chore: sync main into develop (23 Sep)

go.mod

@@ -341,7 +341,7 @@ replace (
 	// Keep the left side unversioned: a versioned LHS stops matching whenever the
 	// require line is bumped, which silently un-pins this and breaks the linux build.
 	github.com/cyphar/filepath-securejoin => github.com/cyphar/filepath-securejoin v0.3.6 // indirect
-	github.com/devtron-labs/authenticator => github.com/devtron-labs/devtron-services/authenticator v0.0.0-20260803100101-66fcb35e4b0e
-	github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260803100101-66fcb35e4b0e
+	github.com/devtron-labs/authenticator => github.com/devtron-labs/devtron-services/authenticator v0.0.0-20260921111017-f0b3fba15081
+	github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260921111017-f0b3fba15081
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 => go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1
 )

go.sum

@@ -237,10 +237,10 @@ github.com/denisenkom/go-mssqldb v0.0.0-20200428022330-06a60b6afbbc h1:VRRKCwnzq
 github.com/denisenkom/go-mssqldb v0.0.0-20200428022330-06a60b6afbbc/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
 github.com/devtron-labs/argo-workflows/v3 v3.5.13 h1:3pINq0gXOSeTw2z/vYe+j80lRpSN5Rp/8mfQORh8SmU=
 github.com/devtron-labs/argo-workflows/v3 v3.5.13/go.mod h1:/vqxcovDPT4zqr4DjR5v7CF8ggpY1l3TSa2CIG3jmjA=
-github.com/devtron-labs/devtron-services/authenticator v0.0.0-20260803100101-66fcb35e4b0e h1:mfAbqKv+CswkCah0JCSzeTJThvjaNBt51TunM8lBsPU=
-github.com/devtron-labs/devtron-services/authenticator v0.0.0-20260803100101-66fcb35e4b0e/go.mod h1:m/dMed6iiZQ/4iOJ6kIVWXQ+T71rJjU7DnCr9RcYh1w=
-github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260803100101-66fcb35e4b0e h1:gh/iIVC9FNpPE8C72duWZGNgwgE2jrYonpYDvty2cFM=
-github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260803100101-66fcb35e4b0e/go.mod h1:QZfnuGy0xqrYWhq3jCRe6fDDwIsrpbjAR2PXNrh0su8=
+github.com/devtron-labs/devtron-services/authenticator v0.0.0-20260921111017-f0b3fba15081 h1:BPkaewVaxMTnIAHcxwsWgebl5GV7uc6R/a0tCBoTZn0=
+github.com/devtron-labs/devtron-services/authenticator v0.0.0-20260921111017-f0b3fba15081/go.mod h1:m/dMed6iiZQ/4iOJ6kIVWXQ+T71rJjU7DnCr9RcYh1w=
+github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260921111017-f0b3fba15081 h1:niegDwFaPhH5b+7UP2QuGdR6rB43hFYqNY1pJ6ZbXQw=
+github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260921111017-f0b3fba15081/go.mod h1:QZfnuGy0xqrYWhq3jCRe6fDDwIsrpbjAR2PXNrh0su8=
 github.com/devtron-labs/go-bitbucket v0.9.60-beta h1:VEx1jvDgdtDPS6A1uUFoaEi0l1/oLhbr+90xOwr6sDU=
 github.com/devtron-labs/go-bitbucket v0.9.60-beta/go.mod h1:GnuiCesvh8xyHeMCb+twm8lBR/kQzJYSKL28ZfObp1Y=
 github.com/devtron-labs/protos v0.0.3-0.20250323220609-ecf8a0f7305e h1:U6UdYbW8a7xn5IzFPd8cywjVVPfutGJCudjePAfL/Hs=

pkg/app/AppListingService.go

@@ -20,7 +20,6 @@ import (
 	"context"
 	"fmt"
 	"github.com/devtron-labs/devtron/api/bean/AppView"
-	bean2 "github.com/devtron-labs/devtron/client/argocdServer/bean"
 	"github.com/devtron-labs/devtron/internal/middleware"
 	"github.com/devtron-labs/devtron/internal/sql/repository/app"
 	"github.com/devtron-labs/devtron/internal/sql/repository/pipelineConfig/bean/workflow/cdWorkflow"
@@ -438,16 +437,17 @@ func (impl AppListingServiceImpl) FetchAppsByEnvironmentV2(fetchAppListingReques
 		return []*AppView.AppEnvironmentContainer{}, 0, nil
 	}
 
-	// Currently AppStatus is available in Db for only ArgoApps
-	// We fetch AppStatus on the fly for Helm Apps from scoop, So AppStatus filter will be applied in last
-	// fun to check if "HIBERNATING" exists in fetchAppListingRequest.AppStatuses
-	isFilteredOnHibernatingStatus := impl.isFilteredOnHibernatingStatus(fetchAppListingRequest)
-	// remove ""HIBERNATING" from fetchAppListingRequest.AppStatuses
-	appStatusesFilter := make([]string, 0)
-	if isFilteredOnHibernatingStatus {
-		appStatusesFilter = fetchAppListingRequest.AppStatuses
-		fetchAppListingRequest.AppStatuses = []string{}
-	}
+	// NOTE on "HIBERNATING": it is an ordinary value persisted in app_status.status
+	// (appStatus.UpdateStatusWithAppIdEnvId normalises Suspended/Hibernated to it), so it is
+	// filterable in SQL exactly like every other app status and is applied below, before
+	// LIMIT/OFFSET, by buildAppListingWhereCondition.
+	//
+	// TODO (helm pipelines): Helm-type (non-GitOps) CD pipelines never get an app_status row --
+	// their status is only known by querying the running release. So a hibernated helm-pipeline
+	// app cannot be matched by this filter today. The fix is to persist their status into
+	// app_status from the status-sync worker (after which the predicate below covers them for
+	// free), NOT to fan out live status calls during a list request -- that is what
+	// updateAppStatusForHelmTypePipelines did and it was removed from this path for slowness.
 
 	appListingFilter := helper.AppListingFilter{
 		Environments:      fetchAppListingRequest.Environments,
@@ -506,29 +506,9 @@ func (impl AppListingServiceImpl) FetchAppsByEnvironmentV2(fetchAppListingReques
 		impl.Logger.Errorw("error, UpdateAppStatusForHelmTypePipelines", "envIds", envIds, "err", err)
 	}
 
-	// apply filter for "HIBERNATING" status
-	if isFilteredOnHibernatingStatus {
-		filteredContainers := make([]*AppView.AppEnvironmentContainer, 0)
-		for _, container := range envContainers {
-			if slices.Contains(appStatusesFilter, container.AppStatus) {
-				filteredContainers = append(filteredContainers, container)
-			}
-		}
-		envContainers = filteredContainers
-		appSize = len(filteredContainers)
-	}
 	return envContainers, appSize, nil
 }
 
-func (impl AppListingServiceImpl) isFilteredOnHibernatingStatus(fetchAppListingRequest FetchAppListingRequest) bool {
-	if fetchAppListingRequest.AppStatuses != nil && len(fetchAppListingRequest.AppStatuses) > 0 {
-		if slices.Contains(fetchAppListingRequest.AppStatuses, bean2.HIBERNATING) {
-			return true
-		}
-	}
-	return false
-}
-
 func (impl AppListingServiceImpl) ISLastReleaseStopType(appId, envId int) (bool, error) {
 	override, err := impl.pipelineOverrideRepository.GetLatestRelease(appId, envId)
 	if err != nil && !util.IsErrNoRows(err) {

scripts/sql/36804600_argo_flux_rbac.up.sql

@@ -60,7 +60,8 @@ VALUES
       "act": { "value": "get", "indexKeyMap": {} },
       "obj": { "value": "%", "indexKeyMap": { "0": "EnvObj" } } }
   ]
-}','now()','1','now()','1',true,false);
+}','now()','1','now()','1',true,false)
+ON CONFLICT ("entity", "access_type", "role") DO NOTHING;
 
 INSERT INTO "public"."rbac_role_data"
 ("entity","access_type","role","role_display_name","role_description","role_data",
@@ -108,4 +109,5 @@ VALUES
   "action":     { "value": "admin", "indexKeyMap": {} },
   "entity":     { "value": "%", "indexKeyMap": { "0": "Entity" } },
   "accessType": { "value": "flux-app", "indexKeyMap": {} }
-}','now()','1','now()','1',true,false);
+}','now()','1','now()','1',true,false)
+ON CONFLICT ("entity", "access_type", "role") DO NOTHING;

vendor/modules.txt

@@ -523,15 +523,15 @@ github.com/davecgh/go-spew/spew
 # github.com/deckarep/golang-set v1.8.0
 ## explicit; go 1.17
 github.com/deckarep/golang-set
-# github.com/devtron-labs/authenticator v0.4.35-0.20240809073103-6e11da8083f8 => github.com/devtron-labs/devtron-services/authenticator v0.0.0-20260803100101-66fcb35e4b0e
+# github.com/devtron-labs/authenticator v0.4.35-0.20240809073103-6e11da8083f8 => github.com/devtron-labs/devtron-services/authenticator v0.0.0-20260921111017-f0b3fba15081
 ## explicit; go 1.25.0
 github.com/devtron-labs/authenticator/apiToken
 github.com/devtron-labs/authenticator/client
 github.com/devtron-labs/authenticator/jwt
 github.com/devtron-labs/authenticator/middleware
 github.com/devtron-labs/authenticator/oidc
 github.com/devtron-labs/authenticator/password
-# github.com/devtron-labs/common-lib v0.18.1-0.20241001061923-eda545dc839e => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260803100101-66fcb35e4b0e
+# github.com/devtron-labs/common-lib v0.18.1-0.20241001061923-eda545dc839e => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260921111017-f0b3fba15081
 ## explicit; go 1.25.0
 github.com/devtron-labs/common-lib/async
 github.com/devtron-labs/common-lib/blob-storage
@@ -2697,5 +2697,5 @@ xorm.io/xorm/names
 xorm.io/xorm/schemas
 xorm.io/xorm/tags
 # github.com/cyphar/filepath-securejoin => github.com/cyphar/filepath-securejoin v0.3.6
-# github.com/devtron-labs/authenticator => github.com/devtron-labs/devtron-services/authenticator v0.0.0-20260803100101-66fcb35e4b0e
-# github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260803100101-66fcb35e4b0e
+# github.com/devtron-labs/authenticator => github.com/devtron-labs/devtron-services/authenticator v0.0.0-20260921111017-f0b3fba15081
+# github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260921111017-f0b3fba15081