## What changed?
- Replace the `gh api` subprocesses used by `flakereport` with a shared
Go HTTP client.
- Rate-limit GitHub API requests to 10 RPS by default; allow an explicit
`--rps` override.
- Stream artifact downloads to temporary files while preserving the
existing 60-second download deadline and artifact worker pool.
## Why?
The report performs a GitHub API request for every artifact. Avoiding a
new `gh` process for each request removes that per-request overhead
without adding a more complex processing pipeline.
## How did you test it?
- [x] added new unit test(s)
- [x] checked the diff for whitespace errors
- [ ] built
- [ ] run locally and tested manually
- [ ] covered by existing tests
- [ ] added new functional test(s)
## Potential risks
The client uses the existing `GH_TOKEN`/`GITHUB_TOKEN` environment
variables, falling back to one `gh auth token` call. Transient API
errors are surfaced to the existing per-artifact error handling rather
than retried.
## What changed?
Extract generic JUnit XML file reading and writing into
`tools/common/junit`.
## Why?
Centralizing format-level JUnit handling.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Sean Kane <spkane31@gmail.com>
## What changed?
* Extracted shared Slack Block Kit message construction, Markdown
rendering, text-limit truncation, and webhook delivery into
`tools/common/slack`.
* Migrated `ci-notify` and `flakereport` to use the shared package while
preserving their report-specific content and ordering.
## Why?
Both tools maintained duplicate Slack payload types and webhook logic.
## How did you test it?
- [x] covered by existing tests
- [x] added new unit test(s)
## Potential risks
Slack block text is now centrally truncated to Slack’s documented
per-block limits. This affects only oversized content and prevents
rejected webhook payloads.
## What changed?
Extract various github helpers into `temporal/tools/common/github`.
No behavioral change expected/intended.
## Why?
Make it easier to re-use github-related code.
## What changed?
- Applied the server-owned subset of testifylint auto-fixes.
- Exact commands that were run:
```sh
.bin/golangci-lint-v2.9.0 run --allow-parallel-runners --concurrency 4 --fix --enable-only testifylint --build-tags disable_grpc_modules,test_dep --timeout 20m --config=.github/.golangci.yml
make goimports
git diff --check
```
- No manual or AI changes were made; unless commented as such.
- Some fixes caused lint errors; those were reverted again.
- Changes were all reviewed by me.
## What changed?
Integrate Go 1.26's new `go fix` into workflow.
NOTE that the changes caused our linter to fire; a [separate
commit](1b23f787ae)
addresses those.
## Why?
Ensure Go code is standardized/modernized.
## How did you test it?
- [ ] built
- [ ] run locally and tested manually
- [x] covered by existing tests
- [ ] added new unit test(s)
- [ ] added new functional test(s)
## What changed?
This updates the server code to use the shorthand log tag constructors
introduced in #9174.
As part of this it _does_ make a breaking change to the `Bool`
constructor: it now takes in the key as a string to be consistent.
The only inconsistent one is now `Error`, but that's used so heavily
that changing it is likely not worth the time.
## Why?
Consistency!
## How did you test it?
Existing tests
## Potential risks
The only risk is that I _have_ introduced a breaking change to the Bool
constructor. I'm happy to undo that if my reviewers desire: my goal is
minimal breaking changes.
I'd prefer none, but I made this change to stir up discussion
## What changed?
`CREATE EXTENSION` sql query is replaced with a pgsql script that checks
for the existence of the extension programatically.
## Why?
`CREATE EXTENSION` can cause issues in environment where creating
extensions are limited to certain users. (e.g. Azure)
## How did you test it?
I've ran the updated schema setup in both environments where btree_gin
is installed and and not installed.
## Potential risks
Regression in visibility database setup.
## Documentation
Not needed.
## Is hotfix candidate?
No
---------
Co-authored-by: Rodrigo Zhou <rodrigo.zhou@gmail.com>
## What changed?
<!-- Describe what has changed in this PR -->
Remove license header from every file. Because it is really hard to
follow in this PR here is the summary:
1. License header is removed from all `.go` and `.proto` files
:fireworks::fireworks:🎆.
2. `LICENSE` file in the root directory has only Temporal and Uber
copyrights.
3. 5 other `LICENSE` files added to the packages which have copyrights
different from Temporal and Uber: Datadog, Xargin, "Mat Ryer, Tyler
Bunnell and contributors".
4. `license_file` flag is removed from all code generation tools.
5. `copyright_file` flag is removed from `go:generate mockgen`
directive.
