feat: expose usage limit response headers

.github/actions/setup-archestra-platform/action.yml

@@ -317,7 +317,7 @@ runs:
           --set "archestra.image=${PLATFORM_IMAGE_TAG}" \
           ${MCP_SET_FLAG} \
           ${EXTRA_SET_FLAGS} \
-          --atomic --timeout=4m
+          --atomic --timeout=15m
 
         # Wait for e2e-tests to complete (should already be done by now)
         if [ -n "${E2E_PID}" ]; then

.github/release-please/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  "platform": "1.2.42"
+  "platform": "1.2.50"
 }

.github/values-ci.yaml

@@ -11,8 +11,23 @@ archestra:
   # other against a fresh CI database.
   replicaCount: 1
 
+  # Override the chart's production CPU requests (2 vCPU per pod) for CI.
+  # On the resource-constrained E2E runners, 1 platform + 2 workers at 2 vCPU
+  # each reserves 6 vCPU before PostgreSQL and the e2e dependency pods are
+  # scheduled — which intermittently leaves no room, so PostgreSQL or the
+  # platform pod gets FailedScheduling ("Insufficient cpu") and the deploy
+  # stalls until the Helm timeout. CPU requests are only a scheduling
+  # reservation (there is no CPU limit), so a smaller request still lets the
+  # pods burst as needed while letting everything fit on the node.
+  resources:
+    requests:
+      cpu: "500m"
+
   worker:
     replicaCount: 2
+    resources:
+      requests:
+        cpu: "500m"
 
   # Environment variables for e2e testing
   env:

.github/workflows/docker-image-scanning.yml

@@ -49,12 +49,17 @@ jobs:
             dockerfile: ./platform/Dockerfile
             local-tag-prefix: archestra-platform
             use-build-action: true
+            scan-exit-code: "true"
           - name: MCP Server Base
             runner: blacksmith-4vcpu-ubuntu-2404
             context: ./platform/mcp_server_docker_image
             dockerfile: ./platform/mcp_server_docker_image/Dockerfile
             local-tag-prefix: mcp-server-base
             use-build-action: false
+            # TEMPORARY: scan runs but does not block merges. Alpine 3.23 has not
+            # yet backported the curl fix for HIGH CVE-2026-3805 (only in edge as
+            # 8.20.0-r1). Restore "true" once 3.23 ships curl >= 8.19.0-r0.
+            scan-exit-code: "false"
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -100,3 +105,4 @@ jobs:
           image: ${{ format('{0}:{1}', matrix.local-tag-prefix, github.sha) }}
           dockerhub-user: ${{ secrets.DOCKER_USERNAME }}
           dockerhub-password: ${{ secrets.DOCKER_PASSWORD }}
+          exit-code: ${{ matrix.scan-exit-code }}

.github/workflows/platform-e2e-tests.yml

@@ -247,8 +247,17 @@ jobs:
           echo "=== Kubernetes Services ==="
           kubectl get services || true
 
-          echo "=== Archestra Platform Logs ==="
-          kubectl logs -l app.kubernetes.io/name=archestra-platform --tail=200 || true
+          echo "=== Archestra Platform Logs (main container) ==="
+          kubectl logs -l app.kubernetes.io/name=archestra-platform -c archestra-platform --tail=200 2>/dev/null || true
+
+          echo "=== Platform Init Container: vault-secrets ==="
+          kubectl logs -l app.kubernetes.io/name=archestra-platform -c vault-secrets --tail=200 2>/dev/null || true
+
+          echo "=== Platform Init Container: setup-postgres-extensions ==="
+          kubectl logs -l app.kubernetes.io/name=archestra-platform -c setup-postgres-extensions --tail=200 2>/dev/null || true
+
+          echo "=== Platform Init Container: wait-for-postgres ==="
+          kubectl logs -l app.kubernetes.io/name=archestra-platform -c wait-for-postgres --tail=200 2>/dev/null || true
 
           echo "=== PostgreSQL Logs ==="
           kubectl logs -l app.kubernetes.io/name=postgresql --tail=200 || true
@@ -268,6 +277,15 @@ jobs:
           echo "=== Describe Platform Pod ==="
           kubectl describe pod -l app.kubernetes.io/name=archestra-platform || true
 
+          echo "=== Describe PostgreSQL Pod ==="
+          kubectl describe pod -l app.kubernetes.io/name=postgresql || true
+
+          echo "=== PostgreSQL StatefulSet & PVCs ==="
+          kubectl get statefulset,pvc -l app.kubernetes.io/name=postgresql -o wide || true
+
+          echo "=== Recent Cluster Events ==="
+          kubectl get events --sort-by=.lastTimestamp -A 2>/dev/null | tail -60 || true
+
       - name: Cleanup Kind cluster
         if: always()
         run: kind delete cluster --name archestra-ci-cluster || true
@@ -365,8 +383,17 @@ jobs:
           echo "=== Kubernetes Services ==="
           kubectl get services || true
 
-          echo "=== Archestra Platform Logs ==="
-          kubectl logs -l app.kubernetes.io/name=archestra-platform --tail=200 || true
+          echo "=== Archestra Platform Logs (main container) ==="
+          kubectl logs -l app.kubernetes.io/name=archestra-platform -c archestra-platform --tail=200 2>/dev/null || true
+
+          echo "=== Platform Init Container: vault-secrets ==="
+          kubectl logs -l app.kubernetes.io/name=archestra-platform -c vault-secrets --tail=200 2>/dev/null || true
+
+          echo "=== Platform Init Container: setup-postgres-extensions ==="
+          kubectl logs -l app.kubernetes.io/name=archestra-platform -c setup-postgres-extensions --tail=200 2>/dev/null || true
+
+          echo "=== Platform Init Container: wait-for-postgres ==="
+          kubectl logs -l app.kubernetes.io/name=archestra-platform -c wait-for-postgres --tail=200 2>/dev/null || true
 
           echo "=== PostgreSQL Logs ==="
           kubectl logs -l app.kubernetes.io/name=postgresql --tail=200 || true
@@ -386,6 +413,15 @@ jobs:
           echo "=== Describe Platform Pod ==="
           kubectl describe pod -l app.kubernetes.io/name=archestra-platform || true
 
+          echo "=== Describe PostgreSQL Pod ==="
+          kubectl describe pod -l app.kubernetes.io/name=postgresql || true
+
+          echo "=== PostgreSQL StatefulSet & PVCs ==="
+          kubectl get statefulset,pvc -l app.kubernetes.io/name=postgresql -o wide || true
+
+          echo "=== Recent Cluster Events ==="
+          kubectl get events --sort-by=.lastTimestamp -A 2>/dev/null | tail -60 || true
+
       - name: Cleanup Kind cluster
         if: always()
         run: kind delete cluster --name archestra-ci-cluster || true

.github/workflows/pr-title-linter.yml

@@ -38,7 +38,7 @@ jobs:
 
       - name: Lint PR title
         if: ${{ github.event_name == 'pull_request' }}
-        uses: grafana/shared-workflows/actions/lint-pr-title@5f4c48c03125ef179c36a821d5b801fc876e672c # v1.2.1
+        uses: grafana/shared-workflows/actions/lint-pr-title@0239db2665246f3b078d8d9166e4d8f09c071cae # v1.2.2
         with:
           config-path: "${{ github.workspace }}/.github/commitlint.config.js" # zizmor: ignore[template-injection] workspace path is provided by GitHub and not user input.
         env:

.github/workflows/random-issue-pr-assignee.yml

@@ -21,8 +21,8 @@ on:
 permissions: {}
 
 env:
-  ASSIGNEE_LOGINS: '["joeyorlando","iskhakov","Konstantinov-Innokentii"]'
-  CORE_TEAM_LOGINS: '["joeyorlando","iskhakov","Konstantinov-Innokentii","Matvey-Kuk"]'
+  ASSIGNEE_LOGINS: '["joeyorlando","iskhakov","Konstantinov-Innokentii","divineforest"]'
+  CORE_TEAM_LOGINS: '["joeyorlando","iskhakov","Konstantinov-Innokentii","Matvey-Kuk","divineforest"]'
 
 concurrency:
   group: random-issue-pr-assignee-${{ github.event.issue.number || github.ref }}

.gitignore

@@ -22,3 +22,6 @@ __pycache__/
 .claude/*.lock
 .turbo/
 
+# playwright-cli runtime cache (snapshots, console logs, screenshots)
+.playwright-cli/
+

EXTERNAL_CONTRIBUTORS.md

@@ -290,3 +290,117 @@ To unblock real contributors without re-opening the floodgates, sign in via GitH
 - @aardappvark
 - @Sagaryadav-ai
 - @heocoi
+- @daiquydev
+- @BrodoB
+- @thejoshuasilverstone-cloud
+- @sus689
+- @didier-brown
+- @diegousdz
+- @Adysekus
+- @phquand2000
+- @elfketchup
+- @basdilhan
+- @Darshan3690
+- @nguyen-hung-dev
+- @phungkaizen
+- @IssacDanny
+- @lyraforge
+- @ErnestHysa
+- @mgalavai
+- @Gammarays1980
+- @AshuraXX2206
+- @surbhitCodes
+- @quietpatchlab
+- @CyberSarvesh
+- @itsbryanman
+- @im-shafiqurrehman
+- @mitochondria-7
+- @Amaaz28
+- @Deepam02
+- @harxhist
+- @artabr
+- @dball1126
+- @baibaozhuanyong
+- @jasonkurniawantangguh-coder
+- @devroy10
+- @yqx07
+- @hala-el
+- @supermax-33
+- @a25955813-cloud
+- @XXXBusy
+- @stvnzhou86
+- @Desaon-CUST
+- @douglaswangome
+- @oocheol
+- @akamabu
+- @sachin0903
+- @mbachaud
+- @abrartawakl2056-cyber
+- @MoMia-Cerpro
+- @VinhTieuGit
+- @AlbinoGeek
+- @yi-hialong
+- @mirageaufsee
+- @funds0033-cmyk
+- @Rishikesh63
+- @antongordievsky
+- @dancarlstedt
+- @simpleprogrammer2
+- @afischh
+- @Exceluyi
+- @VenkateshValaboju
+- @Piyushdev-X
+- @suoyinjv
+- @lyhuuloi
+- @MightGainer
+- @holden-alt
+- @thewshii
+- @iiishop
+- @alaotla
+- @NguyenCong2k
+- @Bilal-Lodhi
+- @alexfedosov
+- @chasdaddy
+- @AryanBV
+- @mquailey
+- @q404365631
+- @Surajsuthar
+- @fzimmermann89
+- @timm-oh
+- @billy-syrett
+- @attilaolah
+- @jeremyjh
+- @Maxi130
+- @EloquentZebra
+- @elliotf
+- @patrickmay
+- @saitanay
+- @CetinSert
+- @Gutopro
+- @llwp
+- @Arnav1709
+- @Yashagarwal9798
+- @m00nxx
+- @schaelle
+- @k-kozika
+- @Yeetusbleetus
+- @pedropaulovc
+- @is3ka1
+- @akhildevelops
+- @luwinter111
+- @adamjacobmuller
+- @falkirks
+- @fernando-aguilar-coro
+- @caffeinum
+- @RYB-404
+- @crftr
+- @StevenWanglolz
+- @SwathiMystery
+- @dennisoelkers
+- @mkcash
+- @prakash-atul
+- @elinamirnaya
+- @sypham98-prog
+- @pk-vyshak
+- @rohit-Jung
+- @tolik518