chore: release v6.0.9

Co-authored-by: Lingo.dev <support@lingo.dev>

.changeset/rude-candies-scream.md

@@ -1,5 +0,0 @@
----
-"@calcom/atoms": minor
----
-
-feat: Booker accepts rrHostSubsetIds to specify round robin hosts

.easignore

@@ -0,0 +1,57 @@
+# EAS Build ignore file for monorepo
+# Only upload the companion app folder
+
+# ===========================================
+# IGNORE EVERYTHING AT ROOT LEVEL
+# ===========================================
+/*
+
+# ===========================================
+# EXCEPT THE COMPANION APP
+# ===========================================
+!companion
+
+# ===========================================
+# BUT IGNORE THESE INSIDE COMPANION
+# ===========================================
+
+# Native folders - EAS generates these during builds (~2.1 GB)
+companion/ios
+companion/android
+
+# Dependencies - EAS installs these during builds (~1.6 GB)
+companion/node_modules
+
+# Expo build cache
+companion/.expo
+companion/dist
+companion/web-build
+
+# Metro
+companion/.metro-health-check*
+
+# WXT Chrome Extension outputs (not needed for mobile builds)
+companion/.output
+companion/.wxt
+companion/dev
+
+# Kotlin cache
+companion/.kotlin
+
+# Build artifacts
+companion/*.jks
+companion/*.p8
+companion/*.p12
+companion/*.key
+companion/*.mobileprovision
+
+# Debug logs
+companion/*.log
+
+# TypeScript build info
+companion/*.tsbuildinfo
+
+# Environment files
+companion/.env
+companion/.env.*
+!companion/.env.example

.env.example

@@ -261,6 +261,9 @@ EMAIL_SERVER_PORT=1025
 ## @see https://support.google.com/accounts/answer/185833
 # EMAIL_SERVER_PASSWORD='<gmail_app_password>'
 
+# queue or cancel payment reminder email/flow
+AWAITING_PAYMENT_EMAIL_DELAY_MINUTES=
+
 # Used for E2E for email testing
 # Set it to "1" if you need to email checks in E2E tests locally
 # Make sure to run mailhog container manually or with `yarn dx`
@@ -431,14 +434,7 @@ BLACKLISTED_GUEST_EMAILS=
 NEXT_PUBLIC_VAPID_PUBLIC_KEY=
 VAPID_PRIVATE_KEY=
 
-# Mintlify chat api
-# Power AI chat in for docs
-MINTLIFY_CHAT_API_KEY=
-NEXT_PUBLIC_ENABLE_MINTLIFY_CHAT=
-NEXT_PUBLIC_CHAT_API_URL=
-NEXT_PUBLIC_DOCS_URL=
-
-# Custom privacy policy / terms URLs (for self-hosters: change to your privacy policy / terms URLs)
+# Custom privacy policy/ terms URLs (for self-hosters: change to your privacy policy / terms URLs)
 NEXT_PUBLIC_WEBSITE_PRIVACY_POLICY_URL=
 NEXT_PUBLIC_WEBSITE_TERMS_URL=
 
@@ -509,4 +505,7 @@ SEED_PLATFORM_OAUTH_CLIENT_SECRET=
 ENABLE_ASYNC_TASKER="false" # set to "true" to enable
 TRIGGER_SECRET_KEY=
 TRIGGER_API_URL=https://api.trigger.dev
-TRIGGER_DEV_PROJECT_REF=
+TRIGGER_DEV_PROJECT_REF=
+
+GOOGLE_ADS_ENABLED=1      # To enable Google Ads tracking (gclid)
+LINKEDIN_ADS_ENABLED=1    # To enable LinkedIn Ads tracking (li_fat_id)

.github/CODEOWNERS

@@ -1,5 +1,7 @@
+.github/actions/**/* @calcom/Foundation
+.github/workflows/**/* @calcom/Foundation
 /**/package.json @calcom/Foundation
-/apps/api/**/* @calcom/API
+/apps/api/**/* @calcom/Foundation
 /apps/web/**/layout.tsx @calcom/Consumer @calcom/Foundation
 /apps/web/lib/csp.ts @calcom/Foundation
 /apps/web/lib/buildNonce.ts @calcom/Foundation
@@ -7,7 +9,7 @@
 /apps/web/lib/core/**/* @calcom/Foundation
 /apps/web/lib/booking.ts @calcom/Foundation
 /apps/web/lib/handleOrgRedirect.ts @calcom/Foundation
-/apps/web/middleware.ts @calcom/Foundation
+/apps/web/proxy.ts @calcom/Foundation
 /deploy/**/* @calcom/Foundation
 /packages/app-store/applecalendar/**/* @calcom/Foundation
 /packages/app-store/caldavcalendar/**/* @calcom/Foundation
@@ -28,7 +30,7 @@
 /packages/features/bookings/lib/getLuckyUser.ts @calcom/Foundation
 /packages/features/schedules/lib/slots.ts @calcom/Foundation
 /packages/platform/atoms/**/*WebWrapper.tsx @calcom/Consumer
-/packages/platform/**/* @calcom/Platform @calcom/Foundation
+/packages/platform/**/* @calcom/Consumer @calcom/Foundation
 /packages/prisma/**/* @calcom/Foundation
 /packages/trpc/server/routers/viewer/bookings/confirm.handler.ts @calcom/Foundation
 /packages/trpc/server/routers/viewer/bookings/get.handler.ts @calcom/Foundation

.github/actions/cache-build-key/action.yml

@@ -0,0 +1,23 @@
+name: Generate cache-build key
+description: "Generate the cache key for production build caching"
+inputs:
+  branch_key:
+    required: true
+    description: "Branch key for cache scoping (e.g., github.head_ref for PRs)"
+outputs:
+  key:
+    description: "The generated cache key"
+    value: ${{ steps.generate-key.outputs.key }}
+runs:
+  using: "composite"
+  steps:
+    - name: Generate cache key
+      id: generate-key
+      shell: bash
+      env:
+        CACHE_NAME: prod-build
+        BRANCH_KEY: ${{ inputs.branch_key }}
+        LOCKFILE_HASH: ${{ hashFiles('yarn.lock') }}
+        SOURCE_HASH: ${{ hashFiles('apps/**/**.[jt]s', 'apps/**/**.[jt]sx', 'apps/**/*.json', 'apps/**/*.css', 'packages/**/**.[jt]s', 'packages/**/**.[jt]sx', 'packages/prisma/schema.prisma', 'packages/prisma/migrations/**/*.sql', '!**/node_modules/**', '!packages/prisma/generated/**', '!packages/prisma/client/**', '!packages/prisma/zod/**', '!packages/kysely/**') }}
+      run: |
+        echo "key=${CACHE_NAME}-${BRANCH_KEY}-${LOCKFILE_HASH}-${SOURCE_HASH}" >> $GITHUB_OUTPUT

.github/actions/cache-build/action.yml

@@ -1,33 +1,23 @@
 name: Cache production build binaries
 description: "Cache or restore if necessary"
-inputs:
-  node_version:
-    required: false
-    default: v18.x
 runs:
   using: "composite"
   steps:
+    - name: Generate cache key
+      id: cache-key
+      uses: ./.github/actions/cache-build-key
+      with:
+        branch_key: ${{ github.head_ref || github.ref_name }}
     - name: Cache production build
-      uses: buildjet/cache@v4
+      uses: actions/cache@v4
       id: cache-build
-      env:
-        # WARN: Don't touch this cache key. Currently github.sha refers to the latest commit in main
-        # and not the branch that's attempting to merge to main, which causes CI errors when merged
-        # to main.
-        # TODO: Fix this problem if intending to modify this cache key.
-        cache-name: prod-build
-        key-1: ${{ inputs.node_version }}-${{ hashFiles('yarn.lock') }}
-        key-2: ${{ hashFiles('apps/**/**.[jt]s', 'apps/**/**.[jt]sx', 'packages/**/**.[jt]s', 'packages/**/**.[jt]sx', '!**/node_modules') }}
-        key-3: ${{ github.event.pull_request.number || github.ref }}
-        key-4: ${{ github.sha }}
-        key-5: ${{ github.event.pull_request.head.sha }}
       with:
         path: |
           ${{ github.workspace }}/apps/web/.next
           ${{ github.workspace }}/apps/web/public/embed
           **/.turbo/**
           **/dist/**
-        key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}-${{ env.key-5 }}
+        key: ${{ steps.cache-key.outputs.key }}
     - run: |
         export NODE_OPTIONS="--max_old_space_size=8192"
         yarn build

.github/actions/cache-db-key/action.yml

@@ -0,0 +1,23 @@
+name: Generate cache-db key
+description: "Generate the cache key for database caching"
+inputs:
+  path:
+    required: false
+    default: "backups/backup.sql"
+    description: "Path to the backup file"
+outputs:
+  key:
+    description: "The generated cache key"
+    value: ${{ steps.generate-key.outputs.key }}
+runs:
+  using: "composite"
+  steps:
+    - name: Generate cache key
+      id: generate-key
+      shell: bash
+      env:
+        CACHE_NAME: cache-db
+        PATH_KEY: ${{ inputs.path }}
+        PRISMA_HASH: ${{ hashFiles('packages/prisma/schema.prisma', 'packages/prisma/migrations/**/**.sql', 'packages/prisma/*.ts') }}
+      run: |
+        echo "key=${CACHE_NAME}-${PATH_KEY}-${PRISMA_HASH}" >> $GITHUB_OUTPUT

.github/actions/cache-db/action.yml

@@ -10,14 +10,15 @@ inputs:
 runs:
   using: "composite"
   steps:
+    - name: Generate cache key
+      id: cache-key
+      uses: ./.github/actions/cache-db-key
+      with:
+        path: ${{ inputs.path }}
     - name: Cache database
       id: cache-db
-      uses: buildjet/cache@v4
+      uses: actions/cache@v4
       env:
-        cache-name: cache-db
-        key-1: ${{ hashFiles('packages/prisma/schema.prisma', 'packages/prisma/migrations/**/**.sql', 'packages/prisma/*.ts') }}
-        key-2: ${{ github.event.pull_request.number || github.ref }}
-        key-3: ${{ github.event.pull_request.head.sha }}
         DATABASE_URL: ${{ inputs.DATABASE_URL }}
         DATABASE_DIRECT_URL: ${{ inputs.DATABASE_URL }}
         E2E_TEST_CALCOM_QA_EMAIL: ${{ inputs.E2E_TEST_CALCOM_QA_EMAIL }}
@@ -25,7 +26,7 @@ runs:
         E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS: ${{ inputs.E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS }}
       with:
         path: ${{ inputs.path }}
-        key: ${{ runner.os }}-${{ env.cache-name }}-${{ inputs.path }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}
+        key: ${{ steps.cache-key.outputs.key }}
     - run: yarn db-seed
       if: steps.cache-db.outputs.cache-hit != 'true'
       shell: bash

.github/actions/docker-build-and-test/action.yml

@@ -34,6 +34,10 @@ inputs:
     description: "Whether to push the built image"
     required: false
     default: "false"
+  use-as-latest:
+    description: "Publish as latest"
+    required: false
+    default: "false"
 
 runs:
   using: "composite"
@@ -61,7 +65,7 @@ runs:
           docker.io/calcom/cal.com
           ghcr.io/calcom/cal.com
         flavor: |
-          latest=${{ !github.event.release.prerelease }}
+          latest=${{ !github.event.release.prerelease && inputs.use-as-latest == 'true' }}
           suffix=${{ inputs.platform-suffix }}
 
     - name: Copy env
@@ -87,7 +91,7 @@ runs:
         docker compose logs database
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: useblacksmith/setup-docker-builder@v1
       with:
         driver-opts: |
           network=container:database
@@ -96,7 +100,7 @@ runs:
 
     - name: Build image
       id: docker_build
-      uses: docker/build-push-action@v6
+      uses: useblacksmith/build-push-action@v2
       with:
         context: ./
         file: ./Dockerfile
@@ -155,7 +159,7 @@ runs:
 
     - name: Push image
       id: docker_push
-      uses: docker/build-push-action@v6
+      uses: useblacksmith/build-push-action@v2
       if: ${{ inputs.push-image == 'true' && !github.event.release.prerelease }}
       with:
         context: ./

.github/actions/yarn-install/action.yml

@@ -15,12 +15,16 @@ inputs:
   node_version:
     required: false
     default: v20.x
+  skip-install-if-cache-hit:
+    description: "Skip yarn install if node_modules cache is hit. Use this for jobs that only need to check that cache exists."
+    required: false
+    default: "false"
 
 runs:
   using: "composite"
   steps:
     - name: Use Node ${{ inputs.node_version }}
-      uses: buildjet/setup-node@v4
+      uses: actions/setup-node@v4
       with:
         node-version: ${{ inputs.node_version }}
     - name: Expose yarn config as "$GITHUB_OUTPUT"
@@ -29,10 +33,57 @@ runs:
       run: |
         echo "CACHE_FOLDER=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
 
+    # When skip-install-if-cache-hit is true, first check if all caches exist without downloading (lookup-only mode)
+    # This avoids downloading ~1.2GB of cache data when we just want to verify caches exist
+    - name: Check yarn cache (lookup-only)
+      if: ${{ inputs.skip-install-if-cache-hit == 'true' }}
+      uses: actions/cache/restore@v4
+      id: yarn-download-cache-check
+      with:
+        path: ${{ steps.yarn-config.outputs.CACHE_FOLDER }}
+        key: yarn-download-cache-${{ hashFiles('yarn.lock') }}
+        lookup-only: true
+
+    - name: Check node_modules cache (lookup-only)
+      if: ${{ inputs.skip-install-if-cache-hit == 'true' }}
+      uses: actions/cache/restore@v4
+      id: yarn-nm-cache-check
+      with:
+        path: |
+          **/node_modules/
+          !**/.next/node_modules/
+        key: ${{ runner.os }}-yarn-nm-cache-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
+        lookup-only: true
+
+    - name: Check yarn install state cache (lookup-only)
+      if: ${{ inputs.skip-install-if-cache-hit == 'true' }}
+      uses: actions/cache/restore@v4
+      id: yarn-install-state-cache-check
+      with:
+        path: .yarn/ci-cache/
+        key: ${{ runner.os }}-yarn-install-state-cache-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
+        lookup-only: true
+
+    # Compute whether all caches hit (only in skip mode)
+    - name: Check if all caches hit
+      if: ${{ inputs.skip-install-if-cache-hit == 'true' }}
+      id: all-caches-check
+      shell: bash
+      run: |
+        if [[ "${{ steps.yarn-download-cache-check.outputs.cache-hit }}" == "true" && \
+              "${{ steps.yarn-nm-cache-check.outputs.cache-hit }}" == "true" && \
+              "${{ steps.yarn-install-state-cache-check.outputs.cache-hit }}" == "true" ]]; then
+          echo "all-hit=true" >> $GITHUB_OUTPUT
+        else
+          echo "all-hit=false" >> $GITHUB_OUTPUT
+        fi
+
     # Yarn rotates the downloaded cache archives, @see https://github.com/actions/setup-node/issues/325
     # Yarn cache is also reusable between arch and os.
+    # Only restore if not in skip mode, or if skip mode but any cache check missed
     - name: Restore yarn cache
-      uses: buildjet/cache@v4
+      if: ${{ inputs.skip-install-if-cache-hit != 'true' || steps.all-caches-check.outputs.all-hit != 'true' }}
+      uses: actions/cache@v4
       id: yarn-download-cache
       with:
         path: ${{ steps.yarn-config.outputs.CACHE_FOLDER }}
@@ -40,25 +91,28 @@ runs:
 
     # Invalidated on yarn.lock changes
     - name: Restore node_modules
+      if: ${{ inputs.skip-install-if-cache-hit != 'true' || steps.all-caches-check.outputs.all-hit != 'true' }}
       id: yarn-nm-cache
-      uses: buildjet/cache@v4
+      uses: actions/cache@v4
       with:
-        path: "**/node_modules/"
+        path: |
+          **/node_modules/
+          !**/.next/node_modules/
         key: ${{ runner.os }}-yarn-nm-cache-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
 
     # Invalidated on yarn.lock changes
     - name: Restore yarn install state
+      if: ${{ inputs.skip-install-if-cache-hit != 'true' || steps.all-caches-check.outputs.all-hit != 'true' }}
       id: yarn-install-state-cache
-      uses: buildjet/cache@v4
+      uses: actions/cache@v4
       with:
         path: .yarn/ci-cache/
         key: ${{ runner.os }}-yarn-install-state-cache-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
 
     - name: Install dependencies
+      if: ${{ inputs.skip-install-if-cache-hit != 'true' || steps.all-caches-check.outputs.all-hit != 'true' }}
       shell: bash
-      run: |
-        yarn install --inline-builds
-        yarn prisma generate
+      run: yarn install --inline-builds
       env:
         # CI optimizations. Overrides yarnrc.yml options (or their defaults) in the CI action.
         YARN_ENABLE_IMMUTABLE_INSTALLS: "false" # So it doesn't try to remove our private submodule deps

