v0.9.36: db and ci improvements, library

.github/actions/setup/action.yml

@@ -66,6 +66,20 @@ runs:
         key: ${{ github.repository }}-${{ inputs.turbo-cache-key }}-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
         path: ./.turbo
 
+    # Bun retries a failed request itself, but a registry connection that stalls
+    # without failing leaves `bun install` waiting until the job's own timeout
+    # cancels it, the whole budget spent on one hung step. Healthy installs finish
+    # in under two and a half minutes cold, so an attempt past three is stalled:
+    # kill it and retry once, which leaves room inside the shortest caller's
+    # 10-minute job timeout. Any other failure is real and fails at once.
     - name: Install dependencies
       shell: bash
-      run: bun install --frozen-lockfile --ignore-scripts
+      run: |
+        for attempt in 1 2; do
+          timeout --kill-after=15s 3m bun install --frozen-lockfile --ignore-scripts && exit 0
+          status=$?
+          if [ "$status" -ne 124 ] && [ "$status" -ne 137 ]; then exit "$status"; fi
+          echo "::warning title=bun install stalled::attempt ${attempt} of 2 ran past 3 minutes"
+        done
+        echo "::error title=bun install stalled::both attempts ran past 3 minutes"
+        exit 1

.github/workflows/helm.yml

@@ -188,6 +188,12 @@ jobs:
             --values helm/sim/ci/kind-overlay.yaml \
             --wait --timeout 15m
 
+      - name: Run helm test
+        run: helm test sim --namespace sim --timeout 5m
+
+      # After the test, so it also explains a failed probe, not only a failed
+      # install. A failed test pod is kept (the hook deletes it only on success),
+      # so its log says which URL refused.
       - name: Diagnostics on failure
         if: failure()
         run: |
@@ -196,9 +202,8 @@ jobs:
           kubectl -n sim describe pods | tail -100 || true
           kubectl -n sim logs deploy/sim-app -c migrations --tail=50 || true
           kubectl -n sim logs deploy/sim-app --tail=80 || true
-
-      - name: Run helm test
-        run: helm test sim --namespace sim --timeout 5m
+          kubectl -n sim logs deploy/sim-realtime --tail=80 || true
+          kubectl -n sim logs sim-test-connection || true
 
   # Resolved once and shared, so the two publish paths cannot package the same
   # immutable chart version with different appVersions -- they run in parallel,

apps/realtime/src/bootstrap.ts

@@ -3,18 +3,9 @@
  * loading the Socket.IO server, whose modules (`@/env`, DB preflight) read env
  * at import time. See `@sim/runtime-secrets`.
  */
-import { createLogger } from '@sim/logger'
 import { loadRuntimeSecrets } from '@sim/runtime-secrets'
-import { distrustCompromisedRoots } from '@sim/security/tls-trust'
 
-const tlsTrust = distrustCompromisedRoots()
 await loadRuntimeSecrets()
-const logger = createLogger('Bootstrap')
-if (tlsTrust.unsupported || tlsTrust.error) {
-  logger.error('Could not distrust compromised CA roots', tlsTrust)
-} else if (tlsTrust.removed.length > 0) {
-  logger.info('Distrusted compromised CA roots', { removed: tlsTrust.removed })
-}
 /**
  * Pin this process to the `realtime` DB role — covering both the realtime
  * `socketDb` pool and the shared `@sim/db` client used by handlers, preflight,

apps/sim/bootstrap.ts

@@ -3,18 +3,9 @@
  * loading the Next.js standalone server, so application modules that read env at
  * import time see the full configuration. See `@sim/runtime-secrets`.
  */
-import { createLogger } from '@sim/logger'
 import { loadRuntimeSecrets } from '@sim/runtime-secrets'
-import { distrustCompromisedRoots } from '@sim/security/tls-trust'
 
-const tlsTrust = distrustCompromisedRoots()
 await loadRuntimeSecrets()
-const logger = createLogger('Bootstrap')
-if (tlsTrust.unsupported || tlsTrust.error) {
-  logger.error('Could not distrust compromised CA roots', tlsTrust)
-} else if (tlsTrust.removed.length > 0) {
-  logger.info('Distrusted compromised CA roots', { removed: tlsTrust.removed })
-}
 // `server.js` is the Next standalone build artifact, a sibling of this file in
 // the image; it does not exist at type-check time, so the specifier is held in a
 // variable to keep it out of static module resolution.

helm/sim/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: sim
 description: A Helm chart for Sim - the open-source AI workspace where teams build, deploy, and manage AI agents
 type: application
-version: 1.11.8
+version: 1.11.9
 appVersion: "v0.8.26"
 kubeVersion: ">=1.25.0-0"
 home: https://sim.ai

helm/sim/templates/tests/test-connection.yaml

@@ -40,15 +40,25 @@ spec:
         - -c
         - |
           set -eu
-          APP_URL="http://{{ include "sim.fullname" . }}-app:{{ .Values.app.service.port }}/"
-          echo "Probing $APP_URL"
-          wget -q -T {{ .Values.tests.timeoutSeconds }} --tries=1 --spider "$APP_URL"
+          # A pod turns Ready before every node routes its Service to it, so a
+          # probe sent the moment `helm install --wait` returns can be refused.
+          # Each URL is retried until a minute has passed, then the test fails.
+          probe() {
+            deadline=$(($(date +%s) + 60))
+            while ! wget -q -T {{ .Values.tests.timeoutSeconds }} --spider "$1"; do
+              if [ "$(date +%s)" -ge "$deadline" ]; then
+                echo "FAILED: $1 did not answer within 60s"
+                return 1
+              fi
+              echo "$1 did not answer; retrying in 5s"
+              sleep 5
+            done
+            echo "OK: $1"
+          }
+          probe "http://{{ include "sim.fullname" . }}-app:{{ .Values.app.service.port }}/"
           {{- if .Values.realtime.enabled }}
-          RT_URL="http://{{ include "sim.fullname" . }}-realtime:{{ .Values.realtime.service.port }}/health"
-          echo "Probing $RT_URL"
-          wget -q -T {{ .Values.tests.timeoutSeconds }} --tries=1 --spider "$RT_URL"
+          probe "http://{{ include "sim.fullname" . }}-realtime:{{ .Values.realtime.service.port }}/health"
           {{- end }}
-          echo "OK"
       resources:
         {{- toYaml .Values.tests.resources | nindent 8 }}
 {{- end }}

packages/db/migrations/0438_drop_redundant_job_log_schedule_index.sql

@@ -0,0 +1,6 @@
+-- job_execution_logs_schedule_occurrence_unique (schedule_id, occurrence_at) leads with
+-- schedule_id, so it serves every lookup and FK check the single-column index did.
+COMMIT;--> statement-breakpoint
+SET lock_timeout = 0;--> statement-breakpoint
+DROP INDEX CONCURRENTLY IF EXISTS "job_execution_logs_schedule_id_idx";--> statement-breakpoint
+SET lock_timeout = '5s';