Daily rebase

.buildkite/pipeline.yml

@@ -8,10 +8,11 @@ steps:
     concurrency: 1
     concurrency_group: "clickhouse-cloud-normal-${CLICKHOUSE_ID}"
     command: CLICKHOUSE_PREFIX="dev-tensorzero-e2e-tests-instance-" ./ci/buildkite/test-clickhouse-cloud.sh
-  - label: "Clickhouse Cloud tests - fast release channel"
-    concurrency: 1
-    concurrency_group: "clickhouse-cloud-fast-${CLICKHOUSE_ID}"
-    command: CLICKHOUSE_PREFIX="dev-tensorzero-e2e-tests-fast-instance-" TENSORZERO_CLICKHOUSE_FAST_CHANNEL=1 ./ci/buildkite/test-clickhouse-cloud.sh
+  # Temporarily disabled - see https://github.com/tensorzero/tensorzero/issues/5887
+  # - label: "Clickhouse Cloud tests - fast release channel"
+  #   concurrency: 1
+  #   concurrency_group: "clickhouse-cloud-fast-${CLICKHOUSE_ID}"
+  #   command: CLICKHOUSE_PREFIX="dev-tensorzero-e2e-tests-fast-instance-" TENSORZERO_CLICKHOUSE_FAST_CHANNEL=1 ./ci/buildkite/test-clickhouse-cloud.sh
 
 notify:
   - github_commit_status:

.cargo/config.toml

@@ -87,6 +87,14 @@ test-clickhouse-fast = [
     "0",
     "--no-fail-fast",
 ]
+test-endpoints = [
+    "nextest",
+    "run",
+    "--features",
+    "e2e_tests",
+    "--profile",
+    "endpoints",
+]
 test-rate-limit-load = [
     "run",
     "--release",

.config/nextest.toml

@@ -13,7 +13,7 @@ default-filter = "not (test(no_aws_credentials) | test(export_bindings_) | test(
 
 [[profile.default.overrides]]
 filter = 'test(evaluations)'
-slow-timeout = { period = "20s", terminate-after = 3 }
+slow-timeout = { period = "20s", terminate-after = 5 }
 
 # Profiles config
 # We use these profiles to define our major test groups.
@@ -62,6 +62,13 @@ default-filter = 'test(batch) and test(mock)'
 default-filter = 'test(test_dummy_only) | test(clickhouse::) | (test(db::) & !test(postgres) & !test(valkey))'
 junit.path = "junit.xml"
 
+# Run only endpoint e2e tests (tests under tests/e2e/endpoints/)
+# These run against both ClickHouse and Postgres-backed TensorZero gateway.
+[profile.endpoints]
+default-filter = 'binary(e2e) and test(endpoints::)'
+junit.path = "junit.xml"
+retries = { backoff = "exponential", count = 4, delay = "5s", jitter = true, max-delay = "60s" }
+
 [profile.optimization]
 default-filter = 'binary(optimization-live)'
 
@@ -155,9 +162,9 @@ slow-timeout = { period = "30s", terminate-after = 3 }
 filter = 'test(websearch)'
 slow-timeout = { period = "120s", terminate-after = 2 }
 
-# Image inference seems to be slow on GCP Vertex Gemini, so we give it a longer timeout
+# Image inference seems to be slow on many providers, so we give it a longer timeout
 [[profile.default.overrides]]
-filter = 'test(providers::gcp_vertex_gemini::test_image_inference)'
+filter = 'test(test_image_inference)'
 slow-timeout = { period = "60s", terminate-after = 2 }
 
 [[profile.default.overrides]]

.dockerignore

@@ -9,8 +9,8 @@ target-rust-analyzer
 **/.env*
 **/.vscode
 **/.claude
-ui/fixtures/*.jsonl
-ui/fixtures/s3-fixtures
+ui/fixtures/small-fixtures
+ui/fixtures/large-fixtures
 /recipes
 /examples
 gcp_jwt_key.json

.github/workflows/build-fixtures-container.yml

@@ -0,0 +1,55 @@
+name: Build Fixtures Container
+
+on:
+  workflow_call:
+    secrets:
+      DOCKERHUB_LIMITED_TOKEN:
+        required: true
+
+jobs:
+  build-fixtures-container:
+    runs-on: ubuntu-latest
+    if: github.repository == 'tensorzero/tensorzero'
+    permissions:
+      # Permission to checkout the repository
+      contents: read
+      # Permission to fetch GitHub OIDC token authentication
+      id-token: write
+
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+
+      - name: Login to DockerHub
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
+        with:
+          username: tensorzero
+          password: ${{ secrets.DOCKERHUB_LIMITED_TOKEN }}
+
+      # We allow the namespace builder setup to fail on Dependabot PRs and PRs from forks
+      # (where the oidc token is not available)
+
+      - name: Install Namespace CLI
+        uses: namespacelabs/nscloud-setup@d1c625762f7c926a54bd39252efff0705fd11c64
+        continue-on-error: ${{ github.event.pull_request.head.repo.full_name != github.repository || github.actor == 'dependabot[bot]' }}
+
+      - name: Configure Namespace-powered Buildx
+        uses: namespacelabs/nscloud-setup-buildx-action@91c2e6537780e3b092cb8476406be99a8f91bd5e
+        with:
+          wait-for-builder: true
+        continue-on-error: ${{ github.event.pull_request.head.repo.full_name != github.repository || github.actor == 'dependabot[bot]' }}
+
+      - name: Build `fixtures` container
+        run: |
+          docker buildx build -f ui/fixtures/Dockerfile . -t tensorzero/fixtures:sha-${{ github.sha }} -t nscr.io/igvf4asmf8kri/fixtures:sha-${{ github.sha }}
+
+      - name: Push `fixtures` container to Docker Hub
+        run: docker push tensorzero/fixtures:sha-${{ github.sha }}
+
+      - name: Login to Namespace registry
+        run: nsc docker login
+        continue-on-error: ${{ github.event.pull_request.head.repo.full_name != github.repository || github.actor == 'dependabot[bot]' }}
+
+      - name: Push `fixtures` container to Namespace registry
+        run: docker push nscr.io/igvf4asmf8kri/fixtures:sha-${{ github.sha }}
+        continue-on-error: ${{ github.event.pull_request.head.repo.full_name != github.repository || github.actor == 'dependabot[bot]' }}

.github/workflows/cancel-merge-queue-on-job-failure.yml

@@ -15,10 +15,32 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'tensorzero/tensorzero'
     steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          sparse-checkout: .github/workflows/general.yml
+          sparse-checkout-cone-mode: false
+
       - name: Check running workflows on merge queue branches
         run: |
           echo "Checking for running workflows on merge queue branches..."
 
+          # Dynamically extract the 'needs' list from 'check-all-general-jobs-passed' job in general.yml
+          # This ensures we only cancel on failures of jobs that actually block merging
+          REQUIRED_JOBS=$(yq -r '.jobs["check-all-general-jobs-passed"].needs[]' .github/workflows/general.yml)
+
+          if [ -z "$REQUIRED_JOBS" ]; then
+            echo "ERROR: Could not extract required jobs from general.yml"
+            exit 1
+          fi
+
+          echo "Required jobs (from check-all-general-jobs-passed needs):"
+          echo "$REQUIRED_JOBS"
+          echo ""
+
+          # Build jq filter for required jobs as a JSON array
+          JQ_FILTER=$(echo "$REQUIRED_JOBS" | jq -R -s 'split("\n") | map(select(length > 0))')
+
           # Get all in-progress workflow runs for general.yml
           workflow_runs=$(curl -s -H "Authorization: Bearer ${{ github.token }}" \
             "https://api.github.com/repos/${{ github.repository }}/actions/workflows/general.yml/runs?status=in_progress&per_page=100")
@@ -51,11 +73,20 @@ jobs:
             jobs=$(curl -s -H "Authorization: Bearer ${{ github.token }}" \
               "https://api.github.com/repos/${{ github.repository }}/actions/runs/$run_id/jobs")
 
-            # Check if any job has failed
-            failed_jobs=$(echo "$jobs" | jq -r '.jobs[] | select(.conclusion == "failure") | "\(.name) (status: \(.status), conclusion: \(.conclusion))"')
+            # Check if any required job has failed
+            # Job names may include matrix suffixes (e.g., "lint-rust (1)"), so we check if the job name starts with any required job name
+            failed_jobs=$(echo "$jobs" | jq -r --argjson required "$JQ_FILTER" '
+              .jobs[] |
+              select(.conclusion == "failure") |
+              select(
+                .name as $job_name |
+                any($required[]; . as $req | $job_name | startswith($req))
+              ) |
+              "\(.name) (status: \(.status), conclusion: \(.conclusion))"
+            ')
 
             if [ -n "$failed_jobs" ]; then
-              echo "Found failed jobs in workflow run $run_id:"
+              echo "Found failed required jobs in workflow run $run_id:"
               echo "$failed_jobs"
               echo ""
               echo "Cancelling workflow run $run_id on branch $branch..."
@@ -75,7 +106,7 @@ jobs:
               fi
               echo ""
             else
-              echo "No failed jobs found in workflow run $run_id"
+              echo "No failed required jobs found in workflow run $run_id"
             fi
           done <<< "$merge_queue_runs"
 

.github/workflows/cla.yml

@@ -29,6 +29,6 @@ jobs:
           path-to-signatures: "ci/cla-signatures.json"
           path-to-document: "https://github.com/tensorzero/tensorzero/blob/main/CLA.md"
           branch: "cla-signatures"
-          allowlist: claude,dependabot[bot],TensorZero-Experimental-CI-Bot[bot]
+          allowlist: claude,cursoragent,dependabot[bot],TensorZero-Experimental-CI-Bot[bot]
           custom-pr-sign-comment: "I have read the Contributor License Agreement (CLA) and hereby sign the CLA."
           lock-pullrequest-aftermerge: false

.github/workflows/docker-hub-publish.yml

@@ -97,6 +97,10 @@ jobs:
           tags: ${{ env.DOCKERHUB_USER }}/${{ matrix.container.name }}
           labels: ${{ steps.meta.outputs.labels }}
           sbom: true
+          # Use debug builds for dev images
+          build-args: |
+            PROFILE=${{ inputs.is_dev && 'dev' || 'performance' }}
+            DEBUG_BUILD=${{ inputs.is_dev && '1' || '0' }}
 
       - name: Export digest
         run: |