Omnia-Insurance
diff --git a/‎.github/workflows/deploy-staging.yaml‎
Lines changed: 48 additions & 6 deletions b/‎.github/workflows/deploy-staging.yaml‎
Lines changed: 48 additions & 6 deletions
diff --git a/‎.github/workflows/scripts/replicate-db-to-staging.sh‎
Lines changed: 19 additions & 10 deletions b/‎.github/workflows/scripts/replicate-db-to-staging.sh‎
Lines changed: 19 additions & 10 deletions
diff --git a/‎packages/twenty-docker/helm/twenty/omnia-staging-values.yaml‎
Lines changed: 14 additions & 1 deletion b/‎packages/twenty-docker/helm/twenty/omnia-staging-values.yaml‎
Lines changed: 14 additions & 1 deletion
diff --git a/‎packages/twenty-docker/helm/twenty/templates/deployment-server.yaml‎
Lines changed: 20 additions & 1 deletion b/‎packages/twenty-docker/helm/twenty/templates/deployment-server.yaml‎
Lines changed: 20 additions & 1 deletion
diff --git a/‎packages/twenty-docker/helm/twenty/templates/deployment-worker.yaml‎
Lines changed: 11 additions & 0 deletions b/‎packages/twenty-docker/helm/twenty/templates/deployment-worker.yaml‎
Lines changed: 11 additions & 0 deletions
diff --git a/‎packages/twenty-docker/twenty/Dockerfile.ci‎
Lines changed: 57 additions & 0 deletions b/‎packages/twenty-docker/twenty/Dockerfile.ci‎
Lines changed: 57 additions & 0 deletions
@@ -47,6 +47,46 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+
+      - name: Cache dependencies and Nx build cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            node_modules
+            packages/*/node_modules
+            .yarn/cache
+            .nx/cache
+          key: build-${{ hashFiles('yarn.lock') }}-${{ github.sha }}
+          restore-keys: |
+            build-${{ hashFiles('yarn.lock') }}-
+            build-
+
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      - name: Build all packages
+        run: npx nx run-many --target=build --projects=twenty-server,twenty-front --parallel=2
+        env:
+          VITE_BUILD_SOURCEMAP: 'true'
+          VITE_DISABLE_TYPESCRIPT_CHECKER: 'true'
+
+      - name: Upload Sentry sourcemaps (server)
+        if: ${{ env.SENTRY_AUTH_TOKEN != '' }}
+        run: |
+          npx sentry-cli sourcemaps upload \
+            --auth-token "$SENTRY_AUTH_TOKEN" \
+            --org omnia-insurance \
+            --project crm-server \
+            --release "${{ github.sha }}" \
+            ./packages/twenty-server/dist
+          find ./packages/twenty-server/dist -name '*.js.map' -delete
+        env:
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
@@ -74,16 +114,14 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          file: packages/twenty-docker/twenty/Dockerfile
+          file: packages/twenty-docker/twenty/Dockerfile.ci
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
           build-args: |
             REACT_APP_SERVER_BASE_URL=/api
-            SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-            SENTRY_RELEASE=${{ github.sha }}
 
   replicate-db:
     name: Replicate Production DB to Staging
@@ -142,12 +180,17 @@ jobs:
       - name: Ensure staging namespace exists
         run: kubectl create namespace ${{ env.NAMESPACE }} --dry-run=client -o yaml | kubectl apply -f -
 
-      - name: Copy S3 secret from prod namespace
+      - name: Copy secrets from prod namespace
         run: |
+          # S3 credentials - only copy if missing
           kubectl get secret twenty-s3-credentials -n ${{ env.NAMESPACE }} 2>/dev/null || \
             kubectl get secret twenty-s3-credentials -n ${{ env.PROD_NAMESPACE }} -o yaml | \
             sed 's/namespace: ${{ env.PROD_NAMESPACE }}$/namespace: ${{ env.NAMESPACE }}/' | \
             kubectl apply -f -
+          # Tokens (APP_SECRET) - sync from prod so encrypted DB config can be decrypted
+          PROD_TOKEN=$(kubectl get secret tokens -n ${{ env.PROD_NAMESPACE }} -o jsonpath='{.data.accessToken}')
+          kubectl patch secret tokens -n ${{ env.NAMESPACE }} -p "{\"data\":{\"accessToken\":\"$PROD_TOKEN\"}}" 2>/dev/null || \
+            kubectl create secret generic tokens -n ${{ env.NAMESPACE }} --from-literal=accessToken="$(echo $PROD_TOKEN | base64 -d)"
 
       - name: Determine image tag
         id: image-tag
@@ -177,8 +220,7 @@ jobs:
             --set worker.image.repository=${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }} \
             --set worker.image.tag=${{ steps.image-tag.outputs.tag }} \
             --wait \
-            --cleanup-on-fail \
-            --timeout 10m
+            --timeout 15m
 
       - name: Verify deployment
         run: |
 
@@ -49,27 +49,36 @@ kubectl exec -n "$STAGING_NS" "$STAGING_POD" -- \
 kubectl exec -n "$STAGING_NS" "$STAGING_POD" -- \
   psql -U postgres -c "CREATE DATABASE $DB_NAME;"
 
