snapshot of https://github.com/twentyhq/twenty.git (main, 2026-09-17; blobs > 131072B omitted)

.github/workflows/app-prod-parity-e2e-dispatch.yaml

@@ -0,0 +1,85 @@
+name: App Prod-Parity E2E Dispatch
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [labeled, synchronize, opened, reopened]
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  dispatch:
+    # main push + manual always run; PR events only when the label is present
+    # and the PR comes from a branch in this repo (forks are excluded, since they
+    # have no access to secrets or a writable token for the dispatch).
+    if: >-
+      github.event_name == 'push' ||
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request' &&
+       github.event.pull_request.head.repo.full_name == github.repository &&
+       contains(github.event.pull_request.labels.*.name, 'run-e2e-apps-prod-parity-tests'))
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      statuses: write
+    steps:
+      - name: Resolve target SHA
+        id: sha
+        env:
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          EVENT_SHA: ${{ github.sha }}
+        run: |
+          if [ -n "$PR_HEAD_SHA" ]; then
+            echo "head_sha=$PR_HEAD_SHA" >> "$GITHUB_OUTPUT"
+          else
+            echo "head_sha=$EVENT_SHA" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Post pending status
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          HEAD_SHA: ${{ steps.sha.outputs.head_sha }}
+        run: |
+          gh api "repos/$REPO/statuses/$HEAD_SHA" \
+            -f state=pending \
+            -f context=app-prod-parity-e2e \
+            -f description="Dispatching prod-parity e2e to twenty-factory"
+
+      - name: Mint twenty-factory dispatch token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
+          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
+          owner: twentyhq
+          repositories: twenty-factory
+          permission-actions: write
+
+      - name: Dispatch to twenty-factory
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          HEAD_SHA: ${{ steps.sha.outputs.head_sha }}
+        run: |
+          gh workflow run app-prod-parity-e2e.yaml \
+            --repo twentyhq/twenty-factory \
+            --ref main \
+            -f head_sha="$HEAD_SHA"
+
+      - name: Post dispatch-failed status
+        if: failure()
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          HEAD_SHA: ${{ steps.sha.outputs.head_sha }}
+        run: |
+          gh api "repos/$REPO/statuses/$HEAD_SHA" \
+            -f state=failure \
+            -f context=app-prod-parity-e2e \
+            -f description="Failed to dispatch prod-parity e2e to twenty-factory"

.github/workflows/cd-deploy-main.yaml

@@ -0,0 +1,37 @@
+name: CD deploy main
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  website-changed-files:
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: packages/twenty-website/**
+
+  deploy-main:
+    needs: website-changed-files
+    timeout-minutes: 3
+    runs-on: ubuntu-latest
+    steps:
+      - name: Mint twenty-infra dispatch token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
+          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
+          owner: twentyhq
+          repositories: twenty-infra
+          permission-actions: write
+
+      - name: Trigger twenty-infra deploy
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          DEPLOY_WEBSITE: ${{ needs.website-changed-files.outputs.any_changed }}
+        run: |
+          gh workflow run auto-deploy-main.yaml --repo twentyhq/twenty-infra --ref main -f deploy_website="$DEPLOY_WEBSITE"

.github/workflows/cd-deploy-tag.yaml

@@ -0,0 +1,35 @@
+name: CD deploy tag
+
+permissions:
+  contents: read
+
+on:
+  push:
+    tags:
+      - 'twenty/v*'
+
+defaults:
+  run:
+    shell: bash --noprofile --norc -euo pipefail {0}
+
+jobs:
+  dispatch-tag:
+    timeout-minutes: 3
+    runs-on: ubuntu-latest
+    steps:
+      - name: Mint twenty-infra dispatch token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
+          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
+          owner: twentyhq
+          repositories: twenty-infra
+          permission-actions: write
+
+      - name: Trigger staging CD
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          gh workflow run staging-ci.yaml --repo twentyhq/twenty-infra --ref main -f tag="$REF_NAME"

.github/workflows/cd-storybook-ui.yaml

@@ -0,0 +1,75 @@
+name: CD Storybook UI
+
+on:
+  push:
+    branches: [main]
+    tags: ['sdk/v*', 'ui/v*']
+    paths:
+      - .github/workflows/cd-storybook-ui.yaml
+      - .github/actions/yarn-install/**
+      - package.json
+      - yarn.lock
+      - nx.json
+      - tsconfig.base.json
+      - packages/twenty-ui/**
+      - packages/twenty-shared/**
+      - packages/twenty-docs/**
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref == 'refs/heads/main' }}
+
+jobs:
+  build:
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
+
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+
+      - name: Build public Storybook
+        run: npx nx storybook:build twenty-ui --configuration=docs
+
+      - name: Check embedded stories against the build
+        run: npx tsx packages/twenty-docs/scripts/check-ui-story-embeds.mts packages/twenty-ui/storybook-static/index.json
+
+      - name: Upload public Storybook
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: storybook-twenty-ui-public
+          path: packages/twenty-ui/storybook-static
+          if-no-files-found: error
+          retention-days: 7
+
+  dispatch:
+    needs: build
+    permissions: {}
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    steps:
+      - name: Mint twenty-factory dispatch token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
+          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
+          owner: twentyhq
+          repositories: twenty-factory
+          permission-actions: write
+
+      - name: Request Storybook deployment
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          SOURCE_RUN_ID: ${{ github.run_id }}
+        run: |
+          gh workflow run deploy-storybook-ui.yaml --repo twentyhq/twenty-factory --ref main \
+            -f source_run_id="$SOURCE_RUN_ID"

