chore: release v6.0.7

* fix(auth): align session user resolution with token subject

* test(auth): add unit tests for getServerSession user resolution

.changeset/config.json

@@ -7,7 +7,7 @@
   "access": "public",
   "baseBranch": "main",
   "updateInternalDependencies": "patch",
-  "ignore": ["@calcom/platform-libraries"],
+  "ignore": ["@calcom/platform-libraries", "@calcom/api-v2"],
   "privatePackages": {
     "version": false,
     "tag": false

.coderabbit.yaml

@@ -1,187 +0,0 @@
-language: en-US
-tone_instructions: ''
-early_access: false
-enable_free_tier: true
-reviews:
-  profile: chill
-  request_changes_workflow: false
-  high_level_summary: false
-  high_level_summary_placeholder: '@coderabbitai summary'
-  high_level_summary_in_walkthrough: false
-  auto_title_placeholder: '@coderabbitai'
-  auto_title_instructions: ''
-  review_status: true
-  commit_status: true
-  fail_commit_status: false
-  collapse_walkthrough: false
-  changed_files_summary: false
-  sequence_diagrams: false
-  estimate_code_review_effort: false
-  assess_linked_issues: true
-  related_issues: false
-  related_prs: true
-  suggested_labels: false
-  auto_apply_labels: false
-  suggested_reviewers: false
-  auto_assign_reviewers: false
-  poem: false
-  labeling_instructions: []
-  path_filters: 
-    - '!**/node_modules/**'
-    - '!**/dist/**'
-    - '!**/build/**' 
-    - '!**/.next/**'
-  path_instructions:
-    - path: "**/*.{ts,tsx,js,jsx}"
-      instructions: "Flag default exports and encourage named exports. Named exports provide better tree-shaking, easier refactoring, and clearer imports. Exempt main components like pages, layouts, and components that serve as the primary export of a module."
-  abort_on_close: true
-  disable_cache: false
-  auto_review:
-    enabled: true
-    auto_incremental_review: true
-    ignore_title_keywords: []
-    labels: []
-    drafts: false
-    base_branches: []
-  finishing_touches:
-    docstrings:
-      enabled: true
-    unit_tests:
-      enabled: true
-  pre_merge_checks:
-    docstrings:
-      mode: warning
-      threshold: 80
-    title:
-      mode: warning
-      requirements: ''
-    description:
-      mode: warning
-    issue_assessment:
-      mode: warning
-  tools:
-    ast-grep:
-      rule_dirs: []
-      util_dirs: []
-      essential_rules: true
-      packages: []
-    shellcheck:
-      enabled: true
-    ruff:
-      enabled: true
-    markdownlint:
-      enabled: true
-    github-checks:
-      enabled: true
-      timeout_ms: 180000
-    languagetool:
-      enabled: true
-      enabled_rules: []
-      disabled_rules: []
-      enabled_categories: []
-      disabled_categories: []
-      enabled_only: false
-      level: default
-    biome:
-      enabled: true
-    hadolint:
-      enabled: true
-    swiftlint:
-      enabled: true
-    phpstan:
-      enabled: true
-      level: default
-    phpmd:
-      enabled: true
-    phpcs:
-      enabled: true
-    golangci-lint:
-      enabled: true
-    yamllint:
-      enabled: true
-    gitleaks:
-      enabled: true
-    checkov:
-      enabled: true
-    detekt:
-      enabled: true
-    eslint:
-      enabled: true
-    flake8:
-      enabled: true
-    rubocop:
-      enabled: true
-    buf:
-      enabled: true
-    regal:
-      enabled: true
-    actionlint:
-      enabled: true
-    pmd:
-      enabled: true
-    cppcheck:
-      enabled: true
-    semgrep:
-      enabled: true
-    circleci:
-      enabled: true
-    clippy:
-      enabled: true
-    sqlfluff:
-      enabled: true
-    prismaLint:
-      enabled: true
-    pylint:
-      enabled: true
-    oxc:
-      enabled: true
-    shopifyThemeCheck:
-      enabled: true
-    luacheck:
-      enabled: true
-    brakeman:
-      enabled: true
-    dotenvLint:
-      enabled: true
-    htmlhint:
-      enabled: true
-    checkmake:
-      enabled: true
-    osvScanner:
-      enabled: true
-chat:
-  art: true
-  auto_reply: true
-  integrations:
-    jira:
-      usage: auto
-    linear:
-      usage: auto
-knowledge_base:
-  opt_out: false
-  web_search:
-    enabled: true
-  code_guidelines:
-    enabled: true
-    filePatterns: []
-  learnings:
-    scope: auto
-  issues:
-    scope: auto
-  jira:
-    usage: auto
-    project_keys: []
-  linear:
-    usage: auto
-    team_keys: []
-  pull_requests:
-    scope: auto
-  mcp:
-    usage: auto
-    disabled_servers: []
-code_generation:
-  docstrings:
-    language: en-US
-    path_instructions: []
-  unit_tests:
-    path_instructions: []

.dockerignore

@@ -0,0 +1,36 @@
+# Dependencies
+node_modules
+**/node_modules
+
+# Build outputs
+.next
+**/.next
+dist
+**/dist
+build
+**/build
+
+# Git
+.git
+.github
+
+# Testing
+coverage
+**/coverage
+test-results
+**/test-results
+.turbo
+**/.turbo
+
+# Logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Examples and docs
+docs

.easignore

@@ -0,0 +1,57 @@
+# EAS Build ignore file for monorepo
+# Only upload the companion app folder
+
+# ===========================================
+# IGNORE EVERYTHING AT ROOT LEVEL
+# ===========================================
+/*
+
+# ===========================================
+# EXCEPT THE COMPANION APP
+# ===========================================
+!companion
+
+# ===========================================
+# BUT IGNORE THESE INSIDE COMPANION
+# ===========================================
+
+# Native folders - EAS generates these during builds (~2.1 GB)
+companion/ios
+companion/android
+
+# Dependencies - EAS installs these during builds (~1.6 GB)
+companion/node_modules
+
+# Expo build cache
+companion/.expo
+companion/dist
+companion/web-build
+
+# Metro
+companion/.metro-health-check*
+
+# WXT Chrome Extension outputs (not needed for mobile builds)
+companion/.output
+companion/.wxt
+companion/dev
+
+# Kotlin cache
+companion/.kotlin
+
+# Build artifacts
+companion/*.jks
+companion/*.p8
+companion/*.p12
+companion/*.key
+companion/*.mobileprovision
+
+# Debug logs
+companion/*.log
+
+# TypeScript build info
+companion/*.tsbuildinfo
+
+# Environment files
+companion/.env
+companion/.env.*
+!companion/.env.example

.env.example

@@ -103,19 +103,14 @@ NEXT_PUBLIC_INTERCOM_APP_ID=
 # Secret to enable Intercom Identity Verification
 INTERCOM_SECRET=
 
+# Intercom api token for free users
+INTERCOM_API_TOKEN=
+
 # Posthog Config
 NEXT_PUBLIC_POSTHOG_KEY=
 
 NEXT_PUBLIC_POSTHOG_HOST=
 
-# plain.com config
-
-PLAIN_API_KEY=
-PLAIN_API_URL=https://api.plain.com/v1
-PLAIN_HMAC_SECRET_KEY=
-NEXT_PUBLIC_PLAIN_CHAT_ID=
-PLAIN_CHAT_HMAC_SECRET_KEY=
-NEXT_PUBLIC_PLAIN_CHAT_EXCLUDED_PATHS=
 
 
 # Dub Config
@@ -132,6 +127,14 @@ NEXT_PUBLIC_HELPSCOUT_KEY=
 NEXT_PUBLIC_FRESHCHAT_TOKEN=
 NEXT_PUBLIC_FRESHCHAT_HOST=
 
+# For holiday feature:
+# Step-by-step: Get a Google Calendar API Key
+# 1. Go to Google Cloud Console: https://console.cloud.google.com/
+# 2. Select or Create a Project
+# 3. Enable Google Calendar API (APIs & Services → Library , Search for Google Calendar API)
+# 4. Create the API Key (APIs & Services → Credentials)
+GOOGLE_CALENDAR_API_KEY=
+
 # Google OAuth credentials
 # To enable Login with Google you need to:
 # 1. Set `GOOGLE_API_CREDENTIALS` below
@@ -149,6 +152,12 @@ GOOGLE_WEBHOOK_TOKEN=
 # Optional URL to override for tunelling webhooks. Defaults to NEXT_PUBLIC_WEBAPP_URL.
 GOOGLE_WEBHOOK_URL=
 
+# Token to verify incoming webhooks from Microsoft Calendar
+MICROSOFT_WEBHOOK_TOKEN=
+
+# Optional URL to override for tunelling webhooks. Defaults to NEXT_PUBLIC_WEBAPP_URL.
+MICROSOFT_WEBHOOK_URL=
+
 # Inbox to send user feedback
 SEND_FEEDBACK_EMAIL=
 
@@ -208,10 +217,13 @@ NEXT_PUBLIC_IS_PREMIUM_NEW_PLAN=0
 NEXT_PUBLIC_STRIPE_PREMIUM_NEW_PLAN_PRICE=
 STRIPE_TEAM_MONTHLY_PRICE_ID=
 NEXT_PUBLIC_STRIPE_CREDITS_PRICE_ID=
+ORG_MONTHLY_CREDITS=
 STRIPE_TEAM_PRODUCT_ID=
 # It is a price ID in the product with id STRIPE_ORG_PRODUCT_ID
 STRIPE_ORG_MONTHLY_PRICE_ID=
 STRIPE_ORG_PRODUCT_ID=
+# Used to pass trial days for orgs during the Stripe checkout session
+STRIPE_ORG_TRIAL_DAYS=
 
 STRIPE_WEBHOOK_SECRET=
 STRIPE_WEBHOOK_SECRET_APPS=
@@ -265,6 +277,9 @@ NEXT_PUBLIC_CLOUDFLARE_SITEKEY=
 NEXT_PUBLIC_CLOUDFLARE_USE_TURNSTILE_IN_BOOKER=
 CLOUDFLARE_TURNSTILE_SECRET=
 
+# 0 = false, 1=true
+NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER=
+
 # Set the following value to true if you wish to enable Team Impersonation
 NEXT_PUBLIC_TEAM_IMPERSONATION=false
 
@@ -386,6 +401,11 @@ UNKEY_ROOT_KEY=
 # Used for Cal.ai Voice AI Agents
 # https://retellai.com
 RETELL_AI_KEY=
+# Local testing overrides for Retell AI
+RETELL_AI_TEST_MODE=false
+# JSON mapping of local to production event type IDs (e.g. {"50": 747280} without any string)
+RETELL_AI_TEST_EVENT_TYPE_MAP=
+RETELL_AI_TEST_CAL_API_KEY=
 
 # Used for buying phone number for cal ai voice agent
 STRIPE_PHONE_NUMBER_MONTHLY_PRICE_ID=
@@ -413,7 +433,8 @@ VAPID_PRIVATE_KEY=
 
 # Mintlify chat api
 # Power AI chat in for docs
-NEXT_PUBLIC_MINTLIFY_CHAT_API_KEY=
+MINTLIFY_CHAT_API_KEY=
+NEXT_PUBLIC_ENABLE_MINTLIFY_CHAT=
 NEXT_PUBLIC_CHAT_API_URL=
 NEXT_PUBLIC_DOCS_URL=
 
@@ -472,3 +493,23 @@ DATABASE_CHUNK_SIZE=
 # Service Account Encryption Key for encrypting/decrypting service account keys
 # You can use: `openssl rand -base64 24` to generate one
 CALCOM_SERVICE_ACCOUNT_ENCRYPTION_KEY=
+
+SALESFORCE_GRAPHQL_DELAY_MS=500
+SALESFORCE_GRAPHQL_MAX_DELAY_MS=2000
+SALESFORCE_GRAPHQL_MAX_RETRIES=3
+
+# Force Node.js to use UTC as process timezone
+TZ=UTC
+
+# test oauth client for `packages/platform/examples/base` (optional)
+SEED_PLATFORM_OAUTH_CLIENT_ID=
+SEED_PLATFORM_OAUTH_CLIENT_SECRET=
+
+# Trigger.dev
+ENABLE_ASYNC_TASKER="false" # set to "true" to enable
+TRIGGER_SECRET_KEY=
+TRIGGER_API_URL=https://api.trigger.dev
+TRIGGER_DEV_PROJECT_REF=
+
+GOOGLE_ADS_ENABLED=1      # To enable Google Ads tracking (gclid)
+LINKEDIN_ADS_ENABLED=1    # To enable LinkedIn Ads tracking (li_fat_id)

.eslintignore

@@ -1,9 +0,0 @@
-node_modules
-apps/api/v2/dist
-packages/platform/**/dist/*
-**/**/node_modules
-**/**/.next
-**/**/public
-packages/prisma/zod
-apps/web/public/embed
-packages/ui/components/icon/dynamicIconImports.tsx

.eslintrc.js

@@ -1,23 +0,0 @@
-// This configuration only applies to the package manager root.
-/** @type {import("eslint").Linter.Config} */
-module.exports = {
-  extends: ["./packages/config/eslint-preset.js"],
-  plugins: ["import"],
-  rules: {
-    "import/no-cycle": ["warn", { maxDepth: Infinity }],
-  },
-  overrides: [
-    {
-      files: ["packages/lib/**/*.{ts,tsx,js,jsx}", "packages/prisma/**/*.{ts,tsx,js,jsx}"],
-      rules: {
-        "no-restricted-imports": [
-          "warn",
-          {
-            paths: ["@calcom/app-store"],
-            patterns: ["@calcom/app-store/*"],
-          },
-        ],
-      },
-    },
-  ],
-};

.gitattributes

@@ -0,0 +1,4 @@
+/.yarn/**            linguist-vendored
+/.yarn/releases/*    binary
+/.yarn/plugins/**/*  binary
+/.pnp.*              binary linguist-generated

