Merge remote-tracking branch 'origin/staging' into chore/sync-dev-with-staging-2026-10-23

Author: waleedlatif1

.github/actions/setup/action.yml

@@ -66,6 +66,20 @@ runs:
         key: ${{ github.repository }}-${{ inputs.turbo-cache-key }}-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
         path: ./.turbo
 
+    # Bun retries a failed request itself, but a registry connection that stalls
+    # without failing leaves `bun install` waiting until the job's own timeout
+    # cancels it, the whole budget spent on one hung step. Healthy installs finish
+    # in under two and a half minutes cold, so an attempt past three is stalled:
+    # kill it and retry once, which leaves room inside the shortest caller's
+    # 10-minute job timeout. Any other failure is real and fails at once.
     - name: Install dependencies
       shell: bash
-      run: bun install --frozen-lockfile --ignore-scripts
+      run: |
+        for attempt in 1 2; do
+          timeout --kill-after=15s 3m bun install --frozen-lockfile --ignore-scripts && exit 0
+          status=$?
+          if [ "$status" -ne 124 ] && [ "$status" -ne 137 ]; then exit "$status"; fi
+          echo "::warning title=bun install stalled::attempt ${attempt} of 2 ran past 3 minutes"
+        done
+        echo "::error title=bun install stalled::both attempts ran past 3 minutes"
+        exit 1

.github/scripts/get-ecr-image-digest.sh

@@ -9,7 +9,7 @@ if [ -n "$ALLOW_MISSING" ] && [ "$ALLOW_MISSING" != '--allow-missing' ]; then
   exit 1
 fi
 export AWS_PAGER=''
-aws ecr batch-get-image --repository-name "$REPOSITORY" --image-ids imageTag="$TAG" --output json |
+aws --cli-connect-timeout 10 --cli-read-timeout 20 ecr batch-get-image --repository-name "$REPOSITORY" --image-ids imageTag="$TAG" --output json |
   ALLOW_MISSING="$ALLOW_MISSING" python3 -c '
 import json, os, re, sys
 response = json.load(sys.stdin)

.github/scripts/promote-app-image.sh

@@ -9,9 +9,22 @@ RELEASE_TAG="${5:-}"
 : "${GITHUB_OUTPUT:?GitHub output file required}"
 SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 PREVIOUS=$(bash "$SCRIPT_DIR/get-ecr-image-digest.sh" "$REPOSITORY" "$DEPLOY_TAG" --allow-missing)
+# A tag read straight after the move can still return the previous image, which
+# reports a moved tag as unchanged. The dry run prints the exact manifest the
+# move pushes (plus a trailing newline), so its hash is the digest the tag will
+# point at, known before the move.
+MANIFEST=$(docker buildx imagetools create --dry-run -t "$REGISTRY/$REPOSITORY:$DEPLOY_TAG" "$REGISTRY/$REPOSITORY:$SOURCE_TAG")
+DIGEST="sha256:$(printf '%s' "$MANIFEST" | sha256sum | cut -d' ' -f1)"
 EPOCH=$(date +%s)
 bash "$SCRIPT_DIR/promote-image.sh" "$REGISTRY" "$REPOSITORY" "$SOURCE_TAG" "$DEPLOY_TAG" "$RELEASE_TAG"
-DIGEST=$(bash "$SCRIPT_DIR/get-ecr-image-digest.sh" "$REPOSITORY" "$DEPLOY_TAG")
+deadline=$(( $(date +%s) + 60 ))
+until [ "$(bash "$SCRIPT_DIR/get-ecr-image-digest.sh" "$REPOSITORY" "$DEPLOY_TAG" --allow-missing)" = "$DIGEST" ]; do
+  if [ "$(date +%s)" -ge "$deadline" ]; then
+    echo "ERROR: $DEPLOY_TAG did not resolve to the pushed $DIGEST within 60s; cutover cannot be correlated" >&2
+    exit 1
+  fi
+  sleep 3
+done
 CHANGED=true
 if [ "$DIGEST" = "$PREVIOUS" ]; then CHANGED=false; fi
 {

.github/workflows/ci.yml

@@ -213,7 +213,7 @@ jobs:
         uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2
 
       - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -365,14 +365,14 @@ jobs:
         uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2
 
       - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GHCR
         if: github.ref == 'refs/heads/main'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -671,10 +671,11 @@ jobs:
       # push: a push that never deployed, or whose submission failed, would otherwise drop its
       # changed URLs for good. The check-runs lookup asks for this one check per commit, so it
       # stays small and counts every attempt of a re-run; a lookup that errors counts as no
-      # success. With no success in view, the base is the oldest run in view, so URLs that no
-      # submission ever covered are sent now. The diff needs only the two trees, so that one
-      # commit is fetched alone; an all-zero `before` (the branch's first push) has no base,
-      # which the script skips.
+      # success. With no success in view, the base is the first parent of the oldest run in view,
+      # so URLs that no submission ever covered, that run's own included, are sent now; a failed
+      # parent lookup fails the step, so the next run retries from the same base. The diff
+      # needs only the two trees, so that one commit is fetched alone; an all-zero `before` (the
+      # branch's first push) has no base, which the script skips.
       - name: Submit changed URLs to IndexNow
         env:
           GH_TOKEN: ${{ github.token }}
@@ -691,7 +692,10 @@ jobs:
             fi
           done < <(gh api "repos/$GITHUB_REPOSITORY/actions/workflows/ci.yml/runs?branch=main&event=push&per_page=30" \
             --jq ".workflow_runs[] | select(.id < $GITHUB_RUN_ID) | .head_sha")
-          BASE_SHA="${BASE_SHA:-${OLDEST_SHA:-$PUSH_BEFORE}}"
+          if [[ -z "$BASE_SHA" && -n "$OLDEST_SHA" ]]; then
+            BASE_SHA="$(gh api "repos/$GITHUB_REPOSITORY/commits/$OLDEST_SHA" --jq '.parents[0].sha // empty')"
+          fi
+          BASE_SHA="${BASE_SHA:-$PUSH_BEFORE}"
           echo "Submitting URLs changed in $BASE_SHA..$GITHUB_SHA"
           if [[ ! "$BASE_SHA" =~ ^0+$ ]]; then
             git fetch --no-tags --depth=1 origin "$BASE_SHA"
@@ -750,7 +754,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
 
       - name: Login to GHCR
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -804,7 +808,7 @@ jobs:
 
     steps:
       - name: Login to GHCR
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -888,7 +892,7 @@ jobs:
       count: ${{ steps.resolve.outputs.count }}
     steps:
       - name: Login to GHCR
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -1069,7 +1073,7 @@ jobs:
 
     steps:
       - name: Login to GHCR
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}

.github/workflows/desktop-e2e.yml

@@ -168,9 +168,11 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
+      # The bunfig age gate would resolve `latest` to the newest week-old release; the canary
+      # exists to test the release that just shipped. Already-locked packages stay locked.
       - name: Switch to electron@latest
         working-directory: apps/desktop
-        run: bun add --no-save -d electron@latest
+        run: bun add --no-save -d --minimum-release-age=0 electron@latest
 
       - name: Bundle main and preload
         working-directory: apps/desktop

.github/workflows/helm.yml

@@ -188,6 +188,12 @@ jobs:
             --values helm/sim/ci/kind-overlay.yaml \
             --wait --timeout 15m
 
+      - name: Run helm test
+        run: helm test sim --namespace sim --timeout 5m
+
+      # After the test, so it also explains a failed probe, not only a failed
+      # install. A failed test pod is kept (the hook deletes it only on success),
+      # so its log says which URL refused.
       - name: Diagnostics on failure
         if: failure()
         run: |
@@ -196,9 +202,8 @@ jobs:
           kubectl -n sim describe pods | tail -100 || true
           kubectl -n sim logs deploy/sim-app -c migrations --tail=50 || true
           kubectl -n sim logs deploy/sim-app --tail=80 || true
-
-      - name: Run helm test
-        run: helm test sim --namespace sim --timeout 5m
+          kubectl -n sim logs deploy/sim-realtime --tail=80 || true
+          kubectl -n sim logs sim-test-connection || true
 
   # Resolved once and shared, so the two publish paths cannot package the same
   # immutable chart version with different appVersions -- they run in parallel,
@@ -277,7 +282,7 @@ jobs:
       # oras also reads ~/.docker/config.json, so this one login covers both the
       # chart push and the Artifact Hub metadata push below.
       - name: Login to GHCR
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}

.github/workflows/migrate.yml

@@ -38,8 +38,41 @@ jobs:
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     # Bulk projection loads and concurrent index builds can outlast ordinary schema changes.
     timeout-minutes: 300
+    # One migrate job per environment at a time, so a manual dispatch queues
+    # behind a CI run instead of racing it for migrate.ts's advisory lock, which
+    # gives up after 30 minutes. Job-level because a called workflow evaluates
+    # workflow-level concurrency with the caller's github context; the group
+    # must also never equal ci.yml's ci-<ref> group or the two deadlock.
+    concurrency:
+      group: migrate-${{ inputs.environment }}
+      cancel-in-progress: false
 
     steps:
+      # An environment only migrates from its own branch, so a manual dispatch
+      # from a feature branch cannot apply that branch's migrations to a shared
+      # database. Under workflow_call github.ref is the caller's ref (ci.yml's
+      # push to main/staging/dev). This fails rather than skips: ci.yml's
+      # promote gates on migrate succeeding, and a skipped run must never read
+      # as a migration that happened. It runs before any secret is read.
+      - name: Require the environment's own branch
+        env:
+          ENVIRONMENT: ${{ inputs.environment }}
+          REF: ${{ github.ref }}
+        run: |
+          case "${ENVIRONMENT}" in
+            production) expected=refs/heads/main ;;
+            staging) expected=refs/heads/staging ;;
+            dev) expected=refs/heads/dev ;;
+            *)
+              echo "::error::Unknown migrate environment '${ENVIRONMENT}'"
+              exit 1
+              ;;
+          esac
+          if [ "${REF}" != "${expected}" ]; then
+            echo "::error::Refusing to migrate ${ENVIRONMENT} from ${REF}; ${ENVIRONMENT} migrates only from ${expected}"
+            exit 1
+          fi
+
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:

