v0.7.3: jira oauth scope fix, read-replica client, table wire data fix, db migrations from ci, docs updates, read replicas

[TheodoreSpeaks]

• fix(oauth): drop ungrantable JSM Forms scopes from Jira scope list (fix(oauth): drop ungrantable JSM Forms scopes from Jira scope list #4960)
• improvement(db): opt-in read-replica client + migration runner hardening (improvement(db): opt-in read-replica client + migration runner hardening #4955)
• fix(table): translate column name-keyed wire data for workflow tool calls on internal row routes (fix(table): translate column name-keyed wire data for workflow tool calls on internal row routes #4958)
• feat(ci): run db migrations from github ci with environment-scoped secrets (feat(ci): run db migrations from github ci with environment-scoped secrets #4957)
• improvement(docs): builder-first IA reorganization of the English docs (improvement(docs): builder-first IA reorganization of the English docs #4896)
• improvement(docs): align docs UI with the platform emcn design system (improvement(docs): align docs UI with the platform emcn design system #4962)
• improvement(mship): contract update (improvement(mship): contract update #4961)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jun 11, 2026 2:46am

[cursor]

PR Summary

High Risk
CI now applies schema changes to production/staging/dev databases before deploys, and table API behavior changes for internal JWT callers affect workflow tool data reads/writes.

Overview
CI runs database migrations before ECR image builds on main, staging, and dev, so schema is ready before CodePipeline deploys (replacing the ECS migration sidecar). The reusable migrations.yml workflow now takes an explicit environment input, maps it to a single DATABASE_URL secret, and fails if none resolves; dev still uses db:push, other envs use versioned migrate.ts.

Table internal row APIs add rowWireTranslators so internal JWT (workflow tool) callers use column names on the wire while storage stays column ids—for row data, filters, and sort on list/get/insert/update/upsert/delete-by-filter paths. Session (UI) callers remain id-keyed with no translation. New route tests cover POST/GET for both auth types.

^{Reviewed by Cursor Bugbot for commit 6e5cce6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR fixes wire-format translation for internal JWT (workflow tool) callers on the internal table row routes, ensuring column names are translated to/from stable column IDs at the API boundary. It also moves DB migrations to run before the ECR image push in CI, replacing the old post-build migration sidecar pattern.

• row-wire.ts: New rowWireTranslators factory returns identity functions for session (UI) callers and name↔id translators for internal_jwt callers, applied consistently across all five HTTP handlers in the rows routes, the single-row route, and the upsert route.
• CI ordering (ci.yml + migrations.yml): migrate (prod/staging) now depends on test-build, guaranteeing tests pass before production schema changes land; migrate-dev runs immediately on push (no needs) while build-dev blocks on it, ensuring schema is current before the dev image is deployed.
• migrations.yml: Added an explicit environment input with a chained secret-selection expression and a shell-level guard that hard-fails the job if no secret resolves, removing reliance on branch-ref heuristics.

Confidence Score: 4/5

Safe to merge; the translation logic is correct and backed by tests, and the CI reordering matches the stated intent.

The wire translation is applied symmetrically across all affected routes, the column-keys helpers are well-tested, and the conflictTarget passthrough in upsert is correctly handled by upsertRow internally. The test file covers POST and GET for both auth types but leaves PUT, DELETE, upsert, and rowId routes without dedicated wire-translation tests — a gap worth noting but not a blocking concern. On the CI side, migrate-dev carries no needs, so a failing test commit to dev will still trigger a schema push; this matches the existing dev-branch behaviour and is likely intentional, but worth confirming.

.github/workflows/ci.yml — confirm the intentional absence of a test-build gate on migrate-dev for the dev environment.

Important Files Changed

Filename	Overview
apps/sim/app/api/table/row-wire.ts	New helper that returns identity translators for session auth and name↔id translators for internal_jwt callers; logic is clean and correctly delegates to column-keys helpers.
apps/sim/app/api/table/[tableId]/rows/route.ts	All five HTTP handlers (POST single, POST batch, GET, PUT, DELETE) now thread rowWireTranslators through correctly; dataIn/filterIn/sortIn applied on input, dataOut applied on all row-returning responses.
apps/sim/app/api/table/[tableId]/rows/[rowId]/route.ts	GET and PATCH handlers updated with wire translators; dataIn on write path and dataOut on read path applied correctly.
apps/sim/app/api/table/[tableId]/rows/upsert/route.ts	Wire translators applied to data in/out; conflictTarget intentionally left untranslated because upsertRow resolves it by id-or-name internally (verified in service.ts).
apps/sim/app/api/table/[tableId]/rows/route.test.ts	New test file with 4 cases covering POST and GET wire translation for both auth types; uses real column-keys implementations to validate actual translation behaviour. PUT, DELETE, batch, upsert, and rowId handlers are not yet covered.
.github/workflows/ci.yml	migrate/migrate-dev jobs moved before the ECR push steps; migrate (prod/staging) correctly gates on test-build, while migrate-dev has no needs and runs in parallel with tests before build-dev.
.github/workflows/migrations.yml	Added environment input; chained expression selects the correct secret per environment with an explicit empty-string guard that fails the job if no secret resolves.

Sequence Diagram

sequenceDiagram
    participant Client as Workflow Tool (internal_jwt)
    participant Route as Table Row Route
    participant Wire as rowWireTranslators
    participant DB as Table Storage (id-keyed)

    Client->>Route: "POST {Name: Ada, Age: 36}"
    Route->>Wire: "dataIn({Name: Ada, Age: 36})"
    Wire-->>Route: "{col_aaa: Ada, col_bbb: 36}"
    Route->>DB: "insertRow({col_aaa: Ada, col_bbb: 36})"
    DB-->>Route: "row {data: {col_aaa: Ada, col_bbb: 36}}"
    Route->>Wire: "dataOut({col_aaa: Ada, col_bbb: 36})"
    Wire-->>Route: "{Name: Ada, Age: 36}"
    Route-->>Client: "200 {data: {Name: Ada, Age: 36}}"

    Note over Client,DB: Session (UI) callers skip translation — identity functions pass through unchanged

Loading

_{Reviews (1): Last reviewed commit: "fix(table): translate column name-keyed ..." | Re-trigger Greptile}