diff --git a/app/Http/Middleware/RuntimeExternalPayloadTransport.php b/app/Http/Middleware/RuntimeExternalPayloadTransport.php index 1b403df8..1c7d017d 100644 --- a/app/Http/Middleware/RuntimeExternalPayloadTransport.php +++ b/app/Http/Middleware/RuntimeExternalPayloadTransport.php @@ -31,6 +31,7 @@ class RuntimeExternalPayloadTransport ['commands', '*', 'arguments'], ['commands', '*', 'entries'], ['commands', '*', 'exception', 'details'], + ['commands', '*', 'request_payload'], ['commands', '*', 'result'], ], 'WorkflowController@query' => [['input']], diff --git a/composer.json b/composer.json index 79f834ac..1c945601 100644 --- a/composer.json +++ b/composer.json @@ -48,7 +48,7 @@ }, "extra": { "durable-workflow": { - "product-train": "2.3.2" + "product-train": "2.3.3" }, "laravel": { "dont-discover": [] diff --git a/composer.lock b/composer.lock index 6c8754e9..c5c95d3c 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "f1a079fb11623a62b16fcd23be3b1ff9", + "content-hash": "df5239602243d3a9189250b9ca16133f", "packages": [ { "name": "apache/avro", diff --git a/docker-compose.dedicated-matching.yml b/docker-compose.dedicated-matching.yml index 5b256f06..3622fc86 100644 --- a/docker-compose.dedicated-matching.yml +++ b/docker-compose.dedicated-matching.yml @@ -32,13 +32,13 @@ name: durable-workflow-server # daemon reports `shape: dedicated`. # Generated by scripts/ci/sync-source-release.mjs. Do not edit the fallback. -x-server-image: &server-image ${DW_SERVER_IMAGE:-durableworkflow/server:${DW_SERVER_TAG:-2.3.2}} +x-server-image: &server-image ${DW_SERVER_IMAGE:-durableworkflow/server:${DW_SERVER_TAG:-2.3.3}} x-server-environment: &server-environment APP_NAME: "Durable Workflow Server" APP_ENV: ${APP_ENV:-local} DW_SERVER_KEY: ${DW_SERVER_KEY:-} - APP_VERSION: ${APP_VERSION:-${DW_SERVER_TAG:-2.3.2}} + APP_VERSION: ${APP_VERSION:-${DW_SERVER_TAG:-2.3.3}} APP_DEBUG: ${APP_DEBUG:-false} DB_CONNECTION: mysql DB_HOST: mysql diff --git a/docker-compose.memo-rolling.yml b/docker-compose.memo-rolling.yml index dda15e16..f4a25090 100644 --- a/docker-compose.memo-rolling.yml +++ b/docker-compose.memo-rolling.yml @@ -49,14 +49,14 @@ services: command: ["server-bootstrap"] environment: <<: *runtime-environment - APP_VERSION: ${APP_VERSION:-2.3.2} + APP_VERSION: ${APP_VERSION:-2.3.3} successor: image: ${DW_MEMO_SUCCESSOR_IMAGE:-durable-workflow/server-memo-rolling:local} ports: !override [] environment: <<: *runtime-environment - APP_VERSION: ${APP_VERSION:-2.3.2} + APP_VERSION: ${APP_VERSION:-2.3.3} DW_SERVER_ID: memo-successor DW_SERVER_TOPOLOGY_SHAPE: standalone_server DW_SERVER_PROCESS_CLASS: server_http_node diff --git a/docker-compose.published.yml b/docker-compose.published.yml index 2f6aeccd..7872d67e 100644 --- a/docker-compose.published.yml +++ b/docker-compose.published.yml @@ -1,13 +1,13 @@ name: durable-workflow-server # Generated by scripts/ci/sync-source-release.mjs. Do not edit the fallback. -x-server-image: &server-image ${DW_SERVER_IMAGE:-durableworkflow/server:${DW_SERVER_TAG:-2.3.2}} +x-server-image: &server-image ${DW_SERVER_IMAGE:-durableworkflow/server:${DW_SERVER_TAG:-2.3.3}} x-server-environment: &server-environment