.github/workflows/publish-python-sdk.yml

@@ -26,7 +26,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.12'
           cache: 'pip'

apps/desktop/e2e/source-connect.spec.ts

@@ -53,6 +53,7 @@ test('source authorization returns to its desktop screen and refreshes live', as
   const githubStartSessions: string[] = []
   const githubInventorySessions: string[] = []
   let nativeCredentialVisible = false
+  let githubInventoryHold: Promise<void> | undefined
   let installed = false
   let holdSlackStart = false
   let canceledSlackRequests = 0
@@ -304,7 +305,7 @@ test('source authorization returns to its desktop screen and refreshes live', as
     }
     if (path === '/api/organization-credentials/oauth') {
       githubInventorySessions.push(session)
-      await sleep(500)
+      await githubInventoryHold
       json({
         credentials: nativeCredentialVisible
           ? [
@@ -545,12 +546,21 @@ test('source authorization returns to its desktop screen and refreshes live', as
         await expect(page.getByLabel('GitHub error')).toContainText('not available')
         await expect(page.getByLabel('GitHub credential')).toHaveText('')
         nativeCredentialVisible = true
-        await page.getByRole('button', { name: 'Connect GitHub' }).click()
-        await expect.poll(async () => (await opened()).length).toBe(6)
-        await external.goto((await opened())[5])
-        await external.getByRole('link', { name: 'Authorize GitHub' }).click()
-        await expect.poll(() => githubInventorySessions.length).toBe(2)
-        await expect(page.getByLabel('GitHub pending')).toHaveText('true')
+        let releaseGithubInventory = () => {}
+        githubInventoryHold = new Promise<void>((resolve) => {
+          releaseGithubInventory = resolve
+        })
+        try {
+          await page.getByRole('button', { name: 'Connect GitHub' }).click()
+          await expect.poll(async () => (await opened()).length).toBe(6)
+          await external.goto((await opened())[5])
+          await external.getByRole('link', { name: 'Authorize GitHub' }).click()
+          await expect.poll(() => githubInventorySessions.length).toBe(2)
+          await expect(page.getByLabel('GitHub pending')).toHaveText('true')
+        } finally {
+          githubInventoryHold = undefined
+          releaseGithubInventory()
+        }
         await expect(page.getByLabel('GitHub credential')).toHaveText('fixture-github-credential')
         expect(githubStartSessions).toEqual(['browser-fixture', 'browser-fixture'])
         expect(githubInventorySessions).toEqual(['desktop-fixture', 'desktop-fixture'])

apps/docs/content/docs/cli/index.mdx

@@ -142,6 +142,39 @@ sim tables rows query --help
 
 The [command overview](/cli/commands) lists global options and root commands. The [complete reference](/cli/reference) contains every subcommand, argument, and option on one page. Both are generated from the CLI.
 
+## Agent skills
+
+The [Sim skills](https://github.com/simstudioai/skills) teach coding agents such as Claude Code and Codex to build and operate Sim through the CLI. Install them with the standard Agent Skills installer:
+
+```bash
+bunx skills add simstudioai/skills --global
+```
+
+To install one skill for one agent without prompting:
+
+```bash
+bunx skills add simstudioai/skills \
+  --skill build-workflow \
+  --agent codex \
+  --global \
+  --yes
+```
+
+| Skill | What it covers |
+| --- | --- |
+| `build-workflow` | Discover blocks and author a draft graph with atomic workflow operations |
+| `run-workflow` | Test saved state, exercise triggers, resume from a block, and diagnose runs |
+| `deploy-workflow` | Publish and manage workflows as APIs, chats, or MCP tools |
+| `files` | Organize workspace files and folders, read and search text, and apply targeted edits |
+| `sync-workspaces` | Import portable workflows with bindings, fork workspaces, and preview, apply, and reconcile push/pull sync |
+| `table` | Design typed tables, load and query rows, import data, and run workflow groups |
+| `knowledge-base` | Ingest and index documents, configure connectors and tags, and verify retrieval |
+| `run-tool` | Call one integration tool directly with Sim-managed credentials |
+
+The repository is also a native Claude Code and Codex plugin, which exposes the same skills under the `sim` namespace (`sim:build-workflow`, `sim:run-workflow`, and so on).
+
+The skills assume `sim` is installed and signed in, so complete [Your first command](#your-first-command) first. They never store or print API keys. These agent skills are separate from the workspace skills you manage with [`sim skills`](/cli/skills).
+
 ## Related docs
 
 - [Authentication](/cli/authentication)