Release v1.17.2 by github-actions[bot] · Pull Request #839 · overmindtech/cli

github-actions · 2026-03-23T09:44:19Z

Copybara Sync - Release v1.17.2

This PR was automatically created by Copybara, syncing changes from the overmindtech/workspace monorepo.

Original author: David Schmitt (david.schmitt@overmind.tech)

What happens when this PR is merged?

The tag-on-merge workflow will automatically create the v1.17.2 tag on main
This tag will trigger the release workflow, which will:
- Run tests
- Build and publish release binaries via GoReleaser
- Upload packages to Cloudsmith

Review Checklist

Changes look correct and match the expected monorepo sync
Tests pass (see CI checks below)

## Summary - Harden the shared Go tracing module to reduce SDK-side span loss before data reaches the collector. - Add structured OpenTelemetry SDK error reporting and improve tracer-provider lifecycle handling for the main and health pipelines. - Tune batching/export behavior for production resilience while avoiding CI hangs from collector-unavailable environments. ## Linear Ticket - **Ticket**: [ENG-3151](https://linear.app/overmind/issue/ENG-3151/harden-go-otel-sdk-against-span-loss) - Harden Go OTel SDK Against Span Loss - **Purpose**: Eliminate silent span-loss vectors in the shared Go OTel SDK setup and improve reliability/visibility of tracing failures. - **Blocks**: None ## Changes - `go/tracing/main.go` - Registers a custom OTel error handler (`otel.SetErrorHandler`) that routes SDK errors to logrus (`OpenTelemetry SDK error`). - Introduces shared `batcherOpts` with `WithMaxQueueSize(8192)` and `WithExportTimeout(60s)`; applies them to OTLP and stdout batchers. - Creates a separate OTLP exporter for `healthTp` to avoid shared-exporter lifecycle coupling. - Refactors shutdown to run `ForceFlush`/`Shutdown` for `tp` and `healthTp` in parallel via `errgroup` with a 10s timeout. - `go/tracing/main_test.go` - Adds tests for shutdown behavior/idempotency, error-handler routing, batcher queue-size configuration, and `InitTracer` error-handler setup. ## Deviations from Approved Plan - **Approach change: queue-full handling** - **Planned**: Use `sdktrace.WithBlocking()` to stop silent drops via backpressure. - **Implemented**: No blocking mode; instead `WithMaxQueueSize(8192)` (4x default) plus `WithExportTimeout(60s)`. - **Why**: Blocking mode caused test/CI hangs when no collector is reachable (each `span.End()` can block while exporter retries). Larger queue materially reduces drop risk without introducing request-path blocking in collector-unavailable environments. - **Test plan adjustment** - **Planned**: Add a blocking-behavior test asserting non-drop behavior under queue pressure. - **Implemented**: Replaced with queue-size configuration coverage and additional shutdown/idempotency/error-handler tests. - **Why**: With blocking mode removed, blocking-specific tests were no longer representative; coverage was redirected to the implemented resiliency strategy. - **Shutdown state handling** - **Planned**: Nil tracer provider globals after shutdown. - **Implemented**: Keep `tp`/`healthTp` references and rely on SDK stop-once semantics for safe repeated shutdown. - **Why**: Nilling globals introduced a race/panic risk for concurrent callers (e.g., health-check probes) during shutdown windows. --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> GitOrigin-RevId: b48c49666f1db350b0751cf8336ebde6b279facf

…ith BatchApplicationPackage adapter (#4287) ## Summary - Adds Step 10 (self-review and fix) to the Azure adapter creation skill, providing a structured 6-item quality checklist that agents run against their own output before opening a PR. - Extends BUGBOT rules to enforce IAMPermissions, PredefinedRole, and PotentialLinks completeness on all Azure adapters. - Validates the updated workflow end-to-end by creating a new Azure Batch Application Package adapter (deeply nested SearchableWrapper with 3 query parts). ## Linear Ticket - **Ticket**: [ENG-3154](https://linear.app/overmind/issue/ENG-3154/phase-2-self-review-and-pr-checklist) — Phase 2: Self-review and PR checklist - **Purpose**: Add a self-review quality gate to the Azure adapter creation workflow so autonomous adapter creation produces PRs that humans can confidently approve. - **Project**: Azure Adapter Creation Automation (v2) ## Changes ### Skill and documentation updates - **`.cursor/skills/azure-adapter-creation/SKILL.md`** — Added Step 10 (self-review and fix) with 6 checklist items: IAMPermissions, PredefinedRole, LinkedItemQueries completeness, PotentialLinks completeness, unit tests, and integration test structure. Updated File Checklist and Cloud Agent delegation sections to reference Step 10. Enhanced Step 8 from "Lint" to "Format, fix, and lint" (gofumpt + go fix before golangci-lint). Expanded DNS linking guidance to cover URL/endpoint fields (e.g. `StorageUrl`, `Endpoint`). Added pitfall: "Never implement TerraformMappings()". - **`.cursor/skills/azure-adapter-creation/references/AZURE-ADAPTER-PATTERNS.md`** — Removed obsolete TerraformMappings section (now AI-resolved). Removed Terraform registry URL reference comment pattern. - **`.cursor/skills/azure-adapter-creation/references/LINKED-ITEM-DISCOVERY.md`** — Expanded DNS section to cover URL/endpoint fields with `url.Parse()` hostname extraction example. - **`.cursor/skills/azure-adapter-creation/templates/adapter.go.tmpl`** — Removed `TerraformMappings()` method from template. - **`sources/.cursor/BUGBOT.md`** — Added rules for IAMPermissions/PredefinedRole enforcement and PotentialLinks completeness validation. ### New BatchApplicationPackage adapter (validation resource) - **`sources/azure/clients/batch-application-package-client.go`** — Client interface wrapping `armbatch.ApplicationPackageClient` with Get and List methods. - **`sources/azure/shared/mocks/mock_batch_application_package_client.go`** — Generated mock (mockgen). - **`sources/azure/manual/batch-batch-application-package.go`** — SearchableWrapper adapter: Get (accountName|applicationName|versionName), Search (accountName|applicationName), health mapping from PackageState, linked items to parent BatchApplication (GET), parent BatchAccount (GET), and DNS from StorageURL hostname (SEARCH). - **`sources/azure/manual/batch-batch-application-package_test.go`** — 16 unit test cases covering Get, Search, SearchStream, error handling, health states, PotentialLinks, nil-name skipping, and static link verification. - **`sources/azure/integration-tests/batch-batch-application-package_test.go`** — Integration test with Setup/Run/Teardown: creates storage account, batch account, batch application, and application package; verifies Get, Search, linked items, and item attributes; tears down in reverse order. - **`sources/azure/manual/adapters.go`** — SDK client creation and adapter registration (live + placeholder). - **`sources/azure/shared/utils.go`** — Added `pathKeysMap` entry for `azure-batch-batch-application-package` with keys `{"batchAccounts", "applications", "versions"}`. Applied gofumpt formatting. ### Reviewer focus areas - Step 10 checklist completeness in `SKILL.md` — does it catch the issues we've seen in prior adapter PRs? - BUGBOT rules wording — will these fire correctly on real adapter reviews? - BatchApplicationPackage linked items — 3 links (parent app, parent account, DNS from StorageURL). The DNS link uses `url.Parse()` to extract the hostname, which is the pattern the updated skill now teaches. ## Deviations from Approved Plan ### Addition: Removed TerraformMappings from skill, references, and template The plan did not include removing TerraformMappings guidance. During the skill update, TerraformMappings were identified as obsolete — they are now resolved automatically using AI. The outdated guidance would confuse future adapter creation agents into implementing a method that is no longer needed. Removed from SKILL.md (added as a pitfall), AZURE-ADAPTER-PATTERNS.md, and adapter.go.tmpl. ### Addition: Expanded DNS linking guidance to cover URL/endpoint fields The plan's LinkedItemQueries checklist item mentions verifying DNS links, but did not call out updating the SKILL.md Step 2 guidance or the LINKED-ITEM-DISCOVERY.md reference. During validation with BatchApplicationPackage (which has a `StorageURL` field), this gap was discovered: URL fields containing hostnames were not covered by the existing DNS linking instructions. The expanded guidance with `url.Parse()` + `Hostname()` prevents this pattern from being missed in future adapters. ### Addition: Enhanced Step 8 (Lint to Format, fix, and lint) The plan's post-checklist actions mention running gofumpt and go fix after self-review, but did not call out updating Step 8 itself. Moving these tools earlier in the workflow (Step 8, before Step 9 integration tests) reduces friction and catches formatting issues before test runs.  --- > [!NOTE] > **Medium Risk** > Medium risk due to adding a new Azure adapter wired into `manual/adapters.go` plus a new integration test and `GetResourceIDPathKeys` mapping, which could affect discovery and CI behavior if misconfigured. > > **Overview** > Adds a new Azure `BatchBatchApplicationPackage` `SearchableWrapper` (Batch account → application → package version) with a dedicated client interface, generated mocks, unit tests, and an end-to-end integration test. The adapter exposes `Get`/`Search` over a 3-part composite key, links back to the parent Batch application/account, and adds a global DNS link by parsing `Properties.StorageURL` hostnames. > > Updates the Azure adapter creation skill/docs to add a Step 10 self-review checklist, expand DNS linking guidance to include URL/endpoint hostname extraction, require format/fix before linting, and explicitly discourage implementing `TerraformMappings()`. Also extends `BUGBOT.md` to enforce `IAMPermissions`, `PredefinedRole`, and `PotentialLinks` completeness, and registers the new adapter + resource ID path key mapping (`azure-batch-batch-application-package`). > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit c1b4e86d92501397387503eb2b02aadabc74c451. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>  --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Lionel Wilson <Lionel-Wilson@users.noreply.github.com> Co-authored-by: David Schmitt <david.schmitt@overmind.tech> GitOrigin-RevId: d5ecc9ec30b5008e660838abd5aaf508eabe6e93