6. All copyright related targets are removed from `Makefile`.
7. Updated Temporal copyright year to 2025 everywhere.
## Why?
<!-- Tell your future self why have you made these changes -->
I double checked with legal department that it is not needed to have
license header in every file. One file per repo is enough. I put all
copyrights to the root `LICENSE` file and removed header from all other
files. Also updated tools and `Makefile`.
## What changed?
Use `path.Join()` instead of `filepath.Join()`
## Why?
#7454
## How did you test it?
Tested locally
## Potential risks
<!-- Assuming the worst case, what can be broken when deploying this
change to production? -->
None
## Documentation
<!-- Have you made sure this change doesn't falsify anything currently
stated in `docs/`? If significant
new behavior is added, have you described that in `docs/`? -->
None
## Is hotfix candidate?
<!-- Is this PR a hotfix candidate or does it require a notification to
be sent to the broader community? (Yes/No) -->
No
## What changed?
The setuptask and updatetask uses `path.Join` when `embed.FS` is used as
the file system.
## Why?
When using `filepath.Join` on Windows environment, the forward slashes
are converted to back slashes. However, `embed.FS` always expects the
paths to be composed with forward slashes. This causes the setuptask and
updatetask to fail in Windows environment.
## How did you test it?
Tested locally on a Windows environment.
## Potential risks
Schema setup and update tasks can break.
## Documentation
All good.
## Is hotfix candidate?
No
## What changed?
New make target to lint imports. added to github workflow for linting as
well
## Why?
To prevent import statements from not aligning.
## How did you test it?
Ran the target locally. Also checking the workflow for this PR
## Potential risks
None
## Documentation
N/A
## Is hotfix candidate?
no
---------
Co-authored-by: Stephan Behnke <stephanos@users.noreply.github.com>
## What changed?
Make import formatting a part of the build, and test validity with
"ensure-no-changes" target
## Why?
So we never discuss import order again (hopefully)
## How did you test it?
its a build change, so the build will test it!
## Potential risks
As long as build works, the only thing I risk is the ire of coworker who
want imports to be different ;)
## Documentation
N/A
## Is hotfix candidate?
No
## What changed?
https://github.com/temporalio/temporal/pull/6155 introduced the config
value `allowedAuthenticators`. This PR updates the
`temporal-cassandra-tool` to use this config value. It also updates
`config_template.yaml` so that the config value can be set in docker
images as well.
## Why?
Cassandra supports several authenticators to verify the login
credentials. Gocql implements a subset of them as [default allowed list
of
authenticators](34fdeebefc/conn.go (L27)).
It allows customization of this list to allow supporting additional
authenticators.
So with this change Temporal can connect to Cassandra clusters that have
authenticators other than the default ones provided by Gocql.
## How did you test it?
Ran `./temporal-cassandra-tool` and verified that it picked up the
values in environment variable `CASSANDRA_ALLOWED_AUTHENTICATORS`.
Couldn't test docker build since it's in a different repo.
## Potential risks
<!-- Assuming the worst case, what can be broken when deploying this
change to production? -->
## Documentation
<!-- Have you made sure this change doesn't falsify anything currently
stated in `docs/`? If significant
new behavior is added, have you described that in `docs/`? -->
## Is hotfix candidate?
No
---------
Co-authored-by: Rob Holland <rob@temporal.io>
## What changed?
Setup and Update schema tasks have been exported.
## Why?
These utilities are useful for setting up the database via code.
## How did you test it?
I've invoked these functions inside a host application.
## Potential risks
No risks. These are utility functions.
## Documentation
Yes.
## Is hotfix candidate?
No.
## What changed?
Add a `manifest.AllowNoCqlFiles` to allow bumping schema version without
any schema changes.
## Why?
Some persistence implementations need to opt-out of applying schema
changes.
## How did you test it?
I added a unit test with partial coverage and traced the errors I got
while trying apply an empty schema upgrade and seems like this should
work ™️ .
## What changed?
<!-- Describe what has changed in this PR -->
Remove support for standard visibility
## Why?
<!-- Tell your future self why have you made these changes -->
Standard visibility is deprecated.
## How did you test it?
<!-- How have you verified this change? Tested locally? Added a unit
test? Checked in staging env? -->
## Potential risks
<!-- Assuming the worst case, what can be broken when deploying this
change to production? -->
## Is hotfix candidate?
<!-- Is this PR a hotfix candidate or does it require a notification to
be sent to the broader community? (Yes/No) -->
## What changed?
This change adds a flag to `temporal-sql-tool` and
`temporal-cassandra-tool`'s `update-schema` and `setup-schema` to
specify an embedded schema instead of a path to the schema directory or
schema file.