APP_NAME: "Durable Workflow Server" APP_ENV: ${APP_ENV:-local} DW_SERVER_KEY: ${DW_SERVER_KEY:-} - APP_VERSION: ${APP_VERSION:-${DW_SERVER_TAG:-2.3.2}} + APP_VERSION: ${APP_VERSION:-${DW_SERVER_TAG:-2.3.3}} APP_DEBUG: ${APP_DEBUG:-false} LOG_CHANNEL: ${LOG_CHANNEL:-stderr} LOG_LEVEL: ${LOG_LEVEL:-info} diff --git a/docker-compose.small-cluster.yml b/docker-compose.small-cluster.yml index 256f8ffb..15b4a826 100644 --- a/docker-compose.small-cluster.yml +++ b/docker-compose.small-cluster.yml @@ -12,7 +12,7 @@ x-server-build: &server-build x-server-environment: &server-environment APP_NAME: "Durable Workflow Server" APP_ENV: testing - APP_VERSION: ${APP_VERSION:-2.3.2} + APP_VERSION: ${APP_VERSION:-2.3.3} APP_DEBUG: "false" DW_SERVER_KEY: ${DW_SERVER_KEY:-base64:5Zt4nUhlCm3DD0nLXZJQdHiwPfb56yGo9gNV/g3jYbY=} DB_CONNECTION: ${DW_SMALL_CLUSTER_DB:-mysql} diff --git a/docker-compose.yml b/docker-compose.yml index 579b8ee1..ee5efc17 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -15,7 +15,7 @@ services: DW_SERVER_KEY: "${DW_SERVER_KEY:-}" DW_SERVER_TOPOLOGY_SHAPE: standalone_server DW_SERVER_PROCESS_CLASS: server_http_node - APP_VERSION: "${APP_VERSION:-2.3.2}" + APP_VERSION: "${APP_VERSION:-2.3.3}" APP_DEBUG: "false" DB_CONNECTION: mysql DB_HOST: mysql @@ -62,7 +62,7 @@ services: APP_NAME: "Durable Workflow Server" APP_ENV: local DW_SERVER_KEY: "${DW_SERVER_KEY:-}" - APP_VERSION: "${APP_VERSION:-2.3.2}" + APP_VERSION: "${APP_VERSION:-2.3.3}" APP_DEBUG: "false" DB_CONNECTION: mysql DB_HOST: mysql @@ -123,7 +123,7 @@ services: DW_SERVER_KEY: "${DW_SERVER_KEY:-}" DW_SERVER_TOPOLOGY_SHAPE: standalone_server DW_SERVER_PROCESS_CLASS: worker_node - APP_VERSION: "${APP_VERSION:-2.3.2}" + APP_VERSION: "${APP_VERSION:-2.3.3}" DB_CONNECTION: mysql DB_HOST: mysql DB_PORT: 3306 @@ -176,7 +176,7 @@ services: DW_SERVER_KEY: "${DW_SERVER_KEY:-}" DW_SERVER_TOPOLOGY_SHAPE: standalone_server DW_SERVER_PROCESS_CLASS: scheduler_node - APP_VERSION: "${APP_VERSION:-2.3.2}" + APP_VERSION: "${APP_VERSION:-2.3.3}" DB_CONNECTION: mysql DB_HOST: mysql DB_PORT: 3306 diff --git a/k8s/README.md b/k8s/README.md index 1baa1fa9..f1479913 100644 --- a/k8s/README.md +++ b/k8s/README.md @@ -13,7 +13,7 @@ The checked-in manifests are synchronized with the repository's stable source release and pin its Docker Hub tag: ```text -durableworkflow/server:2.3.2 +durableworkflow/server:2.3.3 ``` Before production use, patch every workload image to the exact published tag or @@ -21,15 +21,15 @@ digest you intend to run: ```bash kubectl set image -n durable-workflow deploy/durable-workflow-server \ - server=durableworkflow/server:2.3.2 + server=durableworkflow/server:2.3.3 kubectl set image -n durable-workflow deploy/durable-workflow-worker \ - worker=durableworkflow/server:2.3.2 + worker=durableworkflow/server:2.3.3 kubectl set image -n durable-workflow cronjob/durable-workflow-scheduler \ - scheduler=durableworkflow/server:2.3.2 + scheduler=durableworkflow/server:2.3.3 ``` GitHub Container Registry publishes the same release line at -`ghcr.io/durable-workflow/server:2.3.2`. Digest pinning is preferred for strict +`ghcr.io/durable-workflow/server:2.3.3`. Digest