.github/CODEOWNERS

@@ -1,6 +1,5 @@
 /**/package.json @calcom/Foundation
-/apps/api/**/* @calcom/Platform @calcom/Foundation
-/apps/ui-playground/**/* @calcom/Consumer @calcom/Foundation
+/apps/api/**/* @calcom/API
 /apps/web/**/layout.tsx @calcom/Consumer @calcom/Foundation
 /apps/web/lib/csp.ts @calcom/Foundation
 /apps/web/lib/buildNonce.ts @calcom/Foundation
@@ -8,9 +7,8 @@
 /apps/web/lib/core/**/* @calcom/Foundation
 /apps/web/lib/booking.ts @calcom/Foundation
 /apps/web/lib/handleOrgRedirect.ts @calcom/Foundation
-/apps/web/middleware.ts @calcom/Foundation
+/apps/web/proxy.ts @calcom/Foundation
 /deploy/**/* @calcom/Foundation
-/infra/**/* @calcom/Foundation
 /packages/app-store/applecalendar/**/* @calcom/Foundation
 /packages/app-store/caldavcalendar/**/* @calcom/Foundation
 /packages/app-store/exchange2013calendar/**/* @calcom/Foundation
@@ -23,13 +21,14 @@
 /packages/app-store/office365calendar/**/* @calcom/Foundation
 /packages/app-store/zohocalendar/**/* @calcom/Foundation
 /packages/embeds/**/* @calcom/Foundation
+/packages/features/auth/lib/next-auth-options.ts @calcom/Foundation
 /packages/features/bookings/lib/**/* @calcom/Foundation
-/packages/lib/getAggregatedAvailability.ts @calcom/Foundation
-/packages/lib/getUserAvailability.ts @calcom/Foundation
-/packages/lib/server/getLuckyUser.ts @calcom/Foundation
-/packages/lib/slots.ts @calcom/Foundation
+/packages/features/availability/lib/getAggregatedAvailability/getAggregatedAvailability.ts @calcom/Foundation
+/packages/features/availability/lib/getUserAvailability.ts @calcom/Foundation
+/packages/features/bookings/lib/getLuckyUser.ts @calcom/Foundation
+/packages/features/schedules/lib/slots.ts @calcom/Foundation
 /packages/platform/atoms/**/*WebWrapper.tsx @calcom/Consumer
-/packages/platform/**/* @calcom/Platform @calcom/Foundation
+/packages/platform/**/* @calcom/Consumer @calcom/Foundation
 /packages/prisma/**/* @calcom/Foundation
 /packages/trpc/server/routers/viewer/bookings/confirm.handler.ts @calcom/Foundation
 /packages/trpc/server/routers/viewer/bookings/get.handler.ts @calcom/Foundation

.github/actions/cache-build-key/action.yml

@@ -0,0 +1,23 @@
+name: Generate cache-build key
+description: "Generate the cache key for production build caching"
+inputs:
+  branch_key:
+    required: true
+    description: "Branch key for cache scoping (e.g., github.head_ref for PRs)"
+outputs:
+  key:
+    description: "The generated cache key"
+    value: ${{ steps.generate-key.outputs.key }}
+runs:
+  using: "composite"
+  steps:
+    - name: Generate cache key
+      id: generate-key
+      shell: bash
+      env:
+        CACHE_NAME: prod-build
+        BRANCH_KEY: ${{ inputs.branch_key }}
+        LOCKFILE_HASH: ${{ hashFiles('yarn.lock') }}
+        SOURCE_HASH: ${{ hashFiles('apps/**/**.[jt]s', 'apps/**/**.[jt]sx', 'apps/**/*.json', 'apps/**/*.css', 'packages/**/**.[jt]s', 'packages/**/**.[jt]sx', 'packages/prisma/schema.prisma', 'packages/prisma/migrations/**/*.sql', '!**/node_modules/**', '!packages/prisma/generated/**', '!packages/prisma/client/**', '!packages/prisma/zod/**', '!packages/kysely/**') }}
+      run: |
+        echo "key=${CACHE_NAME}-${BRANCH_KEY}-${LOCKFILE_HASH}-${SOURCE_HASH}" >> $GITHUB_OUTPUT

.github/actions/cache-build/action.yml

@@ -1,33 +1,23 @@
 name: Cache production build binaries
 description: "Cache or restore if necessary"
-inputs:
-  node_version:
-    required: false
-    default: v18.x
 runs:
   using: "composite"
   steps:
+    - name: Generate cache key
+      id: cache-key
+      uses: ./.github/actions/cache-build-key
+      with:
+        branch_key: ${{ github.head_ref || github.ref_name }}
     - name: Cache production build
-      uses: buildjet/cache@v4
+      uses: actions/cache@v4
       id: cache-build
-      env:
-        # WARN: Don't touch this cache key. Currently github.sha refers to the latest commit in main
-        # and not the branch that's attempting to merge to main, which causes CI errors when merged
-        # to main.
-        # TODO: Fix this problem if intending to modify this cache key.
-        cache-name: prod-build
-        key-1: ${{ inputs.node_version }}-${{ hashFiles('yarn.lock') }}
-        key-2: ${{ hashFiles('apps/**/**.[jt]s', 'apps/**/**.[jt]sx', 'packages/**/**.[jt]s', 'packages/**/**.[jt]sx', '!**/node_modules') }}
-        key-3: ${{ github.event.pull_request.number || github.ref }}
-        key-4: ${{ github.sha }}
-        key-5: ${{ github.event.pull_request.head.sha }}
       with:
         path: |
           ${{ github.workspace }}/apps/web/.next
           ${{ github.workspace }}/apps/web/public/embed
           **/.turbo/**
           **/dist/**
-        key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}-${{ env.key-5 }}
+        key: ${{ steps.cache-key.outputs.key }}
     - run: |
         export NODE_OPTIONS="--max_old_space_size=8192"
         yarn build

.github/actions/cache-db-key/action.yml

@@ -0,0 +1,23 @@
+name: Generate cache-db key
+description: "Generate the cache key for database caching"
+inputs:
+  path:
+    required: false
+    default: "backups/backup.sql"
+    description: "Path to the backup file"
+outputs:
+  key:
+    description: "The generated cache key"
+    value: ${{ steps.generate-key.outputs.key }}
+runs:
+  using: "composite"
+  steps:
+    - name: Generate cache key
+      id: generate-key
+      shell: bash
+      env:
+        CACHE_NAME: cache-db
+        PATH_KEY: ${{ inputs.path }}
+        PRISMA_HASH: ${{ hashFiles('packages/prisma/schema.prisma', 'packages/prisma/migrations/**/**.sql', 'packages/prisma/*.ts') }}
+      run: |
+        echo "key=${CACHE_NAME}-${PATH_KEY}-${PRISMA_HASH}" >> $GITHUB_OUTPUT

.github/actions/cache-db/action.yml

@@ -10,14 +10,15 @@ inputs:
 runs:
   using: "composite"
   steps:
+    - name: Generate cache key
+      id: cache-key
+      uses: ./.github/actions/cache-db-key
+      with:
+        path: ${{ inputs.path }}
     - name: Cache database
       id: cache-db
-      uses: buildjet/cache@v4
+      uses: actions/cache@v4
       env:
-        cache-name: cache-db
-        key-1: ${{ hashFiles('packages/prisma/schema.prisma', 'packages/prisma/migrations/**/**.sql', 'packages/prisma/*.ts') }}
-        key-2: ${{ github.event.pull_request.number || github.ref }}
-        key-3: ${{ github.event.pull_request.head.sha }}
         DATABASE_URL: ${{ inputs.DATABASE_URL }}
         DATABASE_DIRECT_URL: ${{ inputs.DATABASE_URL }}
         E2E_TEST_CALCOM_QA_EMAIL: ${{ inputs.E2E_TEST_CALCOM_QA_EMAIL }}
@@ -25,8 +26,8 @@ runs:
         E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS: ${{ inputs.E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS }}
       with:
         path: ${{ inputs.path }}
-        key: ${{ runner.os }}-${{ env.cache-name }}-${{ inputs.path }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}
-    - run: echo ${{ env.E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS }} && yarn db-seed
+        key: ${{ steps.cache-key.outputs.key }}
+    - run: yarn db-seed
       if: steps.cache-db.outputs.cache-hit != 'true'
       shell: bash
     - name: Postgres Dump Backup

.github/actions/docker-build-and-test/action.yml

@@ -0,0 +1,186 @@
+name: "Docker Build and Test"
+description: "Reusable action to build and test Docker images for Cal.com"
+
+inputs:
+  platform:
+    description: "Target platform (linux/amd64 or arm64)"
+    required: true
+  platform-suffix:
+    description: "Suffix to add to image tags (e.g., -arm)"
+    required: false
+    default: ""
+  dockerhub-username:
+    description: "Docker Hub username"
+    required: true
+  dockerhub-token:
+    description: "Docker Hub token"
+    required: true
+  github-token:
+    description: "GitHub token for GHCR"
+    required: true
+  postgres-user:
+    description: "PostgreSQL user"
+    required: true
+  postgres-password:
+    description: "PostgreSQL password"
+    required: true
+  postgres-db:
+    description: "PostgreSQL database name"
+    required: true
+  database-host:
+    description: "Database host"
+    required: true
+  push-image:
+    description: "Whether to push the built image"
+    required: false
+    default: "false"
+  use-as-latest:
+    description: "Publish as latest"
+    required: false
+    default: "false"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Log in to the Docker Hub registry
+      uses: docker/login-action@v3
+      with:
+        username: ${{ inputs.dockerhub-username }}
+        password: ${{ inputs.dockerhub-token }}
+        logout: true
+
+    - name: Log in to the Github Container registry
+      uses: docker/login-action@v3
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ inputs.github-token }}
+
+    - name: Docker meta
+      id: meta
+      uses: docker/metadata-action@v5
+      with:
+        images: |
+          docker.io/calendso/calendso
+          docker.io/calcom/cal.com
+          ghcr.io/calcom/cal.com
+        flavor: |
+          latest=${{ !github.event.release.prerelease && inputs.use-as-latest == 'true' }}
+          suffix=${{ inputs.platform-suffix }}
+
+    - name: Copy env
+      shell: bash
+      run: |
+        grep -o '^[^#]*' .env.example > .env
+        cat .env >> $GITHUB_ENV
+        echo "DATABASE_HOST=localhost:5432" >> $GITHUB_ENV
+        eval $(sed -e '/^#/d' -e 's/^/export /' -e 's/$/;/' .env) ;
+
+    - name: Start database
+      shell: bash
+      run: |
+        docker compose up -d database
+
+    - name: Show database logs and container status
+      shell: bash
+      run: |
+        echo "--- Container Status ---"
+        docker compose ps database
+
+        echo "--- Container Logs ---"
+        docker compose logs database
+
+    - name: Set up Docker Buildx
+      uses: useblacksmith/setup-docker-builder@v1
+      with:
+        driver-opts: |
+          network=container:database
+        buildkitd-flags: |
+          --allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host
+
+    - name: Build image
+      id: docker_build
+      uses: useblacksmith/build-push-action@v2
+      with:
+        context: ./
+        file: ./Dockerfile
+        load: true
+        push: false
+        platforms: ${{ inputs.platform }}
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
+        build-args: |
+          NEXT_PUBLIC_WEBAPP_URL=http://localhost:3000
+          NEXT_PUBLIC_API_V2_URL=http://localhost:5555/api/v2
+          NEXT_PUBLIC_LICENSE_CONSENT=agree
+          DATABASE_URL=postgresql://${{ inputs.postgres-user }}:${{ inputs.postgres-password }}@${{ inputs.database-host }}/${{ inputs.postgres-db }}
+          DATABASE_DIRECT_URL=postgresql://${{ inputs.postgres-user }}:${{ inputs.postgres-password }}@${{ inputs.database-host }}/${{ inputs.postgres-db }}
+
+    - name: Test runtime
+      shell: bash
+      run: |
+        tags="${{ steps.meta.outputs.tags }}"
+        IFS=',' read -ra ADDR <<< "$tags"
+        tag=${ADDR[0]}
+
+        docker run --rm --network stack \
+          -p 3000:3000 \
+          -e DATABASE_URL=postgresql://${{ inputs.postgres-user }}:${{ inputs.postgres-password }}@database/${{ inputs.postgres-db }} \
+          -e DATABASE_DIRECT_URL=postgresql://${{ inputs.postgres-user }}:${{ inputs.postgres-password }}@database/${{ inputs.postgres-db }} \
+          -e NEXTAUTH_SECRET=${{ env.NEXTAUTH_SECRET }} \
+          -e CALENDSO_ENCRYPTION_KEY=${{ env.CALENDSO_ENCRYPTION_KEY }} \
+          $tag &
+
+          server_pid=$!
+
+          echo "Waiting for the server to start..."
+          sleep 120
+
+          echo http://localhost:3000/auth/login
+
+          for i in {1..60}; do
+            echo "Checking server health ($i/60)..."
+            response=$(curl -o /dev/null -s -w "%{http_code}" http://localhost:3000/auth/login)
+            echo "HTTP Status Code: $response"
+            if [[ "$response" == "200" ]] || [[ "$response" == "307" ]]; then
+              echo "Server is healthy"
+              kill $server_pid
+              exit 0
+            fi
+            sleep 1
+          done
+
+          echo "Server health check failed"
+          kill $server_pid
+          exit 1
+      env:
+        NEXTAUTH_SECRET: "EI4qqDpcfdvf4A+0aQEEx8JjHxHSy4uWiZw/F32K+pA="
+        CALENDSO_ENCRYPTION_KEY: "0zfLtY99wjeLnsM7qsa8xsT+Q0oSgnOL"
+
+    - name: Push image
+      id: docker_push
+      uses: useblacksmith/build-push-action@v2
+      if: ${{ inputs.push-image == 'true' && !github.event.release.prerelease }}
+      with:
+        context: ./
+        file: ./Dockerfile
+        push: true
+        platforms: ${{ inputs.platform }}
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
+        build-args: |
+          NEXT_PUBLIC_WEBAPP_URL=http://localhost:3000
+          NEXT_PUBLIC_API_V2_URL=http://localhost:5555/api/v2
+          NEXT_PUBLIC_LICENSE_CONSENT=agree
+          DATABASE_URL=postgresql://${{ inputs.postgres-user }}:${{ inputs.postgres-password }}@${{ inputs.database-host }}/${{ inputs.postgres-db }}
+          DATABASE_DIRECT_URL=postgresql://${{ inputs.postgres-user }}:${{ inputs.postgres-password }}@${{ inputs.database-host }}/${{ inputs.postgres-db }}
+
+    - name: Image digest
+      shell: bash
+      run: echo ${{ steps.docker_build.outputs.digest }}
+
+    - name: Cleanup
+      shell: bash
+      if: always()
+      run: |
+        docker compose down

.github/actions/yarn-install/action.yml

@@ -15,12 +15,16 @@ inputs:
   node_version:
     required: false
     default: v20.x
+  skip-install-if-cache-hit:
+    description: "Skip yarn install if node_modules cache is hit. Use this for jobs that only need to check that cache exists."
+    required: false
+    default: "false"
 
 runs:
   using: "composite"
   steps:
     - name: Use Node ${{ inputs.node_version }}
-      uses: buildjet/setup-node@v4
+      uses: actions/setup-node@v4
       with:
         node-version: ${{ inputs.node_version }}
     - name: Expose yarn config as "$GITHUB_OUTPUT"
@@ -29,10 +33,57 @@ runs:
       run: |
         echo "CACHE_FOLDER=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
 