… (#4302) ## Summary - Add a GCP Dataflow Job dynamic adapter that discovers Dataflow jobs and links them to Pub/Sub topics/subscriptions, BigQuery tables/datasets, Spanner instances, Bigtable instances, Compute networks/subnetworks, IAM service accounts, and KMS crypto keys - This is the first step toward detecting outages like ISSUE-7070 where a missing Pub/Sub subscription caused a Dataflow job failure — the Pub/Sub links are the most critical piece - Adds `roles/dataflow.viewer` to all IAM role configuration surfaces and enables `dataflow.googleapis.com` in deployment config ## Linear Ticket - **Ticket**: [ENG-3222](https://linear.app/overmind/issue/ENG-3222/gcp-dataflow-job-adapter) — GCP Dataflow Job Adapter - **Purpose**: Enable infrastructure discovery for GCP Dataflow jobs so Overmind can map their dependencies and detect blast radius from changes to connected resources - **Related**: [ENG-3217](https://linear.app/overmind/issue/ENG-3217) — the original outage where a missing Pub/Sub subscription broke a Dataflow job ## Changes **New files:** - `sources/gcp/dynamic/adapters/dataflow-job.go` — Dynamic adapter with 12 link rules across Pub/Sub, BigQuery, Spanner, Bigtable, networking, and IAM - `sources/gcp/dynamic/adapters/dataflow-job_test.go` — Tests for Get, Search, ErrorHandling, and StaticTests validating all link rules - `docs.overmind.tech/docs/sources/gcp/Types/gcp-dataflow-job.md` — Type documentation page - `docs.overmind.tech/docs/sources/gcp/data/gcp-dataflow-job.json` — Type metadata **Modified files:** - `sources/gcp/shared/models.go` — `Dataflow` API and `Job` resource constants - `sources/gcp/shared/item-types.go` — `DataflowJob` item type - `sources/gcp/shared/predefined-roles.go` — `roles/dataflow.viewer` with permissions - `deploy/modules/ovm-services/gke.tf` — Enable `dataflow.googleapis.com` - `docs.overmind.tech/docs/sources/gcp/configuration.md` — Role in docs table and services list - `services/frontend/src/features/settings/sources/details/gcp-scripts.ts` — Role in setup scripts - `sources/gcp/setup/scripts/overmind-gcp-roles.sh` — Role in shell script **Known limitation:** `spannerDetails.databaseId` and `bigTableDetails.tableId` return plain names (not resource URIs) in the Dataflow API, so those links won't auto-resolve for compound-key target types. Link rules are kept for documentation and `PotentialLinks` registration. The critical Pub/Sub links work correctly. ## Approved Plan - **Plan approver**: Elliot - **Linear ticket**: [ENG-3222](https://linear.app/overmind/issue/ENG-3222/gcp-dataflow-job-adapter) (contains the approved plan) > Deviation analysis and reviewer assignment are handled automatically by the > pre-approved PR review automation (see docs/PREAPPROVED_CHANGES.md). ## Pre-PR Review <details> <summary>Review findings: 0 Blocking, 1 Warning, 4 Advisories, 0 Failed</summary> ### Security Review (P0) **Blocking: 0 | Warning: 0** No security findings. URL construction uses fixed `dataflow.googleapis.com` host. No new endpoints, no secrets, no auth changes. ### Architecture / Scope Review (P1) **Advisory: 3** 1. Cross-cutting scope — PR touches 4 top-level directories (sources/, deploy/, docs.overmind.tech/, services/frontend/) 2. New adapter is not behind a feature flag — acceptable for additive discovery capability 3. Existing customers who already ran setup will need to re-grant `roles/dataflow.viewer` to discover Dataflow jobs ### DevOps / Deployment Review (P1) **Warning: 1 | Advisory: 1** 1. (Warning) Infrastructure change without documented rollback — enabling `dataflow.googleapis.com` is low-risk and revertible via PR revert + terraform apply 2. (Advisory) Consider validating in dogfood before production rollout </details> Made with [Cursor](https://cursor.com)  --- > [!NOTE] > **Medium Risk** > Adds a new GCP discovery adapter plus new IAM role and API enablement across setup surfaces; risk is mainly around permission rollout and correctness of new link rules affecting dependency mapping (no write access or auth flow changes). > > **Overview** > Adds support for discovering **GCP Dataflow Jobs** via a new dynamic adapter (`gcp-dataflow-job`) with `GET` and location-scoped `SEARCH`, plus link rules to map job dependencies to Pub/Sub, BigQuery, Spanner, Bigtable, networking, IAM service accounts, and KMS keys. > > Wires this new resource into the system by introducing the `Dataflow` API / `Job` resource constants and `DataflowJob` item type, adding `roles/dataflow.viewer` (and required permissions) to predefined roles and all customer setup script surfaces (frontend templates, shell scripts, and docs), and enabling `dataflow.googleapis.com` in Terraform deployment config. Includes comprehensive adapter tests and new type metadata/docs for the Dataflow Job resource. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit d203d8485f5af18538afd47a02e6ab1ba6f153a7. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>  GitOrigin-RevId: f5918383aeae36e45e60c5f3f3abc7ec0b129bc3

## Summary Implements all-locations LIST support for 8 GCP adapters as specified in ENG-3225, enabling parameterless LIST queries to return resources across all locations without requiring location-specific queries. ## Changes ### Adapters Updated Added `ListEndpointFunc` with wildcard location support (`-`) for: - `cloudfunctions-function` - `container-cluster` - `eventarc-trigger` - `redis-instance` (with placeholder filtering) - `file-instance` - `logging-bucket` - `logging-saved-query` - `sql-admin-backup-run` (uses instance wildcard) ### Implementation Details - All adapters use `gcpshared.ProjectLevelListFunc` with wildcard `-` in location path - **Redis placeholder filtering**: Added `ListFilterFunc` framework to filter out phantom placeholder entries that GCP returns for unavailable locations (entries with names ending in `/instances/-`) - SQL Admin backup runs use project-wide instance wildcard (`projects/{project}/instances/-/backupRuns`) - Existing GET/SEARCH behavior preserved - `sql-admin-backup-run` now classified as SearchableListable adapter (updated test expectations) ### Framework Enhancements - Added `ListFilterFunc` type to `adapter-meta.go` for filtering LIST results - Implemented filtering support in `ListableAdapter.List()` and `ListStream()` methods - Similar pattern to existing `SearchFilterFunc` for consistency ### Tests - Added LIST test cases for all adapters - Added mock responses for wildcard endpoints - Added test for Redis placeholder filtering to verify phantom entries are excluded - Added comprehensive test coverage for eventarc-trigger adapter (GET, Search, List, ErrorHandling) - Updated adapter type test to reflect sql-admin-backup-run as SearchableListable - All tests pass successfully with race detector ## Validation ✅ All adapter tests pass ✅ Full gcp source test suite passes (3161 test cases) ✅ No lint issues ✅ Existing GET/SEARCH functionality preserved ✅ LIST returns items without requiring location parameters ✅ Redis placeholder entries are properly filtered ✅ Test expectations updated for adapter type classification ## Review Feedback Addressed 1. ✅ **Redis placeholder filtering**: Implemented `ListFilterFunc` to filter out placeholder entries with names ending in `/instances/-` 2. ✅ **Eventarc test coverage**: Added comprehensive test file with GET, Search, List, and ErrorHandling tests 3. ℹ️ **SQLAdminBackupRun**: This adapter has documented issues with extraction that exist independent of LIST support. The LIST endpoint is correct per GCP API docs and aligns with other adapters. Addressing the extraction issue is out of scope for this PR. ## Related Closes #ENG-3225  Linear Issue: [ENG-3225](https://linear.app/overmind/issue/ENG-3225/implement-all-locations-list-for-supported-gcp-adapters) <div><a href="https://cursor.com/agents/bc-e1effc5e-fdd9-4f85-93f8-27d2a52f9db1"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-e1effc5e-fdd9-4f85-93f8-27d2a52f9db1"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> GitOrigin-RevId: e47ccfb5b53f9b28717554481a4b1eb1e4da19ec

## Summary - Add `LIST` support to the GCP Dataflow job dynamic adapter using the Dataflow aggregated endpoint so jobs can be enumerated project-wide. - Preserve existing `GET` and location-based `SEARCH` behaviour while extending adapter capability to `SearchableListable`. - Add focused unit test coverage for the new list path and endpoint wiring. ## Linear Ticket - **Ticket**: [ENG-3227](https://linear.app/overmind/issue/ENG-3227/support-list-for-gcp-dataflow-jobs-via-aggregated-endpoint) — Support LIST for GCP Dataflow jobs via aggregated endpoint - **Purpose**: Enable project-wide Dataflow job discovery using the API's `jobs:aggregated` endpoint. - **Blocks**: None ## Changes Updated `sources/gcp/dynamic/adapters/dataflow-job.go` to add `ListEndpointFunc` with `https://dataflow.googleapis.com/v1b3/projects/%s/jobs:aggregated`, and updated `sources/gcp/dynamic/adapters/dataflow-job_test.go` with aggregated endpoint mocks and a new `List` test. Existing `GET`/`SEARCH` endpoints and metadata remain intact. ## Approved Plan - **Plan approver**: David Schmitt - **Linear ticket**: [ENG-3227](https://linear.app/overmind/issue/ENG-3227/support-list-for-gcp-dataflow-jobs-via-aggregated-endpoint) > Deviation analysis and reviewer assignment are handled automatically by the > pre-approved PR review automation (see docs/PREAPPROVED_CHANGES.md). ## Pre-PR Review <details> <summary>Review findings: 0 Blocking, 0 Warnings, 3 Advisories, 0 Failed</summary> ## Pre-PR Review Summary **Groups run:** Security, Architecture **Groups failed:** none **Result:** 0 Blocking, 0 Warnings, 3 Advisories, 0 Failed ### Advisory (consider) - [Security] Project ID interpolation in list URL construction is acceptable due to scope validation; aligns with existing adapter patterns. - [Architecture] Docs currently still show LIST struck through for `gcp-dataflow-job`; should be regenerated/synchronised. - [Architecture] LIST is an additive user-visible behaviour change; consider release note/customer communication. ### Clean Areas - [Security] No injection, XSS, SSRF, secrets exposure, broken access control, crypto, or dependency issues found. - [Architecture] Scope is limited to adapter+tests, no ADR conflicts, and pattern aligns with existing GCP adapters. </details> Made with [Cursor](https://cursor.com)  --- > [!NOTE] > **Medium Risk** > Adds a new project-wide LIST code path for Dataflow jobs using the `jobs:aggregated` endpoint, which could change discovery volume and behavior compared to location-scoped search/get. > > **Overview** > Enables **project-wide enumeration** of GCP Dataflow jobs by adding `ListEndpointFunc` wiring to the Dataflow job dynamic adapter, using the Dataflow `projects/%s/jobs:aggregated` API endpoint while preserving existing location-based `GET` and `SEARCH` endpoints. > > Extends unit tests to mock the aggregated endpoint and adds a new `List` test asserting the adapter implements `discovery.ListableAdapter` and returns the expected items/unique attributes. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit dc0ff93d244d89c12de006107e982131e718fde4. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>  GitOrigin-RevId: faf029ba13f122eca1e44544c943103673546e87