pinning is preferred for strict change control. The manifests expect you to provide: diff --git a/k8s/helm/durable-workflow/Chart.yaml b/k8s/helm/durable-workflow/Chart.yaml index c206c74f..d64ccc4a 100644 --- a/k8s/helm/durable-workflow/Chart.yaml +++ b/k8s/helm/durable-workflow/Chart.yaml @@ -5,11 +5,11 @@ type: application # The chart's own semver version. Bumped on every chart release; treated as # independent of the server image version (appVersion). Breaking-change rules # for this version live in docs/helm-upgrading.md alongside the chart. -version: 0.1.81 +version: 0.1.82 # The immutable Durable Workflow Server identity this chart release packages. # The onboarding default in values.yaml and appVersion are generated from the # checked-in source release record. -appVersion: "2.3.2" +appVersion: "2.3.3" kubeVersion: ">=1.27.0-0" home: https://durable-workflow.github.io/docs/2.0/deployment sources: @@ -30,7 +30,7 @@ annotations: # exact commit that most recently changed the packaged chart. org.opencontainers.image.source: https://github.com/durable-workflow/server dev.durable-workflow.source-revision: "unreleased" - dev.durable-workflow.image-reference: "docker.io/durableworkflow/server:2.3.2" + dev.durable-workflow.image-reference: "docker.io/durableworkflow/server:2.3.3" artifacthub.io/license: MIT artifacthub.io/category: integration-delivery # Free-form changelog for the current chart release shown by Artifact Hub. diff --git a/k8s/helm/durable-workflow/README.md b/k8s/helm/durable-workflow/README.md index 7110ba0f..6fee90fc 100644 --- a/k8s/helm/durable-workflow/README.md +++ b/k8s/helm/durable-workflow/README.md @@ -63,7 +63,7 @@ helm install durable-workflow ./k8s/helm/durable-workflow \ ```yaml image: - tag: "2.3.2" + tag: "2.3.3" # Pin a digest in production: # digest: "sha256:abc123..." # memoPayloadStorage: "raw-json-v1" # Required for a digest or custom image. diff --git a/k8s/helm/durable-workflow/ci/existing-secrets-values.yaml b/k8s/helm/durable-workflow/ci/existing-secrets-values.yaml index 7f0e7849..164a3b5b 100644 --- a/k8s/helm/durable-workflow/ci/existing-secrets-values.yaml +++ b/k8s/helm/durable-workflow/ci/existing-secrets-values.yaml @@ -1,7 +1,7 @@ # CI fixture: GitOps / externally-managed-secret path. The chart consumes # existing Secrets and renders no Secret resources of its own. image: - tag: "2.3.2" + tag: "2.3.3" externalDatabase: connection: pgsql diff --git a/k8s/helm/durable-workflow/ci/ingress-and-hpa-values.yaml b/k8s/helm/durable-workflow/ci/ingress-and-hpa-values.yaml index 7de74ae6..2085aa43 100644 --- a/k8s/helm/durable-workflow/ci/ingress-and-hpa-values.yaml +++ b/k8s/helm/durable-workflow/ci/ingress-and-hpa-values.yaml @@ -1,6 +1,6 @@ # CI fixture: ingress + autoscaling enabled. Exercises optional templates. image: - tag: "2.3.2" + tag: "2.3.3" externalDatabase: connection: mysql diff --git a/k8s/helm/durable-workflow/ci/inline-secrets-values.yaml b/k8s/helm/durable-workflow/ci/inline-secrets-values.yaml index a2945dda..7751e0d1 100644 --- a/k8s/helm/durable-workflow/ci/inline-secrets-values.yaml +++ b/k8s/helm/durable-workflow/ci/inline-secrets-values.yaml @@ -2,7 +2,7 @@ # chart's render path is exercised end-to-end. Real deployments should use # existingSecret instead. image: - tag: "2.3.2" + tag: "2.3.3" externalDatabase: connection: mysql diff --git a/k8s/helm/durable-workflow/templates/_helpers.tpl b/k8s/helm/durable-workflow/templates/_helpers.tpl index 77918193..7b8bbd7b 100644 --- a/k8s/helm/durable-workflow/templates/_helpers.tpl +++ b/k8s/helm/durable-workflow/templates/_helpers.tpl @@ -88,7 +88,7 @@ resolved by an explicit capability declaration or an existing workload marker. {{- define "durable-workflow.memoPayloadStorageForImage" -}} {{- $image := toString . -}} {{- $normalized := regexReplaceAll "^index\\.docker\\.io/" $image "docker.io/" -}} -{{- if eq $normalized "docker.io/durableworkflow/server:2.3.2" -}} +{{- if eq $normalized "docker.io/durableworkflow/server:2.3.3" -}} dual-v1 {{- else if regexMatch "^docker\\.io/durableworkflow/server:2\\.0\\.0-rc\\.[0-9]+$" $normalized -}} {{- $releaseCandidate := atoi (regexFind "[0-9]+$" $normalized) -}} diff --git a/k8s/helm/durable-workflow/values.yaml b/k8s/helm/durable-workflow/values.yaml index 96667348..236478d8 100644 --- a/k8s/helm/durable-workflow/values.yaml +++ b/k8s/helm/durable-workflow/values.yaml @@ -21,7 +21,7 @@ image: registry: docker.io repository: durableworkflow/server # Generated by scripts/ci/sync-source-release.mjs. Do not edit this default. - tag: "2.3.2" + tag: "2.3.3" # Optional digest pin. When set, takes precedence over tag for change control. # Example: "sha256:abc123..." digest: "" diff --git a/k8s/helm/examples/values-dev.yaml b/k8s/helm/examples/values-dev.yaml index 09255e14..c3604e95 100644 --- a/k8s/helm/examples/values-dev.yaml +++ b/k8s/helm/examples/values-dev.yaml @@ -3,7 +3,7 @@ # shape in production. image: - tag: "2.3.2" + tag: "2.3.3" externalDatabase: connection: mysql diff --git a/k8s/helm/examples/values-external-secrets-operator.yaml b/k8s/helm/examples/values-external-secrets-operator.yaml index 1f316b94..b65e34ba 100644 --- a/k8s/helm/examples/values-external-secrets-operator.yaml +++ b/k8s/helm/examples/values-external-secrets-operator.yaml @@ -5,7 +5,7 @@ # concern. image: - tag: "2.3.2" + tag: "2.3.3" externalDatabase: connection: pgsql diff --git a/k8s/helm/examples/values-production-existing-secrets.yaml b/k8s/helm/examples/values-production-existing-secrets.yaml index 235749d2..834590fa 100644 --- a/k8s/helm/examples/values-production-existing-secrets.yaml +++ b/k8s/helm/examples/values-production-existing-secrets.yaml @@ -10,7 +10,7 @@ image: repository: durable-workflow/server # Pin a digest in production for change-control auditability. digest: "" # e.g. "sha256:abc123..." - tag: "2.3.2" + tag: "2.3.3" externalDatabase: connection: pgsql diff --git a/k8s/migration-job.yaml b/k8s/migration-job.yaml index fe377650..2fce4fa5 100644 --- a/k8s/migration-job.yaml +++ b/k8s/migration-job.yaml @@ -13,7 +13,7 @@ spec: restartPolicy: OnFailure containers: - name: migrate - image: durableworkflow/server:2.3.2 + image: durableworkflow/server:2.3.3 command: ["server-entrypoint"] args: ["server-bootstrap"] envFrom: diff --git a/k8s/scheduler-cronjob.yaml b/k8s/scheduler-cronjob.yaml index 