+    # When skip-install-if-cache-hit is true, first check if all caches exist without downloading (lookup-only mode)
+    # This avoids downloading ~1.2GB of cache data when we just want to verify caches exist
+    - name: Check yarn cache (lookup-only)
+      if: ${{ inputs.skip-install-if-cache-hit == 'true' }}
+      uses: actions/cache/restore@v4
+      id: yarn-download-cache-check
+      with:
+        path: ${{ steps.yarn-config.outputs.CACHE_FOLDER }}
+        key: yarn-download-cache-${{ hashFiles('yarn.lock') }}
+        lookup-only: true
+
+    - name: Check node_modules cache (lookup-only)
+      if: ${{ inputs.skip-install-if-cache-hit == 'true' }}
+      uses: actions/cache/restore@v4
+      id: yarn-nm-cache-check
+      with:
+        path: |
+          **/node_modules/
+          !**/.next/node_modules/
+        key: ${{ runner.os }}-yarn-nm-cache-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
+        lookup-only: true
+
+    - name: Check yarn install state cache (lookup-only)
+      if: ${{ inputs.skip-install-if-cache-hit == 'true' }}
+      uses: actions/cache/restore@v4
+      id: yarn-install-state-cache-check
+      with:
+        path: .yarn/ci-cache/
+        key: ${{ runner.os }}-yarn-install-state-cache-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
+        lookup-only: true
+
+    # Compute whether all caches hit (only in skip mode)
+    - name: Check if all caches hit
+      if: ${{ inputs.skip-install-if-cache-hit == 'true' }}
+      id: all-caches-check
+      shell: bash
+      run: |
+        if [[ "${{ steps.yarn-download-cache-check.outputs.cache-hit }}" == "true" && \
+              "${{ steps.yarn-nm-cache-check.outputs.cache-hit }}" == "true" && \
+              "${{ steps.yarn-install-state-cache-check.outputs.cache-hit }}" == "true" ]]; then
+          echo "all-hit=true" >> $GITHUB_OUTPUT
+        else
+          echo "all-hit=false" >> $GITHUB_OUTPUT
+        fi
+
     # Yarn rotates the downloaded cache archives, @see https://github.com/actions/setup-node/issues/325
     # Yarn cache is also reusable between arch and os.
+    # Only restore if not in skip mode, or if skip mode but any cache check missed
     - name: Restore yarn cache
-      uses: buildjet/cache@v4
+      if: ${{ inputs.skip-install-if-cache-hit != 'true' || steps.all-caches-check.outputs.all-hit != 'true' }}
+      uses: actions/cache@v4
       id: yarn-download-cache
       with:
         path: ${{ steps.yarn-config.outputs.CACHE_FOLDER }}
@@ -40,25 +91,28 @@ runs:
 
     # Invalidated on yarn.lock changes
     - name: Restore node_modules
+      if: ${{ inputs.skip-install-if-cache-hit != 'true' || steps.all-caches-check.outputs.all-hit != 'true' }}
       id: yarn-nm-cache
-      uses: buildjet/cache@v4
+      uses: actions/cache@v4
       with:
-        path: "**/node_modules/"
+        path: |
+          **/node_modules/
+          !**/.next/node_modules/
         key: ${{ runner.os }}-yarn-nm-cache-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
 
     # Invalidated on yarn.lock changes
     - name: Restore yarn install state
+      if: ${{ inputs.skip-install-if-cache-hit != 'true' || steps.all-caches-check.outputs.all-hit != 'true' }}
       id: yarn-install-state-cache
-      uses: buildjet/cache@v4
+      uses: actions/cache@v4
       with:
         path: .yarn/ci-cache/
         key: ${{ runner.os }}-yarn-install-state-cache-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
 
     - name: Install dependencies
+      if: ${{ inputs.skip-install-if-cache-hit != 'true' || steps.all-caches-check.outputs.all-hit != 'true' }}
       shell: bash
-      run: |
-        yarn install --inline-builds
-        yarn prisma generate
+      run: yarn install --inline-builds
       env:
         # CI optimizations. Overrides yarnrc.yml options (or their defaults) in the CI action.
         YARN_ENABLE_IMMUTABLE_INSTALLS: "false" # So it doesn't try to remove our private submodule deps

.github/actions/yarn-playwright-install/action.yml

@@ -1,5 +1,10 @@
 name: Install playwright binaries
 description: "Install playwright, cache and restore if necessary"
+inputs:
+  skip-install-if-cache-hit:
+    description: "Skip playwright install if cache is hit. Use this for jobs that only need to check that cache exists."
+    required: false
+    default: "false"
 runs:
   using: "composite"
   steps:
@@ -7,15 +12,35 @@ runs:
       shell: bash
       id: playwright-version
       run: echo "PLAYWRIGHT_VERSION=$(node -e "console.log(require('./package.json').devDependencies['@playwright/test'])")" >> $GITHUB_ENV
-    - name: Cache playwright binaries
-      id: playwright-cache
-      uses: buildjet/cache@v4
+
+    # When skip-install-if-cache-hit is true, first check if cache exists without downloading (lookup-only mode)
+    - name: Check playwright cache (lookup-only)
+      if: ${{ inputs.skip-install-if-cache-hit == 'true' }}
+      id: playwright-cache-check
+      uses: actions/cache/restore@v4
       with:
         path: |
           ~/Library/Caches/ms-playwright
           ~/.cache/ms-playwright
           ${{ github.workspace }}/node_modules/playwright
         key: ${{ runner.os }}-playwright-${{ env.PLAYWRIGHT_VERSION }}
+        lookup-only: true
+
+    # Only restore cache if not in skip mode, or if skip mode but cache check missed
+    - name: Cache playwright binaries
+      if: ${{ inputs.skip-install-if-cache-hit != 'true' || steps.playwright-cache-check.outputs.cache-hit != 'true' }}
+      id: playwright-cache
+      uses: actions/cache@v4
+      with:
+        path: |
+          ~/Library/Caches/ms-playwright
+          ~/.cache/ms-playwright
+          ${{ github.workspace }}/node_modules/playwright
+        key: ${{ runner.os }}-playwright-${{ env.PLAYWRIGHT_VERSION }}
+
+    # In default mode: run if playwright-cache missed
+    # In skip mode: run if playwright-cache-check missed (but cache restore step was also skipped)
     - name: Yarn playwright install
+      if: ${{ (inputs.skip-install-if-cache-hit != 'true' && steps.playwright-cache.outputs.cache-hit != 'true') || (inputs.skip-install-if-cache-hit == 'true' && steps.playwright-cache-check.outputs.cache-hit != 'true') }}
       shell: bash
       run: yarn playwright install --with-deps

.github/oasdiff-err-ignore.txt

@@ -0,0 +1,4 @@
+GET /v2/event-types/{eventTypeId} added to the 'data' response property 'oneOf' list for the response status '200'
+GET /v2/event-types/{eventTypeId} added '#/components/schemas/EventTypeOutput_2024_06_14, #/components/schemas/TeamEventTypeOutput_2024_06_14' to the 'data' response property 'oneOf' list for the response status '200'
+GET /v2/bookings/{bookingUid}/recordings added the new required 'header' request parameter 'Authorization'
+GET /v2/bookings/{bookingUid}/transcripts added the new required 'header' request parameter 'Authorization'

.github/workflows/all-checks.yml

@@ -24,6 +24,11 @@ jobs:
     uses: ./.github/workflows/unit-tests.yml
     secrets: inherit
 
+  api-v2-unit-test:
+    name: Tests
+    uses: ./.github/workflows/api-v2-unit-tests.yml
+    secrets: inherit
+
   build-api-v1:
     name: Production builds
     uses: ./.github/workflows/api-v1-production-build.yml
@@ -74,16 +79,10 @@ jobs:
     uses: ./.github/workflows/e2e-embed-react.yml
     secrets: inherit
 
-  e2e-atoms:
-    name: Tests
-    needs: [lint, build, build-atoms, build-api-v2]
-    uses: ./.github/workflows/e2e-atoms.yml
-    secrets: inherit
-
   required:
-    needs: [lint, type-check, unit-test, integration-test, build, build-api-v1, build-api-v2, e2e, e2e-embed, e2e-embed-react, e2e-app-store, e2e-atoms]
+    needs: [lint, type-check, unit-test, api-v2-unit-test, integration-test, build, build-api-v1, build-api-v2, e2e, e2e-embed, e2e-embed-react, e2e-app-store]
     if: always()
-    runs-on: buildjet-2vcpu-ubuntu-2204
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - name: fail if conditional jobs failed
         if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'skipped') || contains(needs.*.result, 'cancelled')

.github/workflows/api-v1-production-build.yml

@@ -43,7 +43,7 @@ env:
 jobs:
   build:
     name: Build API v1
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     services:
       postgres:
@@ -56,10 +56,11 @@ jobs:
           POSTGRES_PASSWORD: postgres
           POSTGRES_DB: calendso
         options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
+          --health-cmd "pg_isready -h 127.0.0.1 -U postgres"
+          --health-interval 2s
+          --health-timeout 3s
+          --health-retries 15
+          --health-start-period 2s
         ports:
           - 5432:5432
     steps:
@@ -68,21 +69,18 @@ jobs:
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/cache-db
       - name: Cache API v1 production build
-        uses: buildjet/cache@v4
+        uses: actions/cache@v4
         id: cache-api-v1-build
         env:
           cache-name: api-v1-build
           key-1: ${{ hashFiles('yarn.lock') }}
           key-2: ${{ hashFiles('apps/api/v1/**.[jt]s', 'apps/api/v1/**.[jt]sx', '!**/node_modules') }}
-          key-3: ${{ github.event.pull_request.number || github.ref }}
-          # Ensures production-build.yml will always be fresh
-          key-4: ${{ github.sha }}
         with:
           path: |
             ${{ github.workspace }}/apps/api/v1/.next
             **/.turbo/**
             **/dist/**
-          key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}
+          key: ${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}
       - name: Log Cache Hit
         if: steps.cache-api-v1-build.outputs.cache-hit == 'true'
         run: echo "Cache hit for API v1 build. Skipping build."

.github/workflows/api-v2-production-build.yml

@@ -6,13 +6,15 @@ on:
 env:
   DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
   DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
 
 jobs:
   build:
     name: Build API v2
     permissions:
       contents: read
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     services:
       postgres:
@@ -35,29 +37,11 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
-      - name: Cache API v2 production build
-        uses: buildjet/cache@v4
-        id: cache-api-v2-build
-        env:
-          cache-name: api-v2-build
-          key-1: ${{ hashFiles('yarn.lock') }}
-          key-2: ${{ hashFiles('apps/api/v2/**.[jt]s', 'apps/api/v2/**.[jt]sx', '!**/node_modules') }}
-          key-3: ${{ github.event.pull_request.number || github.ref }}
-          # Ensures production-build.yml will always be fresh
-          key-4: ${{ github.sha }}
-        with:
-          path: |
-            **/dist/**
-          key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}
-      - name: Log Cache Hit
-        if: steps.cache-api-v2-build.outputs.cache-hit == 'true'
-        run: echo "Cache hit for API v2 build. Skipping build."
-      - name: Run build
-        if: steps.cache-api-v2-build.outputs.cache-hit != 'true'
+      - name: Generate Prisma schemas
+        working-directory: apps/api/v2
+        run: yarn workspace @calcom/api-v2 run generate-schemas
+      - name: Build API v2 with Turbo
         run: |
           export NODE_OPTIONS="--max_old_space_size=8192"
-          yarn workspace @calcom/api-v2 run generate-schemas
-          rm -rf apps/api/v2/node_modules
-          yarn install
-          yarn workspace @calcom/api-v2 run build
+          yarn turbo run build --filter=@calcom/api-v2
         shell: bash

.github/workflows/api-v2-unit-tests.yml

@@ -0,0 +1,22 @@
+name: API v2 Unit
+on:
+  workflow_call:
+env:
+  LINGO_DOT_DEV_API_KEY: ${{ secrets.CI_LINGO_DOT_DEV_API_KEY }}
+permissions:
+  contents: read
+jobs:
+  test:
+    name: API v2 Unit
+    timeout-minutes: 20
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/dangerous-git-checkout
+      - uses: ./.github/actions/yarn-install
+      - run: yarn prisma generate
+      - name: Run API v2 unit tests
+        working-directory: apps/api/v2
+        run: |
+          export NODE_OPTIONS="--max_old_space_size=8192"
+          yarn workspace @calcom/platform-libraries build && yarn test

.github/workflows/atoms-production-build.yml

@@ -8,34 +8,28 @@ jobs:
     name: Build Atoms
     permissions:
       contents: read
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - name: Cache atoms production build
-        uses: buildjet/cache@v4
+        uses: actions/cache@v4
         id: cache-atoms-build
         env:
           cache-name: atoms-build
           key-1: ${{ hashFiles('yarn.lock') }}
-          key-2: ${{ hashFiles('packages/platform/atoms/**.[jt]s', 'packages/platform/atoms/**.[jt]sx', '!**/node_modules') }}
-          key-3: ${{ github.event.pull_request.number || github.ref }}
-          # Ensures production-build.yml will always be fresh
-          key-4: ${{ github.sha }}
+          key-2: ${{ hashFiles('packages/platform/atoms/**.[jt]s', 'packages/platform/atoms/**.[jt]sx', 'packages/platform/atoms/package.json', '!**/node_modules') }}
         with:
           path: |
             **/dist/**
-          key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}
-      - name: Log Cache Hit
-        if: steps.cache-atoms-build.outputs.cache-hit == 'true'
-        run: echo "Cache hit for Atoms build. Skipping build."
+          key: ${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}
       - name: Run build
         if: steps.cache-atoms-build.outputs.cache-hit != 'true'
         run: |
           export NODE_OPTIONS="--max_old_space_size=8192"
           rm -rf packages/platform/atoms/node_modules
           yarn install
-          yarn workspace @calcom/atoms run build
+          yarn workspace @calcom/atoms run build-npm
         shell: bash

.github/workflows/cache-clean.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   cleanup:
-    runs-on: buildjet-2vcpu-ubuntu-2204
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - name: Check out code
         uses: actions/checkout@v4

