| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
fix(persist): stream deleteHardAllRecords progress to avoid client timeout on large deletes (#7375) Describe the problem and your solution - `deleteHardAllRecords` in persist buffers the entire delete in memory and only responds once every batch has been deleted. For connections with a very large number of records to hard-delete, this can take long enough that the runner's client-side fetch hits headersTimeout (UND_ERR_HEADERS_TIMEOUT) before persist ever sends a response, causing the sync to fail even though the delete was actually still progressing. This mirrors the same problem (and fix) we already shipped for `deleteOutdatedRecords` in #7192. <!-- Issue ticket number and link (if applicable) --> <!-- Testing instructions (skip if just adding/editing providers) --> <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/NangoHQ/nango/pull/7375?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> | 11 天前 | |
fix(server): Clamp proxy retry to maximum duration (#7264) <!-- Describe the problem and your solution --> While investigating a spike in server latency at the top of each hour, we discovered long running proxy operations for customer Centralize that was causing requests to stack up at the top of each hour. The root cause seems to be our proxy handler respecting long retries (1 hour+) retrying operations long after the client request will have timed out. There should be a maximum value for retry-after beyond which proxy operations fast fail and return retry information to the caller. <!-- Issue ticket number and link (if applicable) --> [NAN-6759: fix(server): Add maximum retry-after in proxy calls](https://linear.app/nango/issue/NAN-6759/fixserver-add-maximum-retry-after-in-proxy-calls) <!-- Testing instructions (skip if just adding/editing providers) --> To test this I had an agent stand up a mock server temporarily. A quick summary is: 1. Edit `providers.yaml` for a provider like `private-api-bearer` or `unauthenticated` to support retry headers. There might be a provider you could use for this already, but I didn't see it 🤷 : ``` retry: after: - 'retry-after' ``` 2. Standup a mock endpoint that always returns a long retry header based on what you are using from 1 3. Create a new integration and connection for provider from step 1 4. Allow Nango to send traffic to your mock endpoint by setting the following in your `.env`: ``` NANGO_OUTBOUND_URL_POLICY={"blockPrivateIps":false} ``` 5. Proxy a request through Nango connection. It should fail fast with this change rather than hanging for the duration of the retry header you provided from the mock endpoint. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/NangoHQ/nango/pull/7264?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> --------- Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> | 6 天前 | |
fix(runners): keep track of pending actions (#5038) Runner idling logic depends on keeping track of ongoing task executions. We used to not keep track of actions, relying on the fact that actions are usually short running and runner idling time was 24h We recently dropped the idling time to 30mins which made it possible for runners doing only actions to always idle after 30mins, requiring a cold start. This commit modifies the tasks tracking logic on runner, tracking all pending tasks (including actions). It is gonna increase the memory consumption of actions heavy runners but will make the idling logic less brittle and timing dependent <!-- Describe the problem and your solution --> <!-- Issue ticket number and link (if applicable) --> <!-- Testing instructions (skip if just adding/editing providers) --> <!-- Summary by @propel-code-bot --> --- **Track all pending tasks (incl. actions) to stabilize runner idle logic** The PR changes how a runner decides whether it is idle. Previously, the runner only tracked long-running sync jobs via `syncJobId`, so runners executing *only* short-lived actions appeared idle and were shut down after the new 30-minute idle threshold. The fix switches the tracking key to `taskId`, stores every incoming task in the `RunnerMonitor.tracked` map, and updates all call-sites to use the new `track(taskId)` / `untrack(taskId)` API. The change impacts `monitor.ts`, `abort.ts`, and `server.ts`, removes now-obsolete helpers, and adds a TODO about outdated Render-specific memory monitoring. Functional surface area is small (≈30 LoC touched) but affects core lifecycle logic, so the PR is classified as MODERATE. <details> <summary><strong>Key Changes</strong></summary> • Changed `RunnerMonitor.tracked` map key from `number` (syncJobId) to `string` (taskId) • Unified untracking logic: removed `untrackByTaskId()` and `untrack(nangoProps)` in favor of `untrack(taskId)` • Updated all call sites in `abort.ts` and `server.ts` to reflect the new API • Added TODO comment about memory monitoring no longer running on Render • Minor refactor: deleted ~20 lines of obsolete code, net +7/-19 </details> <details> <summary><strong>Affected Areas</strong></summary> • `packages/runner/lib/monitor.ts` • `packages/runner/lib/abort.ts` • `packages/runner/lib/server.ts` </details> --- *This summary was automatically generated by @propel-code-bot* | 9 个月前 | |
