[pull] main from MaterializeInc:main

bin/ci-builder

@@ -253,6 +253,14 @@ case "$cmd" in
         npm_dir=$HOME/.npm-builder
         mkdir -p "$(pwd)/target-xcompile" ~/.kube "$claude_dir" "$codex_dir" "$npm_dir"
 
+        container_workdir=$workdir
+        if is_truthy "${CI_BUILDER_FIXED_WORKDIR:-${CI:-0}}"; then
+            if [[ "$workdir" != "$(pwd)" ]]; then
+                die "the fixed workdir requires invoking ci-builder from the repository root (set CI_BUILDER_FIXED_WORKDIR=0 to opt out)"
+            fi
+            container_workdir=/workspace
+        fi
+
         args=(
             --cidfile "$cid_file"
             --rm --interactive
@@ -262,8 +270,8 @@ case "$cmd" in
             --volume "$HOME/.claude.json:/tmp/.claude.json"
             --volume "$codex_dir:/tmp/.codex"
             --volume "$npm_dir:/tmp/.npm"
-            --volume "$workdir:$workdir"
-            --workdir "$workdir"
+            --volume "$workdir:$container_workdir"
+            --workdir "$container_workdir"
             --env XDG_CACHE_HOME=/mnt/build/cache
             --env MZ_SOFT_ASSERTIONS
             --env NO_COLOR

bin/migrate-gh-to-linear

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+# Copyright Materialize, Inc. and contributors. All rights reserved.
+#
+# Use of this software is governed by the Business Source License
+# included in the LICENSE file at the root of this repository.
+#
+# As of the Change Date specified in that file, in accordance with
+# the Business Source License, use of this software will be governed
+# by the Apache License, Version 2.0.
+#
+# migrate-gh-to-linear - Migrate GitHub issues to Linear.
+
+exec "$(dirname "$0")"/pyactivate -m materialize.cli.migrate_gh_to_linear "$@"

ci/mkpipeline.py

@@ -306,9 +306,15 @@ def fetch_hashes() -> None:
         and fail_build_reason is None
     ):
         trim_test_selection_id(pipeline, set())
-        # Make the website always deploy
+        # lint-docs is required for website deploy, the others are free because an agent is always around anyway
         for step in steps(pipeline):
-            if step.get("id") == "lint-docs":
+            if step.get("id") in (
+                "lint-docs",
+                "lint-macos",
+                "lint-fast",
+                "lint-clippy",
+                "lint-doctests",
+            ):
                 step.pop("skip", None)
 
     # Surface label-driven changes as a Buildkite annotation, since otherwise

ci/plugins/cloudtest/hooks/command

@@ -14,6 +14,11 @@ set -euo pipefail
 . misc/shlib/shlib.bash
 . test/cloudtest/config.bash
 
+# The kind cluster setup hands repository paths to the host Docker daemon as
+# bind mount sources, which requires container paths to equal host paths. See
+# CI_BUILDER_FIXED_WORKDIR in bin/ci-builder.
+export CI_BUILDER_FIXED_WORKDIR=0
+
 run_args=(
     "--junitxml=junit_cloudtest_$BUILDKITE_JOB_ID.xml"
 )

ci/plugins/mzcompose/hooks/command

@@ -13,6 +13,11 @@ set -euo pipefail
 
 . misc/shlib/shlib.bash
 
+# mzcompose (and the compositions it runs) hands repository paths to the host
+# Docker daemon as bind mount sources, which requires container paths to equal
+# host paths. See CI_BUILDER_FIXED_WORKDIR in bin/ci-builder.
+export CI_BUILDER_FIXED_WORKDIR=0
+
 builder=${BUILDKITE_PLUGIN_MZCOMPOSE_CI_BUILDER:-min}
 