.github/workflows/changesets.yml

@@ -6,23 +6,31 @@ on:
       - main
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
-permissions: {} # remove permissions and set explicitly under "permissions:" below
+permissions:
+  id-token: write # for NPM provenance - developers can verify where and how it was built
+  contents: write # to create release by changesets/action below
+  pull-requests: write # to create pull request by changesets/action below
+
 jobs:
   release:
     if: github.repository == 'calcom/cal.com' # prevent this action from running on forks
-    permissions:
-      id-token: write # for NPM provenance - developers can verify where and how it was built
-      contents: write # to create release by changesets/action below
-      pull-requests: write # to create pull request by changesets/action below
     name: Release
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+      - name: Setup Node and registry for OIDC
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20.17.0"
+          registry-url: "https://registry.npmjs.org"
+          always-auth: false
       - name: Setup node, yarn and install dependencies
         uses: ./.github/actions/yarn-install
+      - name: Install npm at version supporting OIDC
+        run: npm install -g npm@11.5.1
       - name: Create Release Pull Request or Publish to npm
         id: changesets
         uses: changesets/action@v1
@@ -33,8 +41,7 @@ jobs:
           title: "chore: version packages" # PR title
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: "true"
           VITE_BOOKER_EMBED_OAUTH_CLIENT_ID: ${{ secrets.VITE_BOOKER_EMBED_OAUTH_CLIENT_ID }}
           VITE_BOOKER_EMBED_API_URL: ${{ secrets.VITE_BOOKER_EMBED_API_URL }}
-          NEXT_PUBLIC_WEBAPP_URL: ${{ secrets.NEXT_PUBLIC_WEBAPP_URL }}
+          NEXT_PUBLIC_WEBAPP_URL: ${{ secrets.NEXT_PUBLIC_WEBAPP_URL }}

.github/workflows/check-api-v2-breaking-changes.yml

@@ -0,0 +1,55 @@
+name: Check API v2 breaking changes
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+env:
+  API_KEY_PREFIX: ${{ secrets.CI_API_KEY_PREFIX }}
+  API_PORT: ${{ vars.CI_API_V2_PORT }}
+  API_URL: "http://localhost"
+  CALCOM_LICENSE_KEY: ${{ secrets.CI_CALCOM_LICENSE_KEY }}
+  DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_READ_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_WRITE_URL: ${{ secrets.CI_DATABASE_URL }}
+  JWT_SECRET: ${{ secrets.CI_JWT_SECRET }}
+  NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
+  NODE_ENV: ${{ vars.CI_NODE_ENV }}
+  NODE_OPTIONS: --max-old-space-size=4096
+  REDIS_URL: "redis://localhost:6379"
+  STRIPE_API_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
+  STRIPE_WEBHOOK_SECRET: ${{ secrets.CI_STRIPE_WEBHOOK_SECRET }}
+  WEB_APP_URL: "https://app.cal.com"
+
+jobs:
+  check-api-v2-breaking-changes:
+    name: Check API v2 breaking changes
+    timeout-minutes: 10
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/dangerous-git-checkout
+      - uses: ./.github/actions/yarn-install
+
+      - name: Generate Swagger
+        working-directory: apps/api/v2
+        run: |
+          yarn prisma generate
+          yarn generate-swagger
+
+      - name: Check API v2 breaking changes
+        run: |
+          docker run --rm \
+            -v "$PWD:/work" -w /work \
+            tufin/oasdiff:latest \
+            breaking \
+            https://raw.githubusercontent.com/calcom/cal.com/refs/heads/main/docs/api-reference/v2/openapi.json \
+            docs/api-reference/v2/openapi.json \
+            --fail-on ERR \
+            --err-ignore .github/oasdiff-err-ignore.txt

.github/workflows/check-types.yml

@@ -3,11 +3,13 @@ on:
   workflow_call:
 env:
   NODE_OPTIONS: --max-old-space-size=4096
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
 permissions:
   contents: read
 jobs:
   check-types:
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout

.github/workflows/cleanup-report.yml

@@ -11,12 +11,20 @@ jobs:
   cleanup-report:
     runs-on: ubuntu-latest
     steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'test-results-2'
+
       - name: Checkout GitHub Pages Branch
         uses: actions/checkout@v4
         with:
-          repository: calcom/test-results
+          repository: calcom/test-results-2
           ref: gh-pages
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
 
       - name: Set Git User
         run: |

.github/workflows/cleanup.yml

@@ -22,12 +22,20 @@ jobs:
       # Contains all reports for deleted branch
       BRANCH_REPORTS_DIR: reports/${{ github.event.ref }}
     steps:
-      - name: Checkout GitHub Pages Branch
-        uses: actions/checkout@v2
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
         with:
-          repository: calcom/test-results
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'test-results-2'
+
+      - name: Checkout GitHub Pages Branch
+        uses: actions/checkout@v4
+        with:
+          repository: calcom/test-results-2
           ref: gh-pages
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
       - name: Set Git User
         # see: https://github.com/actions/checkout/issues/13#issuecomment-724415212
         run: |

.github/workflows/companion-build.yml

@@ -0,0 +1,42 @@
+name: Companion Builds
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+env:
+  EXPO_PUBLIC_CAL_API_KEY: ${{ secrets.CI_EXPO_PUBLIC_CAL_API_KEY || vars.CI_EXPO_PUBLIC_CAL_API_KEY || vars.EXPO_PUBLIC_CAL_API_KEY }}
+
+jobs:
+  build:
+    name: Build Companion App & Extension
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/dangerous-git-checkout
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: 1.3.0
+          cache: true
+          cache-dependency-path: companion/bun.lock
+
+      - name: Install dependencies
+        working-directory: companion
+        run: bun install --frozen-lockfile
+
+      - name: Build Expo web app
+        working-directory: companion
+        env:
+          EXPO_NO_TELEMETRY: 1
+          CI: true
+        run: bunx expo export --platform web
+
+      - name: Build browser extension
+        working-directory: companion
+        run: bun run ext:build

.github/workflows/cron-scheduleSMSReminders.yml

@@ -9,15 +9,25 @@ on:
 jobs:
   cron-scheduleSMSReminders:
     env:
-      APP_URL: ${{ secrets.APP_URL }}
-      CRON_API_KEY: ${{ secrets.CRON_API_KEY }}
+      APP_URL_US: ${{ vars.APP_URL_US }}
+      APP_URL_EU: ${{ vars.APP_URL_EU }}
+      CRON_API_KEY_US: ${{ secrets.CRON_API_KEY }}
+      CRON_API_KEY_EU: ${{ secrets.CRON_API_KEY_EU }}
     runs-on: ubuntu-latest
     steps:
-      - name: cURL request
-        if: ${{ env.APP_URL && env.CRON_API_KEY }}
+      - name: cURL request EU
+        if: ${{ env.APP_URL_EU && env.CRON_API_KEY_EU }}
         run: |
-          curl ${{ secrets.APP_URL }}/api/cron/workflows/scheduleSMSReminders \
+          curl ${{ env.APP_URL_EU }}/api/cron/workflows/scheduleSMSReminders \
             -X POST \
             -H 'content-type: application/json' \
-            -H 'authorization: ${{ secrets.CRON_API_KEY }}' \
+            -H 'authorization: ${{ env.CRON_API_KEY_EU }}' \
+            -sSf
+      - name: cURL request US
+        if: ${{ env.APP_URL_US && env.CRON_API_KEY_US }}
+        run: |
+          curl ${{ env.APP_URL_US }}/api/cron/workflows/scheduleSMSReminders \
+            -X POST \
+            -H 'content-type: application/json' \
+            -H 'authorization: ${{ env.CRON_API_KEY_US }}' \
             -sSf

.github/workflows/cron-scheduleWhatsappReminders.yml

@@ -9,15 +9,25 @@ on:
 jobs:
   cron-scheduleWhatsappReminders:
     env:
-      APP_URL: ${{ secrets.APP_URL }}
-      CRON_API_KEY: ${{ secrets.CRON_API_KEY }}
+      APP_URL_EU: ${{ vars.APP_URL_EU }}
+      APP_URL_US: ${{ vars.APP_URL_US }}
+      CRON_API_KEY_EU: ${{ secrets.CRON_API_KEY_EU }}
+      CRON_API_KEY_US: ${{ secrets.CRON_API_KEY }}
     runs-on: ubuntu-latest
     steps:
-      - name: cURL request
-        if: ${{ env.APP_URL && env.CRON_API_KEY }}
+      - name: cURL request EU
+        if: ${{ env.APP_URL_EU && env.CRON_API_KEY_EU }}
         run: |
-          curl ${{ secrets.APP_URL }}/api/cron/workflows/scheduleWhatsappReminders \
+          curl ${{ env.APP_URL_EU }}/api/cron/workflows/scheduleWhatsappReminders \
             -X POST \
             -H 'content-type: application/json' \
-            -H 'authorization: ${{ secrets.CRON_API_KEY }}' \
+            -H 'authorization: ${{ env.CRON_API_KEY_EU }}' \
+            -sSf
+      - name: cURL request US
+        if: ${{ env.APP_URL_US && env.CRON_API_KEY_US }}
+        run: |
+          curl ${{ env.APP_URL_US }}/api/cron/workflows/scheduleWhatsappReminders \
+            -X POST \
+            -H 'content-type: application/json' \
+            -H 'authorization: ${{ env.CRON_API_KEY_US }}' \
             -sSf

.github/workflows/cron-stale-issue.yml

@@ -20,8 +20,8 @@ jobs:
           days-before-close: -1
           days-before-issue-stale: 60
           days-before-issue-close: -1
-          days-before-pr-stale: 14
-          days-before-pr-close: -1
-          stale-pr-message: "This PR is being marked as stale due to inactivity."
-          close-pr-message: "This PR is being closed due to inactivity. Please reopen if work is intended to be continued."
+          days-before-pr-stale: 7
+          days-before-pr-close: 14
+          stale-pr-message: "This PR has been marked as stale due to inactivity. If you're still working on it or need any help, please let us know or update the PR to keep it active."
+          close-pr-message: "This PR has been closed due to inactivity. Please feel free to reopen it if you'd like to continue the work."
           operations-per-run: 100

.github/workflows/cron-webhooks-triggers.yml

@@ -9,15 +9,25 @@ on:
 jobs:
   cron-webhookTriggers:
     env:
-      APP_URL: ${{ secrets.APP_URL }}
-      CRON_API_KEY: ${{ secrets.CRON_API_KEY }}
+      APP_URL_US: ${{ vars.APP_URL_US }}
+      APP_URL_EU: ${{ vars.APP_URL_EU }}
+      CRON_API_KEY_US: ${{ secrets.CRON_API_KEY }}
+      CRON_API_KEY_EU: ${{ secrets.CRON_API_KEY_EU }}
     runs-on: ubuntu-latest
     steps:
-      - name: cURL request
-        if: ${{ env.APP_URL && env.CRON_API_KEY }}
+      - name: cURL request US
+        if: ${{ env.APP_URL_US && env.CRON_API_KEY_US }}
         run: |
-          curl ${{ secrets.APP_URL }}/api/cron/webhookTriggers \
+          curl ${{ env.APP_URL_US }}/api/cron/webhookTriggers \
             -X POST \
             -H 'content-type: application/json' \
-            -H 'authorization: ${{ secrets.CRON_API_KEY }}' \
-            --fail
+            -H 'authorization: ${{ env.CRON_API_KEY_US }}' \
+            -sSf
+      - name: cURL request EU
+        if: ${{ env.APP_URL_EU && env.CRON_API_KEY_EU }}
+        run: |
+          curl ${{ env.APP_URL_EU }}/api/cron/webhookTriggers \
+            -X POST \
+            -H 'content-type: application/json' \
+            -H 'authorization: ${{ env.CRON_API_KEY_EU }}' \
+            -sSf

.github/workflows/delete-blacksmith-cache.yml

@@ -0,0 +1,33 @@
+name: Delete Blacksmith Cache
+on:
+  workflow_dispatch:
+    inputs:
+      cache_key:
+        description: "Blacksmith Cache Key to Delete"
+        required: true
+        type: string
+  pull_request:
+    types: [closed]
+
+jobs:
+  manually-delete-blacksmith-cache:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - uses: useblacksmith/cache-delete@v1
+        with:
+          key: ${{ inputs.cache_key }}
+
+  delete-cache-build-on-pr-close:
+    if: github.event_name == 'pull_request' && github.event.action == 'closed'
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    env:
+      CACHE_NAME: prod-build
+    steps:
+      - name: Delete cache-build cache
+        uses: useblacksmith/cache-delete@v1
+        with:
+          key: ${{ env.CACHE_NAME }}-${{ github.event.pull_request.head.ref }}
+          prefix: "true"

.github/workflows/delete-buildjet-cache.yml

@@ -1,17 +0,0 @@
-name: Manually Delete BuildJet Cache
-on:
-  workflow_dispatch:
-    inputs:
-      cache_key:
-        description: "BuildJet Cache Key to Delete"
-        required: true
-        type: string
-jobs:
-  manually-delete-buildjet-cache:
-    runs-on: buildjet-2vcpu-ubuntu-2204
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - uses: buildjet/cache-delete@v1
-        with:
-          cache_key: ${{ inputs.cache_key }}

.github/workflows/docs-build.yml

@@ -9,27 +9,21 @@ jobs:
     name: Build Docs
     permissions:
       contents: read
-    runs-on: buildjet-2vcpu-ubuntu-2204
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - name: Cache Docs build
-        uses: buildjet/cache@v4
+        uses: actions/cache@v4
         id: cache-docs-build
         env:
           cache-name: docs-build
           key-1: ${{ hashFiles('yarn.lock') }}
           key-2: ${{ hashFiles('docs/**.*', '!**/node_modules') }}
-          key-3: ${{ github.event.pull_request.number || github.ref }}
-          key-4: ${{ github.sha }}
         with:
           path: |
             **/docs/**
-          key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}
-            # Log cache hit
-      - name: Log Cache Hit
-        if: steps.cache-docs-build.outputs.cache-hit == 'true'
-        run: echo "Cache hit for Docs build. Skipping build."
+          key: ${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}
       - name: Run build
         if: steps.cache-docs-build.outputs.cache-hit != 'true'
         working-directory: docs

.github/workflows/draft-release.yml

@@ -17,13 +17,20 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'cal.com'
+
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: 'main'
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
 
       - name: Configure git
         run: |

.github/workflows/e2e-api-v2.yml

@@ -1,4 +1,4 @@
-name: E2E
+name: Check breaking changes and run E2E
 on:
   workflow_call:
 env:
@@ -23,11 +23,17 @@ env:
   STRIPE_CLIENT_ID: ${{ secrets.CI_STRIPE_CLIENT_ID }}
   STRIPE_WEBHOOK_SECRET: ${{ secrets.CI_STRIPE_WEBHOOK_SECRET }}
   SLOTS_CACHE_TTL: ${{ secrets.CI_SLOTS_CACHE_TTL }}
+  NEXT_PUBLIC_VAPID_PUBLIC_KEY: ${{ secrets.NEXT_PUBLIC_VAPID_PUBLIC_KEY }}
+  VAPID_PRIVATE_KEY: ${{ secrets.VAPID_PRIVATE_KEY }}
+  JWT_SECRET: ${{ secrets.CI_JWT_SECRET }}
+  NODE_ENV: ${{ vars.CI_NODE_ENV }}
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
 jobs:
   e2e:
     timeout-minutes: 20
-    name: E2E API v2
-    runs-on: buildjet-16vcpu-ubuntu-2204
+    name: E2E API v2 (${{ matrix.shard }}/${{ strategy.job-total }})
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     services:
       postgres:
         image: postgres:13
@@ -39,10 +45,11 @@ jobs:
           POSTGRES_PASSWORD: postgres
           POSTGRES_DB: calendso
         options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
+          --health-cmd "pg_isready -h 127.0.0.1 -U postgres"
+          --health-interval 2s
+          --health-timeout 3s
+          --health-retries 15
+          --health-start-period 2s
         ports:
           - 5432:5432
       redis:
@@ -59,6 +66,8 @@ jobs:
           --health-retries 5
     strategy:
       fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
     steps:
       - uses: docker/login-action@v3
         with:
@@ -68,16 +77,29 @@ jobs:
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/cache-db
+      - name: Build platform packages with Turbo
+        run: |
+          yarn turbo run build \
+            --filter=@calcom/platform-constants \
+            --filter=@calcom/platform-enums \
+            --filter=@calcom/platform-utils \
+            --filter=@calcom/platform-types \
+            --filter=@calcom/platform-libraries \
+            --filter=@calcom/trpc
+
       - name: Run Tests
         working-directory: apps/api/v2
         run: |
-          yarn test:e2e
+          yarn test:e2e:ci --shard=${{ matrix.shard }}/${{ strategy.job-total }}
           EXIT_CODE=$?
-          echo "yarn test:e2e command exit code: $EXIT_CODE"
+          echo "yarn test:e2e:ci --shard=${{ matrix.shard }}/${{ strategy.job-total }} command exit code: $EXIT_CODE"
           exit $EXIT_CODE
+
       - name: Upload Test Results
         if: ${{ always() }}
         uses: actions/upload-artifact@v4
         with:
-          name: test-results-api-v2
-          path: test-results
+          name: test-results-api-v2-shard-${{ matrix.shard }}
+          path: apps/api/v2/test-results
+          if-no-files-found: ignore
+          retention-days: 7

.github/workflows/e2e-app-store.yml

@@ -45,7 +45,7 @@ jobs:
   e2e-app-store:
     timeout-minutes: 20
     name: E2E App Store
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     services:
       postgres:
         image: postgres:13
@@ -57,10 +57,11 @@ jobs:
           POSTGRES_PASSWORD: postgres
           POSTGRES_DB: calendso
         options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
+          --health-cmd "pg_isready -h 127.0.0.1 -U postgres"
+          --health-interval 2s
+          --health-timeout 3s
+          --health-retries 15
+          --health-start-period 2s
         ports:
           - 5432:5432
       mailhog:
@@ -83,6 +84,7 @@ jobs:
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/yarn-playwright-install
+      - run: yarn prisma generate
       - uses: ./.github/actions/cache-db
         env:
           DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
@@ -93,7 +95,7 @@ jobs:
           E2E_TEST_CALCOM_GCAL_KEYS: ${{ secrets.E2E_TEST_CALCOM_GCAL_KEYS }}
       - uses: ./.github/actions/cache-build
       - name: Run Tests
-        run: yarn e2e:app-store
+        run: yarn e2e:app-store --workers=4
       - name: Upload Test Results
         if: ${{ always() }}
         uses: actions/upload-artifact@v4

.github/workflows/e2e-atoms.yml

@@ -13,6 +13,8 @@ env:
   ATOMS_E2E_API_URL: ${{ secrets.ATOMS_E2E_API_URL }}
   ATOMS_E2E_ORG_ID: ${{ secrets.ATOMS_E2E_ORG_ID }}
   ATOMS_E2E_OAUTH_CLIENT_ID_BOOKER_EMBED: ${{ secrets.ATOMS_E2E_OAUTH_CLIENT_ID_BOOKER_EMBED }}
+  ATOMS_E2E_APPLE_ID: ${{ secrets.ATOMS_E2E_APPLE_ID }}
+  ATOMS_E2E_APPLE_CONNECT_APP_SPECIFIC_PASSCODE: ${{ secrets.ATOMS_E2E_APPLE_CONNECT_APP_SPECIFIC_PASSCODE }}
   DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
   DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
 
@@ -20,7 +22,7 @@ jobs:
   e2e-atoms:
     timeout-minutes: 15
     name: E2E Atoms
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: docker/login-action@v3
         with:

.github/workflows/e2e-embed-react.yml

@@ -45,7 +45,7 @@ jobs:
   e2e-embed:
     timeout-minutes: 20
     name: E2E Embed React
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     services:
       postgres:
         image: postgres:13
@@ -57,10 +57,11 @@ jobs:
           POSTGRES_PASSWORD: postgres
           POSTGRES_DB: calendso
         options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
+          --health-cmd "pg_isready -h 127.0.0.1 -U postgres"
+          --health-interval 2s
+          --health-timeout 3s
+          --health-retries 15
+          --health-start-period 2s
         ports:
           - 5432:5432
     strategy:
@@ -75,11 +76,12 @@ jobs:
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/yarn-playwright-install
+      - run: yarn prisma generate
       - uses: ./.github/actions/cache-db
       - uses: ./.github/actions/cache-build
       - name: Run Tests
         run: |
-          yarn e2e:embed-react
+          yarn e2e:embed-react --workers=4
           yarn workspace @calcom/embed-react packaged:tests
       - name: Upload Test Results
         if: ${{ always() }}

.github/workflows/e2e-embed.yml

@@ -45,7 +45,7 @@ jobs:
   e2e-embed:
     timeout-minutes: 20
     name: E2E Embed Core
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     services:
       postgres:
         image: postgres:13
@@ -57,10 +57,11 @@ jobs:
           POSTGRES_PASSWORD: postgres
           POSTGRES_DB: calendso
         options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
+          --health-cmd "pg_isready -h 127.0.0.1 -U postgres"
+          --health-interval 2s
+          --health-timeout 3s
+          --health-retries 15
+          --health-start-period 2s
         ports:
           - 5432:5432
       mailhog:
@@ -83,10 +84,11 @@ jobs:
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/yarn-playwright-install
+      - run: yarn prisma generate
       - uses: ./.github/actions/cache-db
       - uses: ./.github/actions/cache-build
       - name: Run Tests
-        run: yarn e2e:embed
+        run: yarn e2e:embed --workers=4
       - name: Upload Test Results
         if: ${{ always() }}
         uses: actions/upload-artifact@v4

.github/workflows/e2e-report.yml

@@ -0,0 +1,212 @@
+name: E2E Report
+
+on:
+  workflow_run:
+    workflows: ["PR Update"]
+    types:
+      - completed
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'The PR number to generate report for'
+        required: true
+        type: string
+
+jobs:
+  get-pr-info:
+    name: Get PR Info
+    runs-on: ubuntu-latest
+    # For workflow_run: only run if the triggering workflow failed
+    # For workflow_dispatch: always run (inputs are provided manually)
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'failure' }}
+    permissions:
+      actions: read
+      pull-requests: read
+    outputs:
+      pr-number: ${{ steps.get-info.outputs.pr-number }}
+      head-branch: ${{ steps.get-info.outputs.head-branch }}
+      has-blob-reports: ${{ steps.get-info.outputs.has-blob-reports }}
+      source-run-id: ${{ steps.get-info.outputs.source-run-id }}
+      source-run-number: ${{ steps.get-info.outputs.source-run-number }}
+      source-run-attempt: ${{ steps.get-info.outputs.source-run-attempt }}
+      source-head-sha: ${{ steps.get-info.outputs.source-head-sha }}
+    steps:
+      - name: Get PR and run info
+        id: get-info
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const isDispatch = context.eventName === 'workflow_dispatch';
+            
+            if (isDispatch) {
+              // For workflow_dispatch: look up everything from PR number
+              const prNumber = context.payload.inputs.pr_number;
+              console.log('Looking up PR:', prNumber);
+              
+              // Get PR details
+              const { data: pr } = await github.rest.pulls.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: parseInt(prNumber)
+              });
+              
+              const headSha = pr.head.sha;
+              const headBranch = pr.head.ref;
+              console.log('PR head SHA:', headSha);
+              console.log('PR head branch:', headBranch);
+              
+              // Find the "PR Update" workflow
+              const { data: workflows } = await github.rest.actions.listRepoWorkflows({
+                owner: context.repo.owner,
+                repo: context.repo.repo
+              });
+              const prUpdateWorkflow = workflows.workflows.find(w => w.name === 'PR Update');
+              if (!prUpdateWorkflow) {
+                core.setFailed('Could not find "PR Update" workflow');
+                return;
+              }
+              console.log('Found PR Update workflow ID:', prUpdateWorkflow.id);
+              
+              // Find the most recent completed run for this branch with blob-report artifacts
+              // We search by branch instead of SHA to handle cases where:
+              // 1. The PR was updated after E2E tests ran (artifacts exist for older SHA)
+              // 2. The current run for the SHA is still queued/in-progress
+              const { data: runs } = await github.rest.actions.listWorkflowRuns({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: prUpdateWorkflow.id,
+                branch: headBranch,
+                status: 'completed',
+                per_page: 20
+              });
+              
+              console.log('Found', runs.workflow_runs.length, 'completed runs for branch', headBranch);
+              
+              // Find a run with blob-report artifacts
+              let selectedRun = null;
+              let hasBlobReports = false;
+              
+              for (const run of runs.workflow_runs) {
+                console.log('Checking run', run.id, 'conclusion:', run.conclusion);
+                
+                const { data: artifacts } = await github.rest.actions.listWorkflowRunArtifacts({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  run_id: run.id
+                });
+                
+                const blobReports = artifacts.artifacts.filter(a => a.name.startsWith('blob-report-'));
+                if (blobReports.length > 0) {
+                  console.log('Found run with blob reports:', run.id, 'artifacts:', blobReports.map(a => a.name));
+                  selectedRun = run;
+                  hasBlobReports = true;
+                  break;
+                }
+              }
+              
+              if (!selectedRun) {
+                console.log('No runs found with blob-report artifacts');
+                core.setOutput('pr-number', prNumber);
+                core.setOutput('head-branch', headBranch);
+                core.setOutput('source-head-sha', headSha);
+                core.setOutput('has-blob-reports', 'false');
+                core.setOutput('source-run-id', '');
+                core.setOutput('source-run-number', '');
+                core.setOutput('source-run-attempt', '');
+                return;
+              }
+              
+              core.setOutput('pr-number', prNumber);
+              core.setOutput('head-branch', headBranch);
+              core.setOutput('source-head-sha', headSha);
+              core.setOutput('source-run-id', selectedRun.id.toString());
+              core.setOutput('source-run-number', selectedRun.run_number.toString());
+              core.setOutput('source-run-attempt', selectedRun.run_attempt.toString());
+              core.setOutput('has-blob-reports', 'true');
+              return;
+            }
+            
+            // For workflow_run: extract from payload
+            const workflowRun = context.payload.workflow_run;
+            const headSha = workflowRun.head_sha;
+            const headBranch = workflowRun.head_branch;
+            
+            console.log('Head SHA:', headSha);
+            console.log('Head Branch:', headBranch);
+            
+            // Set source run info
+            core.setOutput('source-run-id', workflowRun.id.toString());
+            core.setOutput('source-run-number', workflowRun.run_number.toString());
+            core.setOutput('source-run-attempt', workflowRun.run_attempt.toString());
+            core.setOutput('source-head-sha', headSha);
+            
+            // Check for blob report artifacts
+            const { data: artifacts } = await github.rest.actions.listWorkflowRunArtifacts({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: workflowRun.id
+            });
+            
+            const blobReports = artifacts.artifacts.filter(a => a.name.startsWith('blob-report-'));
+            console.log('Found blob reports:', blobReports.map(a => a.name));
+            core.setOutput('has-blob-reports', blobReports.length > 0 ? 'true' : 'false');
+            
+            // Try to get PR number from workflow_run payload first
+            if (workflowRun.pull_requests && workflowRun.pull_requests.length > 0) {
+              const prNumber = workflowRun.pull_requests[0].number;
+              console.log('PR number from payload:', prNumber);
+              core.setOutput('pr-number', prNumber.toString());
+              core.setOutput('head-branch', headBranch);
+              return;
+            }
+            
+            // Fall back to API lookup
+            try {
+              const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                commit_sha: headSha
+              });
+              
+              if (prs.length === 0) {
+                console.log('No PRs found for commit');
+                core.setOutput('pr-number', '');
+                core.setOutput('head-branch', headBranch);
+                return;
+              }
+              
+              // Find open PR or use first one
+              const openPr = prs.find(pr => pr.state === 'open') || prs[0];
+              console.log('PR number from API:', openPr.number);
+              core.setOutput('pr-number', openPr.number.toString());
+              core.setOutput('head-branch', openPr.head.ref);
+            } catch (e) {
+              console.log('Error fetching PR:', e);
+              core.setOutput('pr-number', '');
+              core.setOutput('head-branch', headBranch);
+            }
+
+  merge-reports:
+    name: Merge reports
+    needs: [get-pr-info]
+    if: ${{ needs.get-pr-info.outputs.has-blob-reports == 'true' && needs.get-pr-info.outputs.pr-number != '' }}
+    uses: ./.github/workflows/merge-reports.yml
+    with:
+      source_run_id: ${{ needs.get-pr-info.outputs.source-run-id }}
+      source_run_number: ${{ needs.get-pr-info.outputs.source-run-number }}
+      source_run_attempt: ${{ needs.get-pr-info.outputs.source-run-attempt }}
+      source_head_sha: ${{ needs.get-pr-info.outputs.source-head-sha }}
+    # No secrets: inherit - merge-reports only needs the default GITHUB_TOKEN for artifact download
+
+  publish-report:
+    name: Publish HTML report
+    needs: [get-pr-info, merge-reports]
+    if: ${{ needs.get-pr-info.outputs.pr-number != '' }}
+    uses: ./.github/workflows/publish-report.yml
+    with:
+      head_branch: ${{ needs.get-pr-info.outputs.head-branch }}
+      source_run_id: ${{ needs.get-pr-info.outputs.source-run-id }}
+      source_run_number: ${{ needs.get-pr-info.outputs.source-run-number }}
+      source_run_attempt: ${{ needs.get-pr-info.outputs.source-run-attempt }}
+      pr_number: ${{ needs.get-pr-info.outputs.pr-number }}
+    secrets: inherit

.github/workflows/e2e.yml

@@ -5,7 +5,6 @@ permissions:
   actions: write
   contents: read
 env:
-  NODE_OPTIONS: --max-old-space-size=4096
   ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
   CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
   DAILY_API_KEY: ${{ secrets.CI_DAILY_API_KEY }}
@@ -15,11 +14,11 @@ env:
   E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
   E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
   E2E_TEST_MAILHOG_ENABLED: ${{ vars.E2E_TEST_MAILHOG_ENABLED }}
-  GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
   EMAIL_SERVER_HOST: ${{ secrets.CI_EMAIL_SERVER_HOST }}
   EMAIL_SERVER_PORT: ${{ secrets.CI_EMAIL_SERVER_PORT }}
   EMAIL_SERVER_USER: ${{ secrets.CI_EMAIL_SERVER_USER }}
   EMAIL_SERVER_PASSWORD: ${{ secrets.CI_EMAIL_SERVER_PASSWORD}}
+  GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
   GOOGLE_LOGIN_ENABLED: ${{ vars.CI_GOOGLE_LOGIN_ENABLED }}
   NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
   NEXTAUTH_URL: ${{ secrets.CI_NEXTAUTH_URL }}
@@ -30,6 +29,7 @@ env:
   NEXT_PUBLIC_STRIPE_PUBLIC_KEY: ${{ secrets.CI_NEXT_PUBLIC_STRIPE_PUBLIC_KEY }}
   NEXT_PUBLIC_WEBAPP_URL: ${{ vars.CI_NEXT_PUBLIC_WEBAPP_URL }}
   NEXT_PUBLIC_WEBSITE_URL: ${{ vars.CI_NEXT_PUBLIC_WEBSITE_URL }}
+  NODE_OPTIONS: --max-old-space-size=4096
   PAYMENT_FEE_FIXED: ${{ vars.CI_PAYMENT_FEE_FIXED }}
   PAYMENT_FEE_PERCENTAGE: ${{ vars.CI_PAYMENT_FEE_PERCENTAGE }}
   SAML_ADMINS: ${{ secrets.CI_SAML_ADMINS }}
@@ -45,7 +45,7 @@ jobs:
   e2e:
     timeout-minutes: 20
     name: E2E (${{ matrix.shard }}/${{ strategy.job-total }})
-    runs-on: buildjet-8vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     services:
       postgres:
         image: postgres:13
@@ -57,10 +57,11 @@ jobs:
           POSTGRES_PASSWORD: postgres
           POSTGRES_DB: calendso
         options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
+          --health-cmd "pg_isready -h 127.0.0.1 -U postgres"
+          --health-interval 2s
+          --health-timeout 3s
+          --health-retries 15
+          --health-start-period 2s
         ports:
           - 5432:5432
       mailhog:
@@ -74,7 +75,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        shard: [1, 2, 3, 4]
+        shard: [1, 2, 3, 4, 5, 6, 7, 8]
     steps:
       - uses: docker/login-action@v3
         with:
@@ -84,10 +85,11 @@ jobs:
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/yarn-playwright-install
+      - run: yarn prisma generate
       - uses: ./.github/actions/cache-db
       - uses: ./.github/actions/cache-build
       - name: Run Tests
-        run: yarn e2e --shard=${{ matrix.shard }}/${{ strategy.job-total }}
+        run: yarn e2e --shard=${{ matrix.shard }}/${{ strategy.job-total }} --workers=4
       - name: Upload Test Results
         uses: actions/upload-artifact@v4
         if: always()

.github/workflows/i18n.yml

@@ -10,12 +10,20 @@ concurrency:
 jobs:
   i18n:
     name: Run i18n
-    runs-on: buildjet-2vcpu-ubuntu-2204
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     permissions:
       actions: write
       contents: write
       pull-requests: write
     steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'cal.com'
+
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
@@ -23,7 +31,7 @@ jobs:
           cache: 'npm'
       - uses: lingodotdev/lingo.dev@main
         env:
-          GH_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
         with:
           api-key: ${{ secrets.CI_LINGO_DOT_DEV_API_KEY }}
           pull-request: true

.github/workflows/integration-tests.yml

@@ -5,6 +5,7 @@ permissions:
   contents: read
 env:
   NODE_OPTIONS: --max-old-space-size=4096
+  INTEGRATION_TESTS: "true"
   ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
   CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
   DAILY_API_KEY: ${{ secrets.CI_DAILY_API_KEY }}
@@ -44,7 +45,7 @@ jobs:
   integration:
     timeout-minutes: 20
     name: Integration
-    runs-on: buildjet-8vcpu-ubuntu-2204
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     services:
       postgres:
         image: postgres:13
@@ -80,9 +81,10 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
+      - run: yarn prisma generate
       - uses: ./.github/actions/cache-db
       - name: Run Tests
-        run: yarn test -- --integrationTestsOnly
+        run: VITEST_MODE=integration yarn test
       # TODO: Generate test results so we can upload them
       # - name: Upload Test Results
       #   if: ${{ always() }}

.github/workflows/labeler.yml

@@ -15,18 +15,6 @@ jobs:
       - uses: actions/labeler@v5
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
-  team-labels:
-    permissions:
-      contents: read
-      pull-requests: write
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: equitybee/team-label-action@main
-        with:
-          repo-token: ${{ secrets.EQUITY_BEE_TEAM_LABELER_ACTION_TOKEN }}
-          organization-name: calcom
-          ignore-labels: "admin, app-store, ai, authentication, automated-testing, billing, bookings, caldav, calendar-apps, ci, console, crm-apps, dba, devops, docs, documentation, emails, embeds, event-types, i18n, impersonation, manual-testing, ui, performance, ops-stack, organizations, public-api, routing-forms, seats, self-hosted, teams, webhooks, workflows, zapier"
   apply-labels-from-issue:
     runs-on: ubuntu-latest
 

.github/workflows/lint.yml

@@ -6,7 +6,7 @@ permissions:
   contents: read
 jobs:
   lint:
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-2vcpu-ubuntu-2404
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/merge-reports.yml

@@ -1,17 +1,37 @@
 # https://playwright.dev/docs/test-sharding#merging-reports-from-multiple-shards
 on:
   workflow_call:
+    inputs:
+      source_run_id:
+        description: 'The run ID to download artifacts from (for workflow_run triggered calls)'
+        required: true
+        type: string
+      source_run_number:
+        description: 'The run number for artifact naming'
+        required: true
+        type: string
+      source_run_attempt:
+        description: 'The run attempt for artifact naming'
+        required: true
+        type: string
+      source_head_sha:
+        description: 'The head SHA to checkout for Playwright version consistency'
+        required: true
+        type: string
 jobs:
   merge-reports:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: ./.github/actions/dangerous-git-checkout
+        with:
+          ref: ${{ inputs.source_head_sha }}
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/yarn-playwright-install
       - name: Download blob reports from GitHub Actions Artifacts
         uses: actions/download-artifact@v4
         with:
+          run-id: ${{ inputs.source_run_id }}
+          github-token: ${{ github.token }}
           path: all-blob-reports
           pattern: blob-report-*
           merge-multiple: true
@@ -20,6 +40,6 @@ jobs:
       - name: Upload HTML report
         uses: actions/upload-artifact@v4
         with:
-          name: html-report--attempt-${{ github.run_number }}-${{ github.run_attempt }}
+          name: html-report--attempt-${{ inputs.source_run_number }}-${{ inputs.source_run_attempt }}
           path: playwright-report
           retention-days: 14

.github/workflows/nextjs-bundle-analysis-annotation.yml

@@ -12,13 +12,13 @@ permissions:
 jobs:
   annotate:
     if: always()
-    runs-on: buildjet-2vcpu-ubuntu-2204
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/cache-build
       - name: Download base branch bundle stats
-        uses: dawidd6/action-download-artifact@v2
+        uses: dawidd6/action-download-artifact@v6
         if: success()
         with:
           workflow: nextjs-bundle-analysis.yml

.github/workflows/nextjs-bundle-analysis.yml

@@ -16,7 +16,6 @@ env:
   CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
   DAILY_API_KEY: ${{ secrets.CI_DAILY_API_KEY }}
   DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
-  DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
   E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
   E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
   E2E_TEST_MAILHOG_ENABLED: ${{ vars.E2E_TEST_MAILHOG_ENABLED }}
@@ -50,7 +49,7 @@ env:
 jobs:
   analyze:
     if: always()
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4

.github/workflows/post-release.yml

@@ -6,16 +6,27 @@ on:
     tags:
       - "*"
 
+permissions:
+  contents: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
     steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'cal.com'
+
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: 'main'
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
 
       - name: Configure git
         run: |

.github/workflows/pr.yml

@@ -1,11 +1,13 @@
+# ⚠️ SECURITY: Do not add steps that checkout PR code or run local actions before trust-check job completes.
 name: PR Update
 
 on:
   pull_request_target:
-    types: [opened, synchronize, reopened, labeled]
+    types: [opened, synchronize, reopened]
     branches:
       - main
       - gh-actions-test-branch
+
   workflow_dispatch:
 
 permissions:
@@ -17,49 +19,207 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  changes:
-    name: Detect changes
-    runs-on: buildjet-2vcpu-ubuntu-2204
+  # Security gate: Check if PR is from a trusted contributor or approved via run-ci label
+  # This MUST run before any job that checks out PR code and executes it with secrets
+  trust-check:
+    name: Trust Check
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    permissions:
+      pull-requests: read
+      actions: read
+      issues: read
+    outputs:
+      is-trusted: ${{ steps.check-trust.outputs.is-trusted }}
+    steps:
+      - name: Check if PR is trusted
+        id: check-trust
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const trustedAssociations = ['OWNER', 'MEMBER', 'COLLABORATOR'];
+
+            if (!context.payload.pull_request) {
+              if (context.eventName === 'workflow_dispatch') {
+                console.log('workflow_dispatch event - assuming trusted (manual trigger)');
+                core.setOutput('is-trusted', true);
+                return;
+              }
+              console.log('No pull request context found');
+              core.setOutput('is-trusted', false);
+              return;
+            }
+
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            // Fetch fresh PR data - payload labels may be stale on re-runs
+            const { data: pr } = await github.rest.pulls.get({
+              owner,
+              repo,
+              pull_number: context.payload.pull_request.number,
+            });
+
+            const prNumber = pr.number;
+            const headSha = pr.head.sha;
+
+            async function hasWriteAccess(username) {
+              try {
+                const { data: permission } = await github.rest.repos.getCollaboratorPermissionLevel({
+                  owner,
+                  repo,
+                  username,
+                });
+                return ['admin', 'maintain', 'write'].includes(permission.permission);
+              } catch (e) {
+                console.log(`Permission check failed for ${username}: ${e.message}`);
+                return false;
+              }
+            }
+
+            console.log(`PR #${prNumber} by ${pr.user.login} (${pr.author_association})`);
+
+            // Check 1: Is the author a trusted contributor?
+            if (trustedAssociations.includes(pr.author_association)) {
+              console.log(`Author has trusted association: ${pr.author_association}`);
+              core.setOutput('is-trusted', true);
+              return;
+            }
+
+            // Check 2: Verify write access via API (author_association can be unreliable)
+            if (await hasWriteAccess(pr.user.login)) {
+              console.log(`Author has write access`);
+              core.setOutput('is-trusted', true);
+              return;
+            }
+
+            // Check 3: Was 'run-ci' label added AFTER this SHA was pushed by someone with write access?
+            // This enables re-runs triggered by the run-ci.yml workflow
+            // NOTE: We use workflow run created_at instead of commit timestamp because
+            // git commit timestamps can be arbitrarily backdated by attackers
+            if (pr.labels?.some(l => l.name === 'run-ci')) {
+              const events = await github.paginate(github.rest.issues.listEvents, {
+                owner,
+                repo,
+                issue_number: prNumber,
+                per_page: 100,
+              });
+
+              const labelEvent = events
+                .filter(e => e.event === 'labeled' && e.label?.name === 'run-ci')
+                .sort((a, b) => new Date(b.created_at) - new Date(a.created_at))[0];
+
+              if (labelEvent) {
+                // Get workflow runs to find when this SHA was first pushed
+                const runs = await github.paginate(github.rest.actions.listWorkflowRuns, {
+                  owner,
+                  repo,
+                  workflow_id: 'pr.yml',
+                  head_sha: headSha,
+                  per_page: 100,
+                });
+
+                // Filter runs to this PR (in case same SHA exists in multiple PRs)
+                const matchingRuns = runs.filter(run =>
+                  !run.pull_requests?.length || run.pull_requests.some(p => p.number === prNumber)
+                );
+
+                if (matchingRuns.length > 0) {
+                  const labelTime = new Date(labelEvent.created_at);
+                  // Use the oldest run's created_at as the push time
+                  const originalRun = matchingRuns[matchingRuns.length - 1];
+                  const pushTime = new Date(originalRun.created_at);
+
+                  if (labelTime > pushTime) {
+                    const adder = labelEvent.actor.login;
+                    if (await hasWriteAccess(adder)) {
+                      console.log(`Approved via 'run-ci' label added by ${adder} after push (label: ${labelTime.toISOString()}, push: ${pushTime.toISOString()})`);
+                      core.setOutput('is-trusted', true);
+                      return;
+                    }
+                    console.log(`Label 'run-ci' added by ${adder} (no write access)`);
+                  } else {
+                    console.log(`Label 'run-ci' is stale (label: ${labelTime.toISOString()}, push: ${pushTime.toISOString()})`);
+                  }
+                } else {
+                  console.log('No workflow runs found for this SHA - cannot validate label timing');
+                }
+              }
+            }
+
+            console.log('External contribution requires "run-ci" label from a maintainer');
+            core.setOutput('is-trusted', false);
+
+  prepare:
+    name: Prepare
+    needs: [trust-check]
+    if: needs.trust-check.outputs.is-trusted == 'true'
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     permissions:
       pull-requests: read
     outputs:
       has-files-requiring-all-checks: ${{ steps.filter.outputs.has-files-requiring-all-checks }}
+      has_companion: ${{ steps.filter.outputs.has_companion }}
+      has-api-v2-changes: ${{ steps.filter.outputs.has-api-v2-changes }}
       commit-sha: ${{ steps.get_sha.outputs.commit-sha }}
+      run-e2e: ${{ steps.check-if-pr-has-label.outputs.run-e2e == 'true' }}
+      db-cache-hit: ${{ steps.cache-db-check.outputs.cache-hit }}
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
+      - name: Generate DB cache key
+        id: cache-db-key
+        uses: ./.github/actions/cache-db-key
+      - name: Check DB cache (lookup-only)
+        id: cache-db-check
+        uses: actions/cache/restore@v4
+        with:
+          path: backups/backup.sql
+          key: ${{ steps.cache-db-key.outputs.key }}
+          lookup-only: true
       - uses: dorny/paths-filter@v3
         id: filter
         with:
+          predicate-quantifier: "every"
           filters: |
             has-files-requiring-all-checks:
-              - "!(**.md|.github/CODEOWNERS|docs/**|help/**|apps/web/public/static/locales/**/common.json)"
+              - '**'
+              - '!companion/**'
+              - '!**/*.md'
+              - '!**/*.mdx'
+              - '!.github/CODEOWNERS'
+              - '!docs/**'
+              - '!help/**'
+              - '!apps/web/public/static/locales/**/common.json'
+              - '!i18n.lock'
+            has_companion:
+              - "companion/**"
+            has-api-v2-changes:
+              - "apps/api/v2/**"
+              - "packages/platform-constants/**"
+              - "packages/platform-enums/**"
+              - "packages/platform-utils/**"
+              - "packages/platform-types/**"
+              - "packages/platform-libraries/**"
+              - "packages/trpc/**"
+              - "packages/prisma/schema.prisma"
+              - "docs/api-reference/v2/**"
       - name: Get Latest Commit SHA
         id: get_sha
         run: |
           echo "commit-sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-
-  check-label:
-    needs: [changes]
-    runs-on: buildjet-2vcpu-ubuntu-2204
-    name: Check for E2E label
-    permissions:
-      pull-requests: read
-    outputs:
-      run-e2e: ${{ steps.check-if-pr-has-label.outputs.run-e2e == 'true' && (github.event.action != 'labeled' || github.event.label.name == 'ready-for-e2e') }}
-    steps:
       - name: Check if PR exists with ready-for-e2e label for this SHA
         id: check-if-pr-has-label
         uses: actions/github-script@v7
         with:
           script: |
             let labels = [];
+            let prNumber = null;
 
             if (context.payload.pull_request) {
-              labels = context.payload.pull_request.labels;
+              prNumber = context.payload.pull_request.number;
             } else {
               try {
-                const sha = '${{ needs.changes.outputs.commit-sha }}';
+                const sha = '${{ steps.get_sha.outputs.commit-sha }}';
                 console.log('sha', sha);
                 const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
                   owner: context.repo.owner,
@@ -73,194 +233,247 @@ jobs:
                   return;
                 }
 