fix: add custom timeouts per service (#6667) Add customer keep alive timeouts per service. This is only applied if environment variable is set and greater than zero. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/NangoHQ/nango/pull/6667?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> | 2 个月前 | |
fix(runner): auth runner start (#7288) ## Summary - Require a jobs identity on runner `start` / `abort` / `notifyWhenIdle` when `NANGO_INTERNAL_AUTH_REQUIRED=true`. Jobs mints an EdDSA JWT (`aud: runner`); runners verify with a public key only. - Jobs never puts a minting secret on the runner. At node start it injects the Ed25519 public key, a jobs-audience node JWT, and a snapshot of `REQUIRED`. `/health` stays open. - Default is a no-op. Existing runners keep accepting dispatch (fail-open). Enforcement starts on pods created after jobs has a signing key and `REQUIRED=true`. --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> | 14 天前 | |
feat(mtls): add mtls support to internal service-to-service calls (#6928) <!-- Describe the problem and your solution --> <!-- Issue ticket number and link (if applicable) --> <!-- Testing instructions (skip if just adding/editing providers) --> <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/NangoHQ/nango/pull/6928?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> | 1 个月前 | |
fix(runner): move redis requirements to persist (#6566) ## Summary Moves runner distributed coordination (abort flags, sync-conflict locks, SDK locks) off direct customer Redis and behind new persist HTTP endpoints. Persist is now the only service that talks to customer Redis for these concerns. - **Persist**: adds a coordination layer (`abort`, `sync-conflict`, `locks`) with authenticated routes under `/environment/:environmentId/runner/...`, plus integration tests. - **Runner / Lambda**: use `PersistClient` for abort polling, sync-conflict acquire/refresh/release, and `HttpLocks` for SDK locking; removes `@nangohq/kvstore` from runner packages. - **Jobs**: sets abort flags via persist instead of Redis directly. - **Deploy**: drops `NANGO_CUSTOMER_REDIS_URL` from runner/Lambda env; renames `RUNNER_CONFLICT_RESOLUTION_MODE` from `REDIS` → `DISTRIBUTED` (set automatically when K8s replicas > 1). Single-replica runners stay `IN_MEMORY` (local `MapLocks`, tRPC abort only). <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/NangoHQ/nango/pull/6566?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> | 2 个月前 | |
fix(runner): allow node:-prefixed core module specifiers in sandboxed scripts (#7488) ## Describe the problem and your solution - allow node prefixed core module specifiers in sandboxed scripts, this is allowed at [cli](https://github.com/NangoHQ/nango/blob/master/packages/cli/lib/zeroYaml/constants.ts#L46) compilation time. <!-- Issue ticket number and link (if applicable) --> <!-- Testing instructions (skip if just adding/editing providers) --> <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/NangoHQ/nango/pull/7488?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> | 4 天前 | |
feat(functions): support for http trigger (#7250) Functions with http trigger can now compile, be deployed and executed. `debounce` and `subscriptions` support for http trigger is not yet enabled. The shape of trigger is now zod validated. Once this PR land and CLI released, it would be possible to write, deploy and execute action-like functions Example of function that can be run: ```ts import { createFunction } from 'nango/experimental'; import * as z from 'zod'; export default createFunction({ description: '10x', trigger: { kind: 'http', }, input: z.object({ n: z.number(), }), output: z.object({ tenTimes: z.number(), }), exec: async (nango, trigger) => { nango.setLogger({ level: 'debug' }); await nango.log('Hello World!'); await nango.log('Trigger: ' + JSON.stringify(trigger)); const tenTimes = trigger.input.n * 10 await nango.log('Result: ' + tenTimes); return { tenTimes } } }); ``` <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/NangoHQ/nango/pull/7250?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> | 19 天前 | |
fix(runner): error handling and retry in jobs client (#4927) retry mechanism relies on a rejected promise so we cannot wrap the output with Result. But we can catch everything in the jobs client functions so downstream code doesn't have to deal with exception but only Result <!-- Describe the problem and your solution --> <!-- Issue ticket number and link (if applicable) --> <!-- Testing instructions (skip if just adding/editing providers) --> <!-- Summary by @propel-code-bot --> --- **Refactor runner HTTP layer to return `Result` objects and centralize retry logic** This moderate-sized PR (~170 LOC touched) removes in-function `try/catch` blocks from runner call-sites and moves retry/error handling down into the shared HTTP utilities. `packages/runner/lib/clients/jobs.ts` now always returns a `Result` (`Ok`/`Err`) so callers (`idle.ts`, `register.ts`) can use `isErr()` instead of their own exception logic. The new implementation delegates network retries to an enhanced `httpFetch`, which retries only on network failures, 5xx, and 429 status codes and logs errors consistently. Special handling for 413 (payload too large) is preserved. Default back-off parameters are defined once (`defaultRetryOptions`) and passed through, reducing duplicate code. <details> <summary><strong>Key Changes</strong></summary> • Added centralized retry/error logic in `httpFetch` using `retryWithBackoff` and status-code filtering • Updated `packages/runner/lib/clients/jobs.ts` methods (`postHeartbeat`, `putTask`, `postRegister`, `postIdle`) to wrap responses in `Result` and replace local retry blocks • Changed error constant names to snake_case (e.g., `heartbeat_failed`, `put_task_failed`) • Simplified `packages/runner/lib/idle.ts` and `packages/runner/lib/register.ts` – they now check `res.isErr()` instead of catching exceptions • Introduced `defaultRetryOptions` constant and optional back-off options parameter in `httpFetch` </details> <details> <summary><strong>Affected Areas</strong></summary> • `packages/runner/lib/clients/http.ts` • `packages/runner/lib/clients/jobs.ts` • `packages/runner/lib/idle.ts` • `packages/runner/lib/register.ts` </details> --- *This summary was automatically generated by @propel-code-bot* | 10 个月前 | |
fix(runner): move redis requirements to persist (#6566) ## Summary Moves runner distributed coordination (abort flags, sync-conflict locks, SDK locks) off direct customer Redis and behind new persist HTTP endpoints. Persist is now the only service that talks to customer Redis for these concerns. - **Persist**: adds a coordination layer (`abort`, `sync-conflict`, `locks`) with authenticated routes under `/environment/:environmentId/runner/...`, plus integration tests. - **Runner / Lambda**: use `PersistClient` for abort polling, sync-conflict acquire/refresh/release, and `HttpLocks` for SDK locking; removes `@nangohq/kvstore` from runner packages. - **Jobs**: sets abort flags via persist instead of Redis directly. - **Deploy**: drops `NANGO_CUSTOMER_REDIS_URL` from runner/Lambda env; renames `RUNNER_CONFLICT_RESOLUTION_MODE` from `REDIS` → `DISTRIBUTED` (set automatically when K8s replicas > 1). Single-replica runners stay `IN_MEMORY` (local `MapLocks`, tRPC abort only). <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/NangoHQ/nango/pull/6566?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> | 2 个月前 | |
fix: fail action when output is >10mb (#3629) when output action is >10mb (max size supported by jobs and orchestrator) the request from runner to jobs to report the script result fails silently causing the task not to be updated and eventually being expired after 15mins With this commit we ensure the task is errored asap. I took advantage of this change to refactor the runner logic calling jobs and persist API to make it more type-safe As part of this change we are now also retrying the call to jobs PUT /tasks/ID endpoint How to test: - create an action that return a big result (ex: `return new Array(5_000_000).fill(0)`) - run locally and check that runner register, heartbeat, idle and report memory warning correctly. You might want to tweak the different thresholds/intervals ```diff diff --git a/packages/jobs/lib/runner/local.ts b/packages/jobs/lib/runner/local.ts index 6043b061f..8c0823c47 100644 --- a/packages/jobs/lib/runner/local.ts +++ b/packages/jobs/lib/runner/local.ts @@ -33,7 +33,7 @@ export const localNodeProvider: NodeProvider = { RUNNER_URL: `http://localhost:${port}`, - IDLE_MAX_DURATION_MS: '0', + IDLE_MAX_DURATION_MS: '10000', PROVIDERS_URL: getProvidersUrl(), diff --git a/packages/runner/lib/env.ts b/packages/runner/lib/env.ts index a3a5e8048..17f9fd071 100644 --- a/packages/runner/lib/env.ts +++ b/packages/runner/lib/env.ts @@ -3,7 +3,7 @@ import { getJobsUrl, getPersistAPIUrl } from '@nangohq/shared'; export const envs = parseEnvs(ENVS.required({ RUNNER_NODE_ID: true })); -export const heartbeatIntervalMs = 30_000; +export const heartbeatIntervalMs = 1_000; export const jobsServiceUrl = getJobsUrl(); diff --git a/packages/utils/lib/environment/parse.ts b/packages/utils/lib/environment/parse.ts index 6d08c96f7..ca882eb3e 100644 --- a/packages/utils/lib/environment/parse.ts +++ b/packages/utils/lib/environment/parse.ts @@ -60,7 +60,7 @@ export const ENVS = z.object({ RUNNER_URL: z.string().url().optional(), - RUNNER_MEMORY_WARNING_THRESHOLD: z.coerce.number().optional().default(85), + RUNNER_MEMORY_WARNING_THRESHOLD: z.coerce.number().optional().default(0), ``` | 1 年前 | |
fix(runner): move redis requirements to persist (#6566) ## Summary Moves runner distributed coordination (abort flags, sync-conflict locks, SDK locks) off direct customer Redis and behind new persist HTTP endpoints. Persist is now the only service that talks to customer Redis for these concerns. - **Persist**: adds a coordination layer (`abort`, `sync-conflict`, `locks`) with authenticated routes under `/environment/:environmentId/runner/...`, plus integration tests. - **Runner / Lambda**: use `PersistClient` for abort polling, sync-conflict acquire/refresh/release, and `HttpLocks` for SDK locking; removes `@nangohq/kvstore` from runner packages. - **Jobs**: sets abort flags via persist instead of Redis directly. - **Deploy**: drops `NANGO_CUSTOMER_REDIS_URL` from runner/Lambda env; renames `RUNNER_CONFLICT_RESOLUTION_MODE` from `REDIS` → `DISTRIBUTED` (set automatically when K8s replicas > 1). Single-replica runners stay `IN_MEMORY` (local `MapLocks`, tRPC abort only). <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/NangoHQ/nango/pull/6566?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> | 2 个月前 | |
fix(runner): move redis requirements to persist (#6566) ## Summary Moves runner distributed coordination (abort flags, sync-conflict locks, SDK locks) off direct customer Redis and behind new persist HTTP endpoints. Persist is now the only service that talks to customer Redis for these concerns. - **Persist**: adds a coordination layer (`abort`, `sync-conflict`, `locks`) with authenticated routes under `/environment/:environmentId/runner/...`, plus integration tests. - **Runner / Lambda**: use `PersistClient` for abort polling, sync-conflict acquire/refresh/release, and `HttpLocks` for SDK locking; removes `@nangohq/kvstore` from runner packages. - **Jobs**: sets abort flags via persist instead of Redis directly. - **Deploy**: drops `NANGO_CUSTOMER_REDIS_URL` from runner/Lambda env; renames `RUNNER_CONFLICT_RESOLUTION_MODE` from `REDIS` → `DISTRIBUTED` (set automatically when K8s replicas > 1). Single-replica runners stay `IN_MEMORY` (local `MapLocks`, tRPC abort only). <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/NangoHQ/nango/pull/6566?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> | 2 个月前 | |
fix(runner): error handling and retry in jobs client (#4927) retry mechanism relies on a rejected promise so we cannot wrap the output with Result. But we can catch everything in the jobs client functions so downstream code doesn't have to deal with exception but only Result <!-- Describe the problem and your solution --> <!-- Issue ticket number and link (if applicable) --> <!-- Testing instructions (skip if just adding/editing providers) --> <!-- Summary by @propel-code-bot --> --- **Refactor runner HTTP layer to return `Result` objects and centralize retry logic** This moderate-sized PR (~170 LOC touched) removes in-function `try/catch` blocks from runner call-sites and moves retry/error handling down into the shared HTTP utilities. `packages/runner/lib/clients/jobs.ts` now always returns a `Result` (`Ok`/`Err`) so callers (`idle.ts`, `register.ts`) can use `isErr()` instead of their own exception logic. The new implementation delegates network retries to an enhanced `httpFetch`, which retries only on network failures, 5xx, and 429 status codes and logs errors consistently. Special handling for 413 (payload too large) is preserved. Default back-off parameters are defined once (`defaultRetryOptions`) and passed through, reducing duplicate code. <details> <summary><strong>Key Changes</strong></summary> • Added centralized retry/error