chore: merge main

Author: epipav

.env.test

@@ -0,0 +1,5 @@
+NODE_ENV=test
+DB_HOST=localhost
+DB_PORT=5434
+DB_USER=postgres
+DB_PASSWORD=example

.github/scripts/prepare-test-template-db.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# shellcheck source=scripts/utils
+source "${REPO_ROOT}/scripts/utils"
+
+: "${DB_HOST:?DB_HOST is required}"
+: "${DB_PORT:?DB_PORT is required}"
+: "${DB_USER:?DB_USER is required}"
+: "${DB_PASSWORD:?DB_PASSWORD is required}"
+
+say "Applying Sequin bootstrap SQL..."
+docker run --rm --network host \
+  -v "${REPO_ROOT}/scripts/scaffold/sequin/postgres-docker-entrypoint-initdb.d/create-sequin-database.sql:/bootstrap.sql:ro" \
+  -e "PGPASSWORD=${DB_PASSWORD}" \
+  postgres:14-alpine \
+  psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d postgres -v ON_ERROR_STOP=1 -f /bootstrap.sql
+
+say "Recreating test_template..."
+docker run --rm --network host \
+  -e "PGPASSWORD=${DB_PASSWORD}" \
+  postgres:14-alpine \
+  psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d postgres -v ON_ERROR_STOP=1 \
+  -c "DROP DATABASE IF EXISTS test_template;" \
+  -c "CREATE DATABASE test_template;"
+
+if [[ "${SKIP_FLYWAY_BUILD:-0}" == "1" ]]; then
+  say "Using pre-built crowd_flyway image."
+else
+  say "Building flyway image..."
+  docker build -t crowd_flyway -f "${REPO_ROOT}/backend/src/database/Dockerfile.flyway" "${REPO_ROOT}/backend/src/database"
+fi
+
+say "Migrating test_template..."
+docker run --rm --network host \
+  -e "PGHOST=${DB_HOST}" \
+  -e "PGPORT=${DB_PORT}" \
+  -e "PGUSER=${DB_USER}" \
+  -e "PGPASSWORD=${DB_PASSWORD}" \
+  -e PGDATABASE=test_template \
+  crowd_flyway
+
+say "Test template database ready."

.github/workflows/server-tests.yml

@@ -0,0 +1,88 @@
+name: Server Tests
+
+on:
+  pull_request:
+    # Only trigger when relevant files change to save CI minutes
+    paths-ignore:
+      - 'frontend/**'
+      - '**.md'
+      - '.gitignore'
+      - '.editorconfig'
+      - '**/.eslintrc*'
+      - '.prettierrc'
+      - '.prettierignore'
+      - 'LICENSE'
+
+# Automatically cancel in-progress runs if you push new code to the same PR
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  actions: write # GHA cache for Flyway image layers
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    services:
+      postgres:
+        image: postgres:14-alpine
+        command: postgres -c wal_level=logical
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: example
+          POSTGRES_DB: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 15
+
+    env:
+      NODE_ENV: test
+      DB_HOST: localhost
+      DB_PORT: 5432
+      DB_USER: postgres
+      DB_PASSWORD: example
+
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm i --frozen-lockfile
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build Flyway image
+        uses: docker/build-push-action@v6
+        with:
+          context: backend/src/database
+          file: backend/src/database/Dockerfile.flyway
+          load: true
+          tags: crowd_flyway
+          cache-from: type=gha,scope=flyway
+          cache-to: type=gha,mode=max,scope=flyway
+
+      - name: Prepare test database
+        env:
+          SKIP_FLYWAY_BUILD: 1
+        run: ./.github/scripts/prepare-test-template-db.sh
+
+      - name: Run server tests
+        run: pnpm test:server

backend/.env.dist.local

@@ -151,6 +151,7 @@ CROWD_TEMPORAL_ENCRYPTION_KEY_ID=local
 CROWD_TEMPORAL_ENCRYPTION_KEY=FweBMRnGCLshER8FlSvNusQA6G3MRUKt
 
 # Temporal — packages namespace
+CROWD_PACKAGES_TEMPORAL_SERVER_URL=localhost:7233
 CROWD_PACKAGES_TEMPORAL_NAMESPACE=default
 
 # Seach sync api
@@ -201,7 +202,7 @@ OSSPCKGS_GCP_CREDENTIALS_B64=e30=
 # maven/all.zip 404s). The allowlist check and DB storage normalize to lowercase
 # internally per ADR-0001 §OSV "Ecosystem normalization", so downstream stays lowercase.
 OSV_BULK_BASE_URL=https://osv-vulnerabilities.storage.googleapis.com
-OSV_ECOSYSTEMS=npm,Maven,cargo,NuGet
+OSV_ECOSYSTEMS=npm,Maven,cargo,NuGet,RubyGems,Go
 OSV_TMP_DIR=/tmp/osv
 OSV_BATCH_SIZE=500
 OSV_DERIVE_BATCH_SIZE=1000

backend/config/custom-environment-variables.json

@@ -180,6 +180,12 @@
     "certificate": "CROWD_TEMPORAL_CERTIFICATE",
     "privateKey": "CROWD_TEMPORAL_PRIVATE_KEY"
   },
+  "packagesTemporal": {
+    "serverUrl": "CROWD_PACKAGES_TEMPORAL_SERVER_URL",
+    "namespace": "CROWD_PACKAGES_TEMPORAL_NAMESPACE",
+    "certificate": "CROWD_TEMPORAL_CERTIFICATE",
+    "privateKey": "CROWD_TEMPORAL_PRIVATE_KEY"
+  },
   "searchSyncApi": {
     "baseUrl": "CROWD_SEARCH_SYNC_API_URL"
   },

backend/config/default.json

@@ -43,6 +43,7 @@
     "isEnabled": "false"
   },
   "temporal": {},
+  "packagesTemporal": {},
   "searchSyncApi": {},
   "encryption": {},
   "openStatusApi": {},

backend/package.json

@@ -94,7 +94,6 @@
     "dotenv": "8.2.0",
     "dotenv-expand": "^8.0.3",
     "emoji-dictionary": "^1.0.11",
-    "erlpack": "^0.1.4",
     "express": "4.17.1",
     "express-oauth2-jwt-bearer": "^1.7.4",
     "express-rate-limit": "6.5.1",
@@ -133,7 +132,6 @@
     "uuid": "^9.0.0",
     "validator": "^13.7.0",
     "verify-github-webhook": "^1.0.1",
-    "zlib-sync": "^0.1.8",
     "zod": "^4.3.6"
   },
   "private": true,

backend/src/api/member/memberMerge.ts

@@ -1,5 +1,6 @@
 import { CommonMemberService, invalidateMemberQueryCache } from '@crowd/common_services'
-import { optionsQx } from '@crowd/data-access-layer'
+
+import { optionsQx } from '@/database/sequelizeQueryExecutor'
 
 import Permissions from '../../security/permissions'
 import track from '../../segment/track'

backend/src/api/public/middlewares/staticApiKeyMiddleware.ts

@@ -2,7 +2,9 @@ import crypto from 'crypto'
 import type { NextFunction, Request, RequestHandler, Response } from 'express'
 
 import { UnauthorizedError } from '@crowd/common'
-import { findApiKeyByHash, optionsQx, touchApiKeyLastUsed } from '@crowd/data-access-layer'
+import { findApiKeyByHash, touchApiKeyLastUsed } from '@crowd/data-access-layer'
+
+import { optionsQx } from '@/database/sequelizeQueryExecutor'
 
 export function staticApiKeyMiddleware(): RequestHandler {
   return async (req: Request, _res: Response, next: NextFunction): Promise<void> => {

backend/src/api/public/openapi.yaml

@@ -779,8 +779,11 @@ paths:
   /organizations:
     get:
       operationId: getOrganization
-      summary: Look up an organization by domain
-      description: Find a verified organization by its primary domain.
+      summary: Look up an organization by domain or name
+      description: >
+        Provide domain, name, or both. When both are provided, the domain and
+        name must belong to the same organization. If multiple organizations
+        match, the most active one is returned.
       tags:
         - Organizations
       security:
@@ -789,12 +792,20 @@ paths:
       parameters:
         - name: domain
           in: query
-          required: true
+          required: false
           description: Primary domain of the organization.
           schema:
             type: string
             minLength: 1
           example: linuxfoundation.org
+        - name: name
+          in: query
+          required: false
+          description: Exact display name of the organization.
+          schema:
+            type: string
+            minLength: 1
+          example: Linux Foundation
       responses:
         '200':
           description: Organization found.
@@ -805,13 +816,14 @@ paths:
               example:
                 id: 550e8400-e29b-41d4-a716-446655440000
                 name: Linux Foundation
+                domain: linuxfoundation.org
                 logo: https://example.com/logo.png
         '401':
           $ref: '#/components/responses/Unauthorized'
         '403':
           $ref: '#/components/responses/Forbidden'
         '404':
-          description: No verified organization found for the given domain.
+          description: No organization found for the given domain or name.
           content:
             application/json:
               schema:
@@ -876,15 +888,26 @@ paths:
                 required:
                   - id
                   - name
+                  - domain
                 properties:
                   id:
                     type: string
                     format: uuid
                   name:
                     type: string
+                  domain:
+                    type: string
+                    description: Verified primary domain of the organization.
+                  logo:
+                    type:
+                      - string
+                      - 'null'
+                    description: URL of the organization logo.
               example:
                 id: 550e8400-e29b-41d4-a716-446655440000
                 name: Acme Corp
+                domain: acme.com
+                logo: https://example.com/logo.png
         '400':
           $ref: '#/components/responses/BadRequest'
         '401':
@@ -1218,6 +1241,7 @@ components:
         - id
         - organizationId
         - organizationName
+        - organizationDomains
         - jobTitle
         - verified
         - verifiedBy
@@ -1243,6 +1267,11 @@ components:
             - string
             - 'null'
           description: URL of the organization logo.
+        organizationDomains:
+          type: array
+          items:
+            type: string
+          description: Verified primary domains for the organization, in alphabetical order.
         jobTitle:
           type:
             - string
@@ -1531,13 +1560,17 @@ components:
       required:
         - id
         - name
+        - domain
       properties:
         id:
           type: string
           format: uuid
         name:
           type: string
           description: Display name of the organization.
+        domain:
+          type: string
+          description: Verified primary domain.
         logo:
           type: string
           description: URL of the organization logo. Only present if available.