```
NAME:
temporal-cassandra-tool update-schema - update cassandra schema to a specific version
USAGE:
temporal-cassandra-tool update-schema [command options] [arguments...]
OPTIONS:
--version value, -v value target version for the schema update, defaults to latest
--schema-dir value, -d value path to directory containing versioned schema
--schema-name value, -s value name of embedded versioned schema, one of: [cassandra/temporal cassandra/visibility]
```
```
NAME:
temporal-sql-tool update-schema - update sql schema to a specific version
USAGE:
temporal-sql-tool update-schema [command options] [arguments...]
OPTIONS:
--version value, -v value target version for the schema update, defaults to latest
--schema-dir value, -d value path to directory containing versioned schema
--schema-name value, -s value name of embedded versioned schema, one of: [mysql/v57/temporal mysql/v57/visibility mysql/v8/temporal mysql/v8/visibility postgresql/v96/temporal postgresql/v96/visibility postgresql/v12/temporal postgresql/v12/visibility]
```
## Why?
We want to embed the db schemas in the `temporal-sql-tool` and
`temporal-cassandra-tool` with `go:embed` so that customers can simply
specify which schema they want using a flag instead of having to copy
the schema files to wherever they're running the db tool and passing the
path to the schema.
https://github.com/temporalio/temporal/issues/2059
## How did you test it?
I wrote a new unit test for reading the embedded file system, and the
existing codepath of the changed functions are all tested by the
existing unit tests. I also updated the unit test for config validation
to reflect the new changes.
I tested this locally with a locally running Postgres. Since the more
complex changes are in `updatetask.go`, which is shared by the sql and
the cassandra tool, I think there is no need to also test with a real
cassandra db. I also built the cassandra command line tool and confirmed
that the flags and validation checks behaved as expected.
## Potential risks
Schema updates could fail. But the changes are pretty contained to the
new `-s` flag which isn't used anywhere in production yet, so the risk
is very low. The code for the `-d` flag remained basically the same.
## Is hotfix candidate?
No
<!-- Describe what has changed in this PR -->
**What changed?**
Make cassandra schema update tool idempotent
<!-- Tell your future self why have you made these changes -->
**Why?**
So schema upgrade can be retried on partial failure case.
<!-- How have you verified this change? Tested locally? Added a unit
test? Checked in staging env? -->
**How did you test it?**
Tested locally, manually reset the schema_version back to older version
and run the tool. Observed the logging of 'Duplicate update...'
<!-- Assuming the worst case, what can be broken when deploying this
change to production? -->
**Potential risks**
No
<!-- Is this PR a hotfix candidate or require that a notification be
sent to the broader community? (Yes/No) -->
**Is hotfix candidate?**
No
* Revert "Fix auth plugin configuration to match the new SQLAuthPlugin config block (#2844)"
This reverts commit 5acbdd70b1.
* Revert rds-iam-auth - current drivers dont support authentication callbacks
Signed-off-by: Alexander Mays <alex@eastside.io>
Signed-off-by: Alexander Mays <alex@eastside.io>
Added:
A new environment variable to the CLI: SQL_AUTH_PLUGIN=rds-iam-auth
A new flag arg to the CLI: --sql-auth-plugin rds-iam-auth
2 new docker template variables: authPlugin: {{ default .Env.SQL_AUTH_PLUGIN "" }} and authPlugin: {{ default .Env.SQL_VIS_AUTH_PLUGIN "" }}
A new SQL configuration attribute authPlugin
Adds optional flag to disable initial host lookup when performing operations via the temporal-cassandra-tool. This is useful for some configurations of Cassandra where not having this flag enabled can significantly increase connection time or cause other issues. Validated that this worked against a test cluster.
Note that the server configuration also exposes this option, so we are just achieving parity between the server configuration and the tool configuration
* Added UnitTestLogger which sends log messages to the testing.T.Log API.
* Updated schema tool to work with full semantic versions, i.e., MAJOR.MINOR.PATCH
* Responded to PR comments
* Allow overriding host name for TLS host name verification in schema tools
* Disable TLS host name verification when `tls_disable_host_verification` or `tls-disable-host-verification` is set
* remove dryrun instead of making it "safer"
because it didn't actually show what it would do when the command was run anyway - it would just create a dummy db/keyspace and do a real schema update
* Add version check method to SQL interface
* Remove tools version check method in favor of functions defined in persistence package
* Refactor tests to not depend on tools package
Add a --datacenter flag to temporal-cassandra-tool on create that will
use NetworkTopologyStrategy for replication with the specified
replication factor.
This is highly useful for clusters with topologies more complex than
either single node or single node per rack with number of racks equal to
replication factor. Any other layout will benefit from this.