9eb1d85b..530201fa 100644 --- a/k8s/scheduler-cronjob.yaml +++ b/k8s/scheduler-cronjob.yaml @@ -24,7 +24,7 @@ spec: restartPolicy: Never containers: - name: scheduler - image: durableworkflow/server:2.3.2 + image: durableworkflow/server:2.3.3 command: ["server-entrypoint"] args: ["sh", "-c", "php artisan schedule:evaluate --limit=100 --json; php artisan activity:timeout-enforce --limit=100; if php artisan list --raw | grep -q '^external-payloads:cleanup '; then php artisan external-payloads:cleanup --limit=100 --json; fi; php artisan history:prune --limit=100"] envFrom: diff --git a/k8s/secret.yaml b/k8s/secret.yaml index 4d107d2e..069788dd 100644 --- a/k8s/secret.yaml +++ b/k8s/secret.yaml @@ -12,7 +12,7 @@ metadata: app.kubernetes.io/name: durable-workflow data: APP_NAME: "Durable Workflow Server" - APP_VERSION: "2.3.2" + APP_VERSION: "2.3.3" APP_ENV: production APP_DEBUG: "false" DB_CONNECTION: mysql diff --git a/k8s/server-deployment.yaml b/k8s/server-deployment.yaml index c6607746..c0e34c85 100644 --- a/k8s/server-deployment.yaml +++ b/k8s/server-deployment.yaml @@ -23,7 +23,7 @@ spec: spec: containers: - name: server - image: durableworkflow/server:2.3.2 + image: durableworkflow/server:2.3.3 ports: - containerPort: 8080 name: http diff --git a/k8s/worker-deployment.yaml b/k8s/worker-deployment.yaml index 6a3cb6ee..31939bca 100644 --- a/k8s/worker-deployment.yaml +++ b/k8s/worker-deployment.yaml @@ -19,7 +19,7 @@ spec: spec: containers: - name: worker - image: durableworkflow/server:2.3.2 + image: durableworkflow/server:2.3.3 command: ["server-entrypoint"] args: ["php", "artisan", "queue:work", "--sleep=1", "--tries=3", "--max-time=3600"] envFrom: diff --git a/resources/release/source-release.json b/resources/release/source-release.json index 17a607be..7e80aa8c 100644 --- a/resources/release/source-release.json +++ b/resources/release/source-release.json @@ -1,9 +1,9 @@ { "schema": "durable-workflow.server.source-release/v1", "server": { - "version": "2.3.2" + "version": "2.3.3" }, "helm_chart": { - "version": "0.1.81" + "version": "0.1.82" } } diff --git a/scripts/k8s-kind-smoke.sh b/scripts/k8s-kind-smoke.sh index 0d9ee512..0021ad83 100755 --- a/scripts/k8s-kind-smoke.sh +++ b/scripts/k8s-kind-smoke.sh @@ -7,7 +7,7 @@ cluster="${K8S_SMOKE_CLUSTER:-durable-workflow-server-smoke}" image="${K8S_SMOKE_IMAGE:-durableworkflow/server:k8s-smoke}" # Generated by scripts/ci/sync-source-release.mjs so the smoke replaces the # same default shipped by the public manifests. -manifest_image="durableworkflow/server:2.3.2" +manifest_image="durableworkflow/server:2.3.3" kind_node_image="${K8S_SMOKE_KIND_NODE_IMAGE:-kindest/node:v1.29.4}" artifact_dir="${K8S_SMOKE_ARTIFACT_DIR:-/tmp/durable-workflow-k8s-kind-smoke-artifacts}" rendered_dir="${artifact_dir}/rendered-manifests" diff --git a/tests/Feature/WorkerServiceOperationTest.php b/tests/Feature/WorkerServiceOperationTest.php index f5d7d5a8..dc2a4ad6 100644 --- a/tests/Feature/WorkerServiceOperationTest.php +++ b/tests/Feature/WorkerServiceOperationTest.php @@ -4,7 +4,10 @@ namespace Tests\Feature; +use App\Models\RuntimeExternalPayload; +use App\Models\WorkflowNamespace; use