.github/workflows/changed-files.yaml

@@ -0,0 +1,31 @@
+name: Changed files reusable workflow
+
+on:
+  workflow_call:
+    inputs:
+      files:
+        required: true
+        type: string
+    outputs:
+      any_changed:
+        value: ${{ jobs.changed-files.outputs.any_changed }}
+
+permissions:
+  contents: read
+
+jobs:
+  changed-files:
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    outputs:
+      any_changed: ${{ steps.changed-files.outputs.any_changed }}
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Check for changed files
+        id: changed-files
+        uses: tj-actions/changed-files@48d8f15b2aaa3d255ca5af3eba4870f807ce6b3c # v45.0.9
+        with:
+          files: ${{ inputs.files }}

.github/workflows/ci-agent-skills-drift.yaml

@@ -0,0 +1,199 @@
+name: CI Agent Skills Drift
+
+# When a PR changes the app-development surface (twenty-sdk, create-twenty-app,
+# twenty-client-sdk, or the shared manifest types), an agent checks whether the
+# canonical skill content under packages/twenty-agent-skills is impacted and,
+# only when it is, posts a single sticky comment with its findings.
+#
+# This is the skills counterpart to ci-app-docs-drift.yaml: the same source
+# changes that stale the docs also stale the guidance agents follow.
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  changed-files-check:
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        packages/twenty-sdk/**
+        packages/create-twenty-app/**
+        packages/twenty-client-sdk/**
+        packages/twenty-shared/src/application/**
+        packages/twenty-shared/src/types/**
+
+  agent-skills-drift-check:
+    needs: changed-files-check
+    # Secrets are unavailable on fork PRs; skip there and on bot PRs.
+    if: >-
+      needs.changed-files-check.outputs.any_changed == 'true' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.type != 'Bot'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 0
+
+      - name: Run agent skills drift agent
+        id: drift-agent
+        uses: anthropics/claude-code-action@ac7e24bf2938964b8ab203e417a2773802392ddd # v1.0.146
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          claude_args: |
+            --max-turns 60 --json-schema '{"type":"object","properties":{"hasDrift":{"type":"boolean"},"summary":{"type":"string"}},"required":["hasDrift","summary"]}' --allowedTools "Bash(git diff *),Bash(git log *),Bash(git show *),Bash(grep *),Bash(cat *),Bash(ls *),Bash(find *),Bash(head *),Bash(tail *),Bash(gh pr comment *)"
+          prompt: |
+            You are the agent-skills drift checker for the twenty repository.
+
+            A pull request changed files in the app-development platform. Your job is to
+            decide whether the skill guidance under `packages/twenty-agent-skills/`
+            is impacted, and report your findings as ONE pull request comment.
+
+            These skills tell coding agents how to build Twenty apps. When they go stale
+            an agent confidently runs a command that no longer exists, so wrong guidance
+            is worse here than a missing doc page.
+
+            ## Canonical source only
+
+            `packages/twenty-agent-skills/skills/` and
+            `packages/twenty-agent-skills/references/` are the canonical content.
+
+            `packages/twenty-agent-skills/dist/` is generated for distribution and is
+            not committed to main. Report the canonical file that needs an edit.
+
+            ## Step 1 — Understand the change
+
+            The PR branch is checked out with full history; the base branch is
+            `origin/${{ github.base_ref }}`. Inspect what the PR changes however you
+            see fit. Only these kinds of changes are skill-relevant:
+
+            - CLI commands, subcommands, flags, defaults, or help text
+              (`packages/twenty-sdk/src/cli/commands/**`)
+            - `define*` function signatures, config properties, validation rules,
+              or their warnings (`packages/twenty-sdk/src/sdk/define/**`)
+            - Enum / string-union values and manifest types
+              (`packages/twenty-shared/src/application/**`, `packages/twenty-shared/src/types/**`)
+            - Exports added/removed/renamed in the `exports` maps of `twenty-sdk` or
+              `twenty-client-sdk` package.json, or in their public entry points
+            - Front-component runtime hooks and host API
+              (`packages/twenty-sdk/src/sdk/front-component/**`)
+            - The scaffold template (`packages/create-twenty-app/src/constants/template/**`)
+              and scaffolder flags/prompts (`packages/create-twenty-app/src/cli.ts`,
+              `create-app.command.ts`)
+            - Environment variables injected into logic functions or front components
+            - Error codes surfaced to app developers
+            - Default ports and instance URLs used during development
+
+            Internal refactors, tests, and implementation-only changes are NOT relevant —
+            if the changes contain only those, say so and stop.
+
+            ## Step 2 — Map to skill content
+
+            Use this mapping to know which files to check (read the actual files, all
+            paths relative to `packages/twenty-agent-skills/`):
+
+            | Source area | Skill content |
+            |---|---|
+            | CLI commands (`src/cli/commands`) | `references/manage-app/cli-and-sync.md`, `skills/manage-app/SKILL.md`, `references/concepts/operating-rules.md` |