.github/actions/yarn-playwright-install/action.yml

@@ -1,5 +1,10 @@
 name: Install playwright binaries
 description: "Install playwright, cache and restore if necessary"
+inputs:
+  skip-install-if-cache-hit:
+    description: "Skip playwright install if cache is hit. Use this for jobs that only need to check that cache exists."
+    required: false
+    default: "false"
 runs:
   using: "composite"
   steps:
@@ -7,15 +12,35 @@ runs:
       shell: bash
       id: playwright-version
       run: echo "PLAYWRIGHT_VERSION=$(node -e "console.log(require('./package.json').devDependencies['@playwright/test'])")" >> $GITHUB_ENV
-    - name: Cache playwright binaries
-      id: playwright-cache
-      uses: buildjet/cache@v4
+
+    # When skip-install-if-cache-hit is true, first check if cache exists without downloading (lookup-only mode)
+    - name: Check playwright cache (lookup-only)
+      if: ${{ inputs.skip-install-if-cache-hit == 'true' }}
+      id: playwright-cache-check
+      uses: actions/cache/restore@v4
       with:
         path: |
           ~/Library/Caches/ms-playwright
           ~/.cache/ms-playwright
           ${{ github.workspace }}/node_modules/playwright
         key: ${{ runner.os }}-playwright-${{ env.PLAYWRIGHT_VERSION }}
+        lookup-only: true
+
+    # Only restore cache if not in skip mode, or if skip mode but cache check missed
+    - name: Cache playwright binaries
+      if: ${{ inputs.skip-install-if-cache-hit != 'true' || steps.playwright-cache-check.outputs.cache-hit != 'true' }}
+      id: playwright-cache
+      uses: actions/cache@v4
+      with:
+        path: |
+          ~/Library/Caches/ms-playwright
+          ~/.cache/ms-playwright
+          ${{ github.workspace }}/node_modules/playwright
+        key: ${{ runner.os }}-playwright-${{ env.PLAYWRIGHT_VERSION }}
+
+    # In default mode: run if playwright-cache missed
+    # In skip mode: run if playwright-cache-check missed (but cache restore step was also skipped)
     - name: Yarn playwright install
+      if: ${{ (inputs.skip-install-if-cache-hit != 'true' && steps.playwright-cache.outputs.cache-hit != 'true') || (inputs.skip-install-if-cache-hit == 'true' && steps.playwright-cache-check.outputs.cache-hit != 'true') }}
       shell: bash
       run: yarn playwright install --with-deps

.github/workflows/all-checks.yml

@@ -24,6 +24,11 @@ jobs:
     uses: ./.github/workflows/unit-tests.yml
     secrets: inherit
 
+  api-v2-unit-test:
+    name: Tests
+    uses: ./.github/workflows/api-v2-unit-tests.yml
+    secrets: inherit
+
   build-api-v1:
     name: Production builds
     uses: ./.github/workflows/api-v1-production-build.yml
@@ -75,9 +80,9 @@ jobs:
     secrets: inherit
 
   required:
-    needs: [lint, type-check, unit-test, integration-test, build, build-api-v1, build-api-v2, e2e, e2e-embed, e2e-embed-react, e2e-app-store]
+    needs: [lint, type-check, unit-test, api-v2-unit-test, integration-test, build, build-api-v1, build-api-v2, e2e, e2e-embed, e2e-embed-react, e2e-app-store]
     if: always()
-    runs-on: buildjet-2vcpu-ubuntu-2204
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - name: fail if conditional jobs failed
         if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'skipped') || contains(needs.*.result, 'cancelled')

.github/workflows/api-v1-production-build.yml

@@ -43,7 +43,7 @@ env:
 jobs:
   build:
     name: Build API v1
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     services:
       postgres:
@@ -56,10 +56,11 @@ jobs:
           POSTGRES_PASSWORD: postgres
           POSTGRES_DB: calendso
         options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
+          --health-cmd "pg_isready -h 127.0.0.1 -U postgres"
+          --health-interval 2s
+          --health-timeout 3s
+          --health-retries 15
+          --health-start-period 2s
         ports:
           - 5432:5432
     steps:
@@ -68,21 +69,18 @@ jobs:
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/cache-db
       - name: Cache API v1 production build
-        uses: buildjet/cache@v4
+        uses: actions/cache@v4
         id: cache-api-v1-build
         env:
           cache-name: api-v1-build
           key-1: ${{ hashFiles('yarn.lock') }}
           key-2: ${{ hashFiles('apps/api/v1/**.[jt]s', 'apps/api/v1/**.[jt]sx', '!**/node_modules') }}
-          key-3: ${{ github.event.pull_request.number || github.ref }}
-          # Ensures production-build.yml will always be fresh
-          key-4: ${{ github.sha }}
         with:
           path: |
             ${{ github.workspace }}/apps/api/v1/.next
             **/.turbo/**
             **/dist/**
-          key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}
+          key: ${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}
       - name: Log Cache Hit
         if: steps.cache-api-v1-build.outputs.cache-hit == 'true'
         run: echo "Cache hit for API v1 build. Skipping build."

.github/workflows/api-v2-production-build.yml

@@ -6,13 +6,15 @@ on:
 env:
   DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
   DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
 
 jobs:
   build:
     name: Build API v2
     permissions:
       contents: read
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     services:
       postgres:
@@ -35,29 +37,11 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
-      - name: Cache API v2 production build
-        uses: buildjet/cache@v4
-        id: cache-api-v2-build
-        env:
-          cache-name: api-v2-build
-          key-1: ${{ hashFiles('yarn.lock') }}
-          key-2: ${{ hashFiles('apps/api/v2/**.[jt]s', 'apps/api/v2/**.[jt]sx', '!**/node_modules') }}
-          key-3: ${{ github.event.pull_request.number || github.ref }}
-          # Ensures production-build.yml will always be fresh
-          key-4: ${{ github.sha }}
-        with:
-          path: |
-            **/dist/**
-          key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}
-      - name: Log Cache Hit
-        if: steps.cache-api-v2-build.outputs.cache-hit == 'true'
-        run: echo "Cache hit for API v2 build. Skipping build."
-      - name: Run build
-        if: steps.cache-api-v2-build.outputs.cache-hit != 'true'
+      - name: Generate Prisma schemas
+        working-directory: apps/api/v2
+        run: yarn workspace @calcom/api-v2 run generate-schemas
+      - name: Build API v2 with Turbo
         run: |
           export NODE_OPTIONS="--max_old_space_size=8192"
-          yarn workspace @calcom/api-v2 run generate-schemas &&
-          rm -rf apps/api/v2/node_modules &&
-          yarn install &&
-          yarn workspace @calcom/api-v2 run build
+          yarn turbo run build --filter=@calcom/api-v2
         shell: bash

.github/workflows/api-v2-unit-tests.yml

@@ -0,0 +1,22 @@
+name: API v2 Unit
+on:
+  workflow_call:
+env:
+  LINGO_DOT_DEV_API_KEY: ${{ secrets.CI_LINGO_DOT_DEV_API_KEY }}
+permissions:
+  contents: read
+jobs:
+  test:
+    name: API v2 Unit
+    timeout-minutes: 20
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/dangerous-git-checkout
+      - uses: ./.github/actions/yarn-install
+      - run: yarn prisma generate
+      - name: Run API v2 unit tests
+        working-directory: apps/api/v2
+        run: |
+          export NODE_OPTIONS="--max_old_space_size=8192"
+          yarn workspace @calcom/platform-libraries build && yarn test

.github/workflows/atoms-production-build.yml

@@ -8,34 +8,28 @@ jobs:
     name: Build Atoms
     permissions:
       contents: read
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - name: Cache atoms production build
-        uses: buildjet/cache@v4
+        uses: actions/cache@v4
         id: cache-atoms-build
         env:
           cache-name: atoms-build
           key-1: ${{ hashFiles('yarn.lock') }}
-          key-2: ${{ hashFiles('packages/platform/atoms/**.[jt]s', 'packages/platform/atoms/**.[jt]sx', '!**/node_modules') }}
-          key-3: ${{ github.event.pull_request.number || github.ref }}
-          # Ensures production-build.yml will always be fresh
-          key-4: ${{ github.sha }}
+          key-2: ${{ hashFiles('packages/platform/atoms/**.[jt]s', 'packages/platform/atoms/**.[jt]sx', 'packages/platform/atoms/package.json', '!**/node_modules') }}
         with:
           path: |
             **/dist/**
-          key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}
-      - name: Log Cache Hit
-        if: steps.cache-atoms-build.outputs.cache-hit == 'true'
-        run: echo "Cache hit for Atoms build. Skipping build."
+          key: ${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}
       - name: Run build
         if: steps.cache-atoms-build.outputs.cache-hit != 'true'
         run: |
           export NODE_OPTIONS="--max_old_space_size=8192"
           rm -rf packages/platform/atoms/node_modules
           yarn install
-          yarn workspace @calcom/atoms run build
+          yarn workspace @calcom/atoms run build-npm
         shell: bash

.github/workflows/cache-clean.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   cleanup:
-    runs-on: buildjet-2vcpu-ubuntu-2204
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - name: Check out code
         uses: actions/checkout@v4

.github/workflows/check-api-v2-breaking-changes.yml

@@ -0,0 +1,55 @@
+name: Check API v2 breaking changes
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+env:
+  API_KEY_PREFIX: ${{ secrets.CI_API_KEY_PREFIX }}
+  API_PORT: ${{ vars.CI_API_V2_PORT }}
+  API_URL: "http://localhost"
+  CALCOM_LICENSE_KEY: ${{ secrets.CI_CALCOM_LICENSE_KEY }}
+  DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_READ_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_WRITE_URL: ${{ secrets.CI_DATABASE_URL }}
+  JWT_SECRET: ${{ secrets.CI_JWT_SECRET }}
+  NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
+  NODE_ENV: ${{ vars.CI_NODE_ENV }}
+  NODE_OPTIONS: --max-old-space-size=4096
+  REDIS_URL: "redis://localhost:6379"
+  STRIPE_API_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
+  STRIPE_WEBHOOK_SECRET: ${{ secrets.CI_STRIPE_WEBHOOK_SECRET }}
+  WEB_APP_URL: "https://app.cal.com"
+
+jobs:
+  check-api-v2-breaking-changes:
+    name: Check API v2 breaking changes
+    timeout-minutes: 10
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/dangerous-git-checkout
+      - uses: ./.github/actions/yarn-install
+
+      - name: Generate Swagger
+        working-directory: apps/api/v2
+        run: |
+          yarn prisma generate
+          yarn generate-swagger
+
+      - name: Check API v2 breaking changes
+        run: |
+          docker run --rm \
+            -v "$PWD:/work" -w /work \
+            tufin/oasdiff:latest \
+            breaking \
+            https://raw.githubusercontent.com/calcom/cal.com/refs/heads/main/docs/api-reference/v2/openapi.json \
+            docs/api-reference/v2/openapi.json \
+            --fail-on ERR \
+            --err-ignore .github/oasdiff-err-ignore.txt

.github/workflows/check-types.yml

@@ -3,11 +3,13 @@ on:
   workflow_call:
 env:
   NODE_OPTIONS: --max-old-space-size=4096
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
 permissions:
   contents: read
 jobs:
   check-types:
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout

.github/workflows/cleanup-report.yml

@@ -11,12 +11,20 @@ jobs:
   cleanup-report:
     runs-on: ubuntu-latest
     steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'test-results-2'
+
       - name: Checkout GitHub Pages Branch
         uses: actions/checkout@v4
         with:
           repository: calcom/test-results-2
           ref: gh-pages
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
 
       - name: Set Git User
         run: |
@@ -26,12 +34,13 @@ jobs:
       - name: Cleanup HTML reports on PR close/merge
         env:
           BRANCH_REPORTS_DIR: reports/${{ github.event.pull_request.head.ref }}
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
         run: |
           if [ -d "$BRANCH_REPORTS_DIR" ]; then
             rm -rf "$BRANCH_REPORTS_DIR"
             git add .
-            git commit -m "workflow: remove all reports for branch ${{ github.event.pull_request.head.ref }} (PR closed/merged)"
+            git commit -m "workflow: remove all reports for branch $HEAD_REF (PR closed/merged)"
             git push
           else
-            echo "No reports found for branch ${{ github.event.pull_request.head.ref }}. Nothing to clean up."
+            echo "No reports found for branch $HEAD_REF. Nothing to clean up."
           fi

.github/workflows/cleanup.yml

@@ -22,12 +22,20 @@ jobs:
       # Contains all reports for deleted branch
       BRANCH_REPORTS_DIR: reports/${{ github.event.ref }}
     steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'test-results-2'
+
       - name: Checkout GitHub Pages Branch
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           repository: calcom/test-results-2
           ref: gh-pages
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
       - name: Set Git User
         # see: https://github.com/actions/checkout/issues/13#issuecomment-724415212
         run: |

.github/workflows/companion-build.yml

@@ -12,7 +12,7 @@ env:
 jobs:
   build:
     name: Build Companion App & Extension
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
 
     steps:

.github/workflows/cron-scheduleSMSReminders.yml

@@ -9,15 +9,25 @@ on:
 jobs:
   cron-scheduleSMSReminders:
     env:
-      APP_URL: ${{ secrets.APP_URL }}
-      CRON_API_KEY: ${{ secrets.CRON_API_KEY }}
+      APP_URL_US: ${{ vars.APP_URL_US }}
+      APP_URL_EU: ${{ vars.APP_URL_EU }}
+      CRON_API_KEY_US: ${{ secrets.CRON_API_KEY }}
+      CRON_API_KEY_EU: ${{ secrets.CRON_API_KEY_EU }}
     runs-on: ubuntu-latest
     steps:
-      - name: cURL request
-        if: ${{ env.APP_URL && env.CRON_API_KEY }}
+      - name: cURL request EU
+        if: ${{ env.APP_URL_EU && env.CRON_API_KEY_EU }}
         run: |
-          curl ${{ secrets.APP_URL }}/api/cron/workflows/scheduleSMSReminders \
+          curl ${{ env.APP_URL_EU }}/api/cron/workflows/scheduleSMSReminders \
             -X POST \
             -H 'content-type: application/json' \
-            -H 'authorization: ${{ secrets.CRON_API_KEY }}' \
+            -H 'authorization: ${{ env.CRON_API_KEY_EU }}' \
+            -sSf
+      - name: cURL request US
+        if: ${{ env.APP_URL_US && env.CRON_API_KEY_US }}
+        run: |
+          curl ${{ env.APP_URL_US }}/api/cron/workflows/scheduleSMSReminders \
+            -X POST \
+            -H 'content-type: application/json' \
+            -H 'authorization: ${{ env.CRON_API_KEY_US }}' \
             -sSf

.github/workflows/cron-scheduleWhatsappReminders.yml

@@ -9,15 +9,25 @@ on:
 jobs:
   cron-scheduleWhatsappReminders:
     env:
-      APP_URL: ${{ secrets.APP_URL }}
-      CRON_API_KEY: ${{ secrets.CRON_API_KEY }}
+      APP_URL_EU: ${{ vars.APP_URL_EU }}
+      APP_URL_US: ${{ vars.APP_URL_US }}
+      CRON_API_KEY_EU: ${{ secrets.CRON_API_KEY_EU }}
+      CRON_API_KEY_US: ${{ secrets.CRON_API_KEY }}
     runs-on: ubuntu-latest
     steps:
-      - name: cURL request
-        if: ${{ env.APP_URL && env.CRON_API_KEY }}
+      - name: cURL request EU
+        if: ${{ env.APP_URL_EU && env.CRON_API_KEY_EU }}
         run: |
-          curl ${{ secrets.APP_URL }}/api/cron/workflows/scheduleWhatsappReminders \
+          curl ${{ env.APP_URL_EU }}/api/cron/workflows/scheduleWhatsappReminders \
             -X POST \
             -H 'content-type: application/json' \
-            -H 'authorization: ${{ secrets.CRON_API_KEY }}' \
+            -H 'authorization: ${{ env.CRON_API_KEY_EU }}' \
+            -sSf
+      - name: cURL request US
+        if: ${{ env.APP_URL_US && env.CRON_API_KEY_US }}
+        run: |
+          curl ${{ env.APP_URL_US }}/api/cron/workflows/scheduleWhatsappReminders \
+            -X POST \
+            -H 'content-type: application/json' \
+            -H 'authorization: ${{ env.CRON_API_KEY_US }}' \
             -sSf

.github/workflows/cron-webhooks-triggers.yml

@@ -9,15 +9,25 @@ on:
 jobs:
   cron-webhookTriggers:
     env:
-      APP_URL: ${{ secrets.APP_URL }}
-      CRON_API_KEY: ${{ secrets.CRON_API_KEY }}
+      APP_URL_US: ${{ vars.APP_URL_US }}
+      APP_URL_EU: ${{ vars.APP_URL_EU }}
+      CRON_API_KEY_US: ${{ secrets.CRON_API_KEY }}
+      CRON_API_KEY_EU: ${{ secrets.CRON_API_KEY_EU }}
     runs-on: ubuntu-latest
     steps:
-      - name: cURL request
-        if: ${{ env.APP_URL && env.CRON_API_KEY }}
+      - name: cURL request US
+        if: ${{ env.APP_URL_US && env.CRON_API_KEY_US }}
         run: |
-          curl ${{ secrets.APP_URL }}/api/cron/webhookTriggers \
+          curl ${{ env.APP_URL_US }}/api/cron/webhookTriggers \
             -X POST \
             -H 'content-type: application/json' \
-            -H 'authorization: ${{ secrets.CRON_API_KEY }}' \
-            --fail
+            -H 'authorization: ${{ env.CRON_API_KEY_US }}' \
+            -sSf
+      - name: cURL request EU
+        if: ${{ env.APP_URL_EU && env.CRON_API_KEY_EU }}
+        run: |
+          curl ${{ env.APP_URL_EU }}/api/cron/webhookTriggers \
+            -X POST \
+            -H 'content-type: application/json' \
+            -H 'authorization: ${{ env.CRON_API_KEY_EU }}' \
+            -sSf