-echo "==> Restoring dump into staging..."
-kubectl exec -i -n "$STAGING_NS" "$STAGING_POD" -- \
-  psql -U postgres -d "$DB_NAME" < "$DUMP_FILE"
+echo "==> Restoring dump into staging (triggers disabled to avoid FK ordering issues)..."
+{ echo "SET session_replication_role = 'replica';"; cat "$DUMP_FILE"; echo "SET session_replication_role = 'origin';"; } | \
+  kubectl exec -i -n "$STAGING_NS" "$STAGING_POD" -- \
+  psql -U postgres -d "$DB_NAME"
 
 echo "==> Anonymizing staging data..."
 kubectl exec -n "$STAGING_NS" "$STAGING_POD" -- \
   psql -U postgres -d "$DB_NAME" -c "
-    -- Null out password hashes
+    CREATE EXTENSION IF NOT EXISTS pgcrypto;
+
+    -- Null out password hashes (force Google SSO on staging)
     UPDATE core.\"user\" SET \"passwordHash\" = NULL;
 
-    -- Scramble email addresses
-    UPDATE core.\"user\"
-    SET email = 'staging-user-' || id || '@example.com';
+    -- Keep real emails so Google OAuth works on staging
+    -- (same team, private environment)
 
-    -- Delete refresh tokens
-    DELETE FROM core.\"refreshToken\";
+    -- Delete refresh tokens (stored in appToken table with type)
+    DELETE FROM core.\"appToken\" WHERE type = 'REFRESH_TOKEN';
 
-    -- Regenerate app tokens
+    -- Regenerate remaining app tokens
     UPDATE core.\"appToken\"
     SET value = encode(gen_random_bytes(32), 'hex'),
         \"expiresAt\" = NOW() + INTERVAL '30 days';
+
+    -- Rewrite config URLs from prod domain to staging domain
+    -- Config is stored in keyValuePair table as jsonb
+    UPDATE core.\"keyValuePair\"
+    SET value = REPLACE(value::text, 'crm.omniaagent.com', 'staging-crm.omniaagent.com')::jsonb
+    WHERE type = 'CONFIG_VARIABLE'
+      AND value::text LIKE '%crm.omniaagent.com%';
   "
 
 echo "==> Granting permissions to twenty_app_user..."
 
@@ -14,6 +14,10 @@ server:
     SENTRY_FRONT_DSN: https://660cb58838f1dbf2ee91c1290136056e@o4510840638930944.ingest.us.sentry.io/4510840650989568
     NODE_OPTIONS: "--max-old-space-size=1536"
     SIGN_IN_PREFILLED: "true"
+  extraEnvSecrets:
+    CONVOSO_API_TOKEN:
+      secretName: convoso-credentials
+      key: apiToken
   resources:
     requests:
       cpu: 100m
@@ -43,13 +47,17 @@ worker:
   image:
     repository: 189365142140.dkr.ecr.us-east-1.amazonaws.com/twenty-crm
     tag: staging-latest
+  extraEnvSecrets:
+    CONVOSO_API_TOKEN:
+      secretName: convoso-credentials
+      key: apiToken
   resources:
     requests:
       cpu: 100m
       memory: 256Mi
     limits:
       cpu: 500m
-      memory: 512Mi
+      memory: 1024Mi
 
 db:
   internal:
@@ -78,6 +86,11 @@ storage:
     accessKeyIdKey: accessKeyId
     secretAccessKeyKey: secretAccessKey
 
+secrets:
+  tokens:
+    create: true
+    name: tokens
+
 redisInternal:
   resources:
     requests:
 