-                const pr = prs[0];
-                console.log(`PR number: ${pr.number}`);
-                console.log(`PR title: ${pr.title}`);
-                console.log(`PR state: ${pr.state}`);
-                console.log(`PR URL: ${pr.html_url}`);
-
-                labels = pr.labels;
+                prNumber = prs[0].number;
               }
               catch (e) {
                 core.setOutput('run-e2e', false);
                 console.log(e);
+                return;
               }
             }
 
+            // Always fetch fresh PR data to get current labels
+            // This avoids stale label data from event payloads
+            try {
+              const { data: pr } = await github.rest.pulls.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: prNumber
+              });
+
+              console.log(`PR number: ${pr.number}`);
+              console.log(`PR title: ${pr.title}`);
+              console.log(`PR state: ${pr.state}`);
+              console.log(`PR URL: ${pr.html_url}`);
+
+              labels = pr.labels;
+            }
+            catch (e) {
+              core.setOutput('run-e2e', false);
+              console.log(e);
+              return;
+            }
+
             const labelFound = labels.map(l => l.name).includes('ready-for-e2e');
             console.log('Found the label?', labelFound);
             core.setOutput('run-e2e', labelFound);
-
-  deps:
-    name: Install dependencies
-    needs: [changes, check-label]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
-    uses: ./.github/workflows/yarn-install.yml
+      - uses: ./.github/actions/yarn-install
+        if: ${{ steps.filter.outputs.has-files-requiring-all-checks == 'true' }}
+        with:
+          skip-install-if-cache-hit: "true"
+      - uses: ./.github/actions/yarn-playwright-install
+        if: ${{ steps.filter.outputs.has-files-requiring-all-checks == 'true' }}
+        with:
+          skip-install-if-cache-hit: "true"
 
   type-check:
     name: Type check
-    needs: [changes, check-label, deps]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/check-types.yml
     secrets: inherit
 
   lint:
     name: Linters
-    needs: [changes, check-label, deps]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/lint.yml
     secrets: inherit
 
   unit-test:
     name: Tests
-    needs: [changes, check-label, deps]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/unit-tests.yml
     secrets: inherit
 
+  api-v2-unit-test:
+    name: Tests
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
+    uses: ./.github/workflows/api-v2-unit-tests.yml
+    secrets: inherit
+
+  setup-db:
+    name: Setup Database
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
+    uses: ./.github/workflows/setup-db.yml
+    with:
+      DB_CACHE_HIT: ${{ needs.prepare.outputs.db-cache-hit }}
+    secrets: inherit
+
   build-api-v1:
     name: Production builds
-    needs: [changes, check-label, deps]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/api-v1-production-build.yml
     secrets: inherit
 
   build-api-v2:
     name: Production builds
-    needs: [changes, check-label, deps]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/api-v2-production-build.yml
     secrets: inherit
 
   build-atoms:
     name: Production builds
-    needs: [changes, check-label, deps]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/atoms-production-build.yml
     secrets: inherit
 
   build-docs:
     name: Production builds
-    needs: [changes, check-label, deps]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/docs-build.yml
     secrets: inherit
 
+  build-companion:
+    name: Companion builds
+    needs: [prepare]
+    if: needs.prepare.outputs.has_companion == 'true'
+    uses: ./.github/workflows/companion-build.yml
+    secrets: inherit
+
   build:
     name: Production builds
-    needs: [changes, check-label, deps]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/production-build-without-database.yml
     secrets: inherit
 
   integration-test:
     name: Tests
-    needs: [changes, check-label, build, build-api-v1, build-api-v2]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, build, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/integration-tests.yml
     secrets: inherit
 
   e2e:
     name: Tests
-    needs: [changes, check-label, build, build-api-v1, build-api-v2]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, build, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e.yml
     secrets: inherit
 
+  check-api-v2-breaking-changes:
+    name: Check API v2 breaking changes
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-api-v2-changes == 'true' }}
+    uses: ./.github/workflows/check-api-v2-breaking-changes.yml
+    secrets: inherit
+
   e2e-api-v2:
     name: Tests
-    needs: [changes, check-label, build, build-api-v1, build-api-v2]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e-api-v2.yml
     secrets: inherit
 
   e2e-app-store:
     name: Tests
-    needs: [changes, check-label, build, build-api-v1, build-api-v2]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, build, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e-app-store.yml
     secrets: inherit
 
   e2e-embed:
     name: Tests
-    needs: [changes, check-label, build, build-api-v1, build-api-v2]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, build, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e-embed.yml
     secrets: inherit
 
   e2e-embed-react:
     name: Tests
-    needs: [changes, check-label, build, build-api-v1, build-api-v2]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, build, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e-embed-react.yml
     secrets: inherit
 
-  e2e-atoms:
-    name: Tests
-    needs: [changes, check-label, build, build-atoms, build-api-v2]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
-    uses: ./.github/workflows/e2e-atoms.yml
-    secrets: inherit
-
   analyze:
     name: Analyze Build
     needs: [build]
     uses: ./.github/workflows/nextjs-bundle-analysis.yml
     secrets: inherit
 
-  merge-reports:
-    name: Merge reports
-    if: ${{ !cancelled() && needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
-    needs: [changes, check-label, e2e, e2e-embed, e2e-embed-react, e2e-app-store, e2e-atoms]
-    uses: ./.github/workflows/merge-reports.yml
-    secrets: inherit
-
-  publish-report:
-    name: Publish HTML report
-    if: ${{ !cancelled() && needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
-    permissions:
-      contents: write
-      issues: write
-      pull-requests: write
-    needs: [changes, check-label, merge-reports]
-    uses: ./.github/workflows/publish-report.yml
-    secrets: inherit
-
-  cleanup-report:
-    name: Cleanup HTML report
-    if: ${{ !cancelled() && needs.check-label.outputs.run-e2e == 'true' && (github.event.pull_request.merged == true || github.event.pull_request.state == 'closed') }}
-    permissions:
-      contents: write
-      issues: write
-      pull-requests: write
-    needs: [changes, check-label, publish-report]
-    uses: ./.github/workflows/cleanup-report.yml
-    secrets: inherit
-
   required:
     needs:
       [
-        changes,
+        trust-check,
+        prepare,
         lint,
         type-check,
         unit-test,
+        api-v2-unit-test,
+        check-api-v2-breaking-changes,
         integration-test,
-        check-label,
         build,
         build-api-v1,
         build-api-v2,
         build-atoms,
         build-docs,
+        build-companion,
+        setup-db,
         e2e,
         e2e-api-v2,
         e2e-embed,
         e2e-embed-react,
         e2e-app-store,
-        e2e-atoms,
       ]
     if: always()
-    runs-on: buildjet-2vcpu-ubuntu-2204
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
-      - name: fail if conditional jobs failed
-        if: needs.changes.outputs.has-files-requiring-all-checks == 'true' && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'skipped') || contains(needs.*.result, 'cancelled'))
+      - name: Fail if trust-check did not succeed
+        run: |
+          echo "::error::Trust check did not complete successfully (result: ${{ needs.trust-check.result }}). Please re-run the workflow."
+          exit 1
+        if: needs.trust-check.result != 'success'
+      - name: Fail if PR is not trusted (external contributor without run-ci label)
+        run: |
+          echo "::error::This PR is from an external contributor and requires the 'run-ci' label before CI can run."
+          echo "A maintainer must review the code and add the 'run-ci' label to trigger CI checks."
+          exit 1
+        if: needs.trust-check.outputs.is-trusted != 'true' && needs.trust-check.result == 'success'
+      - name: Fail if conditional jobs failed
         run: exit 1
+        if: |
+          (
+            needs.prepare.outputs.has-files-requiring-all-checks == 'true' &&
+            (
+            needs.lint.result != 'success' ||
+            needs.type-check.result != 'success' ||
+            needs.unit-test.result != 'success' ||
+            needs.api-v2-unit-test.result != 'success' ||
+            (needs.prepare.outputs.has-api-v2-changes == 'true' && needs.check-api-v2-breaking-changes.result != 'success') ||
+              needs.build.result != 'success' ||
+              needs.build-api-v1.result != 'success' ||
+              needs.build-api-v2.result != 'success' ||
+              needs.build-atoms.result != 'success' ||
+              needs.build-docs.result != 'success' ||
+              needs.setup-db.result != 'success' ||
+              needs.integration-test.result != 'success' ||
+              needs.e2e.result != 'success' ||
+              needs.e2e-api-v2.result != 'success' ||
+              needs.e2e-embed.result != 'success' ||
+              needs.e2e-embed-react.result != 'success' ||
+              needs.e2e-app-store.result != 'success'
+            )
+          ) ||
+          (
+            needs.prepare.outputs.has_companion == 'true' &&
+            needs.build-companion.result != 'success'
+          )

.github/workflows/production-build-without-database.yml

@@ -10,7 +10,6 @@ env:
   CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
   DAILY_API_KEY: ${{ secrets.CI_DAILY_API_KEY }}
   DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
-  DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
   E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
   E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
   GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
@@ -36,11 +35,10 @@ env:
   NEXT_PUBLIC_API_V2_ROOT_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_ROOT_URL }}
   NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED: ${{ vars.CI_NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED }}
 
-
 jobs:
   build:
     name: Build Web App
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4

.github/workflows/publish-report.yml

@@ -1,5 +1,26 @@
 on:
   workflow_call:
+    inputs:
+      head_branch:
+        description: 'The head branch name for report path'
+        required: true
+        type: string
+      source_run_id:
+        description: 'The source run ID for report path'
+        required: true
+        type: string
+      source_run_number:
+        description: 'The source run number for artifact naming and comment'
+        required: true
+        type: string
+      source_run_attempt:
+        description: 'The source run attempt for artifact naming and comment'
+        required: true
+        type: string
+      pr_number:
+        description: 'The PR number to post comment on'
+        required: true
+        type: string
 permissions:
   contents: write
   issues: write
@@ -10,15 +31,23 @@ jobs:
     continue-on-error: true
     env:
       # Unique URL path for each workflow run attempt
-      HTML_REPORT_URL_PATH: reports/${{ github.head_ref }}/${{ github.run_id }}/${{ github.run_attempt }}
-      BRANCH_REPORTS_DIR: reports/${{ github.head_ref }}
+      HTML_REPORT_URL_PATH: reports/${{ inputs.head_branch }}/${{ inputs.source_run_id }}/${{ inputs.source_run_attempt }}
+      BRANCH_REPORTS_DIR: reports/${{ inputs.head_branch }}
     steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'test-results-2'
+
       - name: Checkout GitHub Pages Branch
         uses: actions/checkout@v4
         with:
-          repository: calcom/test-results
+          repository: calcom/test-results-2
           ref: gh-pages
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
       - name: Set Git User
         # see: https://github.com/actions/checkout/issues/13#issuecomment-724415212
         run: |
@@ -37,11 +66,11 @@ jobs:
         run: |
           rm -rf $BRANCH_REPORTS_DIR
           git add .
-          git commit -m "workflow: remove all reports for branch ${{ github.head_ref }}"
+          git commit -m "workflow: remove all reports for branch ${{ inputs.head_branch }}"
       - name: Download zipped HTML report
         uses: actions/download-artifact@v4
         with:
-          name: html-report--attempt-${{ github.run_number }}-${{ github.run_attempt }}
+          name: html-report--attempt-${{ inputs.source_run_number }}-${{ inputs.source_run_attempt }}
           path: ${{ env.HTML_REPORT_URL_PATH }}
       - name: Push HTML Report
         timeout-minutes: 3
@@ -49,7 +78,7 @@ jobs:
         # this is necessary when this job running at least twice at the same time (e.g. through two pushes at the same time)
         run: |
           git add .
-          git commit -m "workflow: add HTML report for run-id ${{ github.run_id }} (attempt:  ${{ github.run_attempt }})"
+          git commit -m "workflow: add HTML report for run-id ${{ inputs.source_run_id }} (attempt:  ${{ inputs.source_run_attempt }})"
 
           while true; do
             git pull --rebase
@@ -67,25 +96,25 @@ jobs:
       - name: Output Report URL as Workflow Annotation
         id: url
         run: |
-          FULL_HTML_REPORT_URL=https://calcom.github.io/test-results/$HTML_REPORT_URL_PATH
+          FULL_HTML_REPORT_URL=https://calcom.github.io/test-results-2/$HTML_REPORT_URL_PATH
           echo "::notice title=📋 Published Playwright Test Report::$FULL_HTML_REPORT_URL"
           echo "link=$FULL_HTML_REPORT_URL" >> $GITHUB_OUTPUT
       - name: Find Comment
         uses: peter-evans/find-comment@v2
         id: fc
         with:
-          issue-number: ${{ github.event.pull_request.number }}
+          issue-number: ${{ inputs.pr_number }}
           comment-author: "github-actions[bot]"
           body-includes: <!-- GENERATED-E2E-RESULTS -->
       - name: Create comment
         if: steps.fc.outputs.comment-id == ''
         uses: peter-evans/create-or-update-comment@v3
         with:
-          issue-number: ${{ github.event.pull_request.number }}
+          issue-number: ${{ inputs.pr_number }}
           body: |
             <!-- GENERATED-E2E-RESULTS -->
             ## E2E results are ready!
-            - [Workflow #${{ github.run_number }}.${{ github.run_attempt }} latest results](${{ steps.url.outputs.link }})
+            - [Workflow #${{ inputs.source_run_number }}.${{ inputs.source_run_attempt }} latest results](${{ steps.url.outputs.link }})
       - name: Update comment
         if: steps.fc.outputs.comment-id != ''
         uses: peter-evans/create-or-update-comment@v3
@@ -95,4 +124,4 @@ jobs:
           body: |
             <!-- GENERATED-E2E-RESULTS -->
             ## E2E results are ready!
-            - [Workflow #${{ github.run_number }}.${{ github.run_attempt }} latest results](${{ steps.url.outputs.link }})
+            - [Workflow #${{ inputs.source_run_number }}.${{ inputs.source_run_attempt }} latest results](${{ steps.url.outputs.link }})