+            | Scaffolder flags, prompts, template | `skills/create-app/SKILL.md`, `references/develop-app/app-structure.md` |
+            | `defineObject`/`defineField`/relations/indexes | `references/develop-app/data-model.md` |
+            | `defineApplication`/roles/install hooks/variables | `references/concepts/how-apps-work.md`, `references/publish-app/prepare-for-app-store.md` |
+            | Logic functions, triggers, connections, agents/skills | `references/develop-app/logic.md` |
+            | Workflows and their lifecycle | `references/develop-app/workflows.md` |
+            | Views, navigation, page layouts, command menu | `references/develop-app/layout.md`, `references/develop-app/standalone-pages.md` |
+            | Front components, SDK imports, runtime hooks | `references/develop-app/front-components.md`, `references/design/front-component-ui.md` |
+            | Test layout, test target ports | `references/develop-app/tests.md`, `references/concepts/operating-rules.md` |
+            | Publish/install/deploy, versioning | `references/publish-app/prepare-for-app-store.md`, `skills/publish-app/SKILL.md` |
+            | MCP endpoints, transport, auth | `references/use-twenty-mcp/setup.md`, `references/use-twenty-mcp/result-formatting.md` |
+            | Enum value sets (FieldType, ViewType, availabilityType, NavigationMenuItemType, ...) | the reference documenting that value set (search for the enum name) |
+
+            Two extra checks specific to this package:
+
+            - `scripts/validators/` encodes cross-document contracts as literal string
+              fragments (exact commands, ports, section headings). A renamed command or
+              changed port can make a validator assert something no longer true, so check
+              whether the change invalidates a fragment there.
+            - `references/concepts/operating-rules.md` is the single source of truth for
+              the durable rules and names exact commands. A command rename lands here.
+
+            Also check whether the PR already updates the impacted files — if it does,
+            verify the update matches the code change.
+
+            ## Step 3 — Report
+
+            If there is NO skill impact, do NOT post or create any comment.
+            Skip the comment entirely and go straight to Step 4.
+
+            Only when the skills are impacted, post exactly one comment on PR
+            #${{ github.event.pull_request.number }} with:
+            `gh pr comment ${{ github.event.pull_request.number }} --edit-last --create-if-none --body ...`
+            (this updates the previous drift-check comment in place on subsequent runs).
+            Start the comment body with the marker `<!-- agent-skills-drift-check -->`.
+
+            Comment format:
+            - Title line: `### Agent skills drift check`
+            - A table with columns **Change** (what changed in the code),
+              **Skill file** (repo-relative path, canonical only), **Status**
+              (`✅ already updated in this PR` / `⚠️ needs update`), and **Suggested fix**
+              (one concrete sentence, e.g. the exact command to replace).
+            - When any row needs an update, end with one line reminding the author to run
+              `npx nx run twenty-agent-skills:validate` after editing the canonical content.
+            - Be terse. No preamble, no sign-off. Only report genuine drift — if unsure
+              whether something is user-facing, say it's uncertain rather than asserting.
+
+            ## Step 4 — Return the verdict
+
+            After posting the comment, return your final answer as the structured
+            output the CI gate consumes:
+            - `hasDrift`: `true` if at least one impacted skill file still needs updating
+              (drift is NOT fully resolved by this PR); `false` if there is no skill
+              impact, or every impacted file is already correctly updated in this PR.
+            - `summary`: one terse sentence describing the verdict.
+
+            Environment: GH_TOKEN is available for `gh`. The PR branch is checked out.
+          settings: |
+            {
+              "env": {
+                "GH_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
+              }
+            }
+
+      - name: Gate on drift verdict
+        if: always()
+        env:
+          AGENT_OUTCOME: ${{ steps.drift-agent.outcome }}
+          STRUCTURED_OUTPUT: ${{ steps.drift-agent.outputs.structured_output }}
+        run: |
+          if [ "$AGENT_OUTCOME" != "success" ]; then
+            echo "::error::Agent skills drift checker did not complete (agent step outcome: $AGENT_OUTCOME)."
+            exit 1
+          fi
+          if [ -z "$STRUCTURED_OUTPUT" ]; then
+            echo "::error::Agent skills drift checker did not return a structured verdict."
+            exit 1
+          fi
+          has_drift=$(printf '%s' "$STRUCTURED_OUTPUT" | jq -r '.hasDrift')
+          if [ "$has_drift" = "true" ]; then
+            echo "::error::Agent skills drift detected. See the agent-skills-drift-check comment on this PR."
+            exit 1
+          fi
+          if [ "$has_drift" = "false" ]; then
+            echo "No agent skills drift."
+            exit 0
+          fi
+          echo "::error::Structured verdict present but 'hasDrift' was not a recognizable boolean: $has_drift"
+          exit 1

