp"
1717
runs-on: ubuntu-latest
1818
strategy:
19+
# one flaky shard shouldn't cancel its siblings - lets us re-run only the failed shard
20+
fail-fast: false
1921
matrix:
20-
shardIndex: [1, 2, 3, 4, 5, 6, 7, 8]
21-
shardTotal: [8]
22+
shardIndex: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]
23+
shardTotal: [10]
2224
env:
2325
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
2426
SHARD_INDEX: ${{ matrix.shardIndex }}
@@ -53,7 +55,7 @@ jobs:
5355
- name: ⬇️ Checkout repo
5456
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5557
with:
56-
fetch-depth: 0
58+
fetch-depth: 1
5759
persist-credentials: false
5860

5961
- name: ⎔ Setup pnpm
@@ -81,12 +83,23 @@ jobs:
8183
- name: 🐳 Pre-pull testcontainer images
8284
if: ${{ env.DOCKERHUB_USERNAME }}
8385
run: |
86+
# Retry each pull - DockerHub registry timeouts are a recurring transient CI flake.
87+
pull() {
88+
for attempt in 1 2 3; do
89+
docker pull "$1" && return 0
90+
echo "::warning::docker pull $1 failed (attempt ${attempt}/3); retrying in 10s"
91+
sleep 10
92+
done
93+
echo "::error::docker pull $1 failed after 3 attempts"
94+
return 1
95+
}
8496
echo "Pre-pulling Docker images with authenticated session..."
85-
docker pull postgres:14
86-
docker pull clickhouse/clickhouse-server:25.4-alpine
87-
docker pull redis:7-alpine
88-
docker pull testcontainers/ryuk:0.11.0
89-
docker pull electricsql/electric:1.2.4
97+
pull postgres:14
98+
pull clickhouse/clickhouse-server:25.4-alpine
99+
pull redis:7.2
100+
pull testcontainers/ryuk:0.14.0
101+
pull electricsql/electric:1.2.4
102+
pull minio/minio:latest
90103
echo "Image pre-pull complete"
91104
92105
- name: 📥 Download deps
@@ -131,7 +144,7 @@ jobs:
131144
- name: ⬇️ Checkout repo
132145
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
133146
with:
134-
fetch-depth: 0
147+
fetch-depth: 1
135148
persist-credentials: false
136149

137150
- name: ⎔ Setup pnpm

‎.gitignore‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,4 +72,6 @@ apps/**/public/build
7272
.mcp.log
7373
.mcp.json
7474
.cursor/debug.log
75-
ailogger-output.log
75+
ailogger-output.log
76+
# per-package vitest timing capture (transient; merged into root test-timings.json)
77+
.vitest-timing.json

‎.server-changes/trace-export-formats.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
area: webapp
3+
type: feature
4+
---
5+
6+
Export a run's full trace from the run page as a downloadable Log, Markdown, or JSON Lines file, or copy it to the clipboard for pasting into an AI assistant. The export streams straight from the store, so even very large runs export reliably.

0 commit comments

Comments
 (0)