…(#4300) ## Summary - Renames 6 non-persisted proto fields in SDP for improved naming consistency, reducing ambiguity between `Reference` fields and the full `Item` message type — critical for LLM-assisted coding accuracy - No database migration required (protobuf wire format uses field numbers, not names) - This PR should land **before** the companion DB-migration ticket ([ENG-3148](https://linear.app/overmind/issue/ENG-3148)) to reduce that PR's diff surface ## Linear Ticket - **Ticket**: [ENG-3147](https://linear.app/overmind/issue/ENG-3147/sdp-naming-consistency-non-persisted-fields-no-db-migration) — SDP naming consistency — non-persisted fields (no DB migration) - **Purpose**: Rename 6 proto fields whose type is `Reference` but were named `item` (or similar), causing confusion with the full `Item` message type - **Blocks**: [ENG-3148](https://linear.app/overmind/issue/ENG-3148) — SDP naming consistency — persisted fields (DB migration required) ## Changes ### Proto Field Renames | Proto File | Message | Before | After | | --- | --- | --- | --- | | `items.proto` | `Expand` | `Reference item = 1;` | `Reference itemRef = 1;` | | `changes.proto` | `ItemDiffSummary` | `Reference item = 1;` | `Reference itemRef = 1;` | | `changes.proto` | `Risk` | `repeated Reference relatedItems = 4;` | `repeated Reference relatedItemRefs = 4;` | | `signal.proto` | `GetItemSignalDetailsRequest` | `Reference item = 1;` | `Reference itemRef = 1;` | | `revlink.proto` | `GetReverseEdgesRequest` | `Reference item = 2;` | `Reference itemRef = 2;` | | `gateway.proto` | `GatewayResponse` | `Reference deleteItem = 7;` | `Reference deleteItemRef = 7;` | ### Affected Components (48 files) - **Proto**: 5 `.proto` files renamed - **Generated code**: Regenerated Go (`.pb.go`) and TS (`_pb.ts`) bindings - **go/sdp-go**: `changes.go`, `sdpws/client.go` - **services/api-server**: `changesservice_test.go`, `signalservice.go`, `signalservice_test.go`, `changevalidation/`, `area51/changes.go`, `models/changes.go`, `runtask.go` - **services/gateway**: `request_session.go`, `graphstatetracker.go`, `prompts/change_details.tmpl`, tests - **services/revlink**: `connect_server.go`, `connect_server_test.go` - **Frontend**: `ChangeRisks.tsx`, `RiskCard.tsx`, `RiskDescriptionMarkdown.tsx`, `riskDescriptionTokens.ts`, `useRiskDisplay.tsx`, `RisksProvider.tsx`, `ItemSignalDetails.tsx`, `ItemSignalsAccordion.tsx`, stories & tests - **sdp-js**: `gateway-session.ts`, test helpers - **Test fixtures**: `v6/*.json` - **Documentation**: `extracting_data.md` ## Deviation Analysis vs [ENG-3147 Plan](https://linear.app/overmind/issue/ENG-3147/sdp-naming-consistency-non-persisted-fields-no-db-migration) ### Files in plan but NOT changed in this PR These files were listed in the plan but did not require changes — either because they don't actually reference the 6 renamed fields, or their references belong to the companion DB-migration ticket (ENG-3148: `ItemDiff.item`, `LinkedItem.item`): | Planned file | Reason not changed | | --- | --- | | `go/sdp-go/graph/main.go` | No references to renamed fields | | `go/sdp-go/progress.go` | No references to renamed fields | | `services/api-server/service/changesservice.go` | References are to `ItemDiff.item` / `LinkedItem.item` (ENG-3148 scope) | | `services/api-server/service/changeanalysis/*.go` (6 files) | References are to `ItemDiff.item` / `LinkedItem.item` (ENG-3148 scope) | | `services/api-server/area51/signals.go` | No references to renamed fields | | `services/api-server/service/routine/routine.go` | No references to renamed fields | | `go/discovery/`, `sources/snapshot/`, `stdlib-source/`, `cli/` | No references to renamed fields | | `services/frontend/.../renderableItem.ts` | No references to renamed fields | | `docs/domain-glossary.md` | No glossary entries for these field names | | `v6_benchmark_scenarios/**/scenario.json`, `README.md` | Fixtures use `ItemDiff.item` (ENG-3148 scope) | ### Files NOT in plan but changed in this PR These files contained references to the renamed fields but were not listed in the plan: | File | Reason changed | | --- | --- | | `go/sdp-go/sdpws/client.go` | Uses `deleteItemRef` (was `deleteItem`) | | `sdp-js/src/__tests__/gateway.test.ts` | Test references to `deleteItemRef` | | `sdp-js/src/__tests__/sampledata.helper.ts` | Test fixture with `deleteItemRef` | | `services/frontend/.../RiskDescriptionMarkdown.tsx` | Uses `itemRef` in risk description rendering | | `services/frontend/.../ItemSignalDetails.tsx` | Uses `itemRef` field | | `services/frontend/.../ItemSignalsAccordion.tsx` | Uses `itemRef` field | | `services/gateway/service/prompts/change_details.tmpl` | Go template references `RelatedItemRefs` | | `services/gateway/service/tools_test.go` | Test references to renamed fields | ### Summary of deviations The plan over-estimated the scope in `changeanalysis/` and several other Go packages — those files reference `ItemDiff.item` and `LinkedItem.item` which are **persisted** field renames deferred to ENG-3148. Conversely, the plan under-estimated the scope in `sdp-js` tests, gateway templates, and several frontend signal/risk components that also reference the renamed fields. **Net effect: 48 files changed vs ~60 estimated; all 6 field renames are complete.** ## Testing - ✅ Go code compiles successfully - ✅ Frontend TypeScript typechecks pass - ✅ sdp-js builds successfully ## Risk **Low.** No database migration, no stored data at risk. Protobuf wire format uses field numbers not names, so older CLI binaries remain compatible. Fixes ENG-3147 GitOrigin-RevId: 6d2d7ee0919759fe5399293835a1e8e3cce0b48b

…, and Plumbing (#4312)  ## Summary Phase 1 of the [GitHub App Installation Requests](https://linear.app/overmind/issue/ENG-3233) project. Adds the data foundation for tracking pending GitHub App installation requests from non-admin org members. ### Changes **Database (migration + schema)** - Add 5 nullable columns to `accounts`: `github_requested_org_id`, `github_requested_org_name`, `github_requested_at`, `github_requested_by`, `github_requested_user_id` - All columns have `COMMENT ON COLUMN` documentation **SQL queries (SQLC)** - `SetAccountGithubPendingRequest` — store pending request fields - `ClearAccountGithubPendingRequest` — null out all pending request fields - `GetAccountByGithubRequestedOrgID` — lookup by org ID (for webhook matching in Phase 3) - `GetAccountGithubPendingRequest` — lookup by account name **Proto (SDP)** - Add `optional string requestedOrgName`, `optional google.protobuf.Timestamp requestedAt`, `optional string requestedBy` to `GithubAppInformation` (field numbers 10-12) **Config plumbing** - Add `GithubClientID`, `GithubClientSecret`, `GithubWebhookSecret` to `ServerConfig` - Add viper bindings, CLI flags, and secret redaction in `MapFromServerConfig` - Add 1Password references in `.devcontainer/env/op.local.env` - Add `${localEnv:...}` passthrough in `.devcontainer/devcontainer.json` remoteEnv **API server behavior** - `GetGithubAppInformation` now returns pending request fields when no installation ID exists but a pending request is stored **Documentation** - Add GitHub App env vars to the API server README config table ### No user-facing behavior changes This is pure infrastructure. Phases 2-4 build on top of this. ### Related - Project plan: `docs/plans/github-app-installation-requests.md` - Sentry: [FRONTEND-NJ](https://overmindtech.sentry.io/issues/FRONTEND-NJ) - Linear: [ENG-3233](https://linear.app/overmind/issue/ENG-3233)  <div><a href="https://cursor.com/agents/bc-7fdb73b9-67f8-4d5d-a5f5-d07f5b6e8632"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-7fdb73b9-67f8-4d5d-a5f5-d07f5b6e8632"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> GitOrigin-RevId: 0586d483e565c41de6eebdd9f4e9086bfbb7f85b