@@ -100,6 +100,10 @@ spec:
               psql -h ${DB_HOST} -p 5432 -U postgres -d ${DBNAME} -c "ALTER DEFAULT PRIVILEGES IN SCHEMA core GRANT ALL ON SEQUENCES TO ${APP_USER};"
               psql -h ${DB_HOST} -p 5432 -U postgres -d ${DBNAME} -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO ${APP_USER};"
               psql -h ${DB_HOST} -p 5432 -U postgres -d ${DBNAME} -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO ${APP_USER};"
+              echo "Granting permissions on workspace schemas..."
+              psql -h ${DB_HOST} -p 5432 -U postgres -d ${DBNAME} -c "DO \$\$ DECLARE ws RECORD; BEGIN FOR ws IN SELECT nspname FROM pg_namespace WHERE nspname LIKE 'workspace_%' LOOP EXECUTE format('GRANT ALL PRIVILEGES ON SCHEMA %I TO ${APP_USER}', ws.nspname); EXECUTE format('GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA %I TO ${APP_USER}', ws.nspname); EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON TABLES TO ${APP_USER}', ws.nspname); EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON SEQUENCES TO ${APP_USER}', ws.nspname); END LOOP; END \$\$;"
+              echo "Transferring workspace table ownership to ${APP_USER}..."
+              psql -h ${DB_HOST} -p 5432 -U postgres -d ${DBNAME} -c "DO \$\$ DECLARE r RECORD; BEGIN FOR r IN SELECT schemaname, tablename FROM pg_tables WHERE schemaname LIKE 'workspace_%' AND tableowner != '${APP_USER}' LOOP EXECUTE format('ALTER TABLE %I.%I OWNER TO ${APP_USER}', r.schemaname, r.tablename); END LOOP; END \$\$;"
               echo "Database ${DBNAME} is ready."
         {{- end }}
         - name: run-migrations
@@ -112,7 +116,15 @@ spec:
             - >-
               npx -y typeorm migration:run -d dist/database/typeorm/core/core.datasource
           env:
-            {{- if eq (include "twenty.db.useExternalSecret" .) "true" }}
+            {{- if .Values.db.enabled }}
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "twenty.fullname" . }}-db-superuser
+                  key: password
+            - name: PG_DATABASE_URL
+              value: "postgres://postgres:$(PGPASSWORD)@{{ include "twenty.fullname" . }}-db.{{ include "twenty.namespace" . }}.svc.cluster.local/{{ .Values.db.internal.database | default "twenty" }}"
+            {{- else if eq (include "twenty.db.useExternalSecret" .) "true" }}
             - name: DB_PASSWORD
               valueFrom:
                 secretKeyRef:
@@ -173,6 +185,13 @@ spec:
             - name: {{ $key }}
               value: {{ $value | quote }}
             {{- end }}
+            {{- range $key, $ref := .Values.server.extraEnvSecrets }}
+            - name: {{ $key }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $ref.secretName }}
+                  key: {{ $ref.key }}
+            {{- end }}
           lifecycle:
             preStop:
               exec:
 
@@ -77,6 +77,17 @@ spec:
             {{- if $storageEnv }}
             {{ $storageEnv | nindent 12 }}
             {{- end }}
+            {{- range $key, $value := .Values.worker.extraEnv }}
+            - name: {{ $key }}
+              value: {{ $value | quote }}
+            {{- end }}
+            {{- range $key, $ref := .Values.worker.extraEnvSecrets }}
+            - name: {{ $key }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $ref.secretName }}
+                  key: {{ $ref.key }}
+            {{- end }}
           resources:
             {{- toYaml .Values.worker.resources | nindent 12 }}
           stdin: {{ default true .Values.worker.stdin }}
 
@@ -0,0 +1,57 @@
+# Slim CI Dockerfile — no compilation, only packaging.
+# Builds happen on the GHA host where Nx cache persists across runs.
+
+# Stage 1: Production dependencies (cached when yarn.lock unchanged)
+FROM node:24-alpine AS deps
+
+WORKDIR /app
+
+COPY ./package.json ./yarn.lock ./.yarnrc.yml ./tsconfig.base.json ./nx.json /app/
+COPY ./.yarn/releases /app/.yarn/releases
+COPY ./.yarn/patches /app/.yarn/patches
+
+COPY ./packages/twenty-emails/package.json /app/packages/twenty-emails/
+COPY ./packages/twenty-server/package.json /app/packages/twenty-server/
+COPY ./packages/twenty-server/patches /app/packages/twenty-server/patches
+COPY ./packages/twenty-ui/package.json /app/packages/twenty-ui/
+COPY ./packages/twenty-shared/package.json /app/packages/twenty-shared/
+COPY ./packages/twenty-front/package.json /app/packages/twenty-front/
+COPY ./packages/twenty-sdk/package.json /app/packages/twenty-sdk/
+
+RUN yarn workspaces focus --production twenty-emails twenty-shared twenty-server && yarn cache clean
+
+# Stage 2: Final image
+FROM node:24-alpine
+
+RUN apk add --no-cache curl jq postgresql-client
+RUN npm install -g tsx
+
+COPY ./packages/twenty-docker/twenty/entrypoint.sh /app/entrypoint.sh
+RUN chmod +x /app/entrypoint.sh
+
+WORKDIR /app/packages/twenty-server
+
+ARG REACT_APP_SERVER_BASE_URL
+ENV REACT_APP_SERVER_BASE_URL=$REACT_APP_SERVER_BASE_URL
+
+ARG APP_VERSION
+ENV APP_VERSION=$APP_VERSION
+
+# Copy production node_modules from deps stage
+COPY --chown=1000 --from=deps /app /app
+
+# Copy pre-built artifacts from host (via build context)
+COPY --chown=1000 ./packages/twenty-server/dist /app/packages/twenty-server/dist
+COPY --chown=1000 ./packages/twenty-shared/dist /app/packages/twenty-shared/dist
+COPY --chown=1000 ./packages/twenty-emails/dist /app/packages/twenty-emails/dist
+COPY --chown=1000 ./packages/twenty-front/build /app/packages/twenty-server/dist/front
+
+LABEL org.opencontainers.image.source=https://github.com/twentyhq/twenty
+
+RUN mkdir -p /app/.local-storage /app/packages/twenty-server/.local-storage && \
+    chown -R 1000:1000 /app
+
+USER 1000
+
+CMD ["node", "dist/main"]
+ENTRYPOINT ["/app/entrypoint.sh"]