.github/workflows/ci-agent-skills.yaml

@@ -0,0 +1,199 @@
+name: CI Agent Skills
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - package.json
+      - packages/twenty-agent-skills/**
+      - .github/workflows/ci-agent-skills.yaml
+
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  changed-files-check:
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        package.json
+        packages/twenty-agent-skills/**
+        .github/workflows/ci-agent-skills.yaml
+
+  agent-skills-validate:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch local actions
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+
+      - name: Agent Skills / Build and validate
+        run: npx nx run twenty-agent-skills:validate
+
+      - name: Agent Skills / Test
+        run: npx nx run twenty-agent-skills:test
+
+      - name: Agent Skills / List with the skills CLI
+        run: |
+          set -euo pipefail
+          LISTING="$(npx -y skills@latest add ./packages/twenty-agent-skills/dist --list)"
+          echo "$LISTING"
+
+          for SKILL in create-app develop-app manage-app publish-app use-twenty-mcp; do
+            grep -q "$SKILL" <<<"$LISTING" || {
+              echo "::error::$SKILL missing from the collection listing"
+              exit 1
+            }
+          done
+
+          # The package path must scope discovery to the app skills; a listing that
+          # also carries repository-wide skills means the source is wrong.
+          if grep -q 'syncable-entity' <<<"$LISTING"; then
+            echo "::error::listing leaked internal contributor skills"
+            exit 1
+          fi
+
+      - name: Agent Skills / Install each skill independently
+        run: |
+          set -euo pipefail
+          for SKILL in create-app develop-app manage-app publish-app use-twenty-mcp; do
+            INSTALL_DIR="$(mktemp -d)"
+            (
+              cd "$INSTALL_DIR"
+              npx -y skills@latest add "$GITHUB_WORKSPACE/packages/twenty-agent-skills/dist" \
+                --skill "$SKILL" --agent claude-code --agent codex --copy -y
+            )
+            npx nx run twenty-agent-skills:verify:install -- "$INSTALL_DIR" "$SKILL"
+            rm -rf "$INSTALL_DIR"
+          done
+
+      - name: Agent Skills / Install the whole collection
+        run: |
+          set -euo pipefail
+          INSTALL_DIR="$(mktemp -d)"
+          (
+            cd "$INSTALL_DIR"
+            npx -y skills@latest add "$GITHUB_WORKSPACE/packages/twenty-agent-skills/dist" \
+              --skill '*' --agent claude-code --agent codex --copy -y
+          )
+          npx nx run twenty-agent-skills:verify:install -- "$INSTALL_DIR"
+          rm -rf "$INSTALL_DIR"
+
+      - name: Archive the verified distribution
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: tar -C packages/twenty-agent-skills/dist -czf "$RUNNER_TEMP/twenty-agent-skills.tar.gz" .
+
+      - name: Upload the verified distribution
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: twenty-agent-skills
+          path: ${{ runner.temp }}/twenty-agent-skills.tar.gz
+          retention-days: 1
+          if-no-files-found: error
+
+  agent-skills-publish:
+    needs: agent-skills-validate
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'twentyhq/twenty'
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    outputs:
+      released: ${{ steps.publish.outputs.released }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Download the verified distribution
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: twenty-agent-skills
+          path: ${{ runner.temp }}/agent-skills-artifact
+
+      - name: Publish distribution branch
+        id: publish
+        run: |
+          set -euo pipefail
+          git fetch --depth=1 --no-tags origin main
+          if [ "$(git rev-parse "$GITHUB_SHA:packages/twenty-agent-skills")" != "$(git rev-parse 'FETCH_HEAD:packages/twenty-agent-skills')" ]; then
+            echo 'Skipping this distribution because the skills source has changed on main.'
+            exit 0
+          fi
+
+          DISTRIBUTION_DIR="$RUNNER_TEMP/agent-skills-dist"
+          PUBLISH_DIR="$RUNNER_TEMP/agent-skills-release"
+          mkdir "$DISTRIBUTION_DIR"
+          tar -xzf "$RUNNER_TEMP/agent-skills-artifact/twenty-agent-skills.tar.gz" -C "$DISTRIBUTION_DIR"
+
+          REMOTE_BRANCH="$(git ls-remote --heads origin refs/heads/agent-skills)"
+          if [ -n "$REMOTE_BRANCH" ]; then
+            git fetch --no-tags origin refs/heads/agent-skills
+            git worktree add --detach "$PUBLISH_DIR" FETCH_HEAD
+          else
+            git worktree add --detach --no-checkout "$PUBLISH_DIR"
+            git -C "$PUBLISH_DIR" switch --orphan agent-skills
+          fi
+
+          rsync -a --delete --exclude=/.git "$DISTRIBUTION_DIR/" "$PUBLISH_DIR/"
+          cd "$PUBLISH_DIR"
+          git add --all
+          if git diff --cached --quiet; then
+            echo 'The agent-skills distribution is unchanged.'
+            echo 'released=true' >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git commit -m "Publish agent skills from $GITHUB_SHA"
+          git push origin HEAD:refs/heads/agent-skills
+          echo 'released=true' >> "$GITHUB_OUTPUT"
+
+  agent-skills-remote-source:
+    needs: agent-skills-publish
+    if: needs.agent-skills-publish.outputs.released == 'true'
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: '24'
+
+      - name: Download the verified distribution
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: twenty-agent-skills
+          path: ${{ runner.temp }}/agent-skills-artifact
+
+      - name: Agent Skills / Install from the documented remote source
+        run: |
+          set -euo pipefail
+          mkdir -p packages/twenty-agent-skills/dist
+          tar -xzf "$RUNNER_TEMP/agent-skills-artifact/twenty-agent-skills.tar.gz" -C packages/twenty-agent-skills/dist
+          INSTALL_DIR="$(mktemp -d)"
+          (
+            cd "$INSTALL_DIR"
+            npx -y skills@latest add 'https://github.com/twentyhq/twenty/tree/agent-skills' \
+              --skill '*' --agent claude-code --agent codex --copy -y
+          )
+          node packages/twenty-agent-skills/scripts/verify-install.js "$INSTALL_DIR"
+          rm -rf "$INSTALL_DIR"

