Update release-3.7

.github/workflows/fork-pr-dispatch.yml

@@ -0,0 +1,66 @@
+---
+name: Fork PR dispatch to enterprise
+on:
+  workflow_run:
+    workflows: ["PR verification (forks)"]
+    types: [completed]
+permissions:
+  id-token: write
+  contents: read
+  statuses: write
+jobs:
+  dispatch:
+    if: >
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.head_repository.fork == true
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: ${{ vars.RP_AWS_CRED_REGION }}
+          role-to-assume: arn:aws:iam::${{ secrets.RP_AWS_CRED_ACCOUNT_ID }}:role/${{ vars.RP_AWS_CRED_BASE_ROLE_NAME }}${{ github.event.repository.name }}
+      - uses: aws-actions/aws-secretsmanager-get-secrets@v2
+        with:
+          secret-ids: |
+            ,sdlc/prod/github/actions_bot_token
+          parse-json-secrets: true
+      - name: Build dispatch payload
+        id: payload
+        env:
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+          HEAD_REPO: ${{ github.event.workflow_run.head_repository.full_name }}
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const payload = {
+              branch: process.env.HEAD_BRANCH,
+              commit_sha: process.env.HEAD_SHA,
+              head_repository: process.env.HEAD_REPO,
+              is_fork: true,
+            };
+            core.setOutput('json', JSON.stringify(payload));
+            core.setOutput('sha', process.env.HEAD_SHA);
+      - name: Repository dispatch for fork PR
+        uses: peter-evans/repository-dispatch@caebe2a7c967e9f927ff8780fea8e16e50b5ce40
+        with:
+          token: ${{ env.ACTIONS_BOT_TOKEN }}
+          repository: redpanda-data/console-enterprise
+          event-type: push
+          client-payload: ${{ steps.payload.outputs.json }}
+      - name: Set pending enterprise CI status
+        env:
+          HEAD_SHA: ${{ steps.payload.outputs.sha }}
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ env.ACTIONS_BOT_TOKEN }}
+          script: |
+            await github.rest.repos.createCommitStatus({
+              owner: 'redpanda-data',
+              repo: 'console',
+              sha: process.env.HEAD_SHA,
+              state: 'pending',
+              description: 'Enterprise CI is running...',
+              context: 'Enterprise CI'
+            });

.github/workflows/frontend-react-doctor.yml

@@ -5,6 +5,9 @@ on:
     paths:
       - "frontend/**"
       - ".github/workflows/frontend-react-doctor.yml"
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
   react-doctor:
     timeout-minutes: 5
@@ -22,12 +25,10 @@ jobs:
       - name: Cache dependencies
         uses: actions/cache@v4
         with:
-          path: |
-            ~/.bun/install/cache
-            frontend/node_modules
-          key: ${{ runner.os }}-bun-frontend-${{ hashFiles('frontend/bun.lock') }}
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-cache-${{ hashFiles('frontend/bun.lock') }}
           restore-keys: |
-            ${{ runner.os }}-bun-frontend-
+            ${{ runner.os }}-bun-cache-
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Run React Doctor

.github/workflows/frontend-update-baselines.yml

@@ -0,0 +1,60 @@
+---
+name: frontend-update-baselines
+# Regenerate Vitest browser test screenshot baselines (platform-agnostic)
+# and commit them to the branch. Run this workflow when UI changes cause
+# intentional visual diffs that need new baselines.
+# Keep action versions in sync with frontend-visual.yml
+on:
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: Branch to update baselines on
+        required: true
+        default: main
+permissions:
+  contents: write
+env:
+  CI: true
+jobs:
+  update-baselines:
+    timeout-minutes: 5
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+        with:
+          ref: ${{ github.event.inputs.branch }}
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2.2.0
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+      - name: Cache Playwright browsers
+        uses: actions/cache@v5.0.4
+        id: playwright-cache
+        with:
+          path: ~/.cache/ms-playwright
+          key: ${{ runner.os }}-playwright-chromium-${{ hashFiles('frontend/bun.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-playwright-chromium-
+      - name: Install Playwright browsers
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        run: bunx playwright install --with-deps chromium
+      - name: Install Playwright system deps (cached)
+        if: steps.playwright-cache.outputs.cache-hit == 'true'
+        run: bunx playwright install-deps chromium
+      - name: Regenerate screenshot baselines
+        run: bun run test:browser:update
+      - name: Commit updated baselines
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add 'src/**/__screenshots__/**/*.png'
+          if git diff --cached --quiet; then
+            echo "::notice::No baseline changes detected"
+          else
+            git commit -m "chore(frontend): update visual regression baselines [skip ci]"
+            git push
+          fi

.github/workflows/frontend-verify.yml

@@ -16,15 +16,6 @@ jobs:
         uses: actions/checkout@v5
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
-      - name: Cache dependencies
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.bun/install/cache
-            frontend/node_modules
-          key: ${{ runner.os }}-bun-frontend-${{ hashFiles('frontend/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-frontend-
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Get Biome version
@@ -57,15 +48,6 @@ jobs:
         uses: actions/checkout@v5
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
-      - name: Cache dependencies
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.bun/install/cache
-            frontend/node_modules
-          key: ${{ runner.os }}-bun-frontend-${{ hashFiles('frontend/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-frontend-
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Run typecheck
@@ -82,15 +64,6 @@ jobs:
         uses: actions/checkout@v5
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
-      - name: Cache dependencies
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.bun/install/cache
-            frontend/node_modules
-          key: ${{ runner.os }}-bun-frontend-${{ hashFiles('frontend/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-frontend-
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Restore Rspack build cache
@@ -125,15 +98,6 @@ jobs:
         uses: actions/checkout@v5
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
-      - name: Cache dependencies
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.bun/install/cache
-            frontend/node_modules
-          key: ${{ runner.os }}-bun-frontend-${{ hashFiles('frontend/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-frontend-
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Run unit tests
@@ -160,15 +124,6 @@ jobs:
         uses: actions/checkout@v5
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
-      - name: Cache dependencies
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.bun/install/cache
-            frontend/node_modules
-          key: ${{ runner.os }}-bun-frontend-${{ hashFiles('frontend/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-frontend-
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Run integration tests
@@ -180,10 +135,10 @@ jobs:
           path: frontend/test-results
           retention-days: 2
 
