* fix: remove installation requirement from trusted bot check
The installation object is not present in the webhook payload when
GitHub Apps add labels via pull_request_target events. This caused
graphite-app[bot] to fail the authorization check and fall through
to the human permission check, which doesn't work for bots.
The fix removes the installation requirement and relies on:
- sender.type === 'Bot'
- sender.login matching the trusted bot list
This is secure because the sender fields come from GitHub's webhook
payload and cannot be forged by contributors.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* chore: add extra logging about sender type
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* chore: remove senderId from logging
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Update run-ci.yml
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-05 15:19:39 +00:00
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This ensures consistent cache keys between the Build Web App job and E2E
shards by running yarn prisma generate before generating the cache key.
The issue was that packages/prisma/enums/index.ts is:
1. Generated by yarn prisma generate
2. In .gitignore (not committed to git)
3. Included in the SOURCE_HASH (matches packages/**/**.[jt]s)
4. NOT excluded from the hash
E2E jobs already run yarn prisma generate before cache-build, but the
Build Web App job did not, causing different cache keys in the same
workflow run.
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-04 21:38:22 -03:00
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: detach yarn prisma generate from yarn-install action
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add run-prisma-generate input for backward compatibility
The yarn-install action now has a run-prisma-generate input that defaults
to true for backward compatibility. This ensures CI works correctly since
workflow files are pulled from the base branch (main) while actions are
pulled from the PR branch.
Workflows that have explicit yarn prisma generate steps now set
run-prisma-generate: false to avoid running it twice after merge.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: completely remove prisma generate from yarn-install action
Remove all prisma-related code from the yarn-install action:
- Remove the run-prisma-generate input parameter
- Remove the Generate Prisma client step
Remove explicit yarn prisma generate steps from all workflow files.
Prisma generation is now handled by the postinstall script in package.json
which runs 'turbo run post-install' after yarn install. This triggers
@calcom/prisma#post-install which runs 'prisma generate && prisma format'.
This makes the yarn-install action have no knowledge of Prisma at all,
as requested.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add generic post-install step to ensure generated files are up-to-date
When all caches are hit, yarn install completes quickly without running
the postinstall script. This means generated files (like Prisma types)
may not be created.
Add a generic 'turbo run post-install' step that runs after yarn install
to ensure all post-install tasks complete regardless of cache state.
This keeps the action from having Prisma-specific knowledge while
ensuring the post-install pipeline runs.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: remove post-install step from yarn-install action
Remove the turbo run post-install step as requested. The yarn-install
action now only handles yarn install with caching, with no knowledge
of post-install tasks or Prisma generation.
Let CI show what fails without explicit post-install handling.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Add back Prisma schema loaded from schema.prisma
✔ Generated Prisma Client (6.16.1) to ./generated/prisma in 442ms
✔ Generated Zod Prisma Types to ./zod in 1.43s
✔ Generated Kysely types (2.2.0) to ./../kysely in 271ms
✔ Generated Prisma Enum Generator to ./enums/index.ts in 176ms where needed
* Adding Prisma schema loaded from schema.prisma
✔ Generated Prisma Client (6.16.1) to ./generated/prisma in 451ms
✔ Generated Zod Prisma Types to ./zod in 1.40s
✔ Generated Kysely types (2.2.0) to ./../kysely in 271ms
✔ Generated Prisma Enum Generator to ./enums/index.ts in 205ms where needed for E2E
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-01 23:00:56 -03:00
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: upgrade Vitest to 4.0.16 and Vite to 6.4.1
- Update vitest from 2.1.9 to 4.0.16
- Update @vitest/ui from 2.1.9 to 4.0.16
- Update vitest-fetch-mock from 0.3.0 to 0.4.5
- Update vitest-mock-extended from 2.0.2 to 3.1.0
- Update vite from 4.5.14/5.4.21 to 6.4.1 across all packages
- Update @vitejs/plugin-react to 5.1.2
- Update @vitejs/plugin-react-swc to 4.2.2
- Update @vitejs/plugin-basic-ssl to 2.1.0
- Update vite-plugin-dts to 4.5.4
- Rename vitest.config.ts to vitest.config.mts for ESM compatibility
- Add globals: true to vitest config
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: address Vitest 4.0 and Vite 6 breaking changes
- Convert arrow function mockImplementation patterns to regular functions
(Vitest 4.0 breaking change: arrow functions can't be constructor mocks)
- Fix CSS imports with ?inline suffix for Vite 6 compatibility
- Add biome override to disable useArrowFunction rule for test files
- Fix syntax errors in test files introduced by regex replacements
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: fix remaining Vitest 4.0 constructor mock patterns
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: fix more Vitest 4.0 constructor mock patterns and exclude API v2 spec files
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: convert more arrow function mocks to regular functions for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: convert more arrow function mocks to regular functions for Vitest 4.0
- Fix CrmService.integration.test.ts jsforce.Connection mock
- Fix RetellSDKClient.test.ts Retell mock
- Fix RetellAIService.test.ts CreditService mocks
- Fix GoogleCalendarSubscriptionAdapter.test.ts CalendarAuth mock
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: convert Google Calendar and OAuthManager arrow function mocks for Vitest 4.0
- Fix googleapis.ts Calendar, OAuth2Client, and JWT mocks
- Fix utils.ts JWT mock
- Fix OAuthManager.ts defaultMockOAuthManager mock
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add React plugin, jsdom environment, and fix more constructor mocks for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: convert HostRepository PrismaClient mock to regular function for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add useOrgBranding mock to React component tests for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: update TestFunction type for Vitest 4.0 compatibility
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: convert listBookingReports constructor mocks to regular functions for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: convert UserRepository constructor mock to regular function for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: convert OrganizationPaymentService constructor mock to regular function for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: convert more constructor mocks to regular functions for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add apps/web path aliases to vitest config
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: fix test issues for Vitest 4.0 compatibility
- Fix Response constructor 204 status code issue in testUtils.ts
- Fix FeaturesRepository mock persistence in handleNotificationWhenNoSlots.test.ts
- Add @vitest-environment node directive to formSubmissionUtils.test.ts
- Fix document.querySelector mock in embed.test.ts
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: clear EventManager spy between tests for Vitest 4.0 compatibility
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: update TeamRepository mock pattern for Vitest 4.0 compatibility
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: convert RoutingFormResponseRepository mock to regular function for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: convert more constructor mocks to regular functions for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: fix mock reset and spy clear issues for Vitest 4.0
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: fix remaining test failures for Vitest 4.0 upgrade
- Fix booking-validations.test.ts: convert UserRepository mock to regular function
- Fix route.test.ts: update 500 error test to mock ImageResponse instead of fetch
- Fix users-public-view.test.tsx: add missing mocks for getOrgFullOrigin and useRouterQuery
- Add @calcom/web path alias to vitest config
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add vitest-mocks for generated files that don't exist in CI
- Add svg-hashes.json mock for route.test.ts
- Add tailwind.generated.css mock for embed.test.ts
- Update vitest config to use mock files
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: update vitest config aliases for CI compatibility
- Use array format for aliases to ensure proper ordering
- Add @calcom/platform-constants alias to resolve from source
- Add @calcom/embed-react alias to resolve from source
- Ensure svg-hashes.json mock alias is matched before @calcom/web
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add @calcom/embed-snippet alias for CI compatibility
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* Fix wrong test
* fix: migrate from CLI flags to VITEST_MODE env var for Vitest 4.0
Vitest 4.0 no longer allows custom CLI flags like --packaged-embed-tests-only.
This change migrates to using VITEST_MODE environment variable instead:
- VITEST_MODE=packaged-embed for packaged embed tests
- VITEST_MODE=integration for integration tests
- VITEST_MODE=timezone for timezone-dependent tests
Updated vitest.config.mts to handle mode-based include/exclude patterns.
Updated CI workflows and package scripts to use the new env var approach.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: return default include pattern instead of undefined in vitest config
The getTestInclude() function was returning undefined for the default case,
but Vitest 4.0 expects an array. This caused 'resolved.include is not iterable'
error in CI.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: always set INTEGRATION_TEST_MODE for jsdom environment
The getBookingFields.ts file checks for INTEGRATION_TEST_MODE to allow
server-side imports in the jsdom environment. Without this, tests fail
with 'getBookingFields must not be imported on the client side' error.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: support legacy CLI flags for backwards compatibility with main workflow
The CI runs workflows from main branch, which uses the old CLI flag approach
(yarn test -- --integrationTestsOnly). This commit adds backwards compatibility
by checking both VITEST_MODE env var and process.argv for the legacy flags.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-01 18:16:10 -03:00
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* ci: skip yarn-install in setup-db when DB cache exists
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* ci: skip entire setup-db job when DB cache exists
This saves ~35-40s per workflow run by:
1. Adding DB cache lookup to prepare job (lookup-only mode)
2. Skipping the entire setup-db job when cache exists (avoids postgres container startup)
3. Keeping the yarn-install skip in setup-db.yml as a fallback
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* ci: simplify DB cache key and skip yarn-install on cache hit
- Remove commit SHA and PR number from cache key for better reuse
- Cache key now only depends on prisma schema/migrations hash
- Skip yarn-install in setup-db when DB cache exists (saves ~17s)
- Revert changes to pr.yml required job logic
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* ci: move DB cache lookup to prepare step and skip cache-db on hit
- Move cache lookup to pr.yml prepare step for early detection
- Pass db-cache-hit output to setup-db.yml as input
- Skip yarn-install and cache-db action when cache exists
- setup-db job still runs and reports success (no required job changes)
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* ci: skip container initialization when DB cache exists
- Rename setup-db to setup-db-seed (only runs on cache miss)
- Add lightweight setup-db wrapper job that always returns success
- When cache exists: setup-db-seed is skipped, setup-db returns success
- When cache miss: setup-db-seed runs with postgres, setup-db checks result
- This avoids postgres container startup (~17-20s) when cache exists
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* ci: add cache-db-key action for consistent cache key generation
- Create cache-db-key action to generate DB cache key in one place
- Update cache-db action to use cache-db-key for consistency
- Update pr.yml prepare step to use cache-db-key for lookup
- This ensures the lookup key always matches the actual cache key
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* ci: remove runner.os from cache-db-key
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* ci: simplify setup-db by removing wrapper job
- Remove setup-db wrapper job and rename setup-db-seed back to setup-db
- setup-db is now skipped when cache exists (no container startup)
- Update required check to allow skipped for setup-db when cache hit
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* ci: revert to two-job pattern for setup-db
- setup-db-seed: only runs on cache miss (has postgres container)
- setup-db: wrapper that always runs and reports success
- This ensures downstream jobs (Tests, Production builds) are not skipped
- Reverts required check to simple setup-db.result != 'success'
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* ci: single setup-db job with conditional steps on cache hit
- Removed two-job pattern (setup-db-seed + wrapper)
- Single setup-db job calls setup-db.yml reusable workflow
- Pass DB_CACHE_HIT input from prepare job's db-cache-hit output
- Skip yarn-install and cache-db steps when cache hit (~17s savings)
- Container still starts (will optimize in follow-up)
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2025-12-31 19:47:31 +05:30
Anik Dhabal BabuGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* perf: increase E2E test shards from 4 to 6 for faster CI
Increase the number of parallel E2E test shards from 4 to 6 to reduce
overall CI wall-clock time. Each shard runs on a separate 4-vCPU runner
with 4 workers, so adding more shards increases total parallelism.
This should reduce E2E test time from ~3 minutes per shard to ~2 minutes
per shard by distributing tests across more parallel jobs.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* update
* fix
* update
* readd
* final update
* fix flake
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2025-12-31 10:19:09 -03:00
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* perf: optimize postgres health check in e2e workflow
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* perf: optimize postgres health check in all e2e workflows
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- Remove pull_request_review trigger
- Add trust-check job to validate PR authors before running CI
- Create run-ci.yml workflow for maintainer approval via label
- Use workflow run timestamp to prevent backdating attacks
- Add per_page and in-progress checks for robustness
2025-12-31 00:16:52 -03:00
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix(ci): skip yarn install in deps job when cache is hit
The Install Dependencies / Yarn install & cache step in pr.yml is primarily
for populating the cache when nothing is cached. When cache keys are found,
we can skip the actual yarn install and let the workflow carry on quickly.
This adds a skip-install-if-cache-hit parameter to the yarn-install action
that allows skipping the install when node_modules cache is hit. This is
enabled for the deps job in yarn-install.yml but not for other jobs that
actually need node_modules for their work.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(ci): also skip playwright install in deps job when cache is hit
Extends the skip-install-if-cache-hit parameter to the yarn-playwright-install
action as well, so both yarn install and playwright install are skipped in the
deps job when their respective caches are hit.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(ci): use lookup-only cache check to avoid downloading 1.2GB
When skip-install-if-cache-hit is true, use actions/cache/restore@v4 with
lookup-only: true to check if caches exist without downloading them. This
avoids downloading ~1.2GB of cache data when we just want to verify caches
exist in the deps job.
The flow is now:
1. If skip-install-if-cache-hit is true, run lookup-only checks for all caches
2. If all caches hit, skip the entire restore + install flow (no downloads)
3. If any cache misses, fall back to normal restore + install + save behavior
This optimization only applies when skip-install-if-cache-hit is set to true,
so other jobs that need node_modules continue to work normally.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Apply suggestion from @keithwillcode
* Apply suggestion from @keithwillcode
* Apply suggestion from @keithwillcode
* Apply suggestion from @keithwillcode
* fix(ci): address @cubic-dev-ai feedback on cache conditions
1. yarn-install: Add 'all-caches-check' step to compute whether all three
caches hit (not just node_modules). This ensures we only bail out when
everything is cached, matching the PR description.
2. yarn-playwright-install: Fix backward compatibility for install step.
In default mode, check playwright-cache.outputs.cache-hit (the restore step).
In skip mode, check playwright-cache-check.outputs.cache-hit (lookup-only).
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2025-12-30 12:29:33 -03:00
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: Delete cache-build cache entries on PR close
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: Extract cache-build key generation into reusable action
- Create .github/actions/cache-build-key to generate cache keys
- Update cache-build action to use the shared key action
- Update delete workflow to use the shared key action
- Checkout PR head SHA in delete workflow for correct hash computation
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: Remove PR head SHA checkout per review feedback
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: Use prefix-based cache deletion for simpler cleanup
- Use useblacksmith/cache-delete prefix mode to delete all caches matching branch
- Remove dependency on cache-build-key action for deletion
- No checkout needed since we're just using the branch name as prefix
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: Simplify cache key by removing Linux and node version segments
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2025-12-30 11:24:33 -03:00
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix(ci): use GitHub App token for team membership check
The default GITHUB_TOKEN doesn't have org-level permissions to query
team membership via the teams.getMembershipForUserInOrg API. This causes
the API to return 404 even for valid team members, making the trust check
incorrectly fail for core team members.
This change generates a short-lived GitHub App token with org-level access
to properly verify team membership.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix(ci): use getCollaboratorPermissionLevel for trust check
Replace the team membership check (teams.getMembershipForUserInOrg) with
getCollaboratorPermissionLevel which works with the default GITHUB_TOKEN.
This approach:
- Checks if users have write/maintain/admin access to the repo
- Works without requiring a GitHub App token with org-level permissions
- Is semantically correct: if someone can push to the repo, they're trusted
The previous approach using teams.getMembershipForUserInOrg required
org-level permissions that the default GITHUB_TOKEN doesn't have,
causing 404 errors even for valid team members.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Apply suggestion from @keithwillcode
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This change adds a trust-check job that gates CI for external contributors:
- Trusted contributors (OWNER, MEMBER, COLLABORATOR) can run CI immediately
- External contributors require approval from a core team member (write access or higher)
- Approval must be for the current commit SHA (stale approvals are ignored)
- Added pull_request_review trigger so CI runs when approval is given
- The required job now fails with a clear message for untrusted PRs
Co-authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
Co-authored-by: Pedro Castro <pedro@cal.com>
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
2025-12-29 22:31:11 -03:00
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add PUSH_IMAGE boolean input to release-docker workflow
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: simplify push-image expression to always return string
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: make RELEASE_TAG input work for manual workflow triggers
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: add postMessage listener to capture __iframeReady events early
This fixes a race condition in the embed E2E tests where the __iframeReady
event could fire before the Cal.ns[namespace] API was ready to receive it.
The fix adds a window.message listener immediately in the addInitScript that
captures __iframeReady events directly from postMessage, which doesn't depend
on the namespace API being ready. This ensures window.iframeReady is set
even if the event fires before the Cal API listener is attached.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Revert "fix: add postMessage listener to capture __iframeReady events early"
This reverts commit fdd02fcf1e5286f2b3b36a9f4c9889b269720845.
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: add artifact handling for API v2 E2E tests
- Add jest-junit reporter to generate JUnit XML test results
- Update workflow to upload from correct path (apps/api/v2/test-results)
- Add if-no-files-found: ignore and retention-days: 30 for consistency
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Apply suggestion from @keithwillcode
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2025-12-29 02:22:38 -03:00
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: migrate GitHub workflows from Buildjet to Blacksmith
- Replace buildjet-*vcpu-ubuntu-2204 runners with blacksmith-*vcpu-ubuntu-2204
- Replace buildjet/cache@v4 with actions/cache@v4
- Replace buildjet/setup-node@v4 with actions/setup-node@v4
- Replace buildjet/cache-delete@v1 with useblacksmith/cache-delete@v1
- Rename delete-buildjet-cache.yml to delete-blacksmith-cache.yml
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* chore: bump Blacksmith runners to Ubuntu 24.04
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Reduce 16vcpu to 4vcpu for the API v2 E2E
* Remove 8vcpu usage
* chore: switch Blacksmith runners to ARM architecture
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* chore: switch Blacksmith runners back to AMD (remove -arm suffix)
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: improve test cleanup to cover all bookings including reassignment-created ones
- Changed afterEach cleanup to find all bookings by eventTypeId instead of tracking bookingIds
- This ensures bookings created indirectly by managedEventManualReassignment are also cleaned up
- Removed problematic prefix-based deleteMany calls that could affect parallel tests
- Fixes idempotencyKey collision errors on high-parallelism CI runners
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: improve icons screenshot test stability with deviceScaleFactor and increased threshold
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: cap Playwright workers to 4 to match vCPU allocation on Blacksmith runners
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: Add dedicated setup-db job to eliminate cache race condition
- Create new setup-db.yml workflow that runs cache-db action
- Update pr.yml to add setup-db job that runs before all E2E jobs
- Update integration-test, e2e, e2e-api-v2, e2e-app-store, e2e-embed,
and e2e-embed-react jobs to depend on setup-db instead of build-api-v1
- Add setup-db to required job needs list and result check
This eliminates the race condition where multiple jobs could try to
write to the same database cache simultaneously.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: Remove DB parts from api-v1-production-build.yml
The database setup is now handled by the dedicated setup-db job,
so the postgres service and cache-db action are no longer needed
in the API v1 build workflow.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Apply suggestion from @keithwillcode
* Made integration tests dependency consistent
* refactor: Remove unnecessary env vars from setup-db.yml
Only keep the env vars needed for database setup:
- CALENDSO_ENCRYPTION_KEY (for db-seed)
- DATABASE_URL / DATABASE_DIRECT_URL (for database connection)
- TURBO_TOKEN / TURBO_TEAM (for turbo caching)
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: Add back E2E_TEST_CALCOM_QA_* env vars needed by db-seed
These env vars are used by scripts/seed.ts to create the QA user
with Google Calendar credentials during database seeding.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: Restore postgres service and cache-db to api-v1-production-build.yml
The API v1 build still needs a database to run properly. Restored the
postgres service and cache-db action, and added dependency on setup-db
so it waits for the database cache to be created first.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* E2E for API v2 no longer waiting on API v2 build
* Reordering the jobs by dependencies
* add GOOGLE_API_CREDENTIALS env var to setup db
* Added back all env vars to setup-db
* fix: Include commit SHA in cache-db key to invalidate cache on new commits
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: Strip back setup-db.yml env vars to minimal set needed for db-seed
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix
* Refactor PR workflow to use pull_request_target
Updated the GitHub Actions workflow
* update
* Update PR workflow trigger and permissions
Changed event trigger from 'pull_request_target' to 'pull_request' and removed branch restrictions.
* test
* revert
2025-12-22 19:31:43 +00:00
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
When any label is added to a PR, the workflow was re-running and causing issues
because the E2E check would fail for non-ready-for-e2e labels.
This change removes 'labeled' from the trigger types entirely. Users can now:
1. Add the ready-for-e2e label to a PR
2. Click 'Re-run all jobs' in GitHub Actions UI to trigger E2E tests
This is simpler and avoids the complexity of trying to maintain previous check
status when non-E2E labels are added.
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: allow required check to pass when E2E tests are skipped due to missing label
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* revert: remove unnecessary integration-test condition change
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* chore: trigger fresh CI run
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* all should pass to allow merge
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* Isolate companion build
* Fix typo
* Update .github/workflows/pr.yml
* Improve branch protection
* integration tests missing
* fix typo
* fix to only have required
* fix to only have required
* fix to only have required
* adjust to keep as before
---------
Co-authored-by: Peer Richelsen <peeroke@gmail.com>
* chore: Change atoms build command to build-npm to avoid turbo compilations
* Updated turbo.json atoms#build reference
* Updated atoms production build for CI
* chore: replace GH_ACCESS_TOKEN with GitHub App token
Replace personal access token (GH_ACCESS_TOKEN) with GitHub App token
generation using actions/create-github-app-token@v1 for improved security.
Updated workflows:
- draft-release.yml
- post-release.yml
- cleanup.yml
- cleanup-report.yml
- publish-report.yml
- i18n.yml
Benefits:
- Short-lived tokens (1 hour) vs long-lived PATs
- Fine-grained, scoped permissions
- Not tied to individual user accounts
- Better audit trail
Required setup:
- Create a GitHub App with contents:write permission
- Install the app on calcom/cal.com and calcom/test-results-2
- Add RELEASE_APP_ID and RELEASE_APP_PRIVATE_KEY secrets
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* chore: rename secrets to CI_CAL_APP_ID and CI_CAL_APP_PRIVATE_KEY
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* chore: use reusable workflow from calcom-ci-secrets for token generation
This isolates the GitHub App private key in a separate repository,
ensuring that compromised actions in cal.com can only access short-lived
tokens, not the key itself.
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* chore: use explicit secret passing instead of secrets: inherit
Only pass the two required secrets (CI_CAL_APP_ID, CI_CAL_APP_PRIVATE_KEY)
to the reusable workflow instead of inheriting all secrets.
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* chore: remove secrets block - using environment secrets from calcom-ci-secrets
Secrets are now loaded from the ci-github-app environment in
calcom-ci-secrets, so cal.com workflows no longer need to pass them.
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* chore: revert to explicit secret passing
Environment secrets in cross-repo reusable workflows don't work as expected.
Secrets must be passed explicitly from the caller repository.
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* chore: generate GitHub App token directly in workflows
Remove dependency on calcom-ci-secrets reusable workflow.
Token generation is now inline using actions/create-github-app-token
pinned to SHA 7e473efe3cb98aa54f8d4bac15400b15fad77d94 (v2.2.0).
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
