Merge main into helm-improvements — resolve conflicts

Take main's simplified approach for all conflicts:
- No run-migrations init container (entrypoint.sh handles migrations)
- No additionalEnv / server.env pass-through — just extraEnv array
- No disableDbMigrations flag
- Clean indentation throughout

Made-with: Cursor

.gitignore

@@ -10,7 +10,6 @@
 .nx/installation
 .nx/cache
 .nx/workspace-data
-.nx/nxw.js
 
 .pnp.*
 .yarn/*
@@ -28,7 +27,7 @@ coverage
 dist
 storybook-static
 *.tsbuildinfo
-.oxlintcache
+.eslintcache
 .nyc_output
 test-results/
 dump.rdb
@@ -50,4 +49,6 @@ dump.rdb
 mcp.json
 /.junie/
 TRANSLATION_QA_REPORT.md
-.playwright-mcp/
+
+# Local scratch files
+tmp/

packages/twenty-docker/helm/twenty/templates/deployment-worker.yaml

@@ -91,7 +91,7 @@ spec:
             {{- end }}
             {{- $storageEnv := (include "twenty.storageEnv" .) }}
             {{- if $storageEnv }}
-            {{ $storageEnv | nindent 12 }}
+            {{- $storageEnv | nindent 12 }}
             {{- end }}
           resources:
             {{- toYaml .Values.worker.resources | nindent 12 }}

packages/twenty-docker/helm/twenty/tests/env_mapping_test.yaml

@@ -0,0 +1,124 @@
+suite: env mapping
+templates:
+  - templates/deployment-server.yaml
+  - templates/deployment-worker.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: renders Google auth envs when set
+    template: templates/deployment-server.yaml
+    set:
+      server.env.AUTH_GOOGLE_ENABLED: true
+      server.env.AUTH_GOOGLE_CLIENT_ID: gid
+      server.env.AUTH_GOOGLE_CLIENT_SECRET: gsecret
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: AUTH_GOOGLE_ENABLED
+            value: "true"
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: AUTH_GOOGLE_CLIENT_ID
+            value: gid
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: AUTH_GOOGLE_CLIENT_SECRET
+            value: gsecret
+
+  - it: renders server extraEnv value
+    template: templates/deployment-server.yaml
+    set:
+      server.extraEnv:
+        - name: FEATURE_X_ENABLED
+          value: "true"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: FEATURE_X_ENABLED
+            value: "true"
+
+  - it: renders worker extraEnv valueFrom
+    template: templates/deployment-worker.yaml
+    set:
+      worker.extraEnv:
+        - name: CUSTOM_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: my-secret
+              key: custom
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: CUSTOM_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: my-secret
+                key: custom
+
+  - it: disableDbMigrations injects env var into migration init container
+    template: templates/deployment-server.yaml
+    set:
+      server.disableDbMigrations: true
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers[?(@.name=="run-migrations")].env
+          content:
+            name: DISABLE_DB_MIGRATIONS
+            value: "true"
+
+  - it: disableDbMigrations defaults to false in init container
+    template: templates/deployment-server.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers[?(@.name=="run-migrations")].env
+          content:
+            name: DISABLE_DB_MIGRATIONS
+            value: "false"
+
+  - it: non-reserved server.env keys are injected via pass-through (email example)
+    template: templates/deployment-server.yaml
+    set:
+      server.env.EMAIL_DRIVER: smtp
+      server.env.EMAIL_SMTP_HOST: mail.example.com
+      server.env.EMAIL_FROM_ADDRESS: noreply@example.com
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: EMAIL_DRIVER
+            value: smtp
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: EMAIL_SMTP_HOST
+            value: mail.example.com
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: EMAIL_FROM_ADDRESS
+            value: noreply@example.com
+
+  - it: renders server extraEnv valueFrom on server container
+    template: templates/deployment-server.yaml
+    set:
+      server.extraEnv:
+        - name: SMTP_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: smtp-creds
+              key: password
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: SMTP_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: smtp-creds
+                key: password

packages/twenty-docker/helm/twenty/tests/redis_auth_test.yaml

@@ -0,0 +1,89 @@
+suite: redis external authentication
+templates:
+  - templates/deployment-server.yaml
+  - templates/deployment-worker.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: injects REDIS_PASSWORD from external secret into server
+    template: templates/deployment-server.yaml
+    set:
+      redisInternal.enabled: false
+      redis.external.host: redis.example.com
+      redis.external.secretName: redis-creds
+      redis.external.passwordKey: password
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: redis-creds
+                key: password
+
+  - it: injects REDIS_PASSWORD from external secret into worker
+    template: templates/deployment-worker.yaml
+    set:
+      redisInternal.enabled: false
+      redis.external.host: redis.example.com
+      redis.external.secretName: redis-creds
+      redis.external.passwordKey: password
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: redis-creds
+                key: password
+
+  - it: injects plaintext REDIS_PASSWORD when password set directly in server
+    template: templates/deployment-server.yaml
+    set:
+      redisInternal.enabled: false
+      redis.external.host: redis.example.com
+      redis.external.password: "s3cr3t"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+            value: "s3cr3t"
+
+  - it: injects plaintext REDIS_PASSWORD when password set directly in worker
+    template: templates/deployment-worker.yaml
+    set:
+      redisInternal.enabled: false
+      redis.external.host: redis.example.com
+      redis.external.password: "s3cr3t"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+            value: "s3cr3t"
+
+  - it: does not inject REDIS_PASSWORD into server when using internal redis
+    template: templates/deployment-server.yaml
+    set:
+      redisInternal.enabled: true
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+          any: true
+
+  - it: does not inject REDIS_PASSWORD into worker when using internal redis
+    template: templates/deployment-worker.yaml
+    set:
+      redisInternal.enabled: true
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+          any: true

packages/twenty-docker/helm/twenty/tests/schema_permissions_test.yaml

@@ -111,12 +111,12 @@ tests:
   # 'core' schema. This ensures the _typeorm_migrations table and all application
   # tables use the dedicated core schema.
 
-  - it: migrations run against core datasource
+  - it: migration init container runs yarn database:migrate:prod
     template: templates/deployment-server.yaml
     set:
       db.enabled: true
     asserts:
       - matchRegex:
           path: spec.template.spec.initContainers[?(@.name=="run-migrations")].command[2]
-          pattern: core\.datasource
+          pattern: yarn database:migrate:prod
 

packages/twenty-docker/helm/twenty/tests/server_url_test.yaml

@@ -19,7 +19,7 @@ tests:
             - crm.example.com
     asserts:
       - equal:
-          path: spec.template.spec.containers[0].env[0].value
+          path: spec.template.spec.containers[0].env[?(@.name=="SERVER_URL")].value
           value: "https://crm.example.com:443"
   - it: falls back to service when ingress disabled
     set:
@@ -28,7 +28,7 @@ tests:
       server.env.SERVER_URL: ""
     asserts:
       - matchRegex:
-          path: spec.template.spec.containers[0].env[0].value
+          path: spec.template.spec.containers[0].env[?(@.name=="SERVER_URL")].value
           pattern: ^http://my-twenty-twenty-server\.default\.svc\.cluster\.local:3000$
 ---
 suite: ingress configuration

packages/twenty-docker/helm/twenty/values.schema.json

@@ -42,6 +42,7 @@
         },
         "podSecurityContext": { "type": "object" },
         "containerSecurityContext": { "type": "object" },
+        "disableDbMigrations": { "type": "boolean", "description": "Set to true to skip database migrations on startup." },
         "env": {
           "type": "object",
           "properties": {
@@ -66,6 +67,22 @@
             "PASSWORD_RESET_TOKEN_EXPIRES_IN": { "type": "string" }
           }
         },
+        "extraEnv": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "name": { "type": "string" },
+              "value": { "type": "string" },
+              "valueFrom": { "type": "object" }
+            },
+            "required": ["name"],
+            "oneOf": [
+              { "required": ["value"] },
+              { "required": ["valueFrom"] }
+            ]
+          }
+        },
         "service": {
           "type": "object",
           "properties": {
@@ -141,6 +158,22 @@
             "STORAGE_TYPE": { "type": "string" },
             "DISABLE_DB_MIGRATIONS": { "type": "string" }
           }
+        },
+        "extraEnv": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "name": { "type": "string" },
+              "value": { "type": "string" },
+              "valueFrom": { "type": "object" }
+            },
+            "required": ["name"],
+            "oneOf": [
+              { "required": ["value"] },
+              { "required": ["valueFrom"] }
+            ]
+          }
         }
       }
     },

packages/twenty-docker/helm/twenty/values.yaml

@@ -124,7 +124,7 @@ db:
     appPassword: ""  # random if empty
     image:
       repository: twentycrm/twenty-postgres-spilo
-      tag: 3.3-p2
+      tag: v0.43.5
     resources:
       requests:
         cpu: 250m