Illuminate\Foundation\Testing\RefreshDatabase; +use Illuminate\Support\Facades\File; use Illuminate\Support\Facades\Queue; use Illuminate\Testing\TestResponse; use PHPUnit\Framework\Attributes\DataProvider; @@ -104,6 +107,64 @@ public function test_supported_options_reach_the_service_control_plane(): void $this->complete($task, $this->command($options))->assertOk(); } + #[DataProvider('runtimePayloadCases')] + public function test_runtime_payload_reference_is_resolved_before_service_command_admission(string $case): void + { + $this->seedCatalog(); + $task = $this->leaseWorkflow(); + $directory = storage_path('framework/testing/service-runtime-payload-'.bin2hex(random_bytes(5))); + $namespace = $case === 'foreign' ? 'other' : 'default'; + if ($namespace === 'other') { + $this->createNamespace($namespace); + } + WorkflowNamespace::query()->where('name', $namespace)->update(['external_payload_storage' => [ + 'driver' => 'local', 'enabled' => true, 'threshold_bytes' => 1024, + 'config' => ['uri' => 'file://'.$directory], + ]]); + $blob = Avro::serialize([['invoice' => 42]]); + try { + $reference = $this->call('POST', '/api/external-payloads/v1', [], [], [], [ + 'CONTENT_TYPE' => 'application/octet-stream', 'HTTP_X_NAMESPACE' => $namespace, + 'HTTP_X_DURABLE_WORKFLOW_PAYLOAD_CODEC' => 'avro', + 'HTTP_X_DURABLE_WORKFLOW_PAYLOAD_SIZE' => (string) strlen($blob), + 'HTTP_X_DURABLE_WORKFLOW_PAYLOAD_SHA256' => hash('sha256', $blob), + ], $blob)->assertCreated()->json('reference'); + $this->authenticateWorker(); + if ($case === 'tampered') { + $reference['sha256'] = str_repeat('0', 64); + } + $historyCount = WorkflowHistoryEvent::query()->count(); + $response = $this->complete($task, $this->command([ + 'request_payload' => ['codec' => 'avro', 'external_payload' => $reference], + ])); + if ($case !== 'valid') { + $response->assertStatus($case === 'foreign' ? 404 : 422) + ->assertJsonPath('reason', $case === 'foreign' ? 'external_payload_not_found' : 'external_payload_integrity_mismatch'); + $this->assertDatabaseCount('workflow_service_calls', 0); + $this->assertSame($historyCount, WorkflowHistoryEvent::query()->count()); + $this->assertSame('leased', WorkflowTask::query()->findOrFail($task['task_id'])->status->value); + $this->assertNull(RuntimeExternalPayload::query()->findOrFail($reference['reference_id'])->retained_at); + + return; + } + $response->assertOk(); + $call = WorkflowServiceCall::query()->sole(); + $target = WorkflowRun::query()->findOrFail($call->linked_workflow_run_id); + $this->assertSame([['invoice' => 42]], Avro::unserialize($target->arguments)); + $this->assertNotNull(RuntimeExternalPayload::query()->findOrFail($reference['reference_id'])->retained_at); + $this->assertDatabaseHas('workflow_history_events', [ + 'workflow_run_id' => $task['run_id'], 'event_type' => 'ServiceCallStarted', + ]); + } finally { + File::deleteDirectory($directory); + } + } + + public static function runtimePayloadCases(): array + { + return [['valid'], ['foreign'], ['tampered']]; + } + #[DataProvider('invalidOptions')] public function test_invalid_operation_commands_do_not_commit_history_or_consume_the_lease(array $options, string $field): void {