Merge branch 'main' into graham/fix-chat-reconnect-seq

Author: matt-aitken

.changeset/external-trace-id-per-run.md

@@ -0,0 +1,5 @@
+---
+"@trigger.dev/core": patch
+---
+
+Unrelated runs are no longer merged into a single trace in your external observability tool when they happen to execute on the same warm worker process.

.github/workflows/e2e-webapp-auth-full.yml

@@ -99,11 +99,10 @@ jobs:
         run: echo "DockerHub login skipped because secrets are not available."
 
       - name: 🐳 Pre-pull testcontainer images
-        if: ${{ env.DOCKERHUB_USERNAME }}
         run: |
           docker pull postgres:14
           docker pull redis:7.2
-          docker pull testcontainers/ryuk:0.11.0
+          docker pull testcontainers/ryuk:0.14.0
 
       - name: 📥 Download deps
         run: pnpm install --frozen-lockfile

.github/workflows/e2e-webapp.yml

@@ -74,12 +74,11 @@ jobs:
         run: echo "DockerHub login skipped because secrets are not available."
 
       - name: 🐳 Pre-pull testcontainer images
-        if: ${{ env.DOCKERHUB_USERNAME }}
         run: |
           echo "Pre-pulling Docker images with authenticated session..."
           docker pull postgres:14
           docker pull redis:7.2
-          docker pull testcontainers/ryuk:0.11.0
+          docker pull testcontainers/ryuk:0.14.0
           docker pull ghcr.io/s2-streamstore/s2:0.40.0@sha256:b26249e2ede0949755f5af8028185dc2bcfc3aa2db21eb9610543d144eb6ee9d
           docker pull minio/minio:latest
           echo "Image pre-pull complete"

.github/workflows/unit-tests-internal.yml

@@ -78,7 +78,6 @@ jobs:
         run: echo "DockerHub login skipped because secrets are not available."
 
       - name: 🐳 Pre-pull testcontainer images
-        if: ${{ env.DOCKERHUB_USERNAME }}
         run: |
           # Retry each pull - DockerHub registry timeouts are a recurring transient CI flake.
           pull() {
@@ -96,7 +95,6 @@ jobs:
           pull clickhouse/clickhouse-server:26.2.19.43-alpine@sha256:c6ad6a7eb2fb5999df3adfb8b69a0c7222c68fa9b8f6b04a088564ebbc959251
           pull redis:7.2
           pull testcontainers/ryuk:0.14.0
-          pull electricsql/electric:1.2.4
           echo "Image pre-pull complete"
 
       - name: 📥 Download deps

.github/workflows/unit-tests-packages.yml

@@ -81,7 +81,6 @@ jobs:
         run: echo "DockerHub login skipped because secrets are not available."
 
       - name: 🐳 Pre-pull testcontainer images
-        if: ${{ env.DOCKERHUB_USERNAME }}
         run: |
           # Retry each pull - DockerHub registry timeouts are a recurring transient CI flake.
           pull() {
@@ -98,7 +97,6 @@ jobs:
           pull clickhouse/clickhouse-server:26.2.19.43-alpine@sha256:c6ad6a7eb2fb5999df3adfb8b69a0c7222c68fa9b8f6b04a088564ebbc959251
           pull redis:7.2
           pull testcontainers/ryuk:0.14.0
-          pull electricsql/electric:1.2.4
           pull otel/opentelemetry-collector-k8s:0.158.0@sha256:c09130a633196a5becee164411473a0932ecf223f94fda6dab5f22798ff9f376
           echo "Image pre-pull complete"
 

.github/workflows/unit-tests-webapp.yml

@@ -86,7 +86,6 @@ jobs:
         run: echo "DockerHub login skipped because secrets are not available."
 
       - name: 🐳 Pre-pull testcontainer images
-        if: ${{ env.DOCKERHUB_USERNAME }}
         run: |
           # Retry each pull - DockerHub registry timeouts are a recurring transient CI flake.
           pull() {
@@ -100,10 +99,11 @@ jobs:
           }
           echo "Pre-pulling Docker images with authenticated session..."
           pull postgres:14
+          pull postgres:17
           pull clickhouse/clickhouse-server:26.2.19.43-alpine@sha256:c6ad6a7eb2fb5999df3adfb8b69a0c7222c68fa9b8f6b04a088564ebbc959251
           pull redis:7.2
           pull testcontainers/ryuk:0.14.0
-          pull electricsql/electric:1.2.4
+          pull electricsql/electric:1.2.4@sha256:20da3d0b0e74926c5623392db67fd56698b9e374c4aeb6cb5cadeb8fea171c36
           pull minio/minio:latest
           echo "Image pre-pull complete"
 

.oxlintrc.json

@@ -3,7 +3,7 @@
   "categories": {
     "correctness": "error"
   },
-  "plugins": ["typescript", "import", "react"],
+  "plugins": ["typescript", "import", "react", "jsx-a11y"],
   "jsPlugins": [
     "./oxlint-plugins/no-thrown-unawaited-redirect.mjs",
     "./oxlint-plugins/runops-residency.mjs",
@@ -34,7 +34,7 @@
     ],
     "no-empty-pattern": "off",
     "no-control-regex": "off",
-    "typescript/no-non-null-asserted-optional-chain": "off",
+    "typescript/no-non-null-asserted-optional-chain": "error",
     "no-unused-expressions": [
       "error",
       {
@@ -47,6 +47,66 @@
     "import/namespace": "off",
     "react-hooks/exhaustive-deps": "off",
     "react-hooks/rules-of-hooks": "off",
+    "guard-for-in": "error",
+    "symbol-description": "error",
+    "no-unneeded-ternary": "error",
+    "prefer-object-has-own": "error",
+    "no-redeclare": "error",
+    "no-multi-assign": "error",
+    "prefer-object-spread": "error",
+    "react/jsx-no-target-blank": "error",
+    "react/jsx-fragments": "error",
+    "react/self-closing-comp": "error",
+    "react/jsx-no-constructed-context-values": "error",
+    "react/no-children-prop": "error",
+    "react/no-danger-with-children": "error",
+    "react/no-direct-mutation-state": "error",
+    "react/no-find-dom-node": "error",
+    "react/no-is-mounted": "error",
+    "react/no-render-return-value": "error",
+    "react/no-string-refs": "error",
+    "react/no-unsafe": "error",
+    "react/no-will-update-set-state": "error",
+    "react/require-render-return": "error",
+    "react/style-prop-object": "error",
+    "react/void-dom-elements-no-children": "error",
+    "react/checked-requires-onchange-or-readonly": "error",
+    "react/forward-ref-uses-ref": "error",
+    "react/iframe-missing-sandbox": "error",
+    "react/no-unknown-property": "error",
+    "jsx-a11y/alt-text": "off",
+    "jsx-a11y/aria-role": "off",
+    "jsx-a11y/click-events-have-key-events": "off",
+    "jsx-a11y/control-has-associated-label": "off",
+    "jsx-a11y/label-has-associated-control": "off",
+    "jsx-a11y/no-autofocus": "off",
+    "jsx-a11y/no-noninteractive-element-interactions": "off",
+    "jsx-a11y/no-static-element-interactions": "off",
+    "jsx-a11y/prefer-tag-over-role": "off",
+    "jsx-a11y/anchor-ambiguous-text": "error",
+    "jsx-a11y/anchor-has-content": "error",
+    "jsx-a11y/anchor-is-valid": "error",
+    "jsx-a11y/aria-activedescendant-has-tabindex": "error",
+    "jsx-a11y/aria-props": "error",
+    "jsx-a11y/aria-proptypes": "error",
+    "jsx-a11y/aria-unsupported-elements": "error",
+    "jsx-a11y/autocomplete-valid": "error",
+    "jsx-a11y/heading-has-content": "error",
+    "jsx-a11y/html-has-lang": "error",
+    "jsx-a11y/iframe-has-title": "error",
+    "jsx-a11y/img-redundant-alt": "error",
+    "jsx-a11y/media-has-caption": "error",
+    "jsx-a11y/no-access-key": "error",
+    "jsx-a11y/no-aria-hidden-on-focusable": "error",
+    "jsx-a11y/no-distracting-elements": "error",
+    "jsx-a11y/no-redundant-roles": "error",
+    "jsx-a11y/role-has-required-aria-props": "error",
+    "jsx-a11y/role-supports-aria-props": "error",
+    "jsx-a11y/scope": "error",
+    "jsx-a11y/tabindex-no-positive": "error",
+    "no-lone-blocks": "error",
+    "typescript/prefer-function-type": "error",
+    "typescript/prefer-for-of": "error",
     "trigger/no-thrown-unawaited-redirect": "error",
     "trigger-prisma/no-unbounded-list-filter": "error",
     "trigger-prisma/no-unbounded-list-filter-in-args-helper": "error"
@@ -72,6 +132,21 @@
         "trigger-prisma/no-unbounded-list-filter": "off",
         "trigger-prisma/no-unbounded-list-filter-in-args-helper": "off"
       }
+    },
+    {
+      "files": ["internal-packages/tsql/**"],
+      "rules": {
+        "prefer-object-has-own": "off"
+      }
+    },
+    {
+      "files": [
+        "apps/webapp/app/components/primitives/charts/Chart.tsx",
+        "apps/webapp/app/components/primitives/Timeline.tsx"
+      ],
+      "rules": {
+        "react/jsx-no-constructed-context-values": "off"
+      }
     }
   ]
 }

apps/supervisor/src/env.ts

@@ -187,6 +187,7 @@ export const Env = z
     KUBERNETES_STRIP_IMAGE_DIGEST: BoolEnv.default(false),
     KUBERNETES_IMAGE_REGISTRY_REWRITE_FROM: z.string().optional(),
     KUBERNETES_IMAGE_REGISTRY_REWRITE_TO: z.string().optional(),
+    KUBERNETES_RUN_POD_PRIORITY_CLASS_NAME: z.string().optional(),
     KUBERNETES_CPU_REQUEST_MIN_CORES: z.coerce.number().min(0).default(0),
     KUBERNETES_CPU_REQUEST_RATIO: z.coerce.number().min(0).max(1).default(0.75), // Ratio of CPU limit, so 0.75 = 75% of CPU limit
     KUBERNETES_MEMORY_REQUEST_MIN_GB: z.coerce.number().min(0).default(0),
@@ -220,6 +221,8 @@ export const Env = z
     KUBERNETES_RUNNER_SECCOMP_PROFILE_RUNTIMES: z
       .enum(["none", "node-24-plus", "all"])
       .default("node-24-plus"),
+    KUBERNETES_RUNNER_SECURITY_CONTEXT: z.enum(["off", "baseline", "restricted"]).default("off"),
+    KUBERNETES_RUNNER_RUN_AS_USER: z.coerce.number().int().min(1).default(1000),
 
     // Pod DNS config — override the cluster default ndots to `KUBERNETES_POD_DNS_NDOTS`.
     // Default k8s ndots is 5: any name with fewer than 5 dots (e.g. `api.example.com`, 2 dots) is first walked

apps/supervisor/src/workloadManager/kubernetes.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it } from "vitest";
 import {
   nodetypeNodeSelector,
   runPodTolerations,
+  runnerSecurityContext,
   withRunnerSeccompProfile,
   withNodeSelector,
 } from "./kubernetesPodSpec.js";
@@ -153,3 +154,35 @@ describe("withRunnerSeccompProfile", () => {
     }
   });
 });
+
+describe("runnerSecurityContext", () => {
+  it("sets nothing when off", () => {
+    expect(runnerSecurityContext("off", 1000, "node-24")).toBeUndefined();
+  });
+
+  it("drops all capabilities and blocks escalation at baseline", () => {
+    expect(runnerSecurityContext("baseline", 1000, "node-24")).toEqual({
+      allowPrivilegeEscalation: false,
+      capabilities: { drop: ["ALL"] },
+    });
+  });
+
+  it("pins the configured uid when restricted", () => {
+    expect(runnerSecurityContext("restricted", 1000, "node-24")).toEqual({
+      allowPrivilegeEscalation: false,
+      capabilities: { drop: ["ALL"] },
+      runAsNonRoot: true,
+      runAsUser: 1000,
+    });
+  });
+
+  it("pins bun's own uid, which differs from node's", () => {
+    expect(runnerSecurityContext("restricted", 1000, "bun")?.runAsUser).toBe(1001);
+  });
+
+  it("falls back to the configured uid when the runtime is unknown", () => {
+    for (const runtime of [undefined, null, "", "node", "node-22", "node-26"]) {
+      expect(runnerSecurityContext("restricted", 1000, runtime)?.runAsUser).toBe(1000);
+    }
+  });
+});

apps/supervisor/src/workloadManager/kubernetes.ts

@@ -17,6 +17,7 @@ import { getRunnerId } from "../util.js";
 import {
   nodetypeNodeSelector,
   runPodTolerations,
+  runnerSecurityContext,
   withRunnerSeccompProfile,
   withNodeSelector,
 } from "./kubernetesPodSpec.js";
@@ -175,6 +176,11 @@ export class KubernetesWorkloadManager implements WorkloadManager {
                   },
                 ],
                 resources: this.#getResourcesForMachine(opts.machine),
+                securityContext: runnerSecurityContext(
+                  env.KUBERNETES_RUNNER_SECURITY_CONTEXT,
+                  env.KUBERNETES_RUNNER_RUN_AS_USER,
+                  opts.runtime
+                ),
                 env: [
                   {
                     name: "TRIGGER_DEQUEUED_AT_MS",
@@ -365,6 +371,11 @@ export class KubernetesWorkloadManager implements WorkloadManager {
             schedulerName: env.KUBERNETES_SCHEDULER_NAME,
           }
         : {}),
+      ...(env.KUBERNETES_RUN_POD_PRIORITY_CLASS_NAME
+        ? {
+            priorityClassName: env.KUBERNETES_RUN_POD_PRIORITY_CLASS_NAME,
+          }
+        : {}),
       ...nodetypeNodeSelector(env.KUBERNETES_WORKER_NODETYPE_LABEL),
       ...(env.KUBERNETES_POD_DNS_NDOTS_OVERRIDE_ENABLED
         ? {