v0.9.36: db and ci improvements, library

Author: waleedlatif1

.github/actions/setup/action.yml

@@ -66,6 +66,20 @@ runs:
         key: ${{ github.repository }}-${{ inputs.turbo-cache-key }}-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
         path: ./.turbo
 
+    # Bun retries a failed request itself, but a registry connection that stalls
+    # without failing leaves `bun install` waiting until the job's own timeout
+    # cancels it, the whole budget spent on one hung step. Healthy installs finish
+    # in under two and a half minutes cold, so an attempt past three is stalled:
+    # kill it and retry once, which leaves room inside the shortest caller's
+    # 10-minute job timeout. Any other failure is real and fails at once.
     - name: Install dependencies
       shell: bash
-      run: bun install --frozen-lockfile --ignore-scripts
+      run: |
+        for attempt in 1 2; do
+          timeout --kill-after=15s 3m bun install --frozen-lockfile --ignore-scripts && exit 0
+          status=$?
+          if [ "$status" -ne 124 ] && [ "$status" -ne 137 ]; then exit "$status"; fi
+          echo "::warning title=bun install stalled::attempt ${attempt} of 2 ran past 3 minutes"
+        done
+        echo "::error title=bun install stalled::both attempts ran past 3 minutes"
+        exit 1

.github/workflows/helm.yml

@@ -188,6 +188,12 @@ jobs:
             --values helm/sim/ci/kind-overlay.yaml \
             --wait --timeout 15m
 
+      - name: Run helm test
+        run: helm test sim --namespace sim --timeout 5m
+
+      # After the test, so it also explains a failed probe, not only a failed
+      # install. A failed test pod is kept (the hook deletes it only on success),
+      # so its log says which URL refused.
       - name: Diagnostics on failure
         if: failure()
         run: |
@@ -196,9 +202,8 @@ jobs:
           kubectl -n sim describe pods | tail -100 || true
           kubectl -n sim logs deploy/sim-app -c migrations --tail=50 || true
           kubectl -n sim logs deploy/sim-app --tail=80 || true
-
-      - name: Run helm test
-        run: helm test sim --namespace sim --timeout 5m
+          kubectl -n sim logs deploy/sim-realtime --tail=80 || true
+          kubectl -n sim logs sim-test-connection || true
 
   # Resolved once and shared, so the two publish paths cannot package the same
   # immutable chart version with different appVersions -- they run in parallel,

apps/realtime/src/bootstrap.ts

@@ -3,18 +3,9 @@
  * loading the Socket.IO server, whose modules (`@/env`, DB preflight) read env
  * at import time. See `@sim/runtime-secrets`.
  */
-import { createLogger } from '@sim/logger'
 import { loadRuntimeSecrets } from '@sim/runtime-secrets'
-import { distrustCompromisedRoots } from '@sim/security/tls-trust'
 
-const tlsTrust = distrustCompromisedRoots()
 await loadRuntimeSecrets()
-const logger = createLogger('Bootstrap')
-if (tlsTrust.unsupported || tlsTrust.error) {
-  logger.error('Could not distrust compromised CA roots', tlsTrust)
-} else if (tlsTrust.removed.length > 0) {
-  logger.info('Distrusted compromised CA roots', { removed: tlsTrust.removed })
-}
 /**
  * Pin this process to the `realtime` DB role — covering both the realtime
  * `socketDb` pool and the shared `@sim/db` client used by handlers, preflight,

apps/sim/bootstrap.ts

@@ -3,18 +3,9 @@
  * loading the Next.js standalone server, so application modules that read env at
  * import time see the full configuration. See `@sim/runtime-secrets`.
  */
-import { createLogger } from '@sim/logger'
 import { loadRuntimeSecrets } from '@sim/runtime-secrets'
-import { distrustCompromisedRoots } from '@sim/security/tls-trust'
 
-const tlsTrust = distrustCompromisedRoots()
 await loadRuntimeSecrets()
-const logger = createLogger('Bootstrap')
-if (tlsTrust.unsupported || tlsTrust.error) {
-  logger.error('Could not distrust compromised CA roots', tlsTrust)
-} else if (tlsTrust.removed.length > 0) {
-  logger.info('Distrusted compromised CA roots', { removed: tlsTrust.removed })
-}
 // `server.js` is the Next standalone build artifact, a sibling of this file in
 // the image; it does not exist at type-check time, so the specifier is held in a
 // variable to keep it out of static module resolution.