… (#4328) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go) | `v1.79.2` → `v1.79.3` | ![age](https://developer.mend.io/api/mc/badges/age/go/google.golang.org%2fgrpc/v1.79.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/google.golang.org%2fgrpc/v1.79.2/v1.79.3?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. ### GitHub Vulnerability Alerts #### [CVE-2026-33186](https://redirect.github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3) ### Impact _What kind of vulnerability is it? Who is impacted?_ It is an **Authorization Bypass** resulting from **Improper Input Validation** of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. **Who is impacted?** This affects gRPC-Go servers that meet both of the following criteria: 1. They use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`. 2. Their security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. ### Patches _Has the problem been patched? What versions should users upgrade to?_ Yes, the issue has been patched. The fix ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. Users should upgrade to the following versions (or newer): * **v1.79.3** * The latest **master** branch. It is recommended that all users employing path-based authorization (especially `grpc/authz`) upgrade as soon as the patch is available in a tagged release. ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: #### 1. Use a Validating Interceptor (Recommended Mitigation) Add an "outermost" interceptor to your server that validates the path before any other authorization logic runs: ```go func pathValidationInterceptor(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) { if info.FullMethod == "" || info.FullMethod[0] != '/' { return nil, status.Errorf(codes.Unimplemented, "malformed method name") } return handler(ctx, req) } // Ensure this is the FIRST interceptor in your chain s := grpc.NewServer( grpc.ChainUnaryInterceptor(pathValidationInterceptor, authzInterceptor), ) ``` #### 2. Infrastructure-Level Normalization If your gRPC server is behind a reverse proxy or load balancer (such as Envoy, NGINX, or an L7 Cloud Load Balancer), ensure it is configured to enforce strict HTTP/2 compliance for pseudo-headers and reject or normalize requests where the `:path` header does not start with a leading slash. #### 3. Policy Hardening Switch to a "default deny" posture in your authorization policies (explicitly listing all allowed paths and denying everything else) to reduce the risk of bypasses via malformed inputs. --- ### Release Notes <details> <summary>grpc/grpc-go (google.golang.org/grpc)</summary> ### [`v1.79.3`](https://redirect.github.com/grpc/grpc-go/releases/tag/v1.79.3): Release 1.79.3 [Compare Source](https://redirect.github.com/grpc/grpc-go/compare/v1.79.2...v1.79.3) ### Security - server: fix an authorization bypass where malformed :path headers (missing the leading slash) could bypass path-based restricted "deny" rules in interceptors like `grpc/authz`. Any request with a non-canonical path is now immediately rejected with an `Unimplemented` error. ([#8981](https://redirect.github.com/grpc/grpc-go/issues/8981)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" in timezone Europe/London, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> GitOrigin-RevId: 9f42af848b86d574c8b74b26de541b844706029e

## Summary Adds a new Azure adapter for **NetworkFlowLog** resources (`Microsoft.Network/networkWatchers/flowLogs`). Flow Logs are child resources of Network Watchers that capture network traffic information for NSGs, VNets, or Subnets. ## Changes ### New files - `sources/azure/clients/flow-logs-client.go` — Client interface with `Get` and `NewListPager` - `sources/azure/shared/mocks/mock_flow_logs_client.go` — Generated mock - `sources/azure/manual/network-flow-log.go` — SearchableWrapper adapter (child of NetworkWatcher) - `sources/azure/manual/network-flow-log_test.go` — Unit tests (20 test cases) - `sources/azure/integration-tests/network-flow-log_test.go` — Integration test (Setup/Run/Teardown) ### Modified files - `sources/azure/shared/models.go` — Added `NetworkWatcher` resource constant, `OperationalInsights` API, `Workspace` resource - `sources/azure/shared/item-types.go` — Added `NetworkNetworkWatcher`, `OperationalInsightsWorkspace` item types - `sources/azure/shared/utils.go` — Added `pathKeysMap` entry for `azure-network-flow-log` - `sources/azure/manual/adapters.go` — Registered adapter in both live and metadata-only blocks ### Adapter details - **Wrapper type**: `SearchableWrapper` (child of NetworkWatcher) - **Get params**: `networkWatcherName`, `flowLogName` - **Unique attribute**: composite key via `CompositeLookupKey(networkWatcherName, flowLogName)` - **Health mapping**: ProvisioningState → SDP Health (Succeeded/Creating/Updating/Deleting/Failed/Canceled) - **Polymorphic TargetResourceID**: Detects NSG, VNet, or Subnet from ARM path segments ### Linked items (7 types) 1. **NetworkWatcher** (parent, GET) 2. **NetworkSecurityGroup** (via TargetResourceID, GET) 3. **VirtualNetwork** (via TargetResourceID, GET) 4. **Subnet** (via TargetResourceID, GET with composite key) 5. **StorageAccount** (via StorageID, GET) 6. **OperationalInsightsWorkspace** (via WorkspaceResourceID in Traffic Analytics config, GET) 7. **ManagedIdentityUserAssignedIdentity** (via Identity.UserAssignedIdentities, GET) ## Self-Review Checklist - [x] **IAMPermissions**: Present, references `Microsoft.Network/networkWatchers/flowLogs/read` - [x] **PredefinedRole**: Present, uses `Reader` - [x] **LinkedItemQueries**: 7 links verified (NetworkWatcher parent, polymorphic TargetResourceID for NSG/VNet/Subnet, StorageAccount, OperationalInsights workspace, user-assigned managed identities). No IP/DNS fields in FlowLog struct. - [x] **PotentialLinks**: 7 types listed, matches LinkedItemQueries - [x] **Unit tests**: All passing (Get, Get_VNetTarget, Get_SubnetTarget, Get_EmptyFlowLogName, Get_EmptyNetworkWatcherName, Get_InsufficientQueryParts, Search, Search_InvalidQueryParts, Search_FlowLogWithNilName, ErrorHandling_Get, ErrorHandling_Search, HealthMapping x4, Get_NoLinks, StaticTests) - [x] **Integration test**: Present, follows Setup/Run/Teardown structure All checklist items passed. Ready for review.  <div><a href="https://cursor.com/agents/bc-09f0d4e2-8363-4c23-8023-9a87b4d50d70"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-09f0d4e2-8363-4c23-8023-9a87b4d50d70"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> --------- Co-authored-by: Cursor Agent <cursor@overmind.tech> Co-authored-by: Lionel Wilson <Lionel-Wilson@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> GitOrigin-RevId: 1623143537d7d3600e3711b750af1bf67dd771a1

## Summary Resolves ENG-2676. Pins the GoReleaser version from `latest` to the exact version `v2.14.3` in all workflow files that use `goreleaser/goreleaser-action`, and adds a Renovate custom regex manager so version bumps are proposed automatically. ## Changes ### Version pinning All three `goreleaser-action` usages had `version: latest` replaced with `version: "v2.14.3"`: | File | Usage | | --- | --- | | `aws-source/module/provider/.github/workflows/release.yml` | Terraform provider release | | `cli/.github/workflows/release.yml` | CLI release | | `.github/workflows/ci.yml` | CI dry-run build | Each location includes a `# renovate: datasource=github-releases depName=goreleaser/goreleaser` comment hint above the `version:` line. ### Renovate support A new custom regex manager was added to `.github/renovate.json` that: - Scans `**/.github/workflows/*.yml` (covering root, `cli/`, and `aws-source/module/provider/` workflow directories) - Matches the `# renovate:` comment + `version:` line pattern - Uses the `github-releases` datasource for `goreleaser/goreleaser` This means Renovate will automatically open PRs when new GoReleaser releases are published.  Linear Issue: [ENG-2676](https://linear.app/overmind/issue/ENG-2676/pin-goreleaser-version-in-terraform-provider-release-workflow) <div><a href="https://cursor.com/agents/bc-da41845f-eb32-4f09-8435-ee546f468e1c"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-da41845f-eb32-4f09-8435-ee546f468e1c"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: David Schmitt <DavidS-ovm@users.noreply.github.com> GitOrigin-RevId: 3013c59e82ae4b1a67aa313be0a0ba6baaa3842e

> [!NOTE] > **Medium Risk** > Introduces new cloud-agent secret/env templates and a workflow for resolving Azure credentials via `inject-secrets`, which could affect how integration tests authenticate and increases the chance of accidental credential leakage if misused. > > **Overview** > Adds Cloud Agent support files to run Azure integration tests by resolving 1Password `op://...` references at runtime: new `.github/env/op.azure-cloud-agent.secret` (Azure SP + subscription IDs) and `.github/env/op.azure-cloud-agent.env` (enables tests). > > Updates Azure integration test docs with Cloud Agent setup, manual `inject-secrets` invocation, and security guidance, and ignores the generated resolved env output (`.env.azure-cloud-agent`) to prevent committing real credentials. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit cd999e1ccb7fc7eca180a207ada4a45dc5b4b53d. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>  GitOrigin-RevId: 07940caa380eefdf5ff95738f50f4867fdf48355

## Summary Add a new SearchableWrapper adapter for Azure PostgreSQL Flexible Server Backups using the `BackupsAutomaticAndOnDemandClient` from `armpostgresqlflexibleservers/v5`. ## Changes - **Client interface** (`sources/azure/clients/dbforpostgresql-flexible-server-backup-client.go`): Wraps `BackupsAutomaticAndOnDemandClient` with `Get` and `ListByServer` methods - **Adapter** (`sources/azure/manual/dbforpostgresql-flexible-server-backup.go`): SearchableWrapper implementation with Get, Search, SearchStream - Composite unique attribute (`serverName` + `backupName`) - GET link to parent `DBforPostgreSQLFlexibleServer` - **Registration** (`sources/azure/manual/adapters.go`): Live and placeholder registrations - **pathKeysMap** (`sources/azure/shared/utils.go`): Entry for `flexibleServers/backups` resource ID resolution - **Unit tests** (`sources/azure/manual/dbforpostgresql-flexible-server-backup_test.go`): Full coverage - **Integration test** (`sources/azure/integration-tests/dbforpostgresql-flexible-server-backup_test.go`): Setup/Run/Teardown structure ## Notes - Item type `DBforPostgreSQLFlexibleServerBackup` and resource constant `FlexibleServerBackup` already existed in `shared/item-types.go` and `shared/models.go` - The parent `DBforPostgreSQLFlexibleServer` adapter already had a SEARCH link and PotentialLinks entry for the backup type - The `BackupAutomaticAndOnDemand` struct has no IPs, DNS names, URLs, or references to other Azure resources beyond the parent server ## Self-Review Checklist - [x] **IAMPermissions**: Present, references `Microsoft.DBforPostgreSQL/flexibleServers/backups/read` - [x] **PredefinedRole**: Present, uses `Reader` - [x] **LinkedItemQueries**: 1 link verified (parent Flexible Server via GET). No IPs/DNS — struct has only `BackupType`, `CompletedTime`, `Source` fields. - [x] **PotentialLinks**: 1 type listed (`DBforPostgreSQLFlexibleServer`), matches LinkedItemQueries - [x] **Unit tests**: All passing (Get, GetWithInsufficientQueryParts, GetWithEmptyServerName, GetWithEmptyBackupName, Search, SearchStream, SearchWithInsufficientQueryParts, ErrorHandling_Get, ErrorHandling_Search, PotentialLinks, StaticTests) - [x] **Integration test**: Present, follows Setup/Run/Teardown structure All checklist items passed. Ready for review.  <div><a href="https://cursor.com/agents/bc-4198abea-6c30-421b-ba96-b995a0ddbba5"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-4198abea-6c30-421b-ba96-b995a0ddbba5"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> Co-authored-by: Lionel Wilson <Lionel-Wilson@users.noreply.github.com> GitOrigin-RevId: 86c926d761e9a5e417d804f7e5966f1c4fb22ef0

## Summary This PR implements Phase 1 of the snapshot source Docker image support, enabling the snapshot source to run as a container in the benchmark environment. ## Changes - **Created `sources/snapshot/build/package/Dockerfile`**: Follows the established pattern from GCP and Azure sources with multi-stage build - **Updated `build/images-bake.hcl`**: Added "snapshot" to the source matrix, enabling CI builds - **Updated `sources/snapshot/README.md`**: Added comprehensive Docker usage documentation with build and run examples - **Updated `docs/ARCHITECTURE.md`**: Added snapshot-source to the components list - **Fixed `.dockerignore`**: Added exception to include `docs.overmind.tech/docs/sources/` in Docker build context ## CI Fix The initial commit had a Docker build failure because `.dockerignore` was excluding the entire `docs.overmind.tech/` directory. The snapshot source needs access to `docs.overmind.tech/docs/sources/` which contains embedded adapter catalog data (JSON files with metadata like category, descriptive names, etc.). **Solution**: Modified `.dockerignore` to add an exception using `!docs.overmind.tech/docs/sources/` to allow this directory to be included in the Docker build context while still excluding the rest of `docs.overmind.tech/`. ## Validation All validation criteria from the implementation plan have been met: ✅ **Dockerfile builds successfully** - Verified the Dockerfile follows the same pattern as `sources/gcp` and `sources/azure` - Docker build now succeeds with catalog data properly embedded - Multi-stage build produces a minimal alpine-based runtime image ✅ **Binary runs with required environment variables** - Tested with `SNAPSHOT_SOURCE=/data/snapshot.json` environment variable - Verified NATS connection configuration works (requires `OVERMIND_MANAGED_SOURCE=true` with `NATS_SERVICE_HOST` and `NATS_SERVICE_PORT` for local NATS, or uses production NATS URL for cloud deployments) - Confirmed snapshot loading from test data file ✅ **Health check endpoint responds** - Tested `/healthz/alive` and `/healthz/ready` endpoints - Endpoints respond correctly on the configured port (default 8089, configurable via `--health-check-port`) - Returns appropriate status messages based on NATS connection and adapter initialization state ✅ **Image appears in CI build matrix** - Added to the `source` target matrix in `build/images-bake.hcl` - Will be built automatically on push to main alongside azure-source and gcp-source - Tagged as `ghcr.io/overmindtech/workspace/snapshot-source:${TAG}` ✅ **Tests pass** - All snapshot adapter unit tests pass - Adapter metadata correctly sourced from embedded catalog ✅ **CI builds pass** - All 46 CI jobs passing including Docker build ## Testing ```bash # Build the binary go build -o snapshot-source sources/snapshot/main.go # Run with test snapshot ALLOW_UNAUTHENTICATED=true \ SNAPSHOT_SOURCE=/workspace/services/api-server/service/changeanalysis/testdata/snapshot.json \ ./snapshot-source --health-check-port=9999 # Test health checks curl http://localhost:9999/healthz/alive curl http://localhost:9999/healthz/ready # Run tests cd sources/snapshot/adapters && go test -v ``` ## Docker Usage ```bash # Build the image docker buildx bake snapshot-source # Run the container docker run --rm \ -v /path/to/snapshot.json:/data/snapshot.json:ro \ -e SNAPSHOT_SOURCE=/data/snapshot.json \ -e NATS_SERVICE_HOST=nats \ -e NATS_SERVICE_PORT=4222 \ -e OVERMIND_MANAGED_SOURCE=true \ -e ALLOW_UNAUTHENTICATED=true \ ghcr.io/overmindtech/workspace/snapshot-source:dev ``` ## Related Issues - Closes ENG-3240 - Part of the "Improve local feedback cycles" project for LLM-based v6 change analysis benchmarking Linear Issue: [ENG-3240](https://linear.app/overmind/issue/ENG-3240/phase-1-snapshot-source-docker-image)  Linear Issue: [ENG-3240](https://linear.app/overmind/issue/ENG-3240/phase-1-snapshot-source-docker-image) <div><a href="https://cursor.com/agents/bc-18a45891-db10-44db-8523-bf9556848e40"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-18a45891-db10-44db-8523-bf9556848e40"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: carabasdaniel <carabasdaniel@users.noreply.github.com> GitOrigin-RevId: e55b0de25a597ca8e813d7be3003f27de06ce2be

> [!NOTE] > **Low Risk** > Low risk: small CLI behavior change gated behind a new flag, with no changes to secret resolution or output formatting unless `--no-ping` is used. > > **Overview** > `inject-secrets` now supports a `--no-ping` flag that skips the startup health check reading `op://global/PING/text`, allowing use with service-account tokens that can’t access the global vault. > > Updates the Azure integration test README to include `--no-ping` in the manual credential injection example. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 4d1d7872ab5326be96e6279c35097bdc6989db00. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>  GitOrigin-RevId: 176cfdce7974f4441fbdb2e85caab571a4366743

…4322)  ## Summary Add a SearchableWrapper adapter for Azure Load Balancer Frontend IP Configurations, enabling discovery and dependency tracking of this child resource of Load Balancers. ## Changes ### New files - `sources/azure/clients/load-balancer-frontend-ip-configurations-client.go` — client interface wrapping `armnetwork.LoadBalancerFrontendIPConfigurationsClient` - `sources/azure/shared/mocks/mock_load_balancer_frontend_ip_configurations_client.go` — generated mock - `sources/azure/manual/network-load-balancer-frontend-ip-configuration.go` — SearchableWrapper adapter implementation - `sources/azure/manual/network-load-balancer-frontend-ip-configuration_test.go` — unit tests (13 test cases) - `sources/azure/integration-tests/network-load-balancer-frontend-ip-configuration_test.go` — integration test (Setup/Run/Teardown) ### Modified files - `sources/azure/manual/adapters.go` — register the new adapter (init + placeholder) - `sources/azure/shared/utils.go` — add `pathKeysMap` entry for `loadBalancers/frontendIPConfigurations` ### Linked resources (10 types) | Link | Type | Method | Notes | | --- | --- | --- | --- | | Parent Load Balancer | `NetworkLoadBalancer` | GET | Always present | | Public IP Address | `NetworkPublicIPAddress` | GET | Cross-RG aware | | Subnet | `NetworkSubnet` | GET | Cross-RG aware, composite key | | Public IP Prefix | `NetworkPublicIPPrefix` | GET | Cross-RG aware | | Gateway LB Frontend IP | `NetworkLoadBalancerFrontendIPConfiguration` | GET | Self-referencing for chained LBs | | Inbound NAT Rules | `NetworkLoadBalancerInboundNatRule` | GET | Read-only refs from Azure | | Inbound NAT Pools | `NetworkLoadBalancerInboundNatPool` | GET | Read-only refs from Azure | | Outbound Rules | `NetworkLoadBalancerOutboundRule` | GET | Read-only refs from Azure | | Load Balancing Rules | `NetworkLoadBalancerLoadBalancingRule` | GET | Read-only refs from Azure | | Private IP Address | `stdlib.NetworkIP` | GET | Global scope | ### Parent adapter The existing `network-load-balancer.go` already has GET links to `NetworkLoadBalancerFrontendIPConfiguration` children (iterating inline `FrontendIPConfigurations`), and includes `NetworkLoadBalancerFrontendIPConfiguration` in its `PotentialLinks()`. No parent-side changes needed. ## Self-Review Checklist - [x] **IAMPermissions**: Present, references `Microsoft.Network/loadBalancers/frontendIPConfigurations/read` - [x] **PredefinedRole**: Present, uses `Reader` - [x] **LinkedItemQueries**: 10 link types verified (parent LB, PublicIP, Subnet, PublicIPPrefix, GatewayLB FrontendIP, InboundNatRules, InboundNatPools, OutboundRules, LoadBalancingRules, PrivateIP). IP links present. - [x] **PotentialLinks**: 10 types listed, matches LinkedItemQueries - [x] **Unit tests**: All passing (Get, StaticTests, Get_WithInsufficientQueryParts, Get_WithEmptyLoadBalancerName, Get_WithEmptyFrontendIPConfigName, Search, Search_WithNilName, Search_InvalidQueryParts, ErrorHandling_Get, ErrorHandling_Search, Get_CrossResourceGroupLinks, Get_NoProperties) - [x] **Integration test**: Present, follows Setup/Run/Teardown structure All checklist items passed. Ready for review.  <div><a href="https://cursor.com/agents/bc-bd2675cc-773e-4da8-a0a7-c484ce8d7883"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-bd2675cc-773e-4da8-a0a7-c484ce8d7883"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Cursor Agent <cursor@overmind.tech> Co-authored-by: Lionel Wilson <Lionel-Wilson@users.noreply.github.com> GitOrigin-RevId: b259eea6ec0448d38c676c6f7140013ecf3723c6

…layers (#4175) ## Summary - Restructure the sdpcache package after ENG-2977 (ShardedCache) into focused files with clean layering: storage → scheduling → Cache interface - Extract shared `lookupCoordinator` and `purger` structs to eliminate duplicated orchestration and scheduling code - Add 26 table-driven contract tests that validate all Cache methods across all implementations ## Changes 9 commits across 8 phases, touching 19 files (+3479 / -2860 lines). The diff is large but every commit is a self-contained, reviewable step. **Reviewers should focus on:** - `purger.go` — the extracted scheduling struct that all Cache implementations embed - `bolt.go` — BoltCache now owns its purger and wraps StoreItem/StoreError - `sharded.go` — single purger goroutine replaces 17, plus OTel span on Purge - `cache_contract_test.go` — the interface contract that all implementations must satisfy --- # Implementation Plan: sdpcache Refactor **Branch:** `refactor-cache` **Base:** `749c70af4` ([ENG-2977] Implement BoltDB hash-based sharding for sdpcache) **Goal:** After ENG-2977 landed ShardedCache, the sdpcache package had grown organically into two large files (`cache.go` ~1200 lines, `bolt_cache.go` ~800 lines) with duplicated lookup orchestration, duplicated purger scheduling, inconsistent test coverage, and a blurred boundary between storage and scheduling concerns. This plan restructures the package into focused, testable units with a clean layering: storage → scheduling → Cache interface. ## Background ENG-2977 added `ShardedCache` as the production default, wrapping N `boltStore` instances behind FNV-32a shard routing. The implementation was correct but introduced several maintenance hazards: 1. **Lookup orchestration duplicated** across BoltCache, ShardedCache, and MemoryCache — each had its own copy of the pending-work deduplication + search + retry flow 2. **Purger scheduling duplicated** between MemoryCache and boltStore — identical timer/goroutine/min-wait logic copied character-for-character 3. **ShardedCache started N purger goroutines** (17 in production) instead of coordinating a single purger at the cache level 4. **boltStore mixed storage and scheduling** — it embedded the purger but only worked correctly when wrapped by BoltCache; inside ShardedCache the per-shard purgers were dead weight 5. **All implementations and tests lived in two files** — cache.go and cache_test.go were ~2000 lines each 6. **No contract tests** — each implementation was tested independently with no shared assertion of Cache interface semantics ## Decisions | # | Decision | Choice | Rationale | | --- | --- | --- | --- | | 1 | Lookup dedup approach | Extract `lookupCoordinator` struct used by all three Cache implementations | Eliminates triplicated lookup orchestration; each Cache only defines `Search` | | 2 | File layout | One file per implementation (`memory.go`, `boltstore.go`, `bolt.go`, `sharded.go`) + shared types in `cache.go` | Each file under 500 lines; reviewable in isolation | | 3 | Purger dedup approach | Extract `purger` struct with callback injection, embed in Cache implementations | Eliminates duplicated timer/goroutine/scheduling code between MemoryCache and boltStore | | 4 | ShardedCache purger model | Single goroutine at ShardedCache level calling `sc.Purge` (fan-out) | Replaces N independent per-shard purgers; aligns with MemoryCache/BoltCache model | | 5 | Where purger lives | Cache implementations own scheduling; boltStore is pure storage + purge execution | boltStore no longer pretends to self-schedule; avoids dead purger structs in ShardedCache shards | | 6 | MinWaitTime configuration | Hardcoded in production constructor; no option func | `WithMinWaitTime` had exactly one call site with a hardcoded 30s value; option removed | | 7 | boltStore TTL floor | Remove the 100ms minimum TTL enforced in `StoreItem`/`StoreError` | Violated the Cache interface contract; other implementations didn't enforce it | | 8 | Test strategy | Table-driven contract tests covering all Cache methods for all stateful implementations; implementation-specific tests remain in dedicated `*_test.go` files | Contract tests catch interface drift; impl tests cover storage-specific edge cases | | 9 | OTel on ShardedCache.Purge | Add wrapping span with aggregate stats | Gives top-level observability for the combined purge; per-shard spans nest underneath | | 10 | Go idioms | Use `new(expr)` (Go 1.26) for pointer literals; `wg.Go` for goroutine fan-out | Reduces boilerplate in tests and production code | ## Phases ### Phase 1 — Centralize lookup deduplication **Commit:** `84e13827e` **What:** Extract `lookupCoordinator` into `lookup_coordinator.go`. It encapsulates the pending-work check → Search → retry flow. BoltCache, ShardedCache, and MemoryCache each pass themselves as a `cacheSearcher` and get dedup for free. **Files:** | File | Action | | --- | --- | | `lookup_coordinator.go` | **New** — `lookupCoordinator` struct, `cacheSearcher` interface, `Lookup` method | | `lookup_common_test.go` | **New** — Tests for coordinator edge cases (nil pending, unknown method) | | `cache.go` | Remove duplicated lookup logic; MemoryCache delegates to coordinator | | `bolt_cache.go` | Remove duplicated lookup logic; BoltCache delegates to coordinator | | `sharded_cache.go` | Remove duplicated lookup logic; ShardedCache delegates to coordinator | **Validation:** All existing tests pass unchanged. ### Phase 2 — Split implementations into focused files **Commit:** `a40975259` **What:** Extract `boltStore` into `boltstore.go`, `MemoryCache` into `memory.go`, and their tests into `boltstore_test.go` / `memory_test.go`. Inline the `boltLookupObserver` abstraction (was unnecessary indirection). Rename `sharded_cache.go` → `sharded.go`, `bolt_cache.go` → `bolt.go`. `cache.go` retains only shared types (`CacheKey`, `SST`, `Cache` interface, `NoOpCache`, `NewCache`). **Files:** | File | Action | | --- | --- | | `memory.go` | **New** — `MemoryCache` implementation extracted from `cache.go` | | `memory_test.go` | **New** — MemoryCache-specific tests extracted from `cache_test.go` | | `boltstore.go` | **Renamed** from `bolt_cache.go` — `boltStore` storage implementation | | `boltstore_test.go` | **New** — boltStore/BoltCache-specific tests extracted from `cache_test.go` | | `bolt.go` | **New** — thin `BoltCache` wrapper (Lookup + constructor) | | `sharded.go` | **Renamed** from `sharded_cache.go` | | `sharded_test.go` | **Renamed** from `sharded_cache_test.go` | | `cache.go` | Reduced to shared types and interface | | `cache_test.go` | Reduced to cross-cutting tests | **Validation:** All existing tests pass; `go vet` clean. `cache.go` drops from ~1200 to ~320 lines. ### Phase 3 — Housekeeping (goroutine patterns, interface asserts) **Commits:** `13da03978`, `231b58727` **What:** Modernize goroutine fan-out patterns to use `wg.Go` (Go 1.22+), add compile-time `var _ Cache = (*Impl)(nil)` assertions for all four implementations. **Files:** Multiple files, small mechanical changes. **Validation:** `go vet` clean; all tests pass. ### Phase 4 — Cache contract test suite **Commit:** `7444e17fb` **What:** Add comprehensive table-driven contract tests that run every Cache method against MemoryCache, BoltCache, and ShardedCache. NoOpCache gets its own dedicated test file. Document the Cache interface contract inline (state matrix, done() obligations, ignoreCache, GET cardinality, error precedence, TTL, copy semantics). Remove 7 tests from `cache_test.go` that are superseded by the contract suite. Update README to match current interface. **Files:** | File | Action | | --- | --- | | `cache_contract_test.go` | **New** — 26 contract tests covering Lookup, StoreItem, StoreError, Delete, Clear, Purge, GetMinWaitTime, StartPurger | | `noop_cache_test.go` | **New** — NoOpCache-specific tests | | `cache.go` | Normalize interface doc comments | | `cache_test.go` | Remove superseded tests, add file-level classification comments | | `README.md` | Update to match current interface | **Validation:** All contract tests pass for all three stateful implementations. `go vet` clean. ### Phase 5 — Fix boltStore TTL floor contract violation **Commit:** `7d377b27b` **What:** boltStore enforced a 100ms minimum TTL in `StoreItem` and `StoreError`, silently clamping caller-provided durations. No other implementation did this, violating the Cache interface contract. Remove the floor. **Files:** `boltstore.go` — remove the `if duration < 100*time.Millisecond` blocks. **Validation:** Contract tests and `go vet` pass. Short-TTL items now expire as requested. ### Phase 6 — Extract purger struct **Commit:** `5ed83de9a` **What:** MemoryCache and boltStore had character-for-character identical purger scheduling code (StartPurger, setNextPurgeFromStats, setNextPurgeIfEarlier, GetMinWaitTime, plus the fields they operate on). Extract into a `purger` struct in `purger.go` with a `purgeFunc` callback for storage-specific work. Both implementations embed `purger`. Move `PurgeStats` and `MinWaitDefault` to `purger.go`. **Files:** | File | Action | | --- | --- | | `purger.go` | **New** — `purger` struct, `PurgeStats`, `MinWaitDefault`, scheduling methods | | `memory.go` | Remove duplicated fields/methods; embed `purger`; constructor sets `purgeFunc = c.Purge` | | `boltstore.go` | Remove duplicated fields/methods; embed `purger`; constructor sets `purgeFunc = c.Purge` | | `memory_test.go` | Update `MinWaitTime` → `minWaitTime` (promoted unexported field) | **Validation:** All tests pass including contract suite. `go vet` clean. ### Phase 7 — Unify ShardedCache to single purger goroutine **Commit:** `0282f7f2c` **What:** ShardedCache.StartPurger previously delegated to each of its N boltStore shards, creating N independent goroutines and timers (17 in production). Embed `purger` directly in ShardedCache with `purgeFunc = sc.Purge` (the existing fan-out method). Remove `StartPurger` and `GetMinWaitTime` overrides (promoted from embedded purger). Add `setNextPurgeIfEarlier` calls in `StoreItem`/`StoreError` to poke the cache-level timer. Add OTel `"ShardedCache.Purge"` span with `ovm.cache.shardCount`, `ovm.cache.numPurged`, `ovm.cache.purgeDurationMs` attributes. Per-shard boltStore purger timers stay nil (never started), so shard-level `setNextPurgeIfEarlier` calls in `storeResult` are safe no-ops. **Files:** | File | Action | | --- | --- | | `sharded.go` | Embed `purger`; remove `StartPurger`/`GetMinWaitTime` overrides; add timer pokes in `StoreItem`/`StoreError`; add OTel span to `Purge` | **Validation:** All tests pass unchanged. Single goroutine replaces 17. ### Phase 8 — Move purge scheduling out of boltStore **Commit:** `c67e4e049` **What:** boltStore embedded `purger` and poked its own timer in `storeResult`, but this only worked when wrapped by BoltCache. Inside ShardedCache the per-shard purger was dead weight (nil timer, no-op pokes, 17 unused purger structs). Make boltStore a pure storage + purge-execution layer. BoltCache now embeds `purger` directly and adds `StoreItem`/`StoreError` wrappers. Remove `WithMinWaitTime` option (single call site); hardcode `minWaitTime = 30s` in the production constructor. All three Cache implementations (BoltCache, ShardedCache, MemoryCache) now uniformly own their scheduling. boltStore handles only storage and purge execution. **Files:** | File | Action | | --- | --- | | `boltstore.go` | Remove `purger` embedding, `purgeFunc` init, `setNextPurgeIfEarlier` from `storeResult`, `WithMinWaitTime` option | | `bolt.go` | Embed `purger`; wire `purgeFunc = c.boltStore.Purge`; add `StoreItem`/`StoreError` wrappers | | `sharded.go` | Remove `minWaitTime` copy from `shards[0]`; hardcode `30s` in production constructor; remove `WithMinWaitTime` from option list | | `README.md` | Remove `WithMinWaitTime` documentation | **Validation:** All tests pass. `go vet` clean. ## Final Architecture ``` ┌─────────────────────────────────────────────────────┐ │ Cache interface │ │ Lookup · StoreItem · StoreError · Delete · Clear │ │ Purge · GetMinWaitTime · StartPurger │ ├──────────┬───────────────┬──────────────┬───────────┤ │MemoryCache│ BoltCache │ ShardedCache │ NoOpCache │ │embed: │embed: │embed: │(all no-op)│ │ purger │ purger │ purger │ │ │ btrees │ *boltStore │ []*boltStore│ │ │ pending │ pending │ pending │ │ │ lookup │ lookup │ lookup │ │ ├───────────┴───────────────┴──────────────┘ │ │ purger (purger.go) │ │ StartPurger · GetMinWaitTime · timer lifecycle │ │ purgeFunc callback → storage-specific Purge() │ ├──────────────────────────────────────────────────────┤ │ boltStore (boltstore.go) │ │ Pure storage: Search · StoreItem · StoreError │ │ Purge execution: Purge · purgeLocked · compact │ │ No scheduling, no timer, no goroutines │ └──────────────────────────────────────────────────────┘ ``` ## Test Structure | File | Scope | | --- | --- | | `cache_contract_test.go` | 26 interface contract tests × 3 implementations | | `noop_cache_test.go` | NoOpCache-specific no-op semantics | | `memory_test.go` | MemoryCache internals (concurrent purge, stop/restart, dedup) | | `boltstore_test.go` | boltStore/BoltCache internals (persistence, compaction, disk-full) | | `sharded_test.go` | ShardedCache internals (distribution, fan-out, error routing, bounds) | | `lookup_common_test.go` | lookupCoordinator edge cases | | `cache_test.go` | Cross-cutting tests (unexpired overwrite logging) | | `cache_stuck_test.go` | Stuck goroutine detection | | `cache_benchmark_test.go` | Performance benchmarks | ## Risks and Mitigations | Risk | Mitigation | | --- | --- | | Removing boltStore TTL floor changes observable behaviour | Contract tests verify short TTLs work; the floor was undocumented and violated the interface | | ShardedCache single purger changes timing of compaction checks | Compaction remains per-shard inside `boltStore.Purge`; only scheduling is unified | | `WithMinWaitTime` removal breaks external callers | No external callers exist — package is self-contained with `NewCache(ctx)` as sole entry point | | Per-shard `setNextPurgeIfEarlier` calls become no-ops | `purger.setNextPurgeIfEarlier` checks `purgeTimer == nil` and returns early; verified in code and tests | Made with [Cursor](https://cursor.com)  --- > [!NOTE] > **Medium Risk** > Refactors core cache storage/lookup/purge scheduling paths (including TTL semantics and ShardedCache purge concurrency), which could affect cache hit/miss behavior and purge timing despite added contract coverage. > > **Overview** > Refactors `sdpcache` into cleaner layers by extracting shared `lookupCoordinator` (pending-work dedup + retry + GET cardinality) and `purger` (timer-based purge scheduling) and moving each cache implementation into its own focused file. > > Changes `BoltCache` to wrap a pure `boltStore` (storage + purge execution only) while `BoltCache`/`MemoryCache`/`ShardedCache` embed `purger`; `ShardedCache` now runs a **single** cache-level purger goroutine, adds top-level OTel span/attributes for `Purge`, and ensures shard reads use `Search` to avoid stacked dedup. > > Updates cache behavior/docs by removing the Bolt TTL floor (no minimum TTL), dropping `WithMinWaitTime` from bolt options, and expanding `Cache` contract documentation; adds a large table-driven `cache_contract_test.go` suite plus reorganized backend-specific tests/benchmarks and README updates. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 874d1043cd559bc1381e45aa5e1ed7eebcacee14. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>  --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: David Schmitt <DavidS-ovm@users.noreply.github.com> GitOrigin-RevId: 4ae942c5c812bdcc7d0fc5b11b643e31a3d8b229

… install flow (#4338) ## Summary - Replace the non-functional cookie-based CSRF mechanism with a database-backed opaque UUID `state` parameter for the GitHub App install OAuth flow - Add `CreateGithubInstallURL` RPC so the frontend can request a signed install URL rather than constructing one client-side - Add River periodic cleanup job (12h interval) for expired state tokens (7-day TTL) ## Linear Ticket - **Ticket**: [ENG-3281](https://linear.app/overmind/issue/ENG-3281) — Phase 2a: DB-backed state parameter (backend + DB) - **Purpose**: Fix the broken CSRF protection in the GitHub App install callback by replacing cookie-based state with a server-generated, DB-backed UUID - **Blocks**: [ENG-3282](https://linear.app/overmind/issue/ENG-3282) (Phase 2b: Frontend — activate DB-backed state flow) ## Changes **Database:** - New `github_oauth_states` table with UUID primary key, account_name FK, and created_at timestamp - Atlas migration for the new table - SQLC queries: `CreateGithubOAuthState`, `ConsumeGithubOAuthState`, `CleanupExpiredGithubOAuthStates` - Changed `UpdateAccountGithubInstallationID` and `SetAccountGithubPendingRequest` to `:execrows` for zero-row detection **Protobuf:** - New `CreateGithubInstallURL` RPC in `ConfigurationService` with request/response messages - Regenerated Go and TypeScript protobuf code **Backend:** - `CreateGithubInstallURL` handler: creates DB state row, builds install URL with state UUID - New callback handler (`GET /api/github/callback`): consumes DB state for account identity, handles install/request/update flows - OAuth helpers: code exchange, user lookup, installations list, pending request disambiguation (most recent by `created_at`) - Unique constraint violation on `github_requested_org_id` handled with `?error=org_already_claimed` redirect - `InstallationValidator` function type for testable GitHub App-level validation - River periodic cleanup job for expired states - `GithubAppName` config wired through Viper flags, config, and Terraform **Tests:** - 7 callback handler test cases with mock GitHub server and DB-backed state - 4 OAuth helper unit tests including disambiguation logic - All tests pass with `-race`; atomic counter for unique installation IDs ## Approved Plan - **Plan approver**: Daniel Carabas - **Linear ticket**: [ENG-3281](https://linear.app/overmind/issue/ENG-3281/phase-2a-db-backed-state-parameter-backend-db) (plan in description) > Deviation analysis and reviewer assignment are handled automatically by the > pre-approved PR review automation (see docs/PREAPPROVED_CHANGES.md). ## Pre-PR Review <details> <summary>Review findings: 0 Blocking, 5 Warnings, 5 Advisories, 0 Failed</summary> ### Security Review (0 Blocking, 4 Warning) - [Warning] No auth tests for `CreateGithubInstallURL` — other config RPCs have unauthenticated/wrong-scope tests; this new RPC does not. Consider adding in Phase 2b or a follow-up. - [Warning] `GithubAppName` not validated for URL-unsafe characters — consider restricting to alphanumeric/hyphen. - [Warning] Unauthenticated callback endpoint `GET /api/github/callback` — intentional (OAuth redirect from GitHub); does not expose internal data; account identity from DB-backed single-use state UUID. - [Warning] No rate limiting on callback endpoint — consider adding for DoS resilience. Verified secure: `CreateGithubInstallURL` enforces `config:write` scope; callback only redirects with fixed error codes; state is consumed once; SQL is parameterized; no SSRF (URLs from config); no XSS (error codes URL-escaped). ### Database Review (0 Blocking, 1 Warning) - [Warning] No index on `github_oauth_states.created_at` — cleanup query filters on this column; acceptable for a small, short-lived table but consider adding if it grows. All blocking checks pass: no manually edited .sql.go files, no destructive migrations, account_name filtering appropriate for internal-only table. ### Architecture Review (5 Advisory) - [Advisory] Cross-cutting scope — changes span `.devcontainer/`, `go/sdp-go/`, `sdp/`, `sdp-js/`, `services/api-server/`, `deploy/`. - [Advisory] New user flow without feature flag — acceptable as a security fix for broken CSRF. - [Advisory] Customer-facing workflow changes — frontend will need to call `CreateGithubInstallURL` (Phase 2b). - [Advisory] No ADR conflicts detected. - [Advisory] Consider monitoring/alerting on high error rates for callback handler and cleanup worker. ### DevOps Review (0 Blocking, 0 Warning after fix) - ~~[Warning] `GithubAppName` env var not wired through Viper/Terraform~~ — **Fixed** in follow-up commit. - [Advisory] Span name `CleanupGithubOAuthStates` could use `ovm.` prefix for consistency. - [Advisory] OTel attributes correctly use `ovm.` prefix and camelCase. </details> ## Deviations from Approved Plan > Implementation matches the approved plan — no material deviations. The `GithubAppName` Viper/Terraform wiring was implicit in the plan (which specified adding the config field and env var) but was missed in the initial commit. Fixed in a follow-up commit before PR creation. Made with [Cursor](https://cursor.com)  --- > [!NOTE] > **High Risk** > Adds a new unauthenticated GitHub OAuth callback endpoint plus new DB tables/queries and account-write paths for storing installations/requests, so mistakes could impact account linking and security of the install flow. > > **Overview** > Implements a DB-backed `state` token for the GitHub App installation OAuth flow and exposes a new `ConfigurationService.CreateGithubInstallURL` RPC (Go + TS generated clients) so the frontend can request a server-built install URL. > > Adds a new `github_oauth_states` table with sqlc queries and a River periodic cleanup worker (7-day TTL, runs every 12h) to manage single-use state tokens. > > Introduces `GET /api/github/callback` to consume/validate state, exchange the OAuth code, verify user identity (GitHub verified email vs Auth0 user in account), and then either store the installation ID or record a pending org request with clear redirect error codes and unique-violation handling. > > Wires new `github-app-name`/`API_SERVER_GITHUB_APP_NAME` config through dev env + Terraform, adds `dbkit.IsUniqueViolation`, and updates sqlc account update queries to return `RowsAffected` for not-found detection. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 67a083c2cc06494f93d965d304a4534bf786cc48. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>  GitOrigin-RevId: 18c0e3cb962efbc72544cc41c16422abaad3906d

….4.1 [security] (#4347) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/modelcontextprotocol/go-sdk](https://redirect.github.com/modelcontextprotocol/go-sdk) | `v1.4.0` → `v1.4.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fmodelcontextprotocol%2fgo-sdk/v1.4.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fmodelcontextprotocol%2fgo-sdk/v1.4.0/v1.4.1?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. ### GitHub Vulnerability Alerts #### [GHSA-q382-vc8q-7jhj](https://redirect.github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-q382-vc8q-7jhj) The Go SDK recently transitioned to the `segmentio/encoding` library for JSON parsing in version 1.3.1. While this change addressed both case-insensitivity and ASCII folding issues, the new parser implemented aggressive key matching that treated keys with `null` Unicode characters appended at the end as equivalent to their base strings. #### Impact When combined with duplicate keys, the described behavior leads to a "last key wins" resolution that could override the intended MCP message. This had the potential for: - **Bypassing intermediary inspection:** Proxies or policy layers that matched on exact field names may have failed to detect or filter these messages. - **Cross-implementation inconsistency:** Other MCP SDKs (TypeScript, Python) use case-sensitive parsing and would reject the same messages, creating potential security-boundary confusion. #### Fix: The `segmentio/encoding` package was patched with a fix in segmentio/encoding@7d5a25d and a new version of the package was released (`v0.5.4`). The SDK switched to the patched version of the dependency in 724dd47aa. Users are advised to update to v1.4.1 to resolve this issue. #### Credits: Thank you to Francesco Lacerenza (Doyensec) for reporting this issue. --- ### Release Notes <details> <summary>modelcontextprotocol/go-sdk (github.com/modelcontextprotocol/go-sdk)</summary> ### [`v1.4.1`](https://redirect.github.com/modelcontextprotocol/go-sdk/releases/tag/v1.4.1) [Compare Source](https://redirect.github.com/modelcontextprotocol/go-sdk/compare/v1.4.0...v1.4.1) ***This release is a patch release for v1.4.0.*** It contains cherry-picks for several security improvements. Security advisories will follow. ### Fixes #### Update of the `segmentio/encoding` module version The JSON parsing library that was adopted to avoid attacks taking advantage of the Go's standard parser being case insensitive turned out to contain an issue itself. We have submitted the fix upstream and this release updates the dependency to the patched version. #### Cross-origin requests protection We have added additional protection against cross origin requests. From now on, we verify that `Content-Type` for JSON-RPC `POST` requests is set to `application/json` and use the new `http.CrossOriginProtection` functionality to verify the origin of the request. Usage of this functionality required **increasing the required Go version to 1.25**, which is in line with our Go version policy of supporting two newest Go versions. The behavior can be customized by passing a configured `http.CrossOriginProtection` object to `StreamableHTTPOptions`. Since this is a behavior change, we introduced a compatibility parameter `disablecrossoriginprotection` that will allow to temporarily disable it. It will be removed in `v1.6.0` version of the SDK. See [here](https://redirect.github.com/modelcontextprotocol/go-sdk/blob/main/docs/mcpgodebug.md) for more details about behavior changes and a history of compatibility parameters across SDK versions. #### Allowing customization of `http.Client` for client-side OAuth We have introduced an optional `http.Client` parameter to `AuthorizationCodeHandlerConfig`. This allows customization of the transport, for example implementing environment specific protection against [Server-Side Request Forgery](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices#server-side-request-forgery-ssrf). ### Pull requests - internal: fix Unicode zero character handling by [@maciej-kisiel](https://redirect.github.com/maciej-kisiel) in [#841](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/841) - auth: allow passing custom http.Client to AuthorizationCodeHandler by [@maciej-kisiel](https://redirect.github.com/maciej-kisiel) in [#840](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/840) - mcp: verify 'Origin' and 'Content-Type' headers by [@maciej-kisiel](https://redirect.github.com/maciej-kisiel) in [#842](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/842) **Full Changelog**: <modelcontextprotocol/go-sdk@v1.4.0...v1.4.1> </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" in timezone Europe/London, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> GitOrigin-RevId: 25faf3a4f8dc8c406e86a6df26dfc1813eb42795

… d00831a (#4348) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [google.golang.org/genproto/googleapis/rpc](https://redirect.github.com/googleapis/go-genproto) | require | digest | `0b37fe3` → `d00831a` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. --- ### Configuration 📅 **Schedule**: Branch creation - "before 10am on friday" in timezone Europe/London, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace).  GitOrigin-RevId: 0a1e9e58d73c42d7efca6eadb2c7cbb9ba90f811

> [!NOTE] > **Medium Risk** > Mostly test/documentation changes, but it also alters the Capacity Reservation Group adapter to stop sending unsupported `$expand` options, which could change returned data and behavior in production. Risk is moderate due to touching live Azure API call parameters and broad test-suite behavior. > > **Overview** > **Improves Azure integration test stability** by adding consistent `setupCompleted` gating (skip `Run` when `Setup` didn’t finish), adding preflight `Get` checks for resources that may be pre-provisioned, and introducing wait/poll helpers to handle eventual consistency (role assignments, Key Vault secrets) and long-running operations/timeouts (Key Vault creation, PostgreSQL, bounded deletes). > > **Handles common Azure failure modes explicitly**: treats `409 Conflict` as non-success unless a subsequent `Get` confirms the resource exists (VM/VM extension/run-command, role assignments), fails fast on repeated `404`s during wait loops, and skips tests on external conditions like Batch quota exhaustion and NSG flow log retirement. > > **Aligns unique-attribute expectations** in storage integration tests with composite key usage (e.g., blob containers) and updates guidance/docs (`SKILL.md`, integration test `README.md`, `BUGBOT.md`) to codify these patterns. Also updates the `compute-capacity-reservation-group` adapter (and its unit test helper) to pass `nil` `Get` options instead of an `$expand` that can trigger `400 Bad Request`. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 15a3d13d7673f090b478441cadc09a3f78a14d61. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>  <img width="1058" height="654" alt="image" src="https://github.com/user-attachments/assets/89d7ff94-9655-4bc8-94bb-a400e6d7fc90" /> GitOrigin-RevId: 52434ebdb6ab5beb8a842e630b79266866fc61e1

DavidS-ovm and others added 23 commits March 23, 2026 09:42

Run go mod tidy

a3d534c

DavidS-ovm merged commit 529282b into main Mar 23, 2026

DavidS-ovm deleted the copybara/v1.17.2 branch March 23, 2026 16:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Release v1.17.2#839

Release v1.17.2#839
DavidS-ovm merged 23 commits intomainfrom
copybara/v1.17.2

github-actions bot commented Mar 23, 2026 •

edited by DavidS-ovm

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

github-actions bot commented Mar 23, 2026 • edited by DavidS-ovm Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Copybara Sync - Release v1.17.2

What happens when this PR is merged?

Review Checklist

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

github-actions bot commented Mar 23, 2026 •

edited by DavidS-ovm

Loading