.github/workflows/delete-blacksmith-cache.yml

@@ -0,0 +1,33 @@
+name: Delete Blacksmith Cache
+on:
+  workflow_dispatch:
+    inputs:
+      cache_key:
+        description: "Blacksmith Cache Key to Delete"
+        required: true
+        type: string
+  pull_request:
+    types: [closed]
+
+jobs:
+  manually-delete-blacksmith-cache:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - uses: useblacksmith/cache-delete@v1
+        with:
+          key: ${{ inputs.cache_key }}
+
+  delete-cache-build-on-pr-close:
+    if: github.event_name == 'pull_request' && github.event.action == 'closed'
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    env:
+      CACHE_NAME: prod-build
+    steps:
+      - name: Delete cache-build cache
+        uses: useblacksmith/cache-delete@v1
+        with:
+          key: ${{ env.CACHE_NAME }}-${{ github.event.pull_request.head.ref }}
+          prefix: "true"

.github/workflows/delete-buildjet-cache.yml

@@ -1,17 +0,0 @@
-name: Manually Delete BuildJet Cache
-on:
-  workflow_dispatch:
-    inputs:
-      cache_key:
-        description: "BuildJet Cache Key to Delete"
-        required: true
-        type: string
-jobs:
-  manually-delete-buildjet-cache:
-    runs-on: buildjet-2vcpu-ubuntu-2204
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - uses: buildjet/cache-delete@v1
-        with:
-          cache_key: ${{ inputs.cache_key }}

.github/workflows/docs-build.yml

@@ -9,27 +9,21 @@ jobs:
     name: Build Docs
     permissions:
       contents: read
-    runs-on: buildjet-2vcpu-ubuntu-2204
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - name: Cache Docs build
-        uses: buildjet/cache@v4
+        uses: actions/cache@v4
         id: cache-docs-build
         env:
           cache-name: docs-build
           key-1: ${{ hashFiles('yarn.lock') }}
           key-2: ${{ hashFiles('docs/**.*', '!**/node_modules') }}
-          key-3: ${{ github.event.pull_request.number || github.ref }}
-          key-4: ${{ github.sha }}
         with:
           path: |
             **/docs/**
-          key: ${{ runner.os }}-${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}-${{ env.key-4 }}
-            # Log cache hit
-      - name: Log Cache Hit
-        if: steps.cache-docs-build.outputs.cache-hit == 'true'
-        run: echo "Cache hit for Docs build. Skipping build."
+          key: ${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}
       - name: Run build
         if: steps.cache-docs-build.outputs.cache-hit != 'true'
         working-directory: docs

.github/workflows/draft-release.yml

@@ -17,13 +17,20 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'cal.com'
+
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: 'main'
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
 
       - name: Configure git
         run: |
@@ -49,14 +56,18 @@ jobs:
       - uses: ./.github/actions/yarn-install
 
       - name: Bump version
+        env:
+          VERSION: ${{ inputs.next_version }}
         run: |
           cd apps/web
-          yarn version ${{ inputs.next_version }}
+          yarn version "$VERSION"
 
       - name: Commit changes
+        env:
+          VERSION: ${{ inputs.next_version }}
         run: |
           git add .
-          git commit -m "chore: release v${{ inputs.next_version }}"
+          git commit -m "chore: release v$VERSION"
           git push
 
       - name: Draft release

.github/workflows/e2e-api-v2.yml

@@ -27,11 +27,13 @@ env:
   VAPID_PRIVATE_KEY: ${{ secrets.VAPID_PRIVATE_KEY }}
   JWT_SECRET: ${{ secrets.CI_JWT_SECRET }}
   NODE_ENV: ${{ vars.CI_NODE_ENV }}
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
 jobs:
   e2e:
     timeout-minutes: 20
-    name: E2E API v2
-    runs-on: buildjet-16vcpu-ubuntu-2204
+    name: E2E API v2 (${{ matrix.shard }}/${{ strategy.job-total }})
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     services:
       postgres:
         image: postgres:13
@@ -43,10 +45,11 @@ jobs:
           POSTGRES_PASSWORD: postgres
           POSTGRES_DB: calendso
         options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
+          --health-cmd "pg_isready -h 127.0.0.1 -U postgres"
+          --health-interval 2s
+          --health-timeout 3s
+          --health-retries 15
+          --health-start-period 2s
         ports:
           - 5432:5432
       redis:
@@ -63,6 +66,8 @@ jobs:
           --health-retries 5
     strategy:
       fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
     steps:
       - uses: docker/login-action@v3
         with:
@@ -72,33 +77,29 @@ jobs:
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/cache-db
-
-      - name: Generate Swagger
-        working-directory: apps/api/v2
-        run: yarn generate-swagger
-
-      - name: Check breaking changes
+      - name: Build platform packages with Turbo
         run: |
-          docker run --rm \
-            -v "$PWD:/work" -w /work \
-            tufin/oasdiff:latest \
-            breaking \
-            https://raw.githubusercontent.com/calcom/cal.com/refs/heads/main/docs/api-reference/v2/openapi.json \
-            docs/api-reference/v2/openapi.json \
-            --fail-on ERR \
-            --err-ignore .github/oasdiff-err-ignore.txt
+          yarn turbo run build \
+            --filter=@calcom/platform-constants \
+            --filter=@calcom/platform-enums \
+            --filter=@calcom/platform-utils \
+            --filter=@calcom/platform-types \
+            --filter=@calcom/platform-libraries \
+            --filter=@calcom/trpc
 
       - name: Run Tests
         working-directory: apps/api/v2
         run: |
-          yarn workspace @calcom/platform-libraries build && yarn test:e2e
+          yarn test:e2e:ci --shard=${{ matrix.shard }}/${{ strategy.job-total }}
           EXIT_CODE=$?
-          echo "yarn workspace @calcom/platform-libraries build && yarn test:e2e command exit code: $EXIT_CODE"
+          echo "yarn test:e2e:ci --shard=${{ matrix.shard }}/${{ strategy.job-total }} command exit code: $EXIT_CODE"
           exit $EXIT_CODE
 
       - name: Upload Test Results
         if: ${{ always() }}
         uses: actions/upload-artifact@v4
         with:
-          name: test-results-api-v2
-          path: test-results
+          name: test-results-api-v2-shard-${{ matrix.shard }}
+          path: apps/api/v2/test-results
+          if-no-files-found: ignore
+          retention-days: 7

.github/workflows/e2e-app-store.yml

@@ -45,7 +45,7 @@ jobs:
   e2e-app-store:
     timeout-minutes: 20
     name: E2E App Store
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     services:
       postgres:
         image: postgres:13
@@ -57,10 +57,11 @@ jobs:
           POSTGRES_PASSWORD: postgres
           POSTGRES_DB: calendso
         options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
+          --health-cmd "pg_isready -h 127.0.0.1 -U postgres"
+          --health-interval 2s
+          --health-timeout 3s
+          --health-retries 15
+          --health-start-period 2s
         ports:
           - 5432:5432
       mailhog:
@@ -83,6 +84,7 @@ jobs:
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/yarn-playwright-install
+      - run: yarn prisma generate
       - uses: ./.github/actions/cache-db
         env:
           DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
@@ -93,7 +95,7 @@ jobs:
           E2E_TEST_CALCOM_GCAL_KEYS: ${{ secrets.E2E_TEST_CALCOM_GCAL_KEYS }}
       - uses: ./.github/actions/cache-build
       - name: Run Tests
-        run: yarn e2e:app-store
+        run: yarn e2e:app-store --workers=4
       - name: Upload Test Results
         if: ${{ always() }}
         uses: actions/upload-artifact@v4

.github/workflows/e2e-atoms.yml

@@ -22,7 +22,7 @@ jobs:
   e2e-atoms:
     timeout-minutes: 15
     name: E2E Atoms
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: docker/login-action@v3
         with:

.github/workflows/e2e-embed-react.yml

@@ -45,7 +45,7 @@ jobs:
   e2e-embed:
     timeout-minutes: 20
     name: E2E Embed React
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     services:
       postgres:
         image: postgres:13
@@ -57,10 +57,11 @@ jobs:
           POSTGRES_PASSWORD: postgres
           POSTGRES_DB: calendso
         options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
+          --health-cmd "pg_isready -h 127.0.0.1 -U postgres"
+          --health-interval 2s
+          --health-timeout 3s
+          --health-retries 15
+          --health-start-period 2s
         ports:
           - 5432:5432
     strategy:
@@ -75,11 +76,12 @@ jobs:
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/yarn-playwright-install
+      - run: yarn prisma generate
       - uses: ./.github/actions/cache-db
       - uses: ./.github/actions/cache-build
       - name: Run Tests
         run: |
-          yarn e2e:embed-react
+          yarn e2e:embed-react --workers=4
           yarn workspace @calcom/embed-react packaged:tests
       - name: Upload Test Results
         if: ${{ always() }}

.github/workflows/e2e-embed.yml

@@ -45,7 +45,7 @@ jobs:
   e2e-embed:
     timeout-minutes: 20
     name: E2E Embed Core
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     services:
       postgres:
         image: postgres:13
@@ -57,10 +57,11 @@ jobs:
           POSTGRES_PASSWORD: postgres
           POSTGRES_DB: calendso
         options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
+          --health-cmd "pg_isready -h 127.0.0.1 -U postgres"
+          --health-interval 2s
+          --health-timeout 3s
+          --health-retries 15
+          --health-start-period 2s
         ports:
           - 5432:5432
       mailhog:
@@ -83,10 +84,11 @@ jobs:
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/yarn-playwright-install
+      - run: yarn prisma generate
       - uses: ./.github/actions/cache-db
       - uses: ./.github/actions/cache-build
       - name: Run Tests
-        run: yarn e2e:embed
+        run: yarn e2e:embed --workers=4
       - name: Upload Test Results
         if: ${{ always() }}
         uses: actions/upload-artifact@v4

.github/workflows/e2e-report.yml

@@ -0,0 +1,212 @@
+name: E2E Report
+
+on:
+  workflow_run:
+    workflows: ["PR Update"]
+    types:
+      - completed
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'The PR number to generate report for'
+        required: true
+        type: string
+
+jobs:
+  get-pr-info:
+    name: Get PR Info
+    runs-on: ubuntu-latest
+    # For workflow_run: only run if the triggering workflow failed
+    # For workflow_dispatch: always run (inputs are provided manually)
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'failure' }}
+    permissions:
+      actions: read
+      pull-requests: read
+    outputs:
+      pr-number: ${{ steps.get-info.outputs.pr-number }}
+      head-branch: ${{ steps.get-info.outputs.head-branch }}
+      has-blob-reports: ${{ steps.get-info.outputs.has-blob-reports }}
+      source-run-id: ${{ steps.get-info.outputs.source-run-id }}
+      source-run-number: ${{ steps.get-info.outputs.source-run-number }}
+      source-run-attempt: ${{ steps.get-info.outputs.source-run-attempt }}
+      source-head-sha: ${{ steps.get-info.outputs.source-head-sha }}
+    steps:
+      - name: Get PR and run info
+        id: get-info
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const isDispatch = context.eventName === 'workflow_dispatch';
+            
+            if (isDispatch) {
+              // For workflow_dispatch: look up everything from PR number
+              const prNumber = context.payload.inputs.pr_number;
+              console.log('Looking up PR:', prNumber);
+              
+              // Get PR details
+              const { data: pr } = await github.rest.pulls.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: parseInt(prNumber)
+              });
+              
+              const headSha = pr.head.sha;
+              const headBranch = pr.head.ref;
+              console.log('PR head SHA:', headSha);
+              console.log('PR head branch:', headBranch);
+              
+              // Find the "PR Update" workflow
+              const { data: workflows } = await github.rest.actions.listRepoWorkflows({
+                owner: context.repo.owner,
+                repo: context.repo.repo
+              });
+              const prUpdateWorkflow = workflows.workflows.find(w => w.name === 'PR Update');
+              if (!prUpdateWorkflow) {
+                core.setFailed('Could not find "PR Update" workflow');
+                return;
+              }
+              console.log('Found PR Update workflow ID:', prUpdateWorkflow.id);
+              
+              // Find the most recent completed run for this branch with blob-report artifacts
+              // We search by branch instead of SHA to handle cases where:
+              // 1. The PR was updated after E2E tests ran (artifacts exist for older SHA)
+              // 2. The current run for the SHA is still queued/in-progress
+              const { data: runs } = await github.rest.actions.listWorkflowRuns({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: prUpdateWorkflow.id,
+                branch: headBranch,
+                status: 'completed',
+                per_page: 20
+              });
+              
+              console.log('Found', runs.workflow_runs.length, 'completed runs for branch', headBranch);
+              
+              // Find a run with blob-report artifacts
+              let selectedRun = null;
+              let hasBlobReports = false;
+              
+              for (const run of runs.workflow_runs) {
+                console.log('Checking run', run.id, 'conclusion:', run.conclusion);
+                
+                const { data: artifacts } = await github.rest.actions.listWorkflowRunArtifacts({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  run_id: run.id
+                });
+                
+                const blobReports = artifacts.artifacts.filter(a => a.name.startsWith('blob-report-'));
+                if (blobReports.length > 0) {
+                  console.log('Found run with blob reports:', run.id, 'artifacts:', blobReports.map(a => a.name));
+                  selectedRun = run;
+                  hasBlobReports = true;
+                  break;
+                }
+              }
+              
+              if (!selectedRun) {
+                console.log('No runs found with blob-report artifacts');
+                core.setOutput('pr-number', prNumber);
+                core.setOutput('head-branch', headBranch);
+                core.setOutput('source-head-sha', headSha);
+                core.setOutput('has-blob-reports', 'false');
+                core.setOutput('source-run-id', '');
+                core.setOutput('source-run-number', '');
+                core.setOutput('source-run-attempt', '');
+                return;
+              }
+              
+              core.setOutput('pr-number', prNumber);
+              core.setOutput('head-branch', headBranch);
+              core.setOutput('source-head-sha', headSha);
+              core.setOutput('source-run-id', selectedRun.id.toString());
+              core.setOutput('source-run-number', selectedRun.run_number.toString());
+              core.setOutput('source-run-attempt', selectedRun.run_attempt.toString());
+              core.setOutput('has-blob-reports', 'true');
+              return;
+            }
+            
+            // For workflow_run: extract from payload
+            const workflowRun = context.payload.workflow_run;
+            const headSha = workflowRun.head_sha;
+            const headBranch = workflowRun.head_branch;
+            
+            console.log('Head SHA:', headSha);
+            console.log('Head Branch:', headBranch);
+            
+            // Set source run info
+            core.setOutput('source-run-id', workflowRun.id.toString());
+            core.setOutput('source-run-number', workflowRun.run_number.toString());
+            core.setOutput('source-run-attempt', workflowRun.run_attempt.toString());
+            core.setOutput('source-head-sha', headSha);
+            
+            // Check for blob report artifacts
+            const { data: artifacts } = await github.rest.actions.listWorkflowRunArtifacts({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: workflowRun.id
+            });
+            
+            const blobReports = artifacts.artifacts.filter(a => a.name.startsWith('blob-report-'));
+            console.log('Found blob reports:', blobReports.map(a => a.name));
+            core.setOutput('has-blob-reports', blobReports.length > 0 ? 'true' : 'false');
+            
+            // Try to get PR number from workflow_run payload first
+            if (workflowRun.pull_requests && workflowRun.pull_requests.length > 0) {
+              const prNumber = workflowRun.pull_requests[0].number;
+              console.log('PR number from payload:', prNumber);
+              core.setOutput('pr-number', prNumber.toString());
+              core.setOutput('head-branch', headBranch);
+              return;
+            }
+            
+            // Fall back to API lookup
+            try {
+              const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                commit_sha: headSha
+              });
+              
+              if (prs.length === 0) {
+                console.log('No PRs found for commit');
+                core.setOutput('pr-number', '');
+                core.setOutput('head-branch', headBranch);
+                return;
+              }
+              
+              // Find open PR or use first one
+              const openPr = prs.find(pr => pr.state === 'open') || prs[0];
+              console.log('PR number from API:', openPr.number);
+              core.setOutput('pr-number', openPr.number.toString());
+              core.setOutput('head-branch', openPr.head.ref);
+            } catch (e) {
+              console.log('Error fetching PR:', e);
+              core.setOutput('pr-number', '');
+              core.setOutput('head-branch', headBranch);
+            }
+
+  merge-reports:
+    name: Merge reports
+    needs: [get-pr-info]
+    if: ${{ needs.get-pr-info.outputs.has-blob-reports == 'true' && needs.get-pr-info.outputs.pr-number != '' }}
+    uses: ./.github/workflows/merge-reports.yml
+    with:
+      source_run_id: ${{ needs.get-pr-info.outputs.source-run-id }}
+      source_run_number: ${{ needs.get-pr-info.outputs.source-run-number }}
+      source_run_attempt: ${{ needs.get-pr-info.outputs.source-run-attempt }}
+      source_head_sha: ${{ needs.get-pr-info.outputs.source-head-sha }}
+    # No secrets: inherit - merge-reports only needs the default GITHUB_TOKEN for artifact download
+
+  publish-report:
+    name: Publish HTML report
+    needs: [get-pr-info, merge-reports]
+    if: ${{ needs.get-pr-info.outputs.pr-number != '' }}
+    uses: ./.github/workflows/publish-report.yml
+    with:
+      head_branch: ${{ needs.get-pr-info.outputs.head-branch }}
+      source_run_id: ${{ needs.get-pr-info.outputs.source-run-id }}
+      source_run_number: ${{ needs.get-pr-info.outputs.source-run-number }}
+      source_run_attempt: ${{ needs.get-pr-info.outputs.source-run-attempt }}
+      pr_number: ${{ needs.get-pr-info.outputs.pr-number }}
+    secrets: inherit

.github/workflows/e2e.yml

@@ -5,7 +5,6 @@ permissions:
   actions: write
   contents: read
 env:
-  NODE_OPTIONS: --max-old-space-size=4096
   ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
   CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
   DAILY_API_KEY: ${{ secrets.CI_DAILY_API_KEY }}
@@ -15,11 +14,11 @@ env:
   E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
   E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
   E2E_TEST_MAILHOG_ENABLED: ${{ vars.E2E_TEST_MAILHOG_ENABLED }}
-  GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
   EMAIL_SERVER_HOST: ${{ secrets.CI_EMAIL_SERVER_HOST }}
   EMAIL_SERVER_PORT: ${{ secrets.CI_EMAIL_SERVER_PORT }}
   EMAIL_SERVER_USER: ${{ secrets.CI_EMAIL_SERVER_USER }}
   EMAIL_SERVER_PASSWORD: ${{ secrets.CI_EMAIL_SERVER_PASSWORD}}
+  GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
   GOOGLE_LOGIN_ENABLED: ${{ vars.CI_GOOGLE_LOGIN_ENABLED }}
   NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
   NEXTAUTH_URL: ${{ secrets.CI_NEXTAUTH_URL }}
@@ -30,6 +29,7 @@ env:
   NEXT_PUBLIC_STRIPE_PUBLIC_KEY: ${{ secrets.CI_NEXT_PUBLIC_STRIPE_PUBLIC_KEY }}
   NEXT_PUBLIC_WEBAPP_URL: ${{ vars.CI_NEXT_PUBLIC_WEBAPP_URL }}
   NEXT_PUBLIC_WEBSITE_URL: ${{ vars.CI_NEXT_PUBLIC_WEBSITE_URL }}
+  NODE_OPTIONS: --max-old-space-size=4096
   PAYMENT_FEE_FIXED: ${{ vars.CI_PAYMENT_FEE_FIXED }}
   PAYMENT_FEE_PERCENTAGE: ${{ vars.CI_PAYMENT_FEE_PERCENTAGE }}
   SAML_ADMINS: ${{ secrets.CI_SAML_ADMINS }}
@@ -45,7 +45,7 @@ jobs:
   e2e:
     timeout-minutes: 20
     name: E2E (${{ matrix.shard }}/${{ strategy.job-total }})
-    runs-on: buildjet-8vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     services:
       postgres:
         image: postgres:13
@@ -57,10 +57,11 @@ jobs:
           POSTGRES_PASSWORD: postgres
           POSTGRES_DB: calendso
         options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
+          --health-cmd "pg_isready -h 127.0.0.1 -U postgres"
+          --health-interval 2s
+          --health-timeout 3s
+          --health-retries 15
+          --health-start-period 2s
         ports:
           - 5432:5432
       mailhog:
@@ -74,7 +75,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        shard: [1, 2, 3, 4]
+        shard: [1, 2, 3, 4, 5, 6, 7, 8]
     steps:
       - uses: docker/login-action@v3
         with:
@@ -84,10 +85,11 @@ jobs:
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/yarn-playwright-install
+      - run: yarn prisma generate
       - uses: ./.github/actions/cache-db
       - uses: ./.github/actions/cache-build
       - name: Run Tests
-        run: yarn e2e --shard=${{ matrix.shard }}/${{ strategy.job-total }}
+        run: yarn e2e --shard=${{ matrix.shard }}/${{ strategy.job-total }} --workers=4
       - name: Upload Test Results
         uses: actions/upload-artifact@v4
         if: always()

.github/workflows/i18n.yml

@@ -10,12 +10,20 @@ concurrency:
 jobs:
   i18n:
     name: Run i18n
-    runs-on: buildjet-2vcpu-ubuntu-2204
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     permissions:
       actions: write
       contents: write
       pull-requests: write
     steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'cal.com'
+
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
@@ -23,7 +31,7 @@ jobs:
           cache: 'npm'
       - uses: lingodotdev/lingo.dev@main
         env:
-          GH_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
         with:
           api-key: ${{ secrets.CI_LINGO_DOT_DEV_API_KEY }}
           pull-request: true

.github/workflows/integration-tests.yml

@@ -45,7 +45,7 @@ jobs:
   integration:
     timeout-minutes: 20
     name: Integration
-    runs-on: buildjet-8vcpu-ubuntu-2204
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     services:
       postgres:
         image: postgres:13
@@ -81,9 +81,10 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
+      - run: yarn prisma generate
       - uses: ./.github/actions/cache-db
       - name: Run Tests
-        run: yarn test -- --integrationTestsOnly
+        run: VITEST_MODE=integration yarn test
       # TODO: Generate test results so we can upload them
       # - name: Upload Test Results
       #   if: ${{ always() }}

.github/workflows/lint.yml

@@ -6,7 +6,7 @@ permissions:
   contents: read
 jobs:
   lint:
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-2vcpu-ubuntu-2404
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/merge-reports.yml

@@ -1,17 +1,37 @@
 # https://playwright.dev/docs/test-sharding#merging-reports-from-multiple-shards
 on:
   workflow_call:
+    inputs:
+      source_run_id:
+        description: 'The run ID to download artifacts from (for workflow_run triggered calls)'
+        required: true
+        type: string
+      source_run_number:
+        description: 'The run number for artifact naming'
+        required: true
+        type: string
+      source_run_attempt:
+        description: 'The run attempt for artifact naming'
+        required: true
+        type: string
+      source_head_sha:
+        description: 'The head SHA to checkout for Playwright version consistency'
+        required: true
+        type: string
 jobs:
   merge-reports:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: ./.github/actions/dangerous-git-checkout
+        with:
+          ref: ${{ inputs.source_head_sha }}
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/yarn-playwright-install
       - name: Download blob reports from GitHub Actions Artifacts
         uses: actions/download-artifact@v4
         with:
+          run-id: ${{ inputs.source_run_id }}
+          github-token: ${{ github.token }}
           path: all-blob-reports
           pattern: blob-report-*
           merge-multiple: true
@@ -20,6 +40,6 @@ jobs:
       - name: Upload HTML report
         uses: actions/upload-artifact@v4
         with:
-          name: html-report--attempt-${{ github.run_number }}-${{ github.run_attempt }}
+          name: html-report--attempt-${{ inputs.source_run_number }}-${{ inputs.source_run_attempt }}
           path: playwright-report
           retention-days: 14

.github/workflows/nextjs-bundle-analysis-annotation.yml

@@ -12,13 +12,13 @@ permissions:
 jobs:
   annotate:
     if: always()
-    runs-on: buildjet-2vcpu-ubuntu-2204
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/cache-build
       - name: Download base branch bundle stats
-        uses: dawidd6/action-download-artifact@v2
+        uses: dawidd6/action-download-artifact@v6
         if: success()
         with:
           workflow: nextjs-bundle-analysis.yml

.github/workflows/nextjs-bundle-analysis.yml

@@ -49,12 +49,13 @@ env:
 jobs:
   analyze:
     if: always()
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
+      - run: yarn prisma generate
       - uses: ./.github/actions/cache-build
       - name: Analyze bundle
         run: |

.github/workflows/post-release.yml

@@ -6,16 +6,27 @@ on:
     tags:
       - "*"
 
+permissions:
+  contents: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
     steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'cal.com'
+
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: 'main'
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
 
       - name: Configure git
         run: |

.github/workflows/pr.yml

@@ -1,11 +1,13 @@
+# ⚠️ SECURITY: Do not add steps that checkout PR code or run local actions before trust-check job completes.
 name: PR Update
 
 on:
   pull_request_target:
-    types: [opened, synchronize, reopened, labeled]
+    types: [opened, synchronize, reopened]
     branches:
       - main
       - gh-actions-test-branch
+
   workflow_dispatch:
 
 permissions:
@@ -17,49 +19,207 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  changes:
-    name: Detect changes
-    runs-on: buildjet-2vcpu-ubuntu-2204
+  # Security gate: Check if PR is from a trusted contributor or approved via run-ci label
+  # This MUST run before any job that checks out PR code and executes it with secrets
+  trust-check:
+    name: Trust Check
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    permissions:
+      pull-requests: read
+      actions: read
+      issues: read
+    outputs:
+      is-trusted: ${{ steps.check-trust.outputs.is-trusted }}
+    steps:
+      - name: Check if PR is trusted
+        id: check-trust
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const trustedAssociations = ['OWNER', 'MEMBER', 'COLLABORATOR'];
+
+            if (!context.payload.pull_request) {
+              if (context.eventName === 'workflow_dispatch') {
+                console.log('workflow_dispatch event - assuming trusted (manual trigger)');
+                core.setOutput('is-trusted', true);
+                return;
+              }
+              console.log('No pull request context found');
+              core.setOutput('is-trusted', false);
+              return;
+            }
+
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            // Fetch fresh PR data - payload labels may be stale on re-runs
+            const { data: pr } = await github.rest.pulls.get({
+              owner,
+              repo,
+              pull_number: context.payload.pull_request.number,
+            });
+
+            const prNumber = pr.number;
+            const headSha = pr.head.sha;
+
+            async function hasWriteAccess(username) {
+              try {
+                const { data: permission } = await github.rest.repos.getCollaboratorPermissionLevel({
+                  owner,
+                  repo,
+                  username,
+                });
+                return ['admin', 'maintain', 'write'].includes(permission.permission);
+              } catch (e) {
+                console.log(`Permission check failed for ${username}: ${e.message}`);
+                return false;
+              }
+            }
+
+            console.log(`PR #${prNumber} by ${pr.user.login} (${pr.author_association})`);
+
+            // Check 1: Is the author a trusted contributor?
+            if (trustedAssociations.includes(pr.author_association)) {
+              console.log(`Author has trusted association: ${pr.author_association}`);
+              core.setOutput('is-trusted', true);
+              return;
+            }
+
+            // Check 2: Verify write access via API (author_association can be unreliable)
+            if (await hasWriteAccess(pr.user.login)) {
+              console.log(`Author has write access`);
+              core.setOutput('is-trusted', true);
+              return;
+            }
+
+            // Check 3: Was 'run-ci' label added AFTER this SHA was pushed by someone with write access?
+            // This enables re-runs triggered by the run-ci.yml workflow
+            // NOTE: We use workflow run created_at instead of commit timestamp because
+            // git commit timestamps can be arbitrarily backdated by attackers
+            if (pr.labels?.some(l => l.name === 'run-ci')) {
+              const events = await github.paginate(github.rest.issues.listEvents, {
+                owner,
+                repo,
+                issue_number: prNumber,
+                per_page: 100,
+              });
+
+              const labelEvent = events
+                .filter(e => e.event === 'labeled' && e.label?.name === 'run-ci')
+                .sort((a, b) => new Date(b.created_at) - new Date(a.created_at))[0];
+
+              if (labelEvent) {
+                // Get workflow runs to find when this SHA was first pushed
+                const runs = await github.paginate(github.rest.actions.listWorkflowRuns, {
+                  owner,
+                  repo,
+                  workflow_id: 'pr.yml',
+                  head_sha: headSha,
+                  per_page: 100,
+                });
+
+                // Filter runs to this PR (in case same SHA exists in multiple PRs)
+                const matchingRuns = runs.filter(run =>
+                  !run.pull_requests?.length || run.pull_requests.some(p => p.number === prNumber)
+                );
+
+                if (matchingRuns.length > 0) {
+                  const labelTime = new Date(labelEvent.created_at);
+                  // Use the oldest run's created_at as the push time
+                  const originalRun = matchingRuns[matchingRuns.length - 1];
+                  const pushTime = new Date(originalRun.created_at);
+
+                  if (labelTime > pushTime) {
+                    const adder = labelEvent.actor.login;
+                    if (await hasWriteAccess(adder)) {
+                      console.log(`Approved via 'run-ci' label added by ${adder} after push (label: ${labelTime.toISOString()}, push: ${pushTime.toISOString()})`);
+                      core.setOutput('is-trusted', true);
+                      return;
+                    }
+                    console.log(`Label 'run-ci' added by ${adder} (no write access)`);
+                  } else {
+                    console.log(`Label 'run-ci' is stale (label: ${labelTime.toISOString()}, push: ${pushTime.toISOString()})`);
+                  }
+                } else {
+                  console.log('No workflow runs found for this SHA - cannot validate label timing');
+                }
+              }
+            }
+
+            console.log('External contribution requires "run-ci" label from a maintainer');
+            core.setOutput('is-trusted', false);
+
+  prepare:
+    name: Prepare
+    needs: [trust-check]
+    if: needs.trust-check.outputs.is-trusted == 'true'
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     permissions:
       pull-requests: read
     outputs:
       has-files-requiring-all-checks: ${{ steps.filter.outputs.has-files-requiring-all-checks }}
+      has_companion: ${{ steps.filter.outputs.has_companion }}
+      has-api-v2-changes: ${{ steps.filter.outputs.has-api-v2-changes }}
       commit-sha: ${{ steps.get_sha.outputs.commit-sha }}
+      run-e2e: ${{ steps.check-if-pr-has-label.outputs.run-e2e == 'true' }}
+      db-cache-hit: ${{ steps.cache-db-check.outputs.cache-hit }}
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
+      - name: Generate DB cache key
+        id: cache-db-key
+        uses: ./.github/actions/cache-db-key
+      - name: Check DB cache (lookup-only)
+        id: cache-db-check
+        uses: actions/cache/restore@v4
+        with:
+          path: backups/backup.sql
+          key: ${{ steps.cache-db-key.outputs.key }}
+          lookup-only: true
       - uses: dorny/paths-filter@v3
         id: filter
         with:
+          predicate-quantifier: "every"
           filters: |
             has-files-requiring-all-checks:
-              - "!(**.md|**.mdx|.github/CODEOWNERS|docs/**|help/**|apps/web/public/static/locales/**/common.json|i18n.lock)"
+              - '**'
+              - '!companion/**'
+              - '!**/*.md'
+              - '!**/*.mdx'
+              - '!.github/CODEOWNERS'
+              - '!docs/**'
+              - '!help/**'
+              - '!apps/web/public/static/locales/**/common.json'
+              - '!i18n.lock'
+            has_companion:
+              - "companion/**"
+            has-api-v2-changes:
+              - "apps/api/v2/**"
+              - "packages/platform-constants/**"
+              - "packages/platform-enums/**"
+              - "packages/platform-utils/**"
+              - "packages/platform-types/**"
+              - "packages/platform-libraries/**"
+              - "packages/trpc/**"
+              - "packages/prisma/schema.prisma"
+              - "docs/api-reference/v2/**"
       - name: Get Latest Commit SHA
         id: get_sha
         run: |
           echo "commit-sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-
-  check-label:
-    needs: [changes]
-    runs-on: buildjet-2vcpu-ubuntu-2204
-    name: Check for E2E label
-    permissions:
-      pull-requests: read
-    outputs:
-      run-e2e: ${{ steps.check-if-pr-has-label.outputs.run-e2e == 'true' && (github.event.action != 'labeled' || github.event.label.name == 'ready-for-e2e') }}
-    steps:
       - name: Check if PR exists with ready-for-e2e label for this SHA
         id: check-if-pr-has-label
         uses: actions/github-script@v7
         with:
           script: |
             let labels = [];
+            let prNumber = null;
 
             if (context.payload.pull_request) {
-              labels = context.payload.pull_request.labels;
+              prNumber = context.payload.pull_request.number;
             } else {
               try {
-                const sha = '${{ needs.changes.outputs.commit-sha }}';
+                const sha = '${{ steps.get_sha.outputs.commit-sha }}';
                 console.log('sha', sha);
                 const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
                   owner: context.repo.owner,
@@ -73,132 +233,174 @@ jobs:
                   return;
                 }
 
-                const pr = prs[0];
-                console.log(`PR number: ${pr.number}`);
-                console.log(`PR title: ${pr.title}`);
-                console.log(`PR state: ${pr.state}`);
-                console.log(`PR URL: ${pr.html_url}`);
-
-                labels = pr.labels;
+                prNumber = prs[0].number;
               }
               catch (e) {
                 core.setOutput('run-e2e', false);
                 console.log(e);
+                return;
               }
             }
 
+            // Always fetch fresh PR data to get current labels
+            // This avoids stale label data from event payloads
+            try {
+              const { data: pr } = await github.rest.pulls.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: prNumber
+              });
+
+              console.log(`PR number: ${pr.number}`);
+              console.log(`PR title: ${pr.title}`);
+              console.log(`PR state: ${pr.state}`);
+              console.log(`PR URL: ${pr.html_url}`);
+
+              labels = pr.labels;
+            }
+            catch (e) {
+              core.setOutput('run-e2e', false);
+              console.log(e);
+              return;
+            }
+
             const labelFound = labels.map(l => l.name).includes('ready-for-e2e');
             console.log('Found the label?', labelFound);
             core.setOutput('run-e2e', labelFound);
-
-  deps:
-    name: Install dependencies
-    needs: [changes, check-label]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
-    uses: ./.github/workflows/yarn-install.yml
+      - uses: ./.github/actions/yarn-install
+        if: ${{ steps.filter.outputs.has-files-requiring-all-checks == 'true' }}
+        with:
+          skip-install-if-cache-hit: "true"
+      - uses: ./.github/actions/yarn-playwright-install
+        if: ${{ steps.filter.outputs.has-files-requiring-all-checks == 'true' }}
+        with:
+          skip-install-if-cache-hit: "true"
 
   type-check:
     name: Type check
-    needs: [changes, check-label, deps]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/check-types.yml
     secrets: inherit
 
   lint:
     name: Linters
-    needs: [changes, check-label, deps]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/lint.yml
     secrets: inherit
 
   unit-test:
     name: Tests
-    needs: [changes, check-label, deps]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/unit-tests.yml
     secrets: inherit
 
+  api-v2-unit-test:
+    name: Tests
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
+    uses: ./.github/workflows/api-v2-unit-tests.yml
+    secrets: inherit
+
+  setup-db:
+    name: Setup Database
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
+    uses: ./.github/workflows/setup-db.yml
+    with:
+      DB_CACHE_HIT: ${{ needs.prepare.outputs.db-cache-hit }}
+    secrets: inherit
+
   build-api-v1:
     name: Production builds
-    needs: [changes, check-label, deps]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/api-v1-production-build.yml
     secrets: inherit
 
   build-api-v2:
     name: Production builds
-    needs: [changes, check-label, deps]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/api-v2-production-build.yml
     secrets: inherit
 
   build-atoms:
     name: Production builds
-    needs: [changes, check-label, deps]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/atoms-production-build.yml
     secrets: inherit
 
   build-docs:
     name: Production builds
-    needs: [changes, check-label, deps]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/docs-build.yml
     secrets: inherit
 
   build-companion:
     name: Companion builds
-    needs: [changes, check-label, deps]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare]
+    if: needs.prepare.outputs.has_companion == 'true'
     uses: ./.github/workflows/companion-build.yml
     secrets: inherit
 
   build:
     name: Production builds
-    needs: [changes, check-label, deps]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/production-build-without-database.yml
     secrets: inherit
 
   integration-test:
     name: Tests
-    needs: [changes, check-label, build, build-api-v1, build-api-v2]
-    if: ${{ needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, build, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/integration-tests.yml
     secrets: inherit
 
   e2e:
     name: Tests
-    needs: [changes, check-label, build, build-api-v1, build-api-v2]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, build, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e.yml
     secrets: inherit
 
+  check-api-v2-breaking-changes:
+    name: Check API v2 breaking changes
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-api-v2-changes == 'true' }}
+    uses: ./.github/workflows/check-api-v2-breaking-changes.yml
+    secrets: inherit
+
   e2e-api-v2:
     name: Tests
-    needs: [changes, check-label, build, build-api-v1, build-api-v2]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e-api-v2.yml
     secrets: inherit
 
   e2e-app-store:
     name: Tests
-    needs: [changes, check-label, build, build-api-v1, build-api-v2]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, build, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e-app-store.yml
     secrets: inherit
 
   e2e-embed:
     name: Tests
-    needs: [changes, check-label, build, build-api-v1, build-api-v2]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, build, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e-embed.yml
     secrets: inherit
 
   e2e-embed-react:
     name: Tests
-    needs: [changes, check-label, build, build-api-v1, build-api-v2]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    needs: [prepare, build, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
     uses: ./.github/workflows/e2e-embed-react.yml
     secrets: inherit
 
@@ -208,59 +410,70 @@ jobs:
     uses: ./.github/workflows/nextjs-bundle-analysis.yml
     secrets: inherit
 
-  merge-reports:
-    name: Merge reports
-    if: ${{ !cancelled() && needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
-    needs: [changes, check-label, e2e, e2e-embed, e2e-embed-react, e2e-app-store]
-    uses: ./.github/workflows/merge-reports.yml
-    secrets: inherit
-
-  publish-report:
-    name: Publish HTML report
-    if: ${{ !cancelled() && needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
-    permissions:
-      contents: write
-      issues: write
-      pull-requests: write
-    needs: [changes, check-label, merge-reports]
-    uses: ./.github/workflows/publish-report.yml
-    secrets: inherit
-
-  cleanup-report:
-    name: Cleanup HTML report
-    if: ${{ !cancelled() && needs.check-label.outputs.run-e2e == 'true' && (github.event.pull_request.merged == true || github.event.pull_request.state == 'closed') }}
-    permissions:
-      contents: write
-      issues: write
-      pull-requests: write
-    needs: [changes, check-label, publish-report]
-    uses: ./.github/workflows/cleanup-report.yml
-    secrets: inherit
-
   required:
     needs:
       [
-        changes,
+        trust-check,
+        prepare,
         lint,
         type-check,
         unit-test,
+        api-v2-unit-test,
+        check-api-v2-breaking-changes,
         integration-test,
-        check-label,
         build,
         build-api-v1,
         build-api-v2,
         build-atoms,
         build-docs,
         build-companion,
+        setup-db,
         e2e,
         e2e-api-v2,
         e2e-embed,
         e2e-embed-react,
-        e2e-app-store
+        e2e-app-store,
       ]
     if: always()
-    runs-on: buildjet-2vcpu-ubuntu-2204
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
-      - name: fail if conditional jobs failed
-        if: needs.changes.outputs.has-files-requiring-all-checks == 'true' && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'skipped') || contains(needs.*.result, 'cancelled'))
+      - name: Fail if trust-check did not succeed
+        run: |
+          echo "::error::Trust check did not complete successfully (result: ${{ needs.trust-check.result }}). Please re-run the workflow."
+          exit 1
+        if: needs.trust-check.result != 'success'
+      - name: Fail if PR is not trusted (external contributor without run-ci label)
+        run: |
+          echo "::error::This PR is from an external contributor and requires the 'run-ci' label before CI can run."
+          echo "A maintainer must review the code and add the 'run-ci' label to trigger CI checks."
+          exit 1
+        if: needs.trust-check.outputs.is-trusted != 'true' && needs.trust-check.result == 'success'
+      - name: Fail if conditional jobs failed
         run: exit 1
+        if: |
+          (
+            needs.prepare.outputs.has-files-requiring-all-checks == 'true' &&
+            (
+            needs.lint.result != 'success' ||
+            needs.type-check.result != 'success' ||
+            needs.unit-test.result != 'success' ||
+            needs.api-v2-unit-test.result != 'success' ||
+            (needs.prepare.outputs.has-api-v2-changes == 'true' && needs.check-api-v2-breaking-changes.result != 'success') ||
+              needs.build.result != 'success' ||
+              needs.build-api-v1.result != 'success' ||
+              needs.build-api-v2.result != 'success' ||
+              needs.build-atoms.result != 'success' ||
+              needs.build-docs.result != 'success' ||
+              needs.setup-db.result != 'success' ||
+              needs.integration-test.result != 'success' ||
+              needs.e2e.result != 'success' ||
+              needs.e2e-api-v2.result != 'success' ||
+              needs.e2e-embed.result != 'success' ||
+              needs.e2e-embed-react.result != 'success' ||
+              needs.e2e-app-store.result != 'success'
+            )
+          ) ||
+          (
+            needs.prepare.outputs.has_companion == 'true' &&
+            needs.build-companion.result != 'success'
+          )

.github/workflows/production-build-without-database.yml

@@ -4,6 +4,7 @@ on:
 
 permissions:
   contents: read
+  actions: write
 
 env:
   ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
@@ -38,10 +39,33 @@ env:
 jobs:
   build:
     name: Build Web App
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
+      - run: yarn prisma generate
+      - name: Generate cache key
+        id: cache-key
+        uses: ./.github/actions/cache-build-key
+        with:
+          branch_key: ${{ github.head_ref || github.ref_name }}
+      - name: Check if production build cache exists
+        uses: actions/cache@v4
+        id: cache-check
+        with:
+          path: |
+            ${{ github.workspace }}/apps/web/.next
+            ${{ github.workspace }}/apps/web/public/embed
+            **/.turbo/**
+            **/dist/**
+          key: ${{ steps.cache-key.outputs.key }}
+          lookup-only: true
+      - name: Delete old production build caches for this branch
+        if: steps.cache-check.outputs.cache-hit != 'true'
+        uses: useblacksmith/cache-delete@v1
+        with:
+          key: prod-build-${{ github.head_ref || github.ref_name }}
+          prefix: "true"
       - uses: ./.github/actions/cache-build

.github/workflows/publish-report.yml

@@ -1,5 +1,26 @@
 on:
   workflow_call:
+    inputs:
+      head_branch:
+        description: 'The head branch name for report path'
+        required: true
+        type: string
+      source_run_id:
+        description: 'The source run ID for report path'
+        required: true
+        type: string
+      source_run_number:
+        description: 'The source run number for artifact naming and comment'
+        required: true
+        type: string
+      source_run_attempt:
+        description: 'The source run attempt for artifact naming and comment'
+        required: true
+        type: string
+      pr_number:
+        description: 'The PR number to post comment on'
+        required: true
+        type: string
 permissions:
   contents: write
   issues: write
@@ -10,15 +31,23 @@ jobs:
     continue-on-error: true
     env:
       # Unique URL path for each workflow run attempt
-      HTML_REPORT_URL_PATH: reports/${{ github.head_ref }}/${{ github.run_id }}/${{ github.run_attempt }}
-      BRANCH_REPORTS_DIR: reports/${{ github.head_ref }}
+      HTML_REPORT_URL_PATH: reports/${{ inputs.head_branch }}/${{ inputs.source_run_id }}/${{ inputs.source_run_attempt }}
+      BRANCH_REPORTS_DIR: reports/${{ inputs.head_branch }}
     steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'test-results-2'
+
       - name: Checkout GitHub Pages Branch
         uses: actions/checkout@v4
         with:
           repository: calcom/test-results-2
           ref: gh-pages
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
       - name: Set Git User
         # see: https://github.com/actions/checkout/issues/13#issuecomment-724415212
         run: |
@@ -34,22 +63,27 @@ jobs:
       - name: Cleanup old HTML reports
         if: ${{ env.BRANCH_REPORTS_EXIST == 'true' }}
         timeout-minutes: 3
+        env:
+          HEAD_BRANCH: ${{ inputs.head_branch }}
         run: |
-          rm -rf $BRANCH_REPORTS_DIR
+          rm -rf "$BRANCH_REPORTS_DIR"
           git add .
-          git commit -m "workflow: remove all reports for branch ${{ github.head_ref }}"
+          git commit -m "workflow: remove all reports for branch $HEAD_BRANCH"
       - name: Download zipped HTML report
         uses: actions/download-artifact@v4
         with:
-          name: html-report--attempt-${{ github.run_number }}-${{ github.run_attempt }}
+          name: html-report--attempt-${{ inputs.source_run_number }}-${{ inputs.source_run_attempt }}
           path: ${{ env.HTML_REPORT_URL_PATH }}
       - name: Push HTML Report
         timeout-minutes: 3
         # commit report, then try push-rebase-loop until it's able to merge the HTML report to the gh-pages branch
         # this is necessary when this job running at least twice at the same time (e.g. through two pushes at the same time)
+        env:
+          RUN_ID: ${{ inputs.source_run_id }}
+          RUN_ATTEMPT: ${{ inputs.source_run_attempt }}
         run: |
           git add .
-          git commit -m "workflow: add HTML report for run-id ${{ github.run_id }} (attempt:  ${{ github.run_attempt }})"
+          git commit -m "workflow: add HTML report for run-id $RUN_ID (attempt: $RUN_ATTEMPT)"
 
           while true; do
             git pull --rebase
@@ -74,18 +108,18 @@ jobs:
         uses: peter-evans/find-comment@v2
         id: fc
         with:
-          issue-number: ${{ github.event.pull_request.number }}
+          issue-number: ${{ inputs.pr_number }}
           comment-author: "github-actions[bot]"
           body-includes: <!-- GENERATED-E2E-RESULTS -->
       - name: Create comment
         if: steps.fc.outputs.comment-id == ''
         uses: peter-evans/create-or-update-comment@v3
         with:
-          issue-number: ${{ github.event.pull_request.number }}
+          issue-number: ${{ inputs.pr_number }}
           body: |
             <!-- GENERATED-E2E-RESULTS -->
             ## E2E results are ready!
-            - [Workflow #${{ github.run_number }}.${{ github.run_attempt }} latest results](${{ steps.url.outputs.link }})
+            - [Workflow #${{ inputs.source_run_number }}.${{ inputs.source_run_attempt }} latest results](${{ steps.url.outputs.link }})
       - name: Update comment
         if: steps.fc.outputs.comment-id != ''
         uses: peter-evans/create-or-update-comment@v3
@@ -95,4 +129,4 @@ jobs:
           body: |
             <!-- GENERATED-E2E-RESULTS -->
             ## E2E results are ready!
-            - [Workflow #${{ github.run_number }}.${{ github.run_attempt }} latest results](${{ steps.url.outputs.link }})
+            - [Workflow #${{ inputs.source_run_number }}.${{ inputs.source_run_attempt }} latest results](${{ steps.url.outputs.link }})

.github/workflows/release-docker.yaml

@@ -1,5 +1,9 @@
 name: "Release Docker"
 
+permissions:
+  contents: read
+  packages: write
+
 env:
   POSTGRES_USER: "unicorn_user"
   POSTGRES_PASSWORD: "magical_password"
@@ -14,18 +18,30 @@ on:
   workflow_dispatch:
     inputs:
       RELEASE_TAG:
-        description: "v{Major}.{Minor}.{Patch}"
+        description: "Tag to build (e.g., v6.0.5)"
+        required: true
+      PUSH_IMAGE:
+        description: "Push the Docker image to DockerHub"
+        type: boolean
+        default: true
 
 jobs:
   release-amd64:
     name: "Release AMD64"
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.RELEASE_TAG || github.ref }}
 
       - name: "Determine tag"
-        run: 'echo "RELEASE_TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV'
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "RELEASE_TAG=${{ inputs.RELEASE_TAG }}" >> $GITHUB_ENV
+          else
+            echo "RELEASE_TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+          fi
 
       - name: Build and test Docker image
         uses: ./.github/actions/docker-build-and-test
@@ -39,7 +55,8 @@ jobs:
           postgres-password: ${{ env.POSTGRES_PASSWORD }}
           postgres-db: ${{ env.POSTGRES_DB }}
           database-host: ${{ env.DATABASE_HOST }}
-          push-image: "true"
+          push-image: ${{ (github.event_name == 'push' || inputs.PUSH_IMAGE) && 'true' || 'false' }}
+          use-as-latest: "true"
 
       - name: Notify Slack on Success
         if: success()
@@ -69,9 +86,16 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.RELEASE_TAG || github.ref }}
 
       - name: "Determine tag"
-        run: 'echo "RELEASE_TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV'
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "RELEASE_TAG=${{ inputs.RELEASE_TAG }}" >> $GITHUB_ENV
+          else
+            echo "RELEASE_TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+          fi
 
       - name: Build and test Docker image
         uses: ./.github/actions/docker-build-and-test
@@ -85,7 +109,7 @@ jobs:
           postgres-password: ${{ env.POSTGRES_PASSWORD }}
           postgres-db: ${{ env.POSTGRES_DB }}
           database-host: ${{ env.DATABASE_HOST }}
-          push-image: "true"
+          push-image: ${{ (github.event_name == 'push' || inputs.PUSH_IMAGE) && 'true' || 'false' }}
 
       - name: Notify Slack on Success
         if: success()

.github/workflows/run-ci.yml

@@ -0,0 +1,125 @@
+name: Run CI
+
+on:
+  pull_request_target:
+    types: [labeled]
+
+permissions:
+  actions: write
+  contents: read
+
+jobs:
+  trigger:
+    name: Trigger CI
+    if: github.event.label.name == 'run-ci' || github.event.label.name == 'ready-for-e2e'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify and trigger CI
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const adder = context.payload.sender.login;
+            const senderType = context.payload.sender.type;
+            const pr = context.payload.pull_request;
+
+            console.log(`Sender: ${adder} (type: ${senderType})`);
+
+            const trustedBotLogins = ['graphite-app[bot]'];
+            let isAuthorized = false;
+
+            if (senderType === 'Bot' && trustedBotLogins.includes(adder)) {
+              console.log(`Authorized: trusted GitHub App`);
+              isAuthorized = true;
+            }
+
+            if (!isAuthorized) {
+              const { data: perm } = await github.rest.repos.getCollaboratorPermissionLevel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                username: adder,
+              });
+
+              if (!['admin', 'maintain', 'write'].includes(perm.permission)) {
+                core.setFailed(`${adder} does not have write access`);
+                return;
+              }
+
+              console.log(`Label added by ${adder}`);
+            }
+
+            // Find the latest pr.yml run for this PR's head SHA
+            const { data: runs } = await github.rest.actions.listWorkflowRuns({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'pr.yml',
+              head_sha: pr.head.sha,
+              per_page: 5,
+            });
+
+            // Filter runs to this PR (in case same SHA exists in multiple PRs)
+            const matchingRuns = runs.workflow_runs.filter(run =>
+              !run.pull_requests?.length || run.pull_requests.some(p => p.number === pr.number)
+            );
+
+            if (matchingRuns.length === 0) {
+              core.setFailed(`No PR workflow found for SHA ${pr.head.sha}`);
+              return;
+            }
+
+            const latestRun = matchingRuns[0];
+
+            // If workflow is still running, cancel it first then re-run
+            if (latestRun.status === 'in_progress' || latestRun.status === 'queued') {
+              console.log(`Workflow is running (status: ${latestRun.status}). Cancelling it first...`);
+
+              await github.rest.actions.cancelWorkflowRun({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                run_id: latestRun.id,
+              });
+
+              // Wait for the workflow to be cancelled (poll with timeout)
+              const maxWaitTime = 60000; // 60 seconds
+              const pollInterval = 2000; // 2 seconds
+              const startTime = Date.now();
+
+              while (Date.now() - startTime < maxWaitTime) {
+                await new Promise(resolve => setTimeout(resolve, pollInterval));
+
+                const { data: updatedRun } = await github.rest.actions.getWorkflowRun({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  run_id: latestRun.id,
+                });
+
+                if (updatedRun.status === 'completed') {
+                  console.log(`Workflow cancelled successfully (conclusion: ${updatedRun.conclusion})`);
+                  break;
+                }
+
+                console.log(`Waiting for workflow to cancel... (status: ${updatedRun.status})`);
+              }
+
+              // Check final status
+              const { data: finalRun } = await github.rest.actions.getWorkflowRun({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                run_id: latestRun.id,
+              });
+
+              if (finalRun.status !== 'completed') {
+                core.setFailed(`Timed out waiting for workflow to cancel (status: ${finalRun.status})`);
+                return;
+              }
+            }
+
+            console.log(`Re-running workflow ${latestRun.id} (was: ${latestRun.conclusion || latestRun.status})`);
+
+            // Re-run preserves original context (PR, SHA, etc.)
+            await github.rest.actions.reRunWorkflow({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: latestRun.id,
+            });
+
+            console.log(`Triggered: ${latestRun.html_url}`);

.github/workflows/setup-db.yml

@@ -0,0 +1,56 @@
+name: Setup Database
+
+on:
+  workflow_call:
+    inputs:
+      DB_CACHE_HIT:
+        required: false
+        type: string
+        default: "false"
+        description: "Whether the DB cache was hit (skip yarn-install and cache-db if true)"
+
+permissions:
+  contents: read
+
+env:
+  CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
+  DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
+  E2E_TEST_CALCOM_QA_EMAIL: ${{ secrets.E2E_TEST_CALCOM_QA_EMAIL }}
+  E2E_TEST_CALCOM_QA_PASSWORD: ${{ secrets.E2E_TEST_CALCOM_QA_PASSWORD }}
+  E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS: ${{ secrets.E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS }}
+  GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+
+jobs:
+  setup-db:
+    name: Setup Database
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 15
+    services:
+      postgres:
+        image: postgres:13
+        credentials:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: calendso
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/dangerous-git-checkout
+      - uses: ./.github/actions/yarn-install
+        if: inputs.DB_CACHE_HIT != 'true'
+      - run: yarn prisma generate
+        if: inputs.DB_CACHE_HIT != 'true'
+      - uses: ./.github/actions/cache-db
+        if: inputs.DB_CACHE_HIT != 'true'

.github/workflows/unit-tests.yml

@@ -9,16 +9,12 @@ jobs:
   test:
     name: Unit
     timeout-minutes: 20
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
+      - run: yarn prisma generate
       - run: yarn test -- --no-isolate
       # We could add different timezones here that we need to run our tests in
-      - run: TZ=America/Los_Angeles yarn test -- --timeZoneDependentTestsOnly --no-isolate
-      - name: Run API v2 tests
-        working-directory: apps/api/v2
-        run: |
-          export NODE_OPTIONS="--max_old_space_size=8192"
-          yarn workspace @calcom/platform-libraries build && yarn test
+      - run: TZ=America/Los_Angeles VITEST_MODE=timezone yarn test -- --no-isolate

.github/workflows/yarn-install.yml

@@ -1,18 +0,0 @@
-name: Yarn install
-
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  setup:
-    name: Yarn install & cache
-    runs-on: buildjet-4vcpu-ubuntu-2204
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/dangerous-git-checkout
-      - uses: ./.github/actions/yarn-install
-      - uses: ./.github/actions/yarn-playwright-install

.husky/pre-commit

@@ -1,3 +1,7 @@
-yarn lint-staged
+if [ -f .git/MERGE_HEAD ]; then
+  echo "Merge detected. Skipping lint-staged and generators."
+  exit 0
+fi
 
+yarn lint-staged
 yarn app-store:build && git add packages/app-store/*.generated.*

.prettierignore

@@ -1,19 +0,0 @@
-node_modules
-.next
-public
-**/**/node_modules
-**/**/.next
-**/**/public
-
-*.lock
-*.log
-
-.gitignore
-.npmignore
-.prettierignore
-.DS_Store
-.eslintignore
-packages/prisma/zod
-packages/prisma/enums
-apps/web/public/embed
-packages/ui/components/icon/dynamicIconImports.tsx

.prettierrc.js

@@ -1 +0,0 @@
-module.exports = require("./packages/config/prettier-preset");

.vscode/extensions.json

@@ -1,13 +1,12 @@
 {
   "recommendations": [
-    "DavidAnson.vscode-markdownlint", // markdown linting
-    "yzhang.markdown-all-in-one", // nicer markdown support
-    "esbenp.prettier-vscode", // prettier plugin
-    "dbaeumer.vscode-eslint", // eslint plugin
-    "ban.spellright", // Spell check for docs
-    "stripe.vscode-stripe", // stripe VSCode extension
-    "Prisma.prisma", // syntax|format|completion for prisma
-    "rebornix.project-snippets", // Share useful snippets between collaborators
-    "inlang.vs-code-extension" // improved i18n DX
+    "biomejs.biome",
+    "DavidAnson.vscode-markdownlint",
+    "yzhang.markdown-all-in-one",
+    "ban.spellright",
+    "stripe.vscode-stripe",
+    "Prisma.prisma",
+    "rebornix.project-snippets",
+    "inlang.vs-code-extension"
   ]
 }

.vscode/settings.json

@@ -1,12 +1,15 @@
 {
   "typescript.tsdk": "node_modules/typescript/lib",
   "editor.formatOnSave": true,
-  "editor.defaultFormatter": "esbenp.prettier-vscode",
+  "editor.defaultFormatter": "biomejs.biome",
   "editor.codeActionsOnSave": {
     "source.fixAll.eslint": "explicit"
   },
   "typescript.preferences.importModuleSpecifier": "non-relative",
   "spellright.language": ["en"],
   "spellright.documentTypes": ["markdown", "typescript", "typescriptreact"],
-  "tailwindCSS.classFunctions": ["cva"]
+  "tailwindCSS.classFunctions": ["cva"],
+  "[typescript]": {
+    "editor.defaultFormatter": "biomejs.biome"
+  }
 }

.yarn/patches/next-i18next-npm-13.3.0-bf25b0943c.patch

@@ -2,8 +2,8 @@ diff --git a/dist/commonjs/serverSideTranslations.js b/dist/commonjs/serverSideT
 index bcad3d02fbdfab8dacb1d85efd79e98623a0c257..fff668f598154a13c4030d1b4a90d5d9c18214ad 100644
 --- a/dist/commonjs/serverSideTranslations.js
 +++ b/dist/commonjs/serverSideTranslations.js
-@@ -36,7 +36,6 @@ var _fs = _interopRequireDefault(require("fs"));
- var _path = _interopRequireDefault(require("path"));
+@@ -36,7 +36,6 @@ var _fs = _interopRequireDefault(require("node:fs"));
+ var _path = _interopRequireDefault(require("node:path"));
  var _createConfig = require("./config/createConfig");
  var _node = _interopRequireDefault(require("./createClient/node"));
 -var _appWithTranslation = require("./appWithTranslation");

.yarnrc.yml

@@ -1,11 +1,7 @@
+compressionLevel: mixed
+
+enableGlobalCache: false
+
 nodeLinker: node-modules
 
-plugins:
-  - path: .yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
-    spec: "@yarnpkg/plugin-interactive-tools"
-  - path: .yarn/plugins/@yarnpkg/plugin-workspace-tools.cjs
-    spec: "@yarnpkg/plugin-workspace-tools"
-  - path: .yarn/plugins/@yarnpkg/plugin-version.cjs
-    spec: "@yarnpkg/plugin-version"
-
-yarnPath: .yarn/releases/yarn-3.4.1.cjs
+yarnPath: .yarn/releases/yarn-4.12.0.cjs

AGENTS.md

@@ -16,6 +16,8 @@ You are a senior Cal.com engineer working in a Yarn/Turbo monorepo. You prioriti
 - Use `date-fns` or native `Date` instead of Day.js when timezone awareness isn't needed
 - Put permission checks in `page.tsx`, never in `layout.tsx`
 - Use `ast-grep` for searching if available; otherwise use `rg` (ripgrep), then fall back to `grep`
+- Use Biome for formatting and linting
+
 
 ## Don't
 
@@ -36,11 +38,8 @@ You are a senior Cal.com engineer working in a Yarn/Turbo monorepo. You prioriti
 # Type check - always run on changed files
 yarn type-check:ci --force
 
-# Lint single file
-yarn eslint --fix path/to/file.tsx
-
-# Format single file  
-yarn prettier --write path/to/file.tsx
+# Lint and format single file
+yarn biome check --write path/to/file.tsx
 
 # Unit test specific file
 yarn vitest run path/to/file.test.ts
@@ -69,9 +68,9 @@ yarn dev              # Start dev server
 yarn dx               # Dev with database setup
 
 # Build & check
-yarn build            # Build all packages
-yarn lint:fix         # Lint and fix all
-yarn type-check       # Type check all
+yarn build                   # Build all packages
+yarn biome check --write .   # Lint and format all
+yarn type-check              # Type check all
 
 # Tests (use TZ=UTC for consistency)
 TZ=UTC yarn test      # All unit tests
@@ -82,6 +81,14 @@ yarn prisma generate  # Regenerate types after schema changes
 yarn workspace @calcom/prisma db-migrate  # Run migrations
 ```
 
+### Biome focused workflow
++
+```bash
+yarn biome check --write .
+yarn type-check:ci --force
+```
+
+
 ## Boundaries
 
 ### Always do
@@ -89,6 +96,7 @@ yarn workspace @calcom/prisma db-migrate  # Run migrations
 - Run relevant tests before pushing
 - Use `select` in Prisma queries
 - Follow conventional commits for PR titles
+- Run Biome before pushing
 
 ### Ask first
 - Adding new dependencies

Dockerfile

@@ -19,20 +19,20 @@ ARG NEXT_PUBLIC_SINGLE_ORG_SLUG
 ARG ORGANIZATIONS_ENABLED
 
 ENV NEXT_PUBLIC_WEBAPP_URL=http://NEXT_PUBLIC_WEBAPP_URL_PLACEHOLDER \
-    NEXT_PUBLIC_API_V2_URL=$NEXT_PUBLIC_API_V2_URL \
-    NEXT_PUBLIC_LICENSE_CONSENT=$NEXT_PUBLIC_LICENSE_CONSENT \
-    NEXT_PUBLIC_WEBSITE_TERMS_URL=$NEXT_PUBLIC_WEBSITE_TERMS_URL \
-    NEXT_PUBLIC_WEBSITE_PRIVACY_POLICY_URL=$NEXT_PUBLIC_WEBSITE_PRIVACY_POLICY_URL \
-    CALCOM_TELEMETRY_DISABLED=$CALCOM_TELEMETRY_DISABLED \
-    DATABASE_URL=$DATABASE_URL \
-    DATABASE_DIRECT_URL=$DATABASE_URL \
-    NEXTAUTH_SECRET=${NEXTAUTH_SECRET} \
-    CALENDSO_ENCRYPTION_KEY=${CALENDSO_ENCRYPTION_KEY} \
-    NEXT_PUBLIC_SINGLE_ORG_SLUG=$NEXT_PUBLIC_SINGLE_ORG_SLUG \
-    ORGANIZATIONS_ENABLED=$ORGANIZATIONS_ENABLED \
-    NODE_OPTIONS=--max-old-space-size=${MAX_OLD_SPACE_SIZE} \
-    BUILD_STANDALONE=true \
-    CSP_POLICY=$CSP_POLICY
+  NEXT_PUBLIC_API_V2_URL=$NEXT_PUBLIC_API_V2_URL \
+  NEXT_PUBLIC_LICENSE_CONSENT=$NEXT_PUBLIC_LICENSE_CONSENT \
+  NEXT_PUBLIC_WEBSITE_TERMS_URL=$NEXT_PUBLIC_WEBSITE_TERMS_URL \
+  NEXT_PUBLIC_WEBSITE_PRIVACY_POLICY_URL=$NEXT_PUBLIC_WEBSITE_PRIVACY_POLICY_URL \
+  CALCOM_TELEMETRY_DISABLED=$CALCOM_TELEMETRY_DISABLED \
+  DATABASE_URL=$DATABASE_URL \
+  DATABASE_DIRECT_URL=$DATABASE_URL \
+  NEXTAUTH_SECRET=${NEXTAUTH_SECRET} \
+  CALENDSO_ENCRYPTION_KEY=${CALENDSO_ENCRYPTION_KEY} \
+  NEXT_PUBLIC_SINGLE_ORG_SLUG=$NEXT_PUBLIC_SINGLE_ORG_SLUG \
+  ORGANIZATIONS_ENABLED=$ORGANIZATIONS_ENABLED \
+  NODE_OPTIONS=--max-old-space-size=${MAX_OLD_SPACE_SIZE} \
+  BUILD_STANDALONE=true \
+  CSP_POLICY=$CSP_POLICY
 
 COPY package.json yarn.lock .yarnrc.yml playwright.config.ts turbo.json i18n.json ./
 COPY .yarn ./.yarn
@@ -47,6 +47,7 @@ RUN yarn install
 # Build and make embed servable from web/public/embed folder
 RUN yarn workspace @calcom/trpc run build
 RUN yarn --cwd packages/embeds/embed-core workspace @calcom/embed-core run build
+RUN yarn --cwd apps/web workspace @calcom/web run copy-app-store-static
 RUN yarn --cwd apps/web workspace @calcom/web run build
 RUN rm -rf node_modules/.cache .yarn/cache apps/web/.next/cache
 
@@ -70,7 +71,7 @@ RUN chmod +x scripts/*
 # Save value used during this build stage. If NEXT_PUBLIC_WEBAPP_URL and BUILT_NEXT_PUBLIC_WEBAPP_URL differ at
 # run-time, then start.sh will find/replace static values again.
 ENV NEXT_PUBLIC_WEBAPP_URL=$NEXT_PUBLIC_WEBAPP_URL \
-    BUILT_NEXT_PUBLIC_WEBAPP_URL=$NEXT_PUBLIC_WEBAPP_URL
+  BUILT_NEXT_PUBLIC_WEBAPP_URL=$NEXT_PUBLIC_WEBAPP_URL
 
 RUN scripts/replace-placeholder.sh http://NEXT_PUBLIC_WEBAPP_URL_PLACEHOLDER ${NEXT_PUBLIC_WEBAPP_URL}
 
@@ -83,12 +84,12 @@ RUN apt-get update && apt-get install -y --no-install-recommends netcat-openbsd
 COPY --from=builder-two /calcom ./
 ARG NEXT_PUBLIC_WEBAPP_URL=http://localhost:3000
 ENV NEXT_PUBLIC_WEBAPP_URL=$NEXT_PUBLIC_WEBAPP_URL \
-    BUILT_NEXT_PUBLIC_WEBAPP_URL=$NEXT_PUBLIC_WEBAPP_URL
+  BUILT_NEXT_PUBLIC_WEBAPP_URL=$NEXT_PUBLIC_WEBAPP_URL
 
 ENV NODE_ENV=production
 EXPOSE 3000
 
 HEALTHCHECK --interval=30s --timeout=30s --retries=5 \
-    CMD wget --spider http://localhost:3000 || exit 1
+  CMD wget --spider http://localhost:3000 || exit 1
 
 CMD ["/calcom/scripts/start.sh"]

README.md

@@ -174,6 +174,20 @@ Here is what you need to be able to run Cal.com.
 yarn dx
 ```
 
+**Default credentials created:**
+
+| Email | Password | Role |
+|-------|----------|------|
+| `free@example.com` | `free` | Free user |
+| `pro@example.com` | `pro` | Pro user |
+| `trial@example.com` | `trial` | Trial user |
+| `admin@example.com` | `ADMINadmin2022!` | Admin user |
+| `onboarding@example.com` | `onboarding` | Onboarding incomplete |
+
+You can use any of these credentials to sign in at [http://localhost:3000](http://localhost:3000)
+
+> **Tip**: To view the full list of seeded users and their details, run `yarn db-studio` and visit [http://localhost:5555](http://localhost:5555)
+
 #### Development tip
 
 1. Add `export NODE_OPTIONS=“--max-old-space-size=16384”` to your shell script to increase the memory limit for the node process. Alternatively, you can run this in your terminal before running the app. Replace 16384 with the amount of RAM you want to allocate to the node process.
@@ -193,7 +207,7 @@ yarn dx
 
    The logger will include all logs that are at the specified level or higher. For example: \
 
-   - If you set `NEXT_PUBLIC_LOGGER_LEVEL=2`, it will log from level 2 (debug) upwards, meaning levels 2 (debug), 3 (info), 4 (warn), 5 (error), and (fatal) will be logged. \
+   - If you set `NEXT_PUBLIC_LOGGER_LEVEL=2`, it will log from level 2 (debug) upwards, meaning levels 2 (debug), 3 (info), 4 (warn), 5 (error), and 6 (fatal) will be logged. \
    - If you set `NEXT_PUBLIC_LOGGER_LEVEL=3`, it will log from level 3 (info) upwards, meaning levels 3 (info), 4 (warn), 5 (error), and 6 (fatal) will be logged, but level 2 (debug) and level 1 (trace) will be ignored. \
 
 ```sh

agents/commands.md

@@ -16,11 +16,11 @@
 
 ## Lint & Type Check
 
-- `yarn lint` - Run ESLint on codebase
-- `yarn lint:fix` - Run ESLint and fix issues
-- `yarn lint:report` - Generate lint report
+- `yarn lint` - Run Biome across the codebase
+- `yarn lint:fix` - Run Biome and apply safe fixes
+- `yarn lint:report` - Generate Biome lint report
 - `yarn type-check` - Run TypeScript type checking
-- `yarn format` - Format code with Prettier
+- `yarn format` - Format code with Biome
 
 ## Testing Commands
 

agents/knowledge-base.md

@@ -255,7 +255,55 @@ import { TRPCError } from "@trpc/server";
 
 ### packages/features Import Restrictions
 
-Files in `packages/features/**` should NOT import from `trpc`. This keeps the features package decoupled from the tRPC layer, making the code more reusable and testable. Use `ErrorWithCode` for error handling in these files, and let the tRPC middleware handle the conversion.
+Files in `packages/features/**` should NOT import from `@calcom/trpc`. This keeps the features package decoupled from the tRPC layer, making the code more reusable and testable. Use `ErrorWithCode` for error handling in these files, and let the tRPC middleware handle the conversion.
+
+**Architecture: packages/features vs apps/web/modules**
+
+The `packages/features` package should contain only framework-agnostic code:
+- Repositories (data access layer)
+- Services (business logic)
+- Core utilities and helpers
+- Types and interfaces
+
+Web-specific code, particularly anything that uses tRPC, should live in `apps/web/modules/...`. This includes:
+- React hooks that use tRPC queries/mutations
+- tRPC-specific utilities
+- Web-only UI components that depend on tRPC
+
+**Example:**
+
+If you have a feature called `feature-opt-in`:
+
+```
+packages/features/feature-opt-in/
+├── repository/
+│   └── FeatureOptInRepository.ts    # Data access - OK here
+├── service/
+│   └── FeatureOptInService.ts       # Business logic - OK here
+└── types.ts                          # Types - OK here
+
+apps/web/modules/feature-opt-in/
+└── hooks/
+    └── useFeatureOptIn.ts           # tRPC hook - MUST be here, not in packages/features
+```
+
+```typescript
+// ❌ Bad - tRPC hook in packages/features
+// packages/features/feature-opt-in/hooks/useFeatureOptIn.ts
+import { trpc } from "@calcom/trpc/react";
+export function useFeatureOptIn() {
+  return trpc.viewer.featureOptIn.useQuery();
+}
+
+// ✅ Good - tRPC hook in apps/web/modules
+// apps/web/modules/feature-opt-in/hooks/useFeatureOptIn.ts
+import { trpc } from "@calcom/trpc/react";
+export function useFeatureOptIn() {
+  return trpc.viewer.featureOptIn.useQuery();
+}
+```
+
+This separation ensures that `packages/features` remains portable and can be used by other apps (like `apps/api/v2`) without pulling in web-specific dependencies like tRPC React hooks.
 
 ## Basic Performance Guidelines
 
@@ -372,6 +420,28 @@ export interface BookingDTO {
 }
 ```
 
+### DTO Location and Naming
+
+**Location**: All DTOs go in `packages/lib/dto/`
+
+**Naming conventions**:
+- Base entity: `{Entity}Dto` (e.g., `BookingDto`)
+- With relations: `{Entity}With{Relations}Dto` (e.g., `BookingWithAttendeesDto`)
+- For specific projections: `{Entity}For{Purpose}Dto` (e.g., `BookingForConfirmationDto`)
+- Avoid: `{Entity}Dto2`, `{Entity}DtoForHandler`, or other use-case-specific names
+
+**Enum/union pattern** – use string literal unions to stay ORM-agnostic:
+
+```typescript
+// ✅ Good - ORM-agnostic string literal union
+export type BookingStatusDto = "CANCELLED" | "ACCEPTED" | "REJECTED" | "PENDING";
+
+// ❌ Bad - importing Prisma enum
+import { BookingStatus } from "@calcom/prisma/client";
+```
+
+**Type safety** – never use `as any` in DTO mapping functions. If types don't align, fix the mapping explicitly.
+
 ### Prisma boundaries
 
 - **Allowed**: `packages/prisma`, repository implementations (`packages/features/**/repositories/*Repository.ts`), and low-level data access infrastructure.

apps/api/index.js

@@ -1,4 +1,4 @@
-const http = require("http");
+const http = require("node:http");
 const connect = require("connect");
 const { createProxyMiddleware } = require("http-proxy-middleware");
 

apps/api/package.json

@@ -10,11 +10,8 @@
   "author": "",
   "license": "ISC",
   "dependencies": {
-    "connect": "^3.7.0",
-    "http": "^0.0.1-security",
-    "http-proxy-middleware": "^2.0.6"
-  },
-  "devDependencies": {
-    "@calcom/eslint-config": "workspace:*"
+    "connect": "3.7.0",
+    "http": "0.0.1-security",
+    "http-proxy-middleware": "2.0.9"
   }
 }

apps/api/v1/.prettierignore

@@ -1,5 +0,0 @@
-.next/
-coverage/
-node_modules/
-tests/
-templates/

apps/api/v1/eslint.config.mjs

@@ -1,3 +0,0 @@
-import { nextJsConfig } from "@calcom/eslint-config/next-js";
-
-export default nextJsConfig;

apps/api/v1/lib/helpers/verifyApiKey.test.ts

@@ -11,9 +11,9 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import type { ILicenseKeyService } from "@calcom/ee/common/server/LicenseKeyService";
 import LicenseKeyService, { LicenseKeySingleton } from "@calcom/ee/common/server/LicenseKeyService";
-import { PrismaApiKeyRepository } from "@calcom/lib/server/repository/PrismaApiKeyRepository";
-import type { IDeploymentRepository } from "@calcom/lib/server/repository/deployment.interface";
-import { ApiKeyService } from "@calcom/lib/server/service/ApiKeyService";
+import { PrismaApiKeyRepository } from "@calcom/features/ee/api-keys/repositories/PrismaApiKeyRepository";
+import { ApiKeyService } from "@calcom/features/ee/api-keys/services/ApiKeyService";
+import type { IDeploymentRepository } from "@calcom/features/ee/deployment/repositories/IDeploymentRepository";
 import { UserPermissionRole } from "@calcom/prisma/enums";
 
 import { isAdminGuard } from "../utils/isAdmin";
@@ -21,11 +21,11 @@ import { isLockedOrBlocked } from "../utils/isLockedOrBlocked";
 import { ScopeOfAdmin } from "../utils/scopeOfAdmin";
 import { verifyApiKey } from "./verifyApiKey";
 
-vi.mock("@calcom/lib/server/service/ApiKeyService", () => ({
+vi.mock("@calcom/features/ee/api-keys/services/ApiKeyService", () => ({
   ApiKeyService: vi.fn(),
 }));
 
-vi.mock("@calcom/lib/server/repository/PrismaApiKeyRepository", () => ({
+vi.mock("@calcom/features/ee/api-keys/repositories/PrismaApiKeyRepository", () => ({
   PrismaApiKeyRepository: vi.fn(),
 }));
 
@@ -73,8 +73,8 @@ describe("Verify API key - Unit Tests", () => {
       verifyKeyByHashedKey: vi.fn(),
     } as unknown as ApiKeyService;
 
-    vi.mocked(ApiKeyService).mockImplementation(() => mockApiKeyService);
-    vi.mocked(PrismaApiKeyRepository).mockImplementation(() => ({} as unknown as PrismaApiKeyRepository));
+    vi.mocked(ApiKeyService).mockImplementation(function() { return mockApiKeyService; });
+    vi.mocked(PrismaApiKeyRepository).mockImplementation(function() { return {} as unknown as PrismaApiKeyRepository; });
 
     vi.mocked(isAdminGuard).mockReset();
     vi.mocked(isLockedOrBlocked).mockReset();
@@ -139,6 +139,7 @@ describe("Verify API key - Unit Tests", () => {
       valid: true,
       userId: 1,
       user: {
+        uuid: "test-uuid-1",
         role: UserPermissionRole.ADMIN,
         locked: false,
         email: "admin@example.com",
@@ -183,6 +184,7 @@ describe("Verify API key - Unit Tests", () => {
       valid: true,
       userId: 2,
       user: {
+        uuid: "test-uuid-2",
         role: UserPermissionRole.USER,
         locked: false,
         email: "org-admin@acme.com",
@@ -227,6 +229,7 @@ describe("Verify API key - Unit Tests", () => {
       valid: true,
       userId: 3,
       user: {
+        uuid: "test-uuid-3",
         role: UserPermissionRole.USER,
         locked: true,
         email: "locked@example.com",

apps/api/v1/lib/helpers/verifyApiKey.ts

@@ -2,10 +2,10 @@ import type { NextMiddleware } from "next-api-middleware";
 
 import { LicenseKeySingleton } from "@calcom/ee/common/server/LicenseKeyService";
 import { hashAPIKey } from "@calcom/features/ee/api-keys/lib/apiKeys";
+import { PrismaApiKeyRepository } from "@calcom/features/ee/api-keys/repositories/PrismaApiKeyRepository";
+import { ApiKeyService } from "@calcom/features/ee/api-keys/services/ApiKeyService";
+import { DeploymentRepository } from "@calcom/features/ee/deployment/repositories/DeploymentRepository";
 import { IS_PRODUCTION } from "@calcom/lib/constants";
-import { PrismaApiKeyRepository } from "@calcom/lib/server/repository/PrismaApiKeyRepository";
-import { DeploymentRepository } from "@calcom/lib/server/repository/deployment";
-import { ApiKeyService } from "@calcom/lib/server/service/ApiKeyService";
 import { prisma } from "@calcom/prisma";
 
 import { isAdminGuard } from "../utils/isAdmin";
@@ -36,9 +36,10 @@ export const verifyApiKey: NextMiddleware = async (req, res, next) => {
     return res.status(401).json({ error: result.error });
   }
 
-  // save the user id in the request for later use
-  req.userId = result.userId!;
-  req.user = result.user!;
+  // save the user id and uuid in the request for later use
+  req.userId = result.userId;
+  req.userUuid = result.user.uuid;
+  req.user = result.user;
 
   const { isAdmin, scope } = await isAdminGuard(req);
   const userIsLockedOrBlocked = await isLockedOrBlocked(req);

apps/api/v1/lib/validations/booking.ts

@@ -128,7 +128,7 @@ export const schemaBookingReadPublic = Booking.extend({
   title: true,
   startTime: true,
   endTime: true,
-  timeZone: true,
+  // Note: timeZone is not a field on Booking model - it's in nested attendees/user objects
   attendees: true,
   user: true,
   eventType: true,

apps/api/v1/lib/validations/destination-calendar.ts

@@ -2,11 +2,11 @@ import { z } from "zod";
 
 import { DestinationCalendarSchema } from "@calcom/prisma/zod/modelSchema/DestinationCalendarSchema";
 
+// Note: bookingId is not a field on DestinationCalendar model in Prisma schema
 export const schemaDestinationCalendarBaseBodyParams = DestinationCalendarSchema.pick({
   integration: true,
   externalId: true,
   eventTypeId: true,
-  bookingId: true,
   userId: true,
 }).partial();
 
@@ -38,11 +38,11 @@ export const schemaDestinationCalendarEditBodyParams = schemaDestinationCalendar
   schemaDestinationCalendarEditParams
 );
 
+// Note: bookingId is not a field on DestinationCalendar model in Prisma schema
 export const schemaDestinationCalendarReadPublic = DestinationCalendarSchema.pick({
   id: true,
   integration: true,
   externalId: true,
   eventTypeId: true,
-  bookingId: true,
   userId: true,
 });

apps/api/v1/lib/validations/user.ts

@@ -151,6 +151,7 @@ export const schemaUserCreateBodyParams = schemaUserBaseBodyParams
   .strict();
 
 // @note: These are the values that are always returned when reading a user
+// Note: We pick avatarUrl from the Prisma schema and extend with avatar for API v1 backward compatibility
 export const schemaUserReadPublic = UserSchema.pick({
   id: true,
   username: true,
@@ -158,7 +159,7 @@ export const schemaUserReadPublic = UserSchema.pick({
   email: true,
   emailVerified: true,
   bio: true,
-  avatar: true,
+  avatarUrl: true,
   timeZone: true,
   weekStart: true,
   endTime: true,
@@ -176,6 +177,9 @@ export const schemaUserReadPublic = UserSchema.pick({
   verified: true,
   invitedTo: true,
   role: true,
+}).extend({
+  // API v1 backward compatibility: expose avatarUrl as avatar
+  avatar: UserSchema.shape.avatarUrl,
 });
 
 export const schemaUsersReadPublic = z.array(schemaUserReadPublic);

apps/api/v1/lib/validations/webhook.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 
 import { WEBHOOK_TRIGGER_EVENTS } from "@calcom/features/webhooks/lib/constants";
+import { WebhookVersion } from "@calcom/features/webhooks/lib/interface/IWebhookRepository";
 import { WebhookSchema } from "@calcom/prisma/zod/modelSchema/WebhookSchema";
 
 const schemaWebhookBaseBodyParams = WebhookSchema.pick({
@@ -21,6 +22,7 @@ export const schemaWebhookCreateParams = z
     eventTypeId: z.number().optional(),
     userId: z.number().optional(),
     secret: z.string().optional().nullable(),
+    version: z.nativeEnum(WebhookVersion).optional(),
     // API shouldn't mess with Apps webhooks yet (ie. Zapier)
     // appId: z.string().optional().nullable(),
   })
@@ -33,6 +35,7 @@ export const schemaWebhookEditBodyParams = schemaWebhookBaseBodyParams
     z.object({
       eventTriggers: z.enum(WEBHOOK_TRIGGER_EVENTS).array().optional(),
       secret: z.string().optional().nullable(),
+      version: z.nativeEnum(WebhookVersion).optional(),
     })
   )
   .partial()
@@ -44,6 +47,7 @@ export const schemaWebhookReadPublic = WebhookSchema.pick({
   eventTypeId: true,
   payloadTemplate: true,
   eventTriggers: true,
+  version: true,
   // FIXME: We have some invalid urls saved in the DB
   // subscriberUrl: true,
   /** @todo: find out how to properly add back and validate those. */

apps/api/v1/next-i18next.config.js

@@ -1,4 +1,4 @@
-const path = require("path");
+const path = require("node:path");
 const i18nConfig = require("@calcom/config/next-i18next.config");
 
 /** @type {import("next-i18next").UserConfig} */

apps/api/v1/next.config.js

@@ -1,3 +1,4 @@
+/* eslint-disable */
 const { withAxiom } = require("next-axiom");
 const { withSentryConfig } = require("@sentry/nextjs");
 const { PrismaPlugin } = require("@prisma/nextjs-monorepo-workaround-plugin");
@@ -6,6 +7,7 @@ const plugins = [withAxiom];
 
 /** @type {import("next").NextConfig} */
 const nextConfig = {
+  turbopack: {},
   transpilePackages: [
     "@calcom/app-store",
     "@calcom/dayjs",
@@ -94,7 +96,7 @@ const nextConfig = {
   },
 };
 
-if (!!process.env.NEXT_PUBLIC_SENTRY_DSN) {
+if (process.env.NEXT_PUBLIC_SENTRY_DSN) {
   plugins.push((nextConfig) =>
     withSentryConfig(nextConfig, {
       autoInstrumentServerFunctions: true,

apps/api/v1/next.d.ts

@@ -8,6 +8,7 @@ export declare module "next" {
     session?: Session | null;
 
     userId: number;
+    userUuid: string;
     user?: { role: string; locked: boolean; email: string } | null;
     method: string;
     // session: { user: { id: number } };

apps/api/v1/package.json

@@ -10,18 +10,19 @@
     "build": "next build",
     "clean": "rm -rf .turbo && rm -rf node_modules && rm -rf .next",
     "dev": "PORT=3003 next dev",
-    "lint": "eslint .",
-    "lint:fix": "eslint . --ext .ts,.js,.tsx,.jsx --fix",
+    "lint": "biome lint .",
+    "lint:fix": "biome lint --write .",
     "start": "PORT=3003 next start",
     "docker-start-api": "PORT=80 next start",
     "type-check": "tsc --pretty --noEmit",
     "type-check:ci": "tsc-absolute --pretty --noEmit"
   },
   "devDependencies": {
-    "@calcom/eslint-config": "workspace:*",
+    "@calcom/testing": "workspace:*",
     "@calcom/tsconfig": "workspace:*",
     "@calcom/types": "workspace:*",
-    "node-mocks-http": "^1.11.0"
+    "node-mocks-http": "1.16.2",
+    "typescript": "5.9.3"
   },
   "dependencies": {
     "@calcom/app-store": "workspace:*",
@@ -31,18 +32,17 @@
     "@calcom/lib": "workspace:*",
     "@calcom/prisma": "workspace:*",
     "@calcom/trpc": "workspace:*",
-    "@prisma/nextjs-monorepo-workaround-plugin": "^6.16.1",
-    "@sentry/nextjs": "^9.15.0",
-    "bcryptjs": "^2.4.3",
-    "memory-cache": "^0.2.0",
-    "next": "15.4.10",
-    "next-api-middleware": "^1.0.1",
-    "next-axiom": "^0.17.0",
-    "next-swagger-doc": "^0.3.6",
-    "next-validations": "^0.2.0",
-    "typescript": "^5.9.0-beta",
-    "tzdata": "^1.0.30",
-    "uuid": "^8.3.2",
-    "zod": "^3.22.4"
+    "@prisma/nextjs-monorepo-workaround-plugin": "6.16.1",
+    "@sentry/nextjs": "9.15.0",
+    "bcryptjs": "2.4.3",
+    "memory-cache": "0.2.0",
+    "next": "16.1.0",
+    "next-api-middleware": "1.0.1",
+    "next-axiom": "0.17.0",
+    "next-swagger-doc": "0.3.6",
+    "next-validations": "0.2.1",
+    "tzdata": "1.0.40",
+    "uuid": "8.3.2",
+    "zod": "3.25.76"
   }
 }

apps/api/v1/pages/api/availability/_get.ts

@@ -8,6 +8,7 @@ import prisma from "@calcom/prisma";
 import { availabilityUserSelect } from "@calcom/prisma";
 import { MembershipRole } from "@calcom/prisma/enums";
 import { stringOrNumber } from "@calcom/prisma/zod-utils";
+import dayjs from "@calcom/dayjs";
 
 /**
  * @swagger
@@ -190,13 +191,21 @@ const availabilitySchema = z
 
 async function handler(req: NextApiRequest) {
   const { isSystemWideAdmin, userId: reqUserId } = req;
-  const { username, userId, eventTypeId, dateTo, dateFrom, teamId } = availabilitySchema.parse(req.query);
+  const { username, userId, eventTypeId, teamId, dateFrom, dateTo } = availabilitySchema.parse(req.query);
+
+  const dayjsDateFrom = dayjs(dateFrom);
+  const dayjsDateTo = dayjs(dateTo);
+
+  if (!dayjsDateFrom.isValid() || !dayjsDateTo.isValid()) {
+    throw new HttpError({ statusCode: 400, message: "Invalid date range" });
+  }
+
   const userAvailabilityService = getUserAvailabilityService();
   if (!teamId)
     return userAvailabilityService.getUserAvailability({
       username,
-      dateFrom,
-      dateTo,
+      dateFrom: dayjsDateFrom,
+      dateTo: dayjsDateTo,
       eventTypeId,
       userId,
       returnDateOverrides: true,
@@ -224,8 +233,8 @@ async function handler(req: NextApiRequest) {
   }, {} as MemberRoles);
   // check if the user is a team Admin or Owner, if it is a team request, or a system Admin
   const isUserAdminOrOwner =
-    memberRoles[reqUserId] == MembershipRole.ADMIN ||
-    memberRoles[reqUserId] == MembershipRole.OWNER ||
+    memberRoles[reqUserId] === MembershipRole.ADMIN ||
+    memberRoles[reqUserId] === MembershipRole.OWNER ||
     isSystemWideAdmin;
   if (!isUserAdminOrOwner) throw new HttpError({ statusCode: 403, message: "Forbidden" });
   const availabilities = members.map(async (user) => {
@@ -233,8 +242,8 @@ async function handler(req: NextApiRequest) {
       userId: user.id,
       availability: await userAvailabilityService.getUserAvailability({
         userId: user.id,
-        dateFrom,
-        dateTo,
+        dateFrom: dayjsDateFrom,
+        dateTo: dayjsDateTo,
         eventTypeId,
         returnDateOverrides: true,
         bypassBusyCalendarTimes: false,

apps/api/v1/pages/api/credential-sync/_post.ts

@@ -109,7 +109,7 @@ async function handler(req: NextApiRequest) {
   // ^ Workaround for the select in `create` not working
 
   if (createCalendarResources) {
-    const calendar = await getCalendar({ ...credential, delegatedTo: null });
+    const calendar = await getCalendar({ ...credential, delegatedTo: null }, "slots");
     if (!calendar) throw new HttpError({ message: "Calendar missing for credential", statusCode: 500 });
     const calendars = await calendar.listCalendars();
     const calendarToCreate = calendars.find((calendar) => calendar.primary) || calendars[0];

apps/api/v1/pages/api/invites/_post.ts

@@ -22,6 +22,7 @@ async function postHandler(req: NextApiRequest, res: NextApiResponse) {
     return {
       user: {
         id: req.userId,
+        uuid: req.userUuid,
         username: "",
         profile: {
           id: null,

apps/api/v1/pages/api/slots/_get.test.ts

@@ -1,4 +1,4 @@
-import prismock from "../../../../../../tests/libs/__mocks__/prisma";
+import prismock from "@calcom/testing/lib/__mocks__/prisma";
 
 import type { Request, Response } from "express";
 import type { NextApiRequest, NextApiResponse } from "next";

apps/api/v1/pages/api/teams/[teamId]/publish.ts

@@ -22,6 +22,7 @@ const patchHandler = async (req: NextApiRequest, res: NextApiResponse) => {
     return {
       user: {
         id: req.userId,
+        uuid: req.userUuid,
         username: "" /* Not used in this context */,
         role: req.isSystemWideAdmin ? UserPermissionRole.ADMIN : UserPermissionRole.USER,
         profile: {

apps/api/v1/pages/api/users/[userId]/_patch.ts

@@ -1,5 +1,8 @@
 import type { NextApiRequest } from "next";
 
+import { sendChangeOfEmailVerification } from "@calcom/features/auth/lib/verifyEmail";
+import { FeaturesRepository } from "@calcom/features/flags/features.repository";
+import { UserRepository } from "@calcom/features/users/repositories/UserRepository";
 import { HttpError } from "@calcom/lib/http-error";
 import { uploadAvatar } from "@calcom/lib/server/avatar";
 import { defaultResponder } from "@calcom/lib/server/defaultResponder";
@@ -130,10 +133,70 @@ export async function patchHandler(req: NextApiRequest) {
     });
   }
 
+  const userRepository = new UserRepository(prisma);
+  const currentUser = await userRepository.findById({ id: query.userId });
+
+  if (!currentUser) {
+    throw new HttpError({ statusCode: 404, message: "User not found" });
+  }
+
+  const featuresRepository = new FeaturesRepository(prisma);
+  const emailVerification = await featuresRepository.checkIfFeatureIsEnabledGlobally("email-verification");
+
+  const hasEmailBeenChanged = typeof body.email === "string" && currentUser.email !== body.email;
+  const newEmail = typeof body.email === "string" ? body.email : undefined;
+
+  const prismaData: Prisma.UserUpdateInput = { ...body };
+
+  if (hasEmailBeenChanged && newEmail) {
+    const secondaryEmail = await userRepository.findSecondaryEmailByUserIdAndEmail({
+        userId: query.userId,
+        email: newEmail,
+      });
+
+    if (emailVerification) {
+      if (secondaryEmail && secondaryEmail.emailVerified) {
+        const data = await userRepository.swapPrimaryEmailWithSecondaryEmail({
+          userId: query.userId,
+          secondaryEmailId: secondaryEmail.id,
+          oldPrimaryEmail: currentUser.email,
+          oldPrimaryEmailVerified: currentUser.emailVerified,
+          newPrimaryEmail: newEmail,
+          userUpdateData: prismaData,
+        });
+
+        const user = schemaUserReadPublic.parse(data);
+        return { user };
+      } else {
+        prismaData.metadata = {
+          ...(currentUser.metadata as Prisma.JsonObject),
+          ...(typeof prismaData.metadata === "object" && prismaData.metadata ? prismaData.metadata : {}),
+          emailChangeWaitingForVerification: newEmail.toLowerCase(),
+        };
+
+        delete prismaData.email;
+      }
+    }
+  }
+
   const data = await prisma.user.update({
     where: { id: query.userId },
-    data: body,
+    data: prismaData,
   });
+
+  const shouldSendEmailVerification =
+    hasEmailBeenChanged && emailVerification && newEmail && !prismaData.email;
+
+  if (shouldSendEmailVerification) {
+    await sendChangeOfEmailVerification({
+      user: {
+        username: data.username ?? "Nameless User",
+        emailFrom: currentUser.email,
+        emailTo: newEmail,
+      },
+    });
+  }
+
   const user = schemaUserReadPublic.parse(data);
   return { user };
 }

apps/api/v1/proxy.ts

@@ -1,7 +1,7 @@
 import type { NextRequest } from "next/server";
 import { NextResponse } from "next/server";
 
-export function middleware(_request: NextRequest) {
+function proxy(_request: NextRequest) {
   // Matcher guarantees the last segment is one of the blocked segments, so we can
   // immediately return a 403 without further path checks.
   return NextResponse.json({ message: "Forbidden" }, { status: 403 });
@@ -17,3 +17,5 @@ export const config = {
     "/:path*/_auth-middleware",
   ],
 };
+
+export default proxy;

apps/api/v1/test/jest-setup.js

@@ -1,6 +1,6 @@
 // This is a workaround for https://github.com/jsdom/jsdom/issues/2524#issuecomment-902027138
 
 // See https://github.com/microsoft/accessibility-insights-web/blob/40416a4ae6b91baf43102f58e069eff787de4de2/src/tests/unit/jest-setup.ts
-const { TextEncoder, TextDecoder } = require("util");
+const { TextEncoder, TextDecoder } = require("node:util");
 global.TextEncoder = TextEncoder;
 global.TextDecoder = TextDecoder;

apps/api/v1/test/lib/attendees/_post.test.ts

@@ -1,4 +1,4 @@
-import prismaMock from "../../../../../../tests/libs/__mocks__/prismaMock";
+import prismaMock from "@calcom/testing/lib/__mocks__/prismaMock";
 
 import type { Request, Response } from "express";
 import type { NextApiRequest, NextApiResponse } from "next";

apps/api/v1/test/lib/bookings/[id]/_delete.test.ts

@@ -1,4 +1,4 @@
-import prismaMock from "../../../../../../../tests/libs/__mocks__/prismaMock";
+import prismaMock from "@calcom/testing/lib/__mocks__/prismaMock";
 
 import type { Request, Response } from "express";
 import type { NextApiRequest, NextApiResponse } from "next";

apps/api/v1/test/lib/bookings/[id]/_patch.test.ts

@@ -1,4 +1,4 @@
-import prismaMock from "../../../../../../../tests/libs/__mocks__/prismaMock";
+import prismaMock from "@calcom/testing/lib/__mocks__/prismaMock";
 
 import type { Request, Response } from "express";
 import type { NextApiRequest, NextApiResponse } from "next";

apps/api/v1/test/lib/bookings/[id]/recordings/_get.test.ts

@@ -1,4 +1,4 @@
-import prismaMock from "../../../../../../../../tests/libs/__mocks__/prismaMock";
+import prismaMock from "@calcom/testing/lib/__mocks__/prismaMock";
 
 import type { Request, Response } from "express";
 import type { NextApiRequest, NextApiResponse } from "next";

apps/api/v1/test/lib/bookings/[id]/transcripts/[recordingId]/_get.test.ts

@@ -1,4 +1,4 @@
-import prismaMock from "../../../../../../../../../tests/libs/__mocks__/prismaMock";
+import prismaMock from "@calcom/testing/lib/__mocks__/prismaMock";
 
 import type { Request, Response } from "express";
 import type { NextApiRequest, NextApiResponse } from "next";

apps/api/v1/test/lib/bookings/[id]/transcripts/_get.test.ts

@@ -1,4 +1,4 @@
-import prismaMock from "../../../../../../../../tests/libs/__mocks__/prismaMock";
+import prismaMock from "@calcom/testing/lib/__mocks__/prismaMock";
 
 import type { Request, Response } from "express";
 import type { NextApiRequest, NextApiResponse } from "next";

apps/api/v1/test/lib/bookings/_get.test.ts

@@ -1,4 +1,4 @@
-import prismaMock from "../../../../../../tests/libs/__mocks__/prismaMock";
+import prismaMock from "@calcom/testing/lib/__mocks__/prismaMock";
 
 import type { Request, Response } from "express";
 import type { NextApiRequest, NextApiResponse } from "next";

apps/api/v1/test/lib/bookings/_post.test.ts

@@ -1,5 +1,5 @@
 // TODO: Fix tests (These test were never running due to the vitest workspace config)
-import prismaMock from "../../../../../../tests/libs/__mocks__/prismaMock";
+import prismaMock from "@calcom/testing/lib/__mocks__/prismaMock";
 
 import type { Request, Response } from "express";
 import type { NextApiRequest, NextApiResponse } from "next";
@@ -67,15 +67,22 @@ vi.mock("@calcom/features/webhooks/lib/sendOrSchedulePayload", () => ({
 
 const mockFindOriginalRescheduledBooking = vi.fn();
 vi.mock("@calcom/features/bookings/repositories/BookingRepository", () => ({
-  BookingRepository: vi.fn().mockImplementation(() => ({
+  BookingRepository: vi.fn().mockImplementation(function() { return {
     findOriginalRescheduledBooking: mockFindOriginalRescheduledBooking,
-  })),
+  }; }),
 }));
 
 vi.mock("@calcom/features/watchlist/operations/check-if-users-are-blocked.controller", () => ({
   checkIfUsersAreBlocked: vi.fn().mockResolvedValue(false),
 }));
 
+vi.mock("@calcom/features/watchlist/operations/filter-blocked-users.controller", () => ({
+  filterBlockedUsers: vi.fn().mockImplementation(async (users) => ({
+    eligibleUsers: users,
+    blockedCount: 0,
+  })),
+}));
+
 vi.mock("@calcom/features/di/containers/QualifiedHosts", () => ({
   getQualifiedHostsService: vi.fn().mockReturnValue({
     findQualifiedHostsWithDelegationCredentials: vi.fn().mockResolvedValue({
@@ -87,23 +94,25 @@ vi.mock("@calcom/features/di/containers/QualifiedHosts", () => ({
 }));
 
 vi.mock("@calcom/features/bookings/lib/EventManager", () => ({
-  default: vi.fn().mockImplementation(() => ({
-    reschedule: vi.fn().mockResolvedValue({
-      results: [],
-      referencesToCreate: [],
-    }),
-    create: vi.fn().mockResolvedValue({
-      results: [],
-      referencesToCreate: [],
-    }),
-    update: vi.fn().mockResolvedValue({
-      results: [],
-      referencesToCreate: [],
-    }),
-    createAllCalendarEvents: vi.fn().mockResolvedValue([]),
-    updateAllCalendarEvents: vi.fn().mockResolvedValue([]),
-    deleteEventsAndMeetings: vi.fn().mockResolvedValue([]),
-  })),
+  default: vi.fn().mockImplementation(function() {
+    return {
+      reschedule: vi.fn().mockResolvedValue({
+        results: [],
+        referencesToCreate: [],
+      }),
+      create: vi.fn().mockResolvedValue({
+        results: [],
+        referencesToCreate: [],
+      }),
+      update: vi.fn().mockResolvedValue({
+        results: [],
+        referencesToCreate: [],
+      }),
+      createAllCalendarEvents: vi.fn().mockResolvedValue([]),
+      updateAllCalendarEvents: vi.fn().mockResolvedValue([]),
+      deleteEventsAndMeetings: vi.fn().mockResolvedValue([]),
+    };
+  }),
   placeholderCreatedEvent: {
     results: [],
     referencesToCreate: [],
@@ -146,10 +155,10 @@ vi.mock("@calcom/features/profile/repositories/ProfileRepository", () => ({
   },
 }));
 vi.mock("@calcom/features/flags/features.repository", () => ({
-  FeaturesRepository: vi.fn().mockImplementation(() => ({
+  FeaturesRepository: vi.fn().mockImplementation(function() { return {
     checkIfFeatureIsEnabledGlobally: vi.fn().mockResolvedValue(false),
     checkIfTeamHasFeature: vi.fn().mockResolvedValue(false),
-  })),
+  }; }),
 }));
 
 vi.mock("@calcom/features/webhooks/lib/getWebhooks", () => ({
@@ -161,7 +170,7 @@ vi.mock("@calcom/features/ee/workflows/lib/getAllWorkflows", () => ({
   workflowSelect: {},
 }));
 
-vi.mock("@calcom/trpc/server/routers/viewer/workflows/util", () => ({
+vi.mock("@calcom/features/ee/workflows/lib/getAllWorkflowsFromEventType", () => ({
   getAllWorkflowsFromEventType: vi.fn().mockResolvedValue([]),
 }));
 
@@ -245,7 +254,9 @@ describe("POST /api/bookings", () => {
 
       const { req, res } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
         method: "POST",
-        body: {},
+        body: {
+          eventTypeId: 2,
+        },
       });
 
       await handler(req, res);

apps/api/v1/test/lib/event-types/[id]/_delete.test.ts

@@ -1,4 +1,4 @@
-import prismaMock from "../../../../../../../tests/libs/__mocks__/prismaMock";
+import prismaMock from "@calcom/testing/lib/__mocks__/prismaMock";
 
 import type { Request, Response } from "express";
 import type { NextApiRequest, NextApiResponse } from "next";

apps/api/v1/test/lib/event-types/[id]/_get.test.ts

@@ -1,4 +1,4 @@
-import prismaMock from "../../../../../../../tests/libs/__mocks__/prismaMock";
+import prismaMock from "@calcom/testing/lib/__mocks__/prismaMock";
 
 import type { Request, Response } from "express";
 import type { NextApiRequest, NextApiResponse } from "next";