.github/workflows/release-docker.yaml

@@ -1,48 +1,134 @@
 name: "Release Docker"
 
-on: # yamllint disable-line rule:truthy
-  release:
-    types:
-      - created
-      - published
+permissions:
+  contents: read
+  packages: write
+
+env:
+  POSTGRES_USER: "unicorn_user"
+  POSTGRES_PASSWORD: "magical_password"
+  POSTGRES_DB: "calendso"
+  DATABASE_HOST: "database:5432"
+
+on:
+  push:
+    tags:
+      - "v*"
   # in case manual trigger is needed
   workflow_dispatch:
     inputs:
       RELEASE_TAG:
-        description: "v{Major}.{Minor}.{Patch}"
+        description: "Tag to build (e.g., v6.0.5)"
+        required: true
+      PUSH_IMAGE:
+        description: "Push the Docker image to DockerHub"
+        type: boolean
+        default: true
 
 jobs:
-  release:
-    name: "Remote Release"
-
-    runs-on: "ubuntu-latest"
-
+  release-amd64:
+    name: "Release AMD64"
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.RELEASE_TAG || github.ref }}
 
       - name: "Determine tag"
-        run: 'echo "RELEASE_TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV'
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "RELEASE_TAG=${{ inputs.RELEASE_TAG }}" >> $GITHUB_ENV
+          else
+            echo "RELEASE_TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+          fi
 
-      - name: "Run remote release workflow"
-        uses: "actions/github-script@v6"
+      - name: Build and test Docker image
+        uses: ./.github/actions/docker-build-and-test
         with:
-          # Requires a personal access token with Actions Read and write permissions on calcom/docker.
-          github-token: "${{ secrets.DOCKER_REPO_ACCESS_TOKEN }}"
-          script: |
-            try {
-              const response = await github.rest.actions.createWorkflowDispatch({
-                owner: context.repo.owner,
-                repo: 'docker',
-                workflow_id: 'create-release.yaml',
-                ref: 'main',
-                inputs: {
-                  "RELEASE_TAG": process.env.RELEASE_TAG
-                },
-              });
+          platform: "linux/amd64"
+          platform-suffix: ""
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          postgres-user: ${{ env.POSTGRES_USER }}
+          postgres-password: ${{ env.POSTGRES_PASSWORD }}
+          postgres-db: ${{ env.POSTGRES_DB }}
+          database-host: ${{ env.DATABASE_HOST }}
+          push-image: ${{ (github.event_name == 'push' || inputs.PUSH_IMAGE) && 'true' || 'false' }}
+          use-as-latest: "true"
 
-              console.log(response);
-            } catch (error) {
-              console.error(error);
-              core.setFailed(error.message);
+      - name: Notify Slack on Success
+        if: success()
+        uses: slackapi/slack-github-action@v1.24.0
+        with:
+          payload: |
+            {
+              "text": ":large_green_circle: Workflow *${{ github.workflow }}* (AMD64) succeeded in job *${{ github.job }}*.\nSee: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
             }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.CI_SLACK_WEBHOOK_URL }}
+
+      - name: Notify Slack on Failure
+        if: failure()
+        uses: slackapi/slack-github-action@v1.24.0
+        with:
+          payload: |
+            {
+              "text": ":red_circle: Workflow *${{ github.workflow }}* (AMD64) failed in job *${{ github.job }}*.\nSee: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.CI_SLACK_WEBHOOK_URL }}
+
+  release-arm:
+    name: "Release ARM"
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.RELEASE_TAG || github.ref }}
+
+      - name: "Determine tag"
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "RELEASE_TAG=${{ inputs.RELEASE_TAG }}" >> $GITHUB_ENV
+          else
+            echo "RELEASE_TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+          fi
+
+      - name: Build and test Docker image
+        uses: ./.github/actions/docker-build-and-test
+        with:
+          platform: "arm64"
+          platform-suffix: "-arm"
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          postgres-user: ${{ env.POSTGRES_USER }}
+          postgres-password: ${{ env.POSTGRES_PASSWORD }}
+          postgres-db: ${{ env.POSTGRES_DB }}
+          database-host: ${{ env.DATABASE_HOST }}
+          push-image: ${{ (github.event_name == 'push' || inputs.PUSH_IMAGE) && 'true' || 'false' }}
+
+      - name: Notify Slack on Success
+        if: success()
+        uses: slackapi/slack-github-action@v1.24.0
+        with:
+          payload: |
+            {
+              "text": ":large_green_circle: Workflow *${{ github.workflow }}* (ARM) succeeded in job *${{ github.job }}*.\nSee: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.CI_SLACK_WEBHOOK_URL }}
+
+      - name: Notify Slack on Failure
+        if: failure()
+        uses: slackapi/slack-github-action@v1.24.0
+        with:
+          payload: |
+            {
+              "text": ":red_circle: Workflow *${{ github.workflow }}* (ARM) failed in job *${{ github.job }}*.\nSee: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.CI_SLACK_WEBHOOK_URL }}

.github/workflows/run-ci.yml

@@ -0,0 +1,74 @@
+name: Run CI
+
+on:
+  pull_request_target:
+    types: [labeled]
+
+permissions:
+  actions: write
+  contents: read
+
+jobs:
+  trigger:
+    name: Trigger CI
+    if: github.event.label.name == 'run-ci' || github.event.label.name == 'ready-for-e2e'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify and trigger CI
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const adder = context.payload.sender.login;
+            const pr = context.payload.pull_request;
+
+            // Verify label adder has write access
+            const { data: perm } = await github.rest.repos.getCollaboratorPermissionLevel({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              username: adder,
+            });
+
+            if (!['admin', 'maintain', 'write'].includes(perm.permission)) {
+              core.setFailed(`${adder} does not have write access`);
+              return;
+            }
+
+            console.log(`Label added by ${adder} (${perm.permission})`);
+
+            // Find the latest pr.yml run for this PR's head SHA
+            const { data: runs } = await github.rest.actions.listWorkflowRuns({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'pr.yml',
+              head_sha: pr.head.sha,
+              per_page: 5,
+            });
+
+            // Filter runs to this PR (in case same SHA exists in multiple PRs)
+            const matchingRuns = runs.workflow_runs.filter(run =>
+              !run.pull_requests?.length || run.pull_requests.some(p => p.number === pr.number)
+            );
+
+            if (matchingRuns.length === 0) {
+              core.setFailed(`No PR workflow found for SHA ${pr.head.sha}`);
+              return;
+            }
+
+            const latestRun = matchingRuns[0];
+
+            // Check if workflow is still running - can't re-run in-progress workflows
+            if (latestRun.status === 'in_progress' || latestRun.status === 'queued') {
+              core.setFailed(`Workflow is still running (status: ${latestRun.status}). Wait for it to complete or cancel it first.`);
+              return;
+            }
+
+            console.log(`Re-running workflow ${latestRun.id} (was: ${latestRun.conclusion})`);
+
+            // Re-run preserves original context (PR, SHA, etc.)
+            await github.rest.actions.reRunWorkflow({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: latestRun.id,
+            });
+
+            console.log(`Triggered: ${latestRun.html_url}`);

.github/workflows/setup-db.yml

@@ -0,0 +1,56 @@
+name: Setup Database
+
+on:
+  workflow_call:
+    inputs:
+      DB_CACHE_HIT:
+        required: false
+        type: string
+        default: "false"
+        description: "Whether the DB cache was hit (skip yarn-install and cache-db if true)"
+
+permissions:
+  contents: read
+
+env:
+  CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
+  DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
+  E2E_TEST_CALCOM_QA_EMAIL: ${{ secrets.E2E_TEST_CALCOM_QA_EMAIL }}
+  E2E_TEST_CALCOM_QA_PASSWORD: ${{ secrets.E2E_TEST_CALCOM_QA_PASSWORD }}
+  E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS: ${{ secrets.E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS }}
+  GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+
+jobs:
+  setup-db:
+    name: Setup Database
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 15
+    services:
+      postgres:
+        image: postgres:13
+        credentials:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: calendso
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/dangerous-git-checkout
+      - uses: ./.github/actions/yarn-install
+        if: inputs.DB_CACHE_HIT != 'true'
+      - run: yarn prisma generate
+        if: inputs.DB_CACHE_HIT != 'true'
+      - uses: ./.github/actions/cache-db
+        if: inputs.DB_CACHE_HIT != 'true'

.github/workflows/unit-tests.yml

@@ -9,16 +9,12 @@ jobs:
   test:
     name: Unit
     timeout-minutes: 20
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
+      - run: yarn prisma generate
       - run: yarn test -- --no-isolate
       # We could add different timezones here that we need to run our tests in
-      - run: TZ=America/Los_Angeles yarn test -- --timeZoneDependentTestsOnly --no-isolate
-      - name: Run API v2 tests
-        working-directory: apps/api/v2
-        run: |
-          export NODE_OPTIONS="--max_old_space_size=8192"
-          yarn test
+      - run: TZ=America/Los_Angeles VITEST_MODE=timezone yarn test -- --no-isolate

.github/workflows/yarn-install.yml

@@ -1,18 +0,0 @@
-name: Yarn install
-
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  setup:
-    name: Yarn install & cache
-    runs-on: buildjet-4vcpu-ubuntu-2204
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/dangerous-git-checkout
-      - uses: ./.github/actions/yarn-install
-      - uses: ./.github/actions/yarn-playwright-install

.gitignore

@@ -66,7 +66,11 @@ tsconfig.tsbuildinfo
 .turbo
 
 # Prisma generated files
-packages/prisma/zod/*.ts
+packages/prisma/client/*
+!packages/prisma/client/index.ts
+apps/api/v2/generated/prisma/*
+packages/prisma/generated/prisma/*
+packages/prisma/zod/**/*.ts
 packages/prisma/enums
 
 # Builds
@@ -101,3 +105,6 @@ packages/**/.yarn/ci-cache/
 
 # AI
 .claude
+
+# trigger.dev
+.trigger

.husky/pre-commit

@@ -1,6 +1,7 @@
-#!/bin/sh
-. "$(dirname "$0")/_/husky.sh"
+if [ -f .git/MERGE_HEAD ]; then
+  echo "Merge detected. Skipping lint-staged and generators."
+  exit 0
+fi
 
 yarn lint-staged
-
 yarn app-store:build && git add packages/app-store/*.generated.*

.nvmrc

@@ -1 +0,0 @@
-20

.prettierignore

@@ -1,20 +0,0 @@
-node_modules
-.next
-public
-**/**/node_modules
-**/**/.next
-**/**/public
-
-*.lock
-*.log
-
-.gitignore
-.npmignore
-.prettierignore
-.DS_Store
-.eslintignore
-packages/prisma/zod
-packages/prisma/enums
-apps/web/public/embed
-apps/api/v2/swagger/documentation.json
-packages/ui/components/icon/dynamicIconImports.tsx

.prettierrc.js

@@ -1 +0,0 @@
-module.exports = require("./packages/config/prettier-preset");

.vscode/extensions.json

@@ -1,14 +1,12 @@
 {
   "recommendations": [
-    "DavidAnson.vscode-markdownlint", // markdown linting
-    "yzhang.markdown-all-in-one", // nicer markdown support
-    "esbenp.prettier-vscode", // prettier plugin
-    "dbaeumer.vscode-eslint", // eslint plugin
-    "bradlc.vscode-tailwindcss", // hinting / autocompletion for tailwind
-    "ban.spellright", // Spell check for docs
-    "stripe.vscode-stripe", // stripe VSCode extension
-    "Prisma.prisma", // syntax|format|completion for prisma
-    "rebornix.project-snippets", // Share useful snippets between collaborators
-    "inlang.vs-code-extension" // improved i18n DX
+    "biomejs.biome",
+    "DavidAnson.vscode-markdownlint",
+    "yzhang.markdown-all-in-one",
+    "ban.spellright",
+    "stripe.vscode-stripe",
+    "Prisma.prisma",
+    "rebornix.project-snippets",
+    "inlang.vs-code-extension"
   ]
 }

.vscode/settings.json

@@ -1,11 +1,12 @@
 {
   "typescript.tsdk": "node_modules/typescript/lib",
-  "editor.formatOnSave": false,
+  "editor.formatOnSave": true,
+  "editor.defaultFormatter": "esbenp.prettier-vscode",
   "editor.codeActionsOnSave": {
     "source.fixAll.eslint": "explicit"
   },
   "typescript.preferences.importModuleSpecifier": "non-relative",
   "spellright.language": ["en"],
   "spellright.documentTypes": ["markdown", "typescript", "typescriptreact"],
-  "tailwindCSS.experimental.classRegex": [["cva\\(([^)]*)\\)", "[\"'`]([^\"'`]*).*?[\"'`]"]]
+  "tailwindCSS.classFunctions": ["cva"]
 }

.yarn/patches/next-i18next-npm-13.3.0-bf25b0943c.patch

@@ -2,8 +2,8 @@ diff --git a/dist/commonjs/serverSideTranslations.js b/dist/commonjs/serverSideT
 index bcad3d02fbdfab8dacb1d85efd79e98623a0c257..fff668f598154a13c4030d1b4a90d5d9c18214ad 100644
 --- a/dist/commonjs/serverSideTranslations.js
 +++ b/dist/commonjs/serverSideTranslations.js
-@@ -36,7 +36,6 @@ var _fs = _interopRequireDefault(require("fs"));
- var _path = _interopRequireDefault(require("path"));
+@@ -36,7 +36,6 @@ var _fs = _interopRequireDefault(require("node:fs"));
+ var _path = _interopRequireDefault(require("node:path"));
  var _createConfig = require("./config/createConfig");
  var _node = _interopRequireDefault(require("./createClient/node"));
 -var _appWithTranslation = require("./appWithTranslation");

.yarn/versions/41683203.yml

@@ -0,0 +1,2 @@
+undecided:
+  - calcom-monorepo

.yarn/versions/60ad8d80.yml

@@ -0,0 +1,2 @@
+undecided:
+  - calcom-monorepo

.yarn/versions/99843d84.yml

@@ -0,0 +1,2 @@
+undecided:
+  - calcom-monorepo