-  e2e-test:
-    needs: ["lint", "type-check", "build"]
-    timeout-minutes: 30
-    runs-on: blacksmith-16vcpu-ubuntu-2404
+  test-coverage:
+    needs: ["test-unit", "test-integration"]
+    timeout-minutes: 10
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     defaults:
       run:
         working-directory: frontend
@@ -192,45 +147,14 @@ jobs:
         uses: actions/checkout@v5
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
-      - name: Cache dependencies
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.bun/install/cache
-            frontend/node_modules
-          key: ${{ runner.os }}-bun-frontend-${{ hashFiles('frontend/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-frontend-
       - name: Install dependencies
         run: bun install --frozen-lockfile
-      - name: Download frontend build artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: frontend-build
-          path: frontend/build
-      - name: Setup Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'backend/go.mod'
-          cache-dependency-path: backend/go.sum
-      - name: Get Playwright version
-        id: pw-version
-        run: echo "version=$(jq -r '.devDependencies["@playwright/test"]' package.json)" >> $GITHUB_OUTPUT
-      - name: Cache Playwright browsers
-        uses: actions/cache@v4
-        id: playwright-cache
-        with:
-          path: ~/.cache/ms-playwright
-          key: ${{ runner.os }}-playwright-${{ steps.pw-version.outputs.version }}
-      - name: Install Playwright browsers
-        if: steps.playwright-cache.outputs.cache-hit != 'true'
-        run: bun run install:chromium
-      - name: Run Playwright tests
-        run: bun run e2e-test
-      - name: Upload Playwright report artifact
+      - name: Run coverage (unit + integration, merged)
+        run: bun run test:coverage
+      - name: Upload merged coverage HTML report
         uses: actions/upload-artifact@v4
-        if: ${{ failure() }}
+        if: always()
         with:
-          name: playwright-report
-          path: frontend/playwright-report/
-          retention-days: 2
+          name: coverage-report
+          path: frontend/coverage-merged/
+          retention-days: 14

.github/workflows/frontend-visual.yml

@@ -0,0 +1,73 @@
+---
+name: frontend-visual
+# Vitest browser-mode visual regression tests for the console frontend.
+# Mirrors apps/adp-ui/.github/workflows/adp-ui.yml `test-browser` job.
+on:
+  push:
+    paths:
+      - '.github/workflows/frontend-visual.yml'
+      - 'frontend/**'
+    branches-ignore:
+      - 'dependabot/**'
+      - 'snyk-upgrade-**'
+      - 'gh-readonly-queue/**'
+      - 'production'
+      - 'preprod'
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+env:
+  CI: true
+jobs:
+  test-browser:
+    # Visual regression tests — compares against Linux/Chromium baselines
+    # committed to git. If screenshots change, this job fails BUT does NOT
+    # block PR merge (continue-on-error + not listed in any required checks).
+    # Run "bun run test:browser:update" via the frontend-update-baselines
+    # workflow to regenerate baselines when UI changes are intentional.
+    timeout-minutes: 5
+    continue-on-error: true
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2.2.0
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+      - name: Cache Playwright browsers
+        uses: actions/cache@v5.0.4
+        with:
+          path: ~/.cache/ms-playwright
+          key: ${{ runner.os }}-playwright-chromium-${{ hashFiles('frontend/bun.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-playwright-chromium-
+      - name: Install Playwright browsers
+        run: bunx playwright install --with-deps chromium
+      - name: Run browser tests
+        run: |
+          # Only run strict comparison when Linux baselines exist in git.
+          # Baseline generation is intentionally NOT done on push CI — it
+          # blocks on the first cold Vitest+Playwright browser-mode launch
+          # and runs out the job timeout. Use the `frontend-update-baselines`
+          # workflow_dispatch to generate and commit baselines.
+          if git ls-files 'src/**/__screenshots__/**/*-linux.png' | grep -q .; then
+            bun run test:browser
+          else
+            echo "::notice::No Linux baselines committed yet — skipping visual regression. Run 'frontend-update-baselines' workflow to generate."
+          fi
+      - uses: actions/upload-artifact@v7.0.1
+        if: failure()
+        with:
+          name: browser-test-diffs
+          path: |
+            frontend/src/**/__screenshots__/**/*.png
+            frontend/.vitest-attachments
+          retention-days: 7
+      - name: Hint on visual diff failure
+        if: failure()
+        run: |
+          echo "::warning::Visual regression detected. If the UI change is intentional, run the 'frontend-update-baselines' workflow on this branch to regenerate baselines."

.github/workflows/repository-dispatch.yml

@@ -15,6 +15,9 @@ on:
       - '*'
     branches:
       - '**'
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 permissions:
   id-token: write
   contents: read

.gitignore

@@ -19,4 +19,4 @@ requests.txt
 # Local build tools installed via Taskfiles
 build
 
-.cursor
+.cursor