logic in `httpFetch` using `retryWithBackoff` and status-code filtering • Updated `packages/runner/lib/clients/jobs.ts` methods (`postHeartbeat`, `putTask`, `postRegister`, `postIdle`) to wrap responses in `Result` and replace local retry blocks • Changed error constant names to snake_case (e.g., `heartbeat_failed`, `put_task_failed`) • Simplified `packages/runner/lib/idle.ts` and `packages/runner/lib/register.ts` – they now check `res.isErr()` instead of catching exceptions • Introduced `defaultRetryOptions` constant and optional back-off options parameter in `httpFetch` </details> <details> <summary><strong>Affected Areas</strong></summary> • `packages/runner/lib/clients/http.ts` • `packages/runner/lib/clients/jobs.ts` • `packages/runner/lib/idle.ts` • `packages/runner/lib/register.ts` </details> --- *This summary was automatically generated by @propel-code-bot* | 10 个月前 | |
fix(runner): auth runner start (#7288) ## Summary - Require a jobs identity on runner `start` / `abort` / `notifyWhenIdle` when `NANGO_INTERNAL_AUTH_REQUIRED=true`. Jobs mints an EdDSA JWT (`aud: runner`); runners verify with a public key only. - Jobs never puts a minting secret on the runner. At node start it injects the Ed25519 public key, a jobs-audience node JWT, and a snapshot of `REQUIRED`. `/health` stays open. - Default is a no-op. Existing runners keep accepting dispatch (fail-open). Enforcement starts on pods created after jobs has a signing key and `REQUIRED=true`. --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> | 14 天前 | |
fix(runner): auth runner start (#7288) ## Summary - Require a jobs identity on runner `start` / `abort` / `notifyWhenIdle` when `NANGO_INTERNAL_AUTH_REQUIRED=true`. Jobs mints an EdDSA JWT (`aud: runner`); runners verify with a public key only. - Jobs never puts a minting secret on the runner. At node start it injects the Ed25519 public key, a jobs-audience node JWT, and a snapshot of `REQUIRED`. `/health` stays open. - Default is a no-op. Existing runners keep accepting dispatch (fail-open). Enforcement starts on pods created after jobs has a signing key and `REQUIRED=true`. --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> | 14 天前 | |
fix(runner): move redis requirements to persist (#6566) ## Summary Moves runner distributed coordination (abort flags, sync-conflict locks, SDK locks) off direct customer Redis and behind new persist HTTP endpoints. Persist is now the only service that talks to customer Redis for these concerns. - **Persist**: adds a coordination layer (`abort`, `sync-conflict`, `locks`) with authenticated routes under `/environment/:environmentId/runner/...`, plus integration tests. - **Runner / Lambda**: use `PersistClient` for abort polling, sync-conflict acquire/refresh/release, and `HttpLocks` for SDK locking; removes `@nangohq/kvstore` from runner packages. - **Jobs**: sets abort flags via persist instead of Redis directly. - **Deploy**: drops `NANGO_CUSTOMER_REDIS_URL` from runner/Lambda env; renames `RUNNER_CONFLICT_RESOLUTION_MODE` from `REDIS` → `DISTRIBUTED` (set automatically when K8s replicas > 1). Single-replica runners stay `IN_MEMORY` (local `MapLocks`, tRPC abort only). <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/NangoHQ/nango/pull/6566?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> | 2 个月前 | |
chore: reintroduce DT telemetry wiring over pubsub (#6557) This reverts commit e39f8eba31106d88df6fbfb4159cb4beb6c3d603, which reverted the original changes. In other words, it reintroduces the original "Data Transfer telemetry over pubsub" implementation. Also: single event with ingressedBytes/egressedBytes replaces two per-direction events. event.payload.value now carries request count; bytes moved to properties. Halves pubsub volume and keeps directions correlated per call. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/NangoHQ/nango/pull/6557?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> | 2 个月前 | |
chore(dd): try to change some spampling (#3518) ## Changes Fixes https://linear.app/nango/issue/NAN-2703/fine-tune-datadog-tracer - Try to add a little bit of sampling on some resources Honestly, it's hard to pick a number so I just played it safe. - Added missing persist-net - Removed dns persist that I wrongly set to true | 1 年前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 11 天前 | ||
| 6 天前 | ||
| 9 个月前 | ||
| 2 个月前 | ||
| 14 天前 | ||
| 1 个月前 | ||
| 2 个月前 | ||
| 4 天前 | ||
| 19 天前 | ||
| 10 个月前 | ||
| 2 个月前 | ||
| 1 年前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 10 个月前 | ||
| 14 天前 | ||
| 14 天前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 1 年前 |