recce-nightly 1.25.0.20251118__tar.gz → 1.27.0.20251201__tar.gz

{recce_nightly-1.25.0.20251118 → recce_nightly-1.27.0.20251201}/.github/workflows/integration-tests-cloud.yaml

@@ -7,15 +7,48 @@ on:
     paths-ignore:
       - "js/**"
       - "recce/data/**"
-  pull_request_target:
+  pull_request:
     branches:
       - main
     paths-ignore:
       - "js/**"
       - "recce/data/**"
 
+# Explicitly limit permissions for pull_request_target
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
+  # First job: Check if the PR author has write permission
+  # This job runs in the privileged context but doesn't checkout untrusted code
+  authorize:
+    runs-on: ubuntu-latest
+    outputs:
+      authorized: ${{ steps.check.outputs.authorized }}
+    steps:
+      - name: Check if PR author has write permission
+        id: check
+        run: |
+          if [[ "${{ github.event_name }}" == "push" ]]; then
+            echo "authorized=true" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          PERMISSION=$(gh api repos/${{ github.repository }}/collaborators/${{ github.triggering_actor }}/permission --jq '.permission' 2>/dev/null || echo "none")
+          if [[ "$PERMISSION" == "write" || "$PERMISSION" == "admin" ]]; then
+            echo "authorized=true" >> $GITHUB_OUTPUT
+          else
+            echo "authorized=false" >> $GITHUB_OUTPUT
+            echo "::warning::Cloud smoke test skipped for forked repository. This test will be migrated to a separate workflow for external contributors."
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  # Second job: Run the actual tests only if authorized
   smoke-test-cloud:
+    needs: authorize
+    if: needs.authorize.outputs.authorized == 'true'
     concurrency:
       group: smoke-test-cloud
       cancel-in-progress: false
@@ -29,29 +62,21 @@ jobs:
           - python-version: "3.13"
             dbt-version: "latest"
     steps:
-      - name: Check external code before checkout
-        run: |
-          PERMISSION=$(gh api repos/${{ github.repository }}/collaborators/${{ github.triggering_actor }}/permission --jq '.permission')
-          if [[ "$PERMISSION" != "write" && "$PERMISSION" != "admin" ]]; then
-            echo "Please review the code from ${{ github.actor }}, then re-run the workflow."
-            exit 1
-          fi
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - uses: actions/checkout@v3
+      # Safe checkout: only proceeds after authorization check passes
+      # codeql[js/actions/pull-request-target] - Authorization verified in previous job
+      - uses: actions/checkout@v4
         with:
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-          ref: ${{ github.event.pull_request.head.sha }}
-          token: ${{ secrets.RECCE_CLOUD_TOKEN }}
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
-          cache: "pip" # caching pip dependencies
+          cache: "pip"
           cache-dependency-path: setup.py
-      - run: |
+
+      - name: Install dependencies
+        run: |
           python -m pip install --upgrade pip
           if [ "${{ matrix.dbt-version }}" == "latest" ]; then
             pip install dbt-core
@@ -70,4 +95,4 @@ jobs:
           ./integration_tests/dbt/smoke_test_cloud.sh
         env:
           GITHUB_TOKEN: ${{ secrets.RECCE_CLOUD_TOKEN }}
-          RECCE_STATE_PASSWORD: ${{ vars.RECCE_STATE_PASSWORD}}
+          RECCE_STATE_PASSWORD: ${{ vars.RECCE_STATE_PASSWORD }}

{recce_nightly-1.25.0.20251118 → recce_nightly-1.27.0.20251201}/.github/workflows/nightly.yaml

@@ -17,6 +17,9 @@ on:
         type: number
         default: 0
 
+permissions:
+  contents: read
+
 jobs:
   build-nightly-release:
     name: Build Recce Nightly Release
@@ -72,7 +75,7 @@ jobs:
               final_version="$new_version"
             else
               # Same date, check if latest already has postN
-              if [[ "$latest_version" =~ -post([0-9]+)$ ]]; then
+              if [[ "$latest_version" =~ \.post([0-9]+)$ ]]; then
                 post_num=$(( ${BASH_REMATCH[1]} + 1 ))
               else
                 post_num=1
@@ -134,8 +137,6 @@ jobs:
   build-recce-cloud-nightly:
     name: Build Recce Cloud Nightly Release
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -166,8 +167,7 @@ jobs:
               # New date is newer, no post needed
               final_version="$new_version"
             else
-              # Same date, check if latest already has postN
-              if [[ "$latest_version" =~ -post([0-9]+)$ ]]; then
+              if [[ "$latest_version" =~ \.post([0-9]+)$ ]]; then
                 post_num=$(( ${BASH_REMATCH[1]} + 1 ))
               else
                 post_num=1
@@ -212,3 +212,33 @@ jobs:
           ignore_empty: true
           ignore_missing: true
           version: ${{ steps.patch_version.outputs.nightly_version }}
+
+  trigger-build-recce-instance-launcher-image:
+    name: Trigger Build Recce Instance Launcher Image
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    needs: build-nightly-release
+    steps:
+      - uses: actions/create-github-app-token@v2
+        id: app-token
+        with:
+          app-id: 2343362 # App ID of Recce Action Bot
+          private-key: ${{ secrets.RECCE_ACTION_BOT_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+      - name: Trigger Recce Instance Launcher Image Build
+        id: dispatch
+        continue-on-error: true
+        uses: benc-uk/workflow-dispatch@v1
+        with:
+          workflow: 'build-recce-instance-launcher.yml'
+          repo: 'DataRecce/recce-cloud-infra'
+          ref: 'main'
+          inputs: '{ "environment": "staging" }'
+          token: '${{ steps.app-token.outputs.token }}'
+      - name: Handle dispatch failure
+        if: steps.dispatch.outcome == 'failure'
+        run: |
+          echo "::warning::Failed to trigger recce-cloud-infra build workflow"
+          echo "::warning::Please manually trigger the build at: https://github.com/DataRecce/recce-cloud-infra/actions/workflows/build-recce-instance-launcher.yml"
+          echo "::warning::Use ref: main and environment: staging"

{recce_nightly-1.25.0.20251118 → recce_nightly-1.27.0.20251201}/.github/workflows/release.yaml

@@ -3,6 +3,9 @@ on:
   push:
     tags: 'v*'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build Recce Official Release
@@ -92,8 +95,6 @@ jobs:
   build-recce-cloud:
     name: Build Recce Cloud Official Release
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
 
     steps:
       - name: Checkout
@@ -141,3 +142,53 @@ jobs:
           ignore_empty: true
           ignore_missing: true
           version: ${{ steps.patch_version.outputs.release_version }}
+
+  trigger-build-recce-instance-launcher-image:
+    name: Trigger Recce Instance Launcher Image Build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    needs: build
+    steps:
+      - uses: actions/create-github-app-token@v2
+        id: app-token
+        with:
+          app-id: 2343362 # App ID of Recce Action Bot
+          private-key: ${{ secrets.RECCE_ACTION_BOT_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+      - name: Fetch latest release from Recce Cloud Infra repo
+        id: latest-recce-cloud-release
+        env:
+          TOKEN: ${{ steps.app-token.outputs.token }}
+          ORG: DataRecce
+          REPO: recce-cloud-infra
+        run: |
+          tag=$(curl -sS --fail-with-body \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${TOKEN}" \
+            https://api.github.com/repos/${ORG}/${REPO}/releases/latest \
+            | jq -r .tag_name)
+
+          if [ -z "$tag" ] || [ "$tag" = "null" ]; then
+            echo "Error: Failed to fetch latest release tag from ${ORG}/${REPO}"
+            exit 1
+          fi
+
+          echo "tag_name=$tag" >> "$GITHUB_OUTPUT"
+          echo "Fetched latest release: $tag"
+      - name: Trigger Recce Instance Launcher Image Build Workflow
+        id: dispatch
+        continue-on-error: true
+        uses: benc-uk/workflow-dispatch@v1
+        with:
+          workflow: 'build-recce-instance-launcher.yml'
+          repo: 'DataRecce/recce-cloud-infra'
+          ref: ${{ steps.latest-recce-cloud-release.outputs.tag_name }}
+          inputs: '{ "environment": "production" }'
+          token: '${{ steps.app-token.outputs.token }}'
+      - name: Handle dispatch failure
+        if: steps.dispatch.outcome == 'failure'
+        run: |
+          echo "::warning::Failed to trigger recce-cloud-infra build workflow"
+          echo "::warning::Please manually trigger the build at: https://github.com/DataRecce/recce-cloud-infra/actions/workflows/build-recce-instance-launcher.yml"
+          echo "::warning::Use ref: ${{ steps.latest-recce-cloud-release.outputs.tag_name }} and environment: production"

{recce_nightly-1.25.0.20251118 → recce_nightly-1.27.0.20251201}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: recce-nightly
-Version: 1.25.0.20251118
+Version: 1.27.0.20251201
 Summary: Environment diff tool for dbt
 Home-page: https://github.com/InfuseAI/recce
 Author: InfuseAI Dev Team

{recce_nightly-1.25.0.20251118 → recce_nightly-1.27.0.20251201}/js/app/Providers.tsx

@@ -6,6 +6,7 @@ import { Router } from "wouter";
 import { Provider } from "@/components/ui/provider";
 import { Toaster } from "@/components/ui/toaster";
 import { reactQueryClient } from "@/lib/api/axiosClient";
+import { IdleTimeoutProvider } from "@/lib/hooks/IdleTimeoutContext";
 import RecceContextProvider from "@/lib/hooks/RecceContextProvider";
 import { useHashLocation } from "@/lib/hooks/useHashLocation";
 
@@ -13,12 +14,14 @@ export default function Providers({ children }: { children: ReactNode }) {
   return (
     <Provider forcedTheme="light">
       <QueryClientProvider client={reactQueryClient}>
-        <Router hook={useHashLocation}>
-          <RecceContextProvider>
-            {children}
-            <Toaster />
-          </RecceContextProvider>
-        </Router>
+        <IdleTimeoutProvider>
+          <Router hook={useHashLocation}>
+            <RecceContextProvider>
+              {children}
+              <Toaster />
+            </RecceContextProvider>
+          </Router>
+        </IdleTimeoutProvider>
       </QueryClientProvider>
     </Provider>
   );

{recce_nightly-1.25.0.20251118 → recce_nightly-1.27.0.20251201}/js/app/page.tsx

@@ -40,13 +40,13 @@ import { LineagePage } from "@/components/lineage/LineagePage";
 import { RunList } from "@/components/run/RunList";
 import { RunResultPane } from "@/components/run/RunResultPane";
 import { HSplit, VSplit } from "@/components/split/Split";
+import { IdleTimeoutBadge } from "@/components/timeout/IdleTimeoutBadge";
 import { toaster } from "@/components/ui/toaster";
 import { cacheKeys } from "@/lib/api/cacheKeys";
 import { Check, listChecks } from "@/lib/api/checks";
 import { trackInit, trackNavigation } from "@/lib/api/track";
 import { useRecceActionContext } from "@/lib/hooks/RecceActionContext";
 import { useRecceInstanceContext } from "@/lib/hooks/RecceInstanceContext";
-import { useCountdownToast } from "@/lib/hooks/useCountdownToast";
 import { useRecceServerFlag } from "@/lib/hooks/useRecceServerFlag";
 
 const RouteAlwaysMount = ({
@@ -166,8 +166,7 @@ function RecceVersionBadge() {
 function TopBar() {
   const { reviewMode, isDemoSite, envInfo, cloudMode } =
     useLineageGraphContext();
-  const { featureToggles, lifetimeExpiredAt, authed } =
-    useRecceInstanceContext();
+  const { featureToggles, authed } = useRecceInstanceContext();
   const { url: prURL, id: prID } = envInfo?.pullRequest ?? {};
   const demoPrId = prURL ? prURL.split("/").pop() : null;
   const brandLink =
@@ -176,8 +175,6 @@ function TopBar() {
       : "https://reccehq.com/";
   const [showModal, setShowModal] = useState(false);
 
-  useCountdownToast(lifetimeExpiredAt);
-
   return (
     <Flex
       gap="10px"
@@ -302,6 +299,7 @@ function TopBar() {
       )}
       {!isDemoSite && featureToggles.mode !== "read only" && (
         <>
+          <IdleTimeoutBadge />
           {authed || cloudMode ? (
             <Box mr={2}>
               <AvatarDropdown />

{recce_nightly-1.25.0.20251118 → recce_nightly-1.27.0.20251201}/js/package.json

@@ -55,7 +55,10 @@
     "react-data-grid": "7.0.0-beta.58",
     "react-dom": "19.2.0",
     "react-icons": "^5.5.0",
+    "react-markdown": "^10.1.0",
     "react-split": "^2.0.14",
+    "react-syntax-highlighter": "^16.1.0",
+    "remark-gfm": "^4.0.1",
     "simplebar": "^6.3.3",
     "simplebar-react": "3.3.2",
     "usehooks-ts": "^3.1.1",
@@ -77,6 +80,7 @@
     "@types/node": "^24.10.1",
     "@types/react": "19.2.5",
     "@types/react-dom": "19.2.3",
+    "@types/react-syntax-highlighter": "^15.5.13",
     "globals": "^16.5.0",
     "husky": "^9.1.7",
     "jest": "^30.2.0",