 if is_truthy "${CI_HEAP_PROFILES:-}"; then

ci/test/coverage_report.sh

@@ -29,7 +29,12 @@ bin/ci-annotate-errors junit_coverage*.xml || true
 ci_unimportant_heading "Create coverage report"
 REPORT=coverage_without_unittests_"$BUILDKITE_BUILD_ID"
 REPORT_UNITTESTS=coverage_with_unittests_"$BUILDKITE_BUILD_ID"
-find coverage -name '*.lcov' -exec sed -i "s#SF:/var/lib/buildkite-agent/builds/buildkite-[^/]*/materialize/[^/]*/#SF:#" {} +
+# Binaries embed the checkout path of the agent that compiled them: /workspace
+# for builds with CI_BUILDER_FIXED_WORKDIR, the Buildkite checkout path
+# otherwise (e.g. the cargo-test job).
+find coverage -name '*.lcov' -exec sed -i \
+  -e "s#SF:/workspace/#SF:#" \
+  -e "s#SF:/var/lib/buildkite-agent/builds/buildkite-[^/]*/materialize/[^/]*/#SF:#" {} +
 find coverage -name '*.lcov' -not -name 'cargotest.lcov' -exec genhtml -o "$REPORT" {} +
 find coverage -name '*.lcov' -exec genhtml -o "$REPORT_UNITTESTS" {} +
 

ci/test/pipeline.template.yml

@@ -787,6 +787,9 @@ steps:
           queue: linux-x86_64
         env:
           CI: "true"
+          # The kind cluster setup hands repository paths to the host Docker
+          # daemon. See CI_BUILDER_FIXED_WORKDIR in bin/ci-builder.
+          CI_BUILDER_FIXED_WORKDIR: "0"
         coverage: skip
         sanitizer: skip
         ci_glue_exempt: true

console/misc/docker/nginx.conf.template

@@ -48,6 +48,20 @@ ${MZ_NGINX_LISTENER_CONFIG}
         proxy_set_header X-Webhook-Event $http_x_webhook_event;
     }
 
+    # RFC 9728 OAuth protected-resource metadata. MCP clients pointed at
+    # /api/mcp follow the resource_metadata URL from the 401 challenge, which
+    # environmentd publishes on this host, so it must reach environmentd too.
+    location /.well-known/oauth-protected-resource {
+        resolver ${NGINX_LOCAL_RESOLVERS} valid=10s;
+        set $backend ${MZ_ENDPOINT};
+        proxy_pass $backend;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Request-ID $request_id;
+    }
+
     # Cache policy for static assets
     location ~* \.(js|css|png|jpg|jpeg|gif|svg|woff|woff2)$ {
         root /usr/share/nginx/html;

console/src/access/AppPasswordsPage.tsx

@@ -54,7 +54,7 @@ import { hasTenantApiTokenPermissions } from "~/api/auth";
 import { ApiToken } from "~/api/frontegg/types";
 import Alert from "~/components/Alert";
 import { AppErrorBoundary } from "~/components/AppErrorBoundary";
-import ConnectModal from "~/components/ConnectModal";
+import ConnectDrawer from "~/components/connect/ConnectDrawer";
 import { SecretCopyableBox } from "~/components/copyableComponents";
 import TaggedMultiSelect from "~/components/Dropdown/TaggedComboBox";
 import { LoadingContainer } from "~/components/LoadingContainer";
@@ -451,7 +451,7 @@ const ApiTokensTableProps = ({
                 borderBottomColor={colors.border.primary}
               >
                 <HStack>
-                  <ConnectAppPasswordModal user={user} userStr={userStr} />
+                  <ConnectAppPasswordButton userStr={userStr} />
                   <DeleteAppPasswordModal token={token} />
                 </HStack>
               </Td>
@@ -545,13 +545,7 @@ const SecretBox = ({
   );
 };
 
-const ConnectAppPasswordModal = ({
-  user,
-  userStr,
-}: {
-  user: User;
-  userStr: string;
-}) => {
+const ConnectAppPasswordButton = ({ userStr }: { userStr: string }) => {
   const { isOpen, onOpen, onClose } = useDisclosure();
 
   return (
@@ -566,10 +560,9 @@ const ConnectAppPasswordModal = ({
       >
         Connect
       </Button>
-      <ConnectModal
+      <ConnectDrawer
         onClose={onClose}
         isOpen={isOpen}
-        user={user}
         forAppPassword={{ user: userStr }}
       />
     </>