.github/workflows/ci-ai-catalog-sync.yaml

@@ -0,0 +1,96 @@
+name: AI Catalog Sync
+
+on:
+  schedule:
+    - cron: '0 6 * * *' # Daily at 6 AM UTC
+  workflow_dispatch: # Allow manual trigger
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  sync-catalog:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      NODE_OPTIONS: '--max-old-space-size=4096'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          ref: main
+
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+
+      - name: Build dependencies
+        run: npx nx build twenty-shared
+
+      - name: Run catalog sync
+        env:
+          ARTIFICIAL_ANALYSIS_API_KEY: ${{ secrets.ARTIFICIAL_ANALYSIS_API_KEY }}
+        run: |
+          npx nx run twenty-server:ts-node-no-deps-transpile-only -- \
+            ./scripts/ai-catalog-sync/index.ts --report "${RUNNER_TEMP}/coverage.md"
+
+      - name: Check for changes
+        id: changes
+        run: |
+          catalog_dir=packages/twenty-server/src/engine/metadata-modules/ai/ai-models
+          if git diff --quiet "$catalog_dir"; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Compose pull request body
+        if: steps.changes.outputs.changed == 'true'
+        run: |
+          cat > "${RUNNER_TEMP}/pr-body.md" <<'PREAMBLE'
+          Automated daily sync of the AI model catalog.
+
+          - Model identity, pricing, context windows and availability come from [models.dev](https://models.dev).
+          - Intelligence, speed and cost per task come from [Artificial Analysis](https://artificialanalysis.ai/),
+            which requires `ARTIFICIAL_ANALYSIS_API_KEY`.
+
+          New models meeting inclusion criteria (tool calling, pricing data, context limits) are added
+          automatically. Benchmark data is best-effort: a model Artificial Analysis has not rated keeps
+          every other field and simply carries no `benchmark` entry.
+
+          **Please review before merging** and check the coverage summary below for models that silently
+          stopped matching.
+
+          PREAMBLE
+          cat "${RUNNER_TEMP}/coverage.md" >> "${RUNNER_TEMP}/pr-body.md"
+
+      - name: Create pull request
+        if: steps.changes.outputs.changed == 'true'
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: 'chore: sync AI model catalog'
+          title: 'chore: sync AI model catalog'
+          body-path: ${{ runner.temp }}/pr-body.md
+          branch: chore/ai-catalog-sync
+          base: main
+          labels: ai, automated
+          delete-branch: true
+
+      - name: Mint twenty-infra dispatch token
+        id: app-token
+        if: steps.changes.outputs.changed == 'true'
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
+          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
+          owner: twentyhq
+          repositories: twenty-infra
+          permission-actions: write
+
+      - name: Trigger automerge
+        if: steps.changes.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main

.github/workflows/ci-app-docs-drift.yaml

@@ -0,0 +1,172 @@
+name: CI App Docs Drift
+
+# When a PR changes the app-development surface (twenty-sdk, create-twenty-app,
+# twenty-client-sdk, or the shared manifest types), an agent checks whether the
+# app documentation under packages/twenty-docs/developers/extend/apps is
+# impacted and, only when it is, posts a single sticky comment with its findings.
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  changed-files-check:
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        packages/twenty-sdk/**
+        packages/create-twenty-app/**
+        packages/twenty-client-sdk/**
+        packages/twenty-shared/src/application/**
+        packages/twenty-shared/src/types/**
+
+  docs-drift-check:
+    needs: changed-files-check
+    # Secrets are unavailable on fork PRs; skip there and on bot PRs.
+    if: >-
+      needs.changed-files-check.outputs.any_changed == 'true' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.type != 'Bot'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 0
+
+      - name: Run docs drift agent
+        id: drift-agent
+        uses: anthropics/claude-code-action@ac7e24bf2938964b8ab203e417a2773802392ddd # v1.0.146
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          claude_args: |
+            --max-turns 60 --json-schema '{"type":"object","properties":{"hasDrift":{"type":"boolean"},"summary":{"type":"string"}},"required":["hasDrift","summary"]}' --allowedTools "Bash(git diff *),Bash(git log *),Bash(git show *),Bash(grep *),Bash(cat *),Bash(ls *),Bash(find *),Bash(head *),Bash(tail *),Bash(gh pr comment *)"
+          prompt: |
+            You are the app-documentation drift checker for the twenty repository.
+
+            A pull request changed files in the app-development platform. Your job is to
+            decide whether the documentation under
+            `packages/twenty-docs/developers/extend/apps/` (English pages only — ignore
+            `packages/twenty-docs/l/`) is impacted, and report your findings as ONE pull
+            request comment.
+
+            ## Step 1 — Understand the change
+
+            The PR branch is checked out with full history; the base branch is
+            `origin/${{ github.base_ref }}`. Inspect what the PR changes however you
+            see fit. Only these kinds of changes are documentation-relevant:
+
+            - CLI commands, subcommands, flags, defaults, or help text
+              (`packages/twenty-sdk/src/cli/commands/**`)
+            - `define*` function signatures, config properties, validation rules,
+              or their warnings (`packages/twenty-sdk/src/sdk/define/**`)
+            - Enum / string-union values and manifest types
+              (`packages/twenty-shared/src/application/**`, `packages/twenty-shared/src/types/**`)
+            - Exports added/removed/renamed in the `exports` maps of `twenty-sdk` or
+              `twenty-client-sdk` package.json, or in their public entry points
+            - Front-component runtime hooks and host API
+              (`packages/twenty-sdk/src/sdk/front-component/**`)
+            - The scaffold template (`packages/create-twenty-app/src/constants/template/**`)
+              and scaffolder flags/prompts (`packages/create-twenty-app/src/cli.ts`,
+              `create-app.command.ts`)
+            - Environment variables injected into logic functions or front components
+            - Error codes surfaced to app developers
+
+            Internal refactors, tests, and implementation-only changes are NOT relevant —
+            if the changes contain only those, say so and stop.
+
+            ## Step 2 — Map to documentation
+
+            Use this mapping to know which pages to check (read the actual pages):
+
+            | Source area | Docs pages |
+            |---|---|
+            | CLI commands (`src/cli/commands`) | `operations/cli.mdx`, `getting-started/quick-start.mdx`, `operations/sync-and-recovery.mdx`, `getting-started/local-server.mdx`, `getting-started/scaffolding.mdx` |
+            | `defineObject`/`defineField`/relations/indexes | `data/*.mdx` |
+            | `defineApplication`/roles/install hooks/variables | `config/*.mdx` |
+            | Logic functions, triggers, connections, agents/skills | `logic/*.mdx` |
+            | Views, navigation, page layouts, front components, command menu | `layout/*.mdx` |
+            | Publish/install/deploy, versioning, engines | `operations/publishing.mdx`, `operations/sync-and-recovery.mdx` |
+            | Testing APIs (`twenty-sdk/cli` operations) | `operations/testing.mdx` |
+            | Scaffold template | `getting-started/project-structure.mdx`, `getting-started/quick-start.mdx`, `operations/testing.mdx`, `operations/publishing.mdx` |
+            | client SDK (`core`/`metadata`/`rest`/`generate`) | `logic/logic-functions.mdx`, `layout/front-components.mdx`, `operations/cli.mdx` |
+            | Enum value sets (FieldType, ViewType, availabilityType, NavigationMenuItemType, ...) | the page documenting that value set (search for the enum name) |
+
+            Also check whether the PR already updates the impacted docs pages — if it
+            does, verify the update matches the code change.
+
+            ## Step 3 — Report
+
+            If there is NO documentation impact, do NOT post or create any comment.
+            Skip the comment entirely and go straight to Step 4.
+
+            Only when the documentation is impacted, post exactly one comment on PR
+            #${{ github.event.pull_request.number }} with:
+            `gh pr comment ${{ github.event.pull_request.number }} --edit-last --create-if-none --body ...`
+            (this updates the previous drift-check comment in place on subsequent runs).
+            Start the comment body with the marker `<!-- app-docs-drift-check -->`.
+
+            Comment format:
+            - Title line: `### App docs drift check`
+            - A table with columns **Change** (what changed in the code),
+              **Docs page** (repo-relative path), **Status** (`✅ already updated in this PR`
+              / `⚠️ needs update`), and **Suggested fix** (one concrete sentence, e.g. the
+              exact value to add to a table).
+            - Be terse. No preamble, no sign-off. Only report genuine drift — if unsure
+              whether something is user-facing, say it's uncertain rather than asserting.
+
+            ## Step 4 — Return the verdict
+
+            After posting the comment, return your final answer as the structured
+            output the CI gate consumes:
+            - `hasDrift`: `true` if at least one impacted docs page still needs updating
+              (drift is NOT fully resolved by this PR); `false` if there is no
+              documentation impact, or every impacted page is already correctly updated
+              in this PR.
+            - `summary`: one terse sentence describing the verdict.
+
+            Environment: GH_TOKEN is available for `gh`. The PR branch is checked out.
+          settings: |
+            {
+              "env": {
+                "GH_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
+              }
+            }
+
+      - name: Gate on drift verdict
+        if: always()
+        env:
+          AGENT_OUTCOME: ${{ steps.drift-agent.outcome }}
+          STRUCTURED_OUTPUT: ${{ steps.drift-agent.outputs.structured_output }}
+        run: |
+          if [ "$AGENT_OUTCOME" != "success" ]; then
+            echo "::error::Docs drift checker did not complete (agent step outcome: $AGENT_OUTCOME)."
+            exit 1
+          fi
+          if [ -z "$STRUCTURED_OUTPUT" ]; then
+            echo "::error::Docs drift checker did not return a structured verdict."
+            exit 1
+          fi
+          has_drift=$(printf '%s' "$STRUCTURED_OUTPUT" | jq -r '.hasDrift')
+          if [ "$has_drift" = "true" ]; then
+            echo "::error::App docs drift detected. See the app-docs-drift-check comment on this PR."
+            exit 1
+          fi
+          if [ "$has_drift" = "false" ]; then
+            echo "No app docs drift."
+            exit 0
+          fi
+          echo "::error::Structured verdict present but 'hasDrift' was not a recognizable boolean: $has_drift"
+          exit 1

.github/workflows/ci-blocked-contributors.yaml

@@ -0,0 +1,35 @@
+name: Blocked Contributors Check
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+  issue_comment:
+    types: [created, edited]
+  pull_request_review:
+    types: [submitted, edited]
+  pull_request_review_comment:
+    types: [created, edited]
+
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
+
+jobs:
+  check-blocked-contributors:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: ${{ github.event_name != 'issue_comment' || github.event.issue.pull_request }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+
+      - name: Check PR commits, description, comments and reviews for blocked contributors
+        run: npx nx run twenty-server:ts-node-no-deps-transpile-only -- ./scripts/check-blocked-contributors.ts
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}

.github/workflows/ci-breaking-changes.yaml

@@ -0,0 +1,746 @@
+name: GraphQL and OpenAPI Breaking Changes Detection
+
+on:
+ pull_request:
+    types: [opened, synchronize, edited]
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+env:
+  MAIN_SERVER_PORT: 3000
+  CURRENT_SERVER_PORT: 3002
+
+permissions:
+  contents: read
+
+jobs:
+  changed-files-check:
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        package.json
+        packages/twenty-server/**
+        packages/twenty-emails/**
+        packages/twenty-shared/**
+        .github/workflows/ci-breaking-changes.yaml
+
+  api-breaking-changes:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 45
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:18
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+      redis:
+        image: redis
+        ports:
+          - 6379:6379
+      clickhouse:
+        image: clickhouse/clickhouse-server:25.8.8
+        env:
+          CLICKHOUSE_PASSWORD: clickhousePassword
+          CLICKHOUSE_URL: "http://default:clickhousePassword@localhost:8123/twenty"
+        ports:
+          - 8123:8123
+          - 9000:9000
+        options: >-
+          --health-cmd "clickhouse-client --host=localhost --port=9000 --user=default --password=clickhousePassword --query='SELECT 1'"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - name: Checkout current branch
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+
+      - name: Try to merge main into current branch
+        id: merge_attempt
+        run: |
+          echo "Attempting to merge main into current branch..."
+
+          git config user.email "ci@twenty.com"
+          git config user.name "CI"
+          git fetch origin main
+
+          CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
+          echo "Current branch: $CURRENT_BRANCH"
+
+          if git merge origin/main --no-edit; then
+            echo "✅ Successfully merged main into current branch"
+            echo "merged=true" >> $GITHUB_OUTPUT
+            echo "BRANCH_STATE=merged" >> $GITHUB_ENV
+          else
+            echo "❌ Merge failed due to conflicts"
+            echo "⚠️ Falling back to comparing current branch against main without merge"
+
+            # Abort the failed merge (may not exist if merge never started)
+            git merge --abort 2>/dev/null || true
+
+            echo "merged=false" >> $GITHUB_OUTPUT
+            echo "BRANCH_STATE=conflicts" >> $GITHUB_ENV
+          fi
+
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+
+      - name: Build shared dependencies
+        run: |
+          npx nx build twenty-shared
+          npx nx build twenty-emails
+
+      - name: Build current branch server
+        run: npx nx build twenty-server
+
+      - name: Setup databases
+        run: |
+          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "current_branch";'
+          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "main_branch";'
+
+      - name: Run ClickHouse migrations
+        run: npx nx clickhouse:migrate twenty-server
+        env:
+          CLICKHOUSE_URL: http://default:clickhousePassword@localhost:8123/twenty
+          CLICKHOUSE_PASSWORD: clickhousePassword
+
+      - name: Setup current branch database
+        run: |
+          npx nx reset:env twenty-server
+          set_env_var() {
+            local var_name="$1"
+            local var_value="$2"
+            local env_file="packages/twenty-server/.env"
+
+            echo "" >> "$env_file"
+
+            if grep -q "^${var_name}=" "$env_file" 2>/dev/null; then
+              sed -i "s|^${var_name}=.*|${var_name}=${var_value}|" "$env_file"
+            else
+              echo "${var_name}=${var_value}" >> "$env_file"
+            fi
+          }
+
+          set_env_var "PG_DATABASE_URL" "postgres://postgres:postgres@localhost:5432/current_branch"
+          set_env_var "NODE_PORT" "${{ env.CURRENT_SERVER_PORT }}"
+          set_env_var "REDIS_URL" "redis://localhost:6379"
+          set_env_var "CLICKHOUSE_URL" "http://default:clickhousePassword@localhost:8123/twenty"
+          set_env_var "CLICKHOUSE_PASSWORD" "clickhousePassword"
+
+          npx nx run twenty-server:database:init:prod
+
+      - name: Flush cache before seeding current branch
+        run: npx nx command-no-deps twenty-server -- cache:flush
+
+      - name: Seed current branch database with test data
+        run: |
+          npx nx command-no-deps twenty-server -- workspace:seed:dev
+
+      - name: Start current branch server in background
+        run: |
+          echo "=== Current branch .env file contents ==="
+          cat packages/twenty-server/.env
+          echo "=== Starting current branch server ==="
+          nohup npx nx run twenty-server:start:prod > /tmp/current-server.log 2>&1 &
+          echo $! > /tmp/current-server.pid
+          echo "Current server PID: $(cat /tmp/current-server.pid)"
+
+      - name: Wait for current branch server to be ready
+        run: |
+          echo "Waiting for current branch server to start..."
+          timeout=60
+          interval=5
+          elapsed=0
+
+          ADMIN_TOKEN=$(jq -r '.APPLE_JANE_ADMIN_ACCESS_TOKEN' packages/twenty-server/test/integration/constants/test-tokens.json)
+
+          while [ $elapsed -lt $timeout ]; do
+            GRAPHQL_RESPONSE=$(curl -s -X POST "http://localhost:${{ env.CURRENT_SERVER_PORT }}/graphql" \
+              -H "Content-Type: application/json" \
+              -H "Authorization: Bearer ${ADMIN_TOKEN}" \
+              -d '{"query":"{ __schema { queryType { name } } }"}' 2>/dev/null || echo '{}')
+
+            if echo "$GRAPHQL_RESPONSE" | jq -e '.data.__schema' > /dev/null 2>&1 && \
+               curl -fsS "http://localhost:${{ env.CURRENT_SERVER_PORT }}/rest/open-api/core" \
+                 -H "Authorization: Bearer ${ADMIN_TOKEN}" > /dev/null 2>&1; then
+              echo "Current branch server is ready!"
+              break
+            fi
+
+            echo "Current branch server not ready yet, waiting ${interval}s..."
+            sleep $interval
+            elapsed=$((elapsed + interval))
+          done
+
+          if [ $elapsed -ge $timeout ]; then
+            echo "❌ Timed out waiting for current branch server to serve a valid schema."
+            echo "Current server log:"
+            cat /tmp/current-server.log || echo "No current server log found"
+            exit 1
+          fi
+
+      - name: Download GraphQL and REST responses from current branch
+        run: |
+          # Read admin token from shared test tokens file (single source of truth)
+          ADMIN_TOKEN=$(jq -r '.APPLE_JANE_ADMIN_ACCESS_TOKEN' packages/twenty-server/test/integration/constants/test-tokens.json)
+
+          # Load introspection query from file
+          INTROSPECTION_QUERY=$(cat packages/twenty-utils/graphql-introspection-query.graphql)
+
+          # Prepare the query payload
+          QUERY_PAYLOAD=$(echo "$INTROSPECTION_QUERY" | tr '\n' ' ' | sed 's/"/\\"/g')
+
+          echo "Downloading GraphQL schema from current server..."
+          curl -X POST "http://localhost:${{ env.CURRENT_SERVER_PORT }}/graphql" \
+            -H "Content-Type: application/json" \
+            -H "Authorization: Bearer ${ADMIN_TOKEN}" \
+            -d "{\"query\":\"${QUERY_PAYLOAD}\"}" \
+            -o current-schema-introspection.json \
+            -w "HTTP Status: %{http_code}\n" \
+            -s
+
+          echo "Downloading GraphQL metadata schema from current server..."
+          curl -X POST "http://localhost:${{ env.CURRENT_SERVER_PORT }}/metadata" \
+            -H "Content-Type: application/json" \
+            -H "Authorization: Bearer ${ADMIN_TOKEN}" \
+            -d "{\"query\":\"${QUERY_PAYLOAD}\"}" \
+            -o current-metadata-schema-introspection.json \
+            -w "HTTP Status: %{http_code}\n" \
+            -s
+
+          # Download current branch OpenAPI specs
+          echo "Downloading OpenAPI specifications from current server..."
+          curl -s "http://localhost:${{ env.CURRENT_SERVER_PORT }}/rest/open-api/core" \
+            -H "Authorization: Bearer ${ADMIN_TOKEN}" \
+            -o current-rest-api.json \
+            -w "HTTP Status: %{http_code}\n"
+
+          curl -s "http://localhost:${{ env.CURRENT_SERVER_PORT }}/rest/open-api/metadata" \
+            -H "Authorization: Bearer ${ADMIN_TOKEN}" \
+            -o current-rest-metadata-api.json \
+            -w "HTTP Status: %{http_code}\n"
+
+          # Verify the downloads
+          echo "Current branch files downloaded:"
+          ls -la current-*
+
+
+      - name: Preserve current branch files
+        run: |
+          # Create a temp directory to store current branch files
+          mkdir -p /tmp/current-branch-files
+
+          # Move current branