* refactor: move WebWrapper files from packages/platform to apps/web/modules
Move the following WebWrapper files to their appropriate locations in apps/web/modules:
- EventTypeWebWrapper and related tab wrappers to apps/web/modules/event-types/components/wrappers/
- BookerWebWrapper to apps/web/modules/bookings/components/
- ConferencingAppsViewWebWrapper to apps/web/modules/apps/components/
- SelectedCalendarsSettingsWebWrapper to apps/web/modules/calendars/components/
- AddMembersWithSwitchWebWrapper to apps/web/modules/event-types/components/
This reduces the number of files in packages/platform that import from @calcom/web,
improving the separation between platform and web-specific code.
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix: move web-specific hooks to apps/web and update imports
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* fix
* fix
* fix
* fix
* fix
* fix
* fix
* fix
* add back comments
* fix
* fix
* fix
* fix
* fix: correct relative import paths in moved WebWrapper files
Co-Authored-By: benny@cal.com <sldisek783@gmail.com>
* final
* fix: use package alias for event-type hooks instead of deeply nested relative paths
- Move sortHosts function to @calcom/lib/bookings/hostGroupUtils.ts for shared access
- Add exports for useEventTypeForm, useHandleRouteChange, useTabsNavigations to @calcom/atoms package.json
- Update EventTypeWebWrapper.tsx to use @calcom/atoms package alias instead of ../../../../../packages/... paths
- Update useEventTypeForm.ts to import sortHosts from @calcom/lib instead of @calcom/web
- Re-export sortHosts from HostEditDialogs.tsx for backward compatibility
This addresses the Cubic AI review feedback about fragile deeply nested relative paths that bypass proper package resolution.
Co-Authored-By: unknown <>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-10 12:55:39 +00:00
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: implement git checkout caching to speed up CI workflows
- Create cache-checkout action to save/restore git working directory
- Update prepare job in pr.yml to cache checkout after dangerous-git-checkout
- Update all downstream workflows to restore from cache instead of checkout
- Pass commit-sha to all workflow calls for cache key consistency
This reduces the number of full git checkouts from 20+ per workflow run to just 1,
significantly improving CI performance especially for large repos.
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: use actions/cache/restore directly instead of custom action
Remove sparse-checkout and use actions/cache/restore@v4 directly in all
downstream workflows. This eliminates the need for any git fetch operation
before restoring from cache, making the optimization more effective.
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: use github.event.pull_request.head.sha for cache key
- Remove commit-sha input from all downstream workflows
- Update cache-checkout action to use github.event.pull_request.head.sha directly
- Remove commit-sha output from prepare job
- Remove commit-sha from all workflow calls in pr.yml
- Keep sparse-checkout of .github to access the cache-checkout action
This eliminates the need to pass commit-sha around while still using
a reusable action for the cache restore logic.
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: update cache key to include branch name and add cache cleanup
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: use github.head_ref and github.sha for cache key
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: add prefix delete before saving cache to clear previous caches
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* perf: add sparse-checkout to exclude example-apps and mp4 files
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: restore get_sha step and commit-sha output that was accidentally removed
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: add trailing dash to cache key prefix to prevent accidental deletion of other branches' caches
The prefix-based cache deletion was using 'git-checkout-{branch}' which would
accidentally match and delete caches for branches with similar prefixes.
For example, branch 'feature' would delete caches for 'feature-2', 'feature-new', etc.
Adding a trailing '-' ensures exact branch matching:
- 'git-checkout-feature-' matches 'git-checkout-feature-abc123' (intended)
- 'git-checkout-feature-' does NOT match 'git-checkout-feature-2-def456' (correct)
Fixes both the cache-checkout action and the PR close cleanup workflow.
Co-Authored-By: unknown <>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: companion alert system for browser extension
* feat: implement cross-platform alert system for browser extension
- Add ToastContext.tsx with global toast provider for managing toast state
- Add GlobalToast.tsx centered toast component for web/browser extension
- Modify alerts.ts to be platform-aware (native Alert on iOS/Android, toast on web)
- Add showInfoAlert function for informational alerts
- Update _layout.tsx to wrap app with ToastProvider and GlobalToast
- Export new toast context and alert functions from index files
* style: update toast to white/black design system
- Use white background with gray border
- Use black icons and text colors
- Match companion app design system
* open the toast at the center
* refactor: migrate event-types/index.tsx to unified alert system
- Remove inline toast state (showToast, toastMessage) and showToastMessage function
- Remove inline toast UI component at the end of the file
- Migrate all platform-specific Alert.alert calls to showSuccessAlert/showErrorAlert
- Simplifies code by using cross-platform alert utilities
* refactor: migrate useBookingActions.ts to unified alert system
- Add showSuccessAlert import alongside showErrorAlert
- Migrate all Alert.alert('Success', ...) calls to showSuccessAlert
- Affected handlers: handleSubmitReschedule, handleRescheduleWithValues,
handleSubmitCancel, handleCancelBooking, handleConfirmBooking,
handleRejectBooking, handleSubmitReject, handleInlineConfirm
* refactor: migrate useBookingActionModals.ts to unified alert system
- Add showSuccessAlert import alongside showErrorAlert
- Migrate all Alert.alert('Success', ...) calls to showSuccessAlert
- Affected handlers: handleAddGuests, handleUpdateLocation, handleMarkNoShow
* refactor: migrate medium-priority screens to unified alert system
- AvailabilityDetailScreen.ios.tsx: 4 Alert.alert calls migrated
- RescheduleScreen.tsx/ios/android: 3 Alert.alert calls each migrated
- EditLocationScreen.tsx/ios: 4 Alert.alert calls each migrated
- Removed unused Alert imports
* refactor: migrate remaining medium-priority screens to unified alert system
- BookingDetailScreen.tsx: 2 Alert.alert calls migrated
- AvailabilityListScreen.tsx: 1 Alert.alert call migrated
- AddGuestsScreen.tsx: 6 Alert.alert calls migrated
- MarkNoShowScreen.tsx: 2 Alert.alert calls migrated
- EditAvailabilityOverrideScreen.tsx: 4 Alert.alert calls migrated
- EditAvailabilityOverrideScreen.ios.tsx: 2 Alert.alert calls migrated
- Removed unused Alert imports
* refactor: migrate medium-priority app routes to unified alert system
Migrated 24 app route files from direct Alert.alert() calls to unified
alert utilities (showErrorAlert, showSuccessAlert, showInfoAlert):
- reschedule.tsx, reschedule.ios.tsx
- edit-location.tsx, edit-location.ios.tsx
- add-guests.tsx, add-guests.ios.tsx
- mark-no-show.tsx, mark-no-show.ios.tsx
- view-recordings.tsx, view-recordings.ios.tsx
- meeting-session-details.tsx, meeting-session-details.ios.tsx
- profile-sheet.tsx, profile-sheet.ios.tsx
- edit-availability-hours.tsx, edit-availability-hours.ios.tsx
- edit-availability-day.tsx, edit-availability-day.ios.tsx
- edit-availability-name.tsx, edit-availability-name.ios.tsx
- edit-availability-override.tsx, edit-availability-override.ios.tsx
- booking-detail.tsx, booking-detail.ios.tsx
This enables cross-platform alert support where native Alert.alert()
is used on iOS/Android and toast notifications on web (browser extension).
* refactor: migrate lower-priority components to unified alert system
Migrated Alert.alert calls to showSuccessAlert/showErrorAlert/showInfoAlert in:
- event-types/index.ios.tsx (copy link, delete, duplicate success alerts)
- event-type-detail.tsx (copy link, create/update success, validation errors, info alerts)
- deep-links.ts (error alerts for link failures)
- LogoutButton.tsx (error alert)
- BookingModals.tsx and .ios.tsx (report booking info alerts)
- AdvancedTab.tsx (info alert for unsaved event type)
- BookingListScreen.tsx (success/error/info alerts for bulk actions)
Confirmation dialogs with buttons remain as Alert.alert (out of scope).
* fix: restore Alert import for confirmation dialogs, migrate remaining info alert
- AdvancedTab.tsx: Added back Alert import for timezone selector confirmation dialog (out of scope), migrated private links info alert to showInfoAlert
- deep-links.ts: Added back Alert import for request reschedule confirmation dialog (out of scope)
* some ui dialoes were missing
* fixed multi hours ui issues on Availability detail page for android and web
* fix: add __DEV__ check for web platform in showErrorAlert
The showErrorAlert function was showing error toasts to production users
on web platform, bypassing the __DEV__ check that exists for native platforms.
This fix ensures consistent behavior across all platforms - error alerts
are only shown in development mode, while production errors are logged
to console.
Co-Authored-By: unknown <>
* fix: address dual dialogs on web and onSuccess timing issues
- BookingDetailScreen.tsx: Add Platform.OS === 'android' guard to AlertDialog
to prevent dual dialogs rendering on web (FullScreenModal + AlertDialog)
- RescheduleScreen.android.tsx: Restore original Alert.alert with callback
to ensure onSuccess() is called after user dismisses the alert
Co-Authored-By: unknown <>
* fix: restore Alert.alert with callback for native platforms
- AddGuestsScreen.tsx: Use platform-specific handling - Alert.alert with
callback on iOS/Android, showSuccessAlert on web
- EditAvailabilityOverrideScreen.tsx: Same pattern - wait for user
acknowledgment on native platforms before calling onSuccess()
Co-Authored-By: unknown <>
* fix: RescheduleScreen timing and GlobalToast useState pattern
- RescheduleScreen.tsx: Use platform-specific handling - Alert.alert with
callback on iOS/Android, showSuccessAlert on web
- GlobalToast.tsx: Replace useMemo with useState for Animated.Value to
guarantee instance preservation across renders
Co-Authored-By: unknown <>
* fix: restore Alert.alert with callback for iOS delete success
AvailabilityDetailScreen.ios.tsx: Use Alert.alert with callback to ensure
router.back() is called after user dismisses the success alert
Co-Authored-By: unknown <>
* feat(companion): new event type detail page (#26678)
* fix: skip stale run-ci label check on workflow re-runs (#26590)
* fix: trust community PRs when maintainer pushes to the branch
When a maintainer merges main into a community PR branch, the new SHA
invalidates the run-ci label timing check because the label was added
before the new push. This fix adds a check to trust the PR if the
person who pushed the latest commit has write access.
This handles the case where a maintainer:
- Merges main into a community PR to resolve conflicts
- Pushes any changes to help the contributor
The security model is maintained because:
- Only users with write access can trigger this trust
- The maintainer has reviewed the code by pushing to it
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix: skip stale label check on workflow re-runs
Instead of implicitly trusting maintainer pushes (which could be just
a sync action without code review), use github.run_attempt to detect
re-runs. If run_attempt > 1, it means the workflow was explicitly
re-triggered (via run-ci.yml or manual re-run), so we skip the stale
label check.
This avoids the need to remove and re-add the 'run-ci' label after
syncing a community PR with main, while keeping the explicit approval
flow intact.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* Simplify comment about re-runs in PR workflow
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
* fix: Text cursor barely visible in calendar event name field (#26563)
* fix: cursor visibility in input fields
* fix: cursor visibility in input fields with suffix addons
* fix: text cursor visibility in input fields
---------
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
* fix: PayPal setup page inconsistent spacing and button styling (#26612)
* chore: api v2 generate swagger only in dev (#26617)
* feat: add BUILD_FROM_BRANCH option to release-docker workflow (#26615)
* feat: add BUILD_FROM_BRANCH option to release-docker workflow
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: sanitize branch names with slashes for valid Docker tags
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* refactor: extract common logic into prepare job to avoid duplication
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add Cubic AI to Devin review integration workflow (#26618)
* feat: add Cubic AI to Devin review integration workflow
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: update permissions to allow posting PR comments
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: remove sensitive API response logging from CI workflow
Address Cubic AI review feedback: Remove the debug log that outputs the
full Devin API response, which could expose sensitive session tokens or
authentication data in CI logs. The session URL is still logged when
successfully extracted.
Co-Authored-By: unknown <>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: enable/disable slots workers via env (#26621)
* chore: enable/disable slots workers via env
* fix: address Cubic AI review feedback
- Fix incorrect JSDoc comment for getSerializableContext method
- Remove debug console.log statement from slots controller
- Fix port suffix condition to preserve original behavior
Co-Authored-By: unknown <>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: USE_POOL env var for api v2 prisma pooling
* fix list numbering in Manual setup section of README (#26620)
* Revert "chore: USE_POOL env var for api v2 prisma pooling"
This reverts commit a97092619f.
* feat: limit badges to 2 with hover/click popover in UserListTable (#26556)
* feat: limit badges to 2 with hover tooltip in UserListTable
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: reuse LimitedBadges component with clickable popover for mobile
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: move LimitedBadges to components/ui with hover+click support
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: fix Biome lint issues in LimitedBadges and UserListTable
- Refactor LimitedBadges to concrete component with BadgeItem type
- Move exports to end of files to comply with useExportsLast rule
- Add explicit types to callback parameters for useExplicitType rule
- Convert nested ternary to if-else for filterType calculation
- Remove unused imports (Row, Table types)
- Update ResponseValueCell and UserListTable to use new LimitedBadges API
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: add proper types for filterType and getFacetedUniqueValues
- Add FilterType import from @calcom/types/data-table
- Add FacetedValue import from @calcom/features/data-table
- Type filterType as FilterType to allow reassignment to different ColumnFilterType values
- Type getFacetedUniqueValues return as Map<FacetedValue, number>
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* add vertical gap
* fix: address code review feedback for LimitedBadges
- Add index to id for unique keys in ResponseValueCell.tsx
- Restore orange variant for group options in UserListTable.tsx
- Fix useMemo dependency array (add t, remove dispatch)
- Fix import ordering with biome
- Convert ternary operators to if-else statements for biome compliance
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: remove id from BadgeItem type, use label as key
- Remove id field from BadgeItem type in LimitedBadges
- Use label as React key instead of id
- Remove unused rowId parameter from ResponseValueCell
- Update all consumers to not pass id field
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: use index for key instead of label in LimitedBadges
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* Revert "refactor: use index for key instead of label in LimitedBadges"
This reverts commit 1daaac47e596fd6b5f5583847faa10b131783349.
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: add database-backed feature flag for sidebar tips section (#26516)
* chore: remove tips section from sidebar
Co-Authored-By: amit@cal.com <samit91848@gmail.com>
* chore: add feature flag for sidebar tips section
Co-Authored-By: amit@cal.com <samit91848@gmail.com>
* chore: use database-backed feature flag for sidebar tips section
Co-Authored-By: amit@cal.com <samit91848@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add automated stale PR completion workflow with Devin API (#26627)
* feat: add stale PR completion workflow with Devin API
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* feat: only trigger for community PRs (non-calcom org members)
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* refactor: use author_association pattern from pr.yml for community check
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* refactor: simplify workflow - use community label check and let Devin gather PR details
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add Devin PR conflict resolver workflow (#26624)
* feat: add Devin PR conflict resolver workflow
Adds a GitHub Actions workflow that automatically detects PRs with merge
conflicts and spins up Devin sessions to resolve them.
How it works:
1. Triggers on push to main branch (when main updates could cause conflicts)
2. Also supports manual trigger via workflow_dispatch
3. Lists all open PRs and checks their mergeable status
4. For PRs with conflicts (mergeable=false, mergeable_state=dirty):
- Checks if a Devin session was already created (avoids duplicates)
- Creates a new Devin session with instructions to resolve conflicts
- Posts a comment on the PR with the Devin session link
The workflow follows the same pattern as cubic-devin-review.yml for
consistency.
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: skip draft PRs in conflict detection workflow
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: use GitHub Search API to filter draft PRs at API level
Instead of filtering draft PRs in the loop, use the GitHub Search API
with 'draft:false' filter which is more efficient as it filters at the
API level rather than fetching all PRs and filtering locally.
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* style: remove explanatory comments from workflow
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* style: remove all unnecessary explanatory comments
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: use GraphQL for batched PR fetching and labels for tracking
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add support for resolving conflicts on fork PRs
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: check response.ok before parsing Devin API response
Address Cubic AI review feedback: Add response.ok check before parsing
the response body to explicitly handle HTTP error status codes from the
Devin API. This distinguishes API failures (authentication errors,
server errors) from successful responses that might be missing expected
fields.
Co-Authored-By: unknown <>
* fix: improve Devin API error logging with PR number
Co-Authored-By: unknown <>
* feat: add pr_number input for manual fork PR conflict resolution
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add maximum 15 PRs safety net limit
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: make stale PR workflow fork-aware with workflow_dispatch support (#26633)
* feat: make stale PR workflow fork-aware with workflow_dispatch support
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: add null check for pr.head.repo in stale PR workflow
When a fork is deleted after a PR is created, pr.head.repo can be null
(documented GitHub API behavior). This would cause a TypeError when
accessing properties like fork, full_name, or clone_url.
Added a null check that fails gracefully with a clear error message
when the source repository has been deleted.
Co-Authored-By: unknown <>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: reuse existing Devin session for Cubic AI review feedback (#26632)
* feat: reuse existing Devin session for Cubic AI review feedback
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: parse session ID from PR comments instead of API search
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: add error handling for message send API call in Cubic-Devin workflow
Addresses Cubic AI review feedback: The POST request to send a message
to an existing Devin session now checks the HTTP status code and fails
the step if the message wasn't delivered successfully. This prevents
posting a misleading comment claiming feedback was sent when the API
call actually failed.
Co-Authored-By: unknown <>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: Remove stale label when work is completed (#26638)
* chore: Remove stale label when work is completed
* Mark as ready for review too
* feat: add retry mechanism for UNKNOWN mergeable status PRs (#26635)
* feat: add retry mechanism for UNKNOWN mergeable status PRs
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: remove redundant filtering logic for unknown mergeable status PRs
Address Cubic AI review feedback by:
- Having processPR return isTargetPR in the unknown case (like the conflict case)
- Simplifying the main loop to just push PRs to unknownPRs without re-checking
draft status and devin label (already checked in processPR)
Co-Authored-By: unknown <>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* chore: Add sentry http integration (#26634)
* chore: ignore fork PRs in devin-conflict-resolver workflow (#26640)
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* limits and advanced tabs
* availability tab
* basics tab
* black toggles!!
* new recurring, others tab and update basics
* version 1
---------
Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
Co-authored-by: Anshumancanrock <109489361+Anshumancanrock@users.noreply.github.com>
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
Co-authored-by: cal.com <morgan@cal.com>
Co-authored-by: Anas Najam <129951478+anzz14@users.noreply.github.com>
Co-authored-by: Eunjae Lee <hey@eunjae.dev>
Co-authored-by: Amit Sharma <74371312+Amit91848@users.noreply.github.com>
Co-authored-by: Volnei Munhoz <volnei@cal.com>
* fix: address Cubic AI review feedback
- Add HTTP error handling for Devin API session creation in cubic-devin-review.yml
- Localize aria-label in LimitedBadges.tsx using t() function
- Improve Docker tag sanitization in release-docker.yaml to handle all invalid characters
- Avoid logging raw error objects and sensitive API response data in devin-conflict-resolver.yml
- Fix selectedSchedule dependency array issue in event-type-detail.tsx using ref pattern
Co-Authored-By: unknown <>
* chore: add translation key for show_x_more_items aria-label
Co-Authored-By: unknown <>
* fix: reset schedule ref on id change and add i18n pluralization
- Reset hasAutoSelectedScheduleRef when event type id changes to handle component reuse
- Add proper i18next pluralization variants (_one/_other) for show_x_more_items
Co-Authored-By: unknown <>
* revert: remove i18n changes from LimitedBadges and common.json
Per user request - i18n not needed in companion for now
Co-Authored-By: unknown <>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
Co-authored-by: Anshumancanrock <109489361+Anshumancanrock@users.noreply.github.com>
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
Co-authored-by: cal.com <morgan@cal.com>
Co-authored-by: Anas Najam <129951478+anzz14@users.noreply.github.com>
Co-authored-by: Eunjae Lee <hey@eunjae.dev>
Co-authored-by: Amit Sharma <74371312+Amit91848@users.noreply.github.com>
Co-authored-by: Volnei Munhoz <volnei@cal.com>
2026-01-10 17:57:42 +05:30
Anik Dhabal BabuGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: prioritize PR-creator Devin session when addressing Cubic AI reviews
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix: always use PR-creator Devin session regardless of status
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix: use checkSessionStatus helper for both PR description and comment cases
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* Clarify comment about PR review session check
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* Make and instance method
* Refactor files
* fix: update MembershipRepository mocks to use vi.hoisted() for proper hoisting
Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-09 22:37:42 -03:00
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add retry mechanism for UNKNOWN mergeable status PRs
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: remove redundant filtering logic for unknown mergeable status PRs
Address Cubic AI review feedback by:
- Having processPR return isTargetPR in the unknown case (like the conflict case)
- Simplifying the main loop to just push PRs to unknownPRs without re-checking
draft status and devin label (already checked in processPR)
Co-Authored-By: unknown <>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: reuse existing Devin session for Cubic AI review feedback
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: parse session ID from PR comments instead of API search
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: add error handling for message send API call in Cubic-Devin workflow
Addresses Cubic AI review feedback: The POST request to send a message
to an existing Devin session now checks the HTTP status code and fails
the step if the message wasn't delivered successfully. This prevents
posting a misleading comment claiming feedback was sent when the API
call actually failed.
Co-Authored-By: unknown <>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-09 19:41:13 +00:00
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: make stale PR workflow fork-aware with workflow_dispatch support
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: add null check for pr.head.repo in stale PR workflow
When a fork is deleted after a PR is created, pr.head.repo can be null
(documented GitHub API behavior). This would cause a TypeError when
accessing properties like fork, full_name, or clone_url.
Added a null check that fails gracefully with a clear error message
when the source repository has been deleted.
Co-Authored-By: unknown <>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-09 19:22:37 +00:00
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add Devin PR conflict resolver workflow
Adds a GitHub Actions workflow that automatically detects PRs with merge
conflicts and spins up Devin sessions to resolve them.
How it works:
1. Triggers on push to main branch (when main updates could cause conflicts)
2. Also supports manual trigger via workflow_dispatch
3. Lists all open PRs and checks their mergeable status
4. For PRs with conflicts (mergeable=false, mergeable_state=dirty):
- Checks if a Devin session was already created (avoids duplicates)
- Creates a new Devin session with instructions to resolve conflicts
- Posts a comment on the PR with the Devin session link
The workflow follows the same pattern as cubic-devin-review.yml for
consistency.
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: skip draft PRs in conflict detection workflow
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: use GitHub Search API to filter draft PRs at API level
Instead of filtering draft PRs in the loop, use the GitHub Search API
with 'draft:false' filter which is more efficient as it filters at the
API level rather than fetching all PRs and filtering locally.
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* style: remove explanatory comments from workflow
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* style: remove all unnecessary explanatory comments
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: use GraphQL for batched PR fetching and labels for tracking
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add support for resolving conflicts on fork PRs
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: check response.ok before parsing Devin API response
Address Cubic AI review feedback: Add response.ok check before parsing
the response body to explicitly handle HTTP error status codes from the
Devin API. This distinguishes API failures (authentication errors,
server errors) from successful responses that might be missing expected
fields.
Co-Authored-By: unknown <>
* fix: improve Devin API error logging with PR number
Co-Authored-By: unknown <>
* feat: add pr_number input for manual fork PR conflict resolution
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add maximum 15 PRs safety net limit
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-09 19:10:13 +00:00
Anik Dhabal BabuGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add stale PR completion workflow with Devin API
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* feat: only trigger for community PRs (non-calcom org members)
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* refactor: use author_association pattern from pr.yml for community check
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* refactor: simplify workflow - use community label check and let Devin gather PR details
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-09 18:27:57 +00:00
Amit SharmaGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: limit badges to 2 with hover tooltip in UserListTable
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: reuse LimitedBadges component with clickable popover for mobile
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: move LimitedBadges to components/ui with hover+click support
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: fix Biome lint issues in LimitedBadges and UserListTable
- Refactor LimitedBadges to concrete component with BadgeItem type
- Move exports to end of files to comply with useExportsLast rule
- Add explicit types to callback parameters for useExplicitType rule
- Convert nested ternary to if-else for filterType calculation
- Remove unused imports (Row, Table types)
- Update ResponseValueCell and UserListTable to use new LimitedBadges API
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* fix: add proper types for filterType and getFacetedUniqueValues
- Add FilterType import from @calcom/types/data-table
- Add FacetedValue import from @calcom/features/data-table
- Type filterType as FilterType to allow reassignment to different ColumnFilterType values
- Type getFacetedUniqueValues return as Map<FacetedValue, number>
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* add vertical gap
* fix: address code review feedback for LimitedBadges
- Add index to id for unique keys in ResponseValueCell.tsx
- Restore orange variant for group options in UserListTable.tsx
- Fix useMemo dependency array (add t, remove dispatch)
- Fix import ordering with biome
- Convert ternary operators to if-else statements for biome compliance
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: remove id from BadgeItem type, use label as key
- Remove id field from BadgeItem type in LimitedBadges
- Use label as React key instead of id
- Remove unused rowId parameter from ResponseValueCell
- Update all consumers to not pass id field
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* refactor: use index for key instead of label in LimitedBadges
Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>
* Revert "refactor: use index for key instead of label in LimitedBadges"
This reverts commit 1daaac47e596fd6b5f5583847faa10b131783349.
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add Cubic AI to Devin review integration workflow
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: update permissions to allow posting PR comments
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* fix: remove sensitive API response logging from CI workflow
Address Cubic AI review feedback: Remove the debug log that outputs the
full Devin API response, which could expose sensitive session tokens or
authentication data in CI logs. The session URL is still logged when
successfully extracted.
Co-Authored-By: unknown <>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-09 11:23:41 -03:00
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: cursor visibility in input fields
* fix: cursor visibility in input fields with suffix addons
* fix: text cursor visibility in input fields
---------
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
* fix: trust community PRs when maintainer pushes to the branch
When a maintainer merges main into a community PR branch, the new SHA
invalidates the run-ci label timing check because the label was added
before the new push. This fix adds a check to trust the PR if the
person who pushed the latest commit has write access.
This handles the case where a maintainer:
- Merges main into a community PR to resolve conflicts
- Pushes any changes to help the contributor
The security model is maintained because:
- Only users with write access can trigger this trust
- The maintainer has reviewed the code by pushing to it
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix: skip stale label check on workflow re-runs
Instead of implicitly trusting maintainer pushes (which could be just
a sync action without code review), use github.run_attempt to detect
re-runs. If run_attempt > 1, it means the workflow was explicitly
re-triggered (via run-ci.yml or manual re-run), so we skip the stale
label check.
This avoids the need to remove and re-add the 'run-ci' label after
syncing a community PR with main, while keeping the explicit approval
flow intact.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* Simplify comment about re-runs in PR workflow
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
* feat: companion add missing advanced event type
* feat: companion add missing advanced event type
* remove metadata code and remove non implemented Auto translate title and description toggle from companion
* Save Button Dirty State
* address cubic feedback - default value for sendTranscriptionEmails
* address cubic comments - fix new event type blocked issue
* ios language dropdown
* fix(auth): sanitize unverified accounts during OAuth linking
- Add AccountSanitizationService for secure account cleanup
- Clear webhooks, API keys, credentials, and sessions for unverified accounts
- Reset password and 2FA settings during OAuth conversion
- Nullify redirect URLs on event types
Only affects accounts that never completed email verification
* fix(auth): block OAuth linking for unverified accounts
Replace sanitization with simpler blocking approach:
- Unverified CAL accounts cannot link to OAuth (Google/SAML)
- Add user-friendly error message with recovery path
- Remove AccountSanitizationService (no data loss risk)
2026-01-09 11:04:39 +00:00
Pasquale VitielloGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>pasquale@cal.com <pasquale@cal.com>Rajiv Sahal
* fix: improve cleanup for managed event types in e2e tests
- Add deleteAllUserEventTypes method to EventTypesRepositoryFixture
- Update afterAll cleanup to delete user event types before deleting users
- This ensures child event types of managed event types are properly cleaned up
- Fixes flaky tests caused by incomplete cleanup between test runs
- Add explicit return types to fixture methods to satisfy lint rules
- Replace @ts-ignore with @ts-expect-error for better type safety
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-09 06:16:59 -03:00
Benny JooGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
## What does this PR do?
Adds audit logging for the reschedule request flow. When an organizer requests an attendee to reschedule a booking, this action is now logged to the booking audit system.
This is part of the booking audit integration effort, following the pattern established in PR #26046 (booking creation/rescheduling audit) and PR #26458 (cancellation audit).
## Changes
- Added audit logging call to `requestReschedule.handler.ts` using `BookingEventHandlerService.onRescheduleRequested()`
- Captures audit data:
- `rescheduleReason`: The reason provided for requesting the reschedule (nullable string)
- `rescheduledRequestedBy`: Email of the user who requested the reschedule
- Uses `makeUserActor(user.uuid)` to identify the actor performing the action
- Added required `source` parameter for action source tracking (passed as `"WEBAPP"` from tRPC router)
- Updated `RescheduleRequestedAuditActionService` schema to use simpler field structure
- Updated test helper `getTrpcHandlerData` to pass `source: "WEBAPP"` parameter
## Updates since last revision
- Changed `source` parameter from optional with default to required - tests now explicitly pass `source: "WEBAPP"` instead of relying on a default value
## Mandatory Tasks (DO NOT REMOVE)
- [x] I have self-reviewed the code (A decent size PR without self-review might be rejected).
- [x] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). N/A - no documentation changes needed.
- [x] I confirm automated tests are in place that prove my fix is effective or that my feature works. N/A - follows established audit pattern with existing infrastructure tests.
## How should this be tested?
1. Log in as a user with a booking
2. Navigate to the booking and click "Request Reschedule"
3. Provide a reschedule reason and submit
4. Verify the audit log is created with the correct data (requires access to audit log storage/database)
The audit logging follows the same pattern as other booking audit integrations, so if those are working, this should work as well.
## Checklist
- [x] My code follows the style guidelines of this project
- [x] I have checked if my changes generate no new warnings
---
**Link to Devin run**: https://app.devin.ai/sessions/ae84d093c4594a5d89b88c45639a6a06
**Requested by**: @hariombalhara
## Human Review Checklist
- [ ] Verify the audit data schema matches `RescheduleRequestedAuditActionService` expectations (fields: `rescheduleReason`, `rescheduledRequestedBy`)
- [ ] Confirm the schema change from change-based fields (`{ old, new }`) to simple nullable strings is intentional
- [ ] Confirm `user.uuid` is available in the tRPC session context
- [ ] Note: API v2 does not have a reschedule request endpoint, so no API v2 changes are needed
* fix(auth): add URL validation for organization logo fields
- Add URL validation utility for server-side fetched URLs
- Validate logo URLs in tRPC organization schema
- Validate logo URLs in API v2 team DTOs
- Add graceful fallback in logo route for invalid URLs
- Only allow HTTPS and image data URLs
- Add unit tests for URL validation
* fix: add missing IP range and type validation
- Add RFC 6598 CGNAT range (100.64.0.0/10) to blocked IPs
- Add @IsString() decorator before custom URL validators
- Add boundary tests for new IP range
* fix: address review feedback
- Export validateUrlForSSRFSync via @calcom/platform-libraries
- Fix nullable/optional order in Zod schema
* fix: block localhost hostname and explicit null check
- Add localhost to BLOCKED_HOSTNAMES for sync validation
- Use explicit null check (url == null) instead of falsy check
* fix: allow empty string in URL validation
* refactor: extract shared validation logic
- Extract validateUrlCore() to eliminate duplication between sync/async versions
- Add JSDoc to all exported functions for better discoverability
- Remove redundant comments that repeated function names
- Simplify existing comments to be more concise
* fix: reject empty strings in URL validator
Previously if (!url) allowed empty strings to bypass validation.
Now explicitly checks for null/undefined only
* Availability Detail Page Header and fix event type payment amount badge, and index ui bug bottom navbar
* feat(companion): implement read-only availability detail page for Android/Extension
- Convert AvailabilityDetailScreen.tsx to read-only display with expandable sections
- Add header dropdown menu with edit options in availability-detail.tsx
- Update edit-availability-name.tsx with modal presentation pattern
- Update edit-availability-hours.tsx with modal presentation pattern
- Update edit-availability-override.tsx with modal presentation pattern
- Match iOS flow: read-only detail page with edit actions via header menu
* fix header on Availability Detail screen for android
* make dialoges center on extension
* update padding
* AvailabilityDetailScreen for android and extension
* added click to modal feat
* fix Date Overrides Card was always shown
---------
Co-authored-by: Volnei Munhoz <volnei@cal.com>
* fix: Add email verification requirement for API v1 and v2 email updates
- API v2 (/v2/me): Implement email verification check when updating primary email
- Store new email in metadata as emailChangeWaitingForVerification when verification is required
- Send verification email using sendChangeOfEmailVerification
- Allow immediate email change if new email is already a verified secondary email
- Add hasEmailBeenChanged and sendEmailVerification flags to response
- Add tests to verify email verification behavior
- Add findVerifiedSecondaryEmail method to UsersRepository
- Add PrismaFeaturesRepository to MeModule providers
- API v1 (/v1/users/{userId}): Implement same email verification logic
- Check if email-verification feature flag is enabled
- Store new email in metadata when verification is required
- Send verification email for unverified email changes
- Allow immediate change for verified secondary emails
- Preserve existing API v1 response format
- Test fixtures: Add createSecondaryEmail method to UserRepositoryFixture
This fixes the vulnerability where users could update their primary email
without verification via API endpoints.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* update
* update
* refactor: Extract business logic to MeService and add platform-managed bypass
- Create MeService with all business logic extracted from MeController
- Update MeController to delegate to MeService (thin controller pattern)
- Add PrismaWorkerModule to MeModule imports to provide PrismaWriteService
- Add isPlatformManaged bypass: platform-managed users can update email without verification
- Fix test cleanup to use delete by ID instead of email to avoid failures when email changes
- Remove hasEmailBeenChanged and sendEmailVerification response flags per reviewer feedback
- Add comprehensive documentation to @ApiOperation describing email verification behavior
- Update tests to remove flag assertions
Addresses PR comments:
- supalarry: Extract logic to service layer
- supalarry: Allow platform-managed users to update email without verification
- supalarry: Remove response flags and document behavior in @ApiOperation instead
- cubic-dev-ai: Fix module dependency for PrismaFeaturesRepository
- cubic-dev-ai: Fix test cleanup issue
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* docs: Simplify API operation description
Remove internal implementation details about metadata staging and shorten the description to focus on API consumer behavior.
Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>
* fix
* update
* update
* update
* remove comment
* addressed commit
* review addressed
* use repository
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-08 15:51:11 +00:00
Eunjae LeeGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* refactor: First high level changes to getUsersAvailability
* Fix usage of getUserAvailability where getUsersAvailability is unused
* Fix user.schema.ts in APIv2
* User handler did not provide initial data
* Small ts fixes
* Set user non-nullable in getTimezoneFromDelegatedCredential
* Small ts fixes, ensure consumers are aware its nonnullable
* Mode is defaulted to none
* Mode is defaulted to none, fix ts when directly using fn (temp)
* fix: filter Google Workspace credentials by current user
Add userId filter to getUsersFromGWorkspace credential query and add
unit tests for all googleWorkspace handler functions. Also fix OAuth2Client
import to use google-auth-library for proper type compatibility
* refactor(tests): improve googleWorkspace handler test structure
Move dynamic imports to beforeEach block to reduce repetition
and improve test readability
---------
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
* fix: capitalize German 'Uhr' in 24-hour time format
- Conditionally apply toLowerCase() only for 12-hour format (AM/PM)
- Preserve proper capitalization for 24-hour format in German and other locales
- German 'Uhr' now displays correctly as 'Uhr' instead of 'uhr'
Fixes#24455
* refactor: remove code comments for clarity
* use ternary in return instead of mutable variable
* refactor: remove toLowerCase from time formatting
* addressed cubic suggestion
---------
Co-authored-by: Pallav <90088723+Pallava-Joshi@users.noreply.github.com>
Co-authored-by: Anik Dhabal Babu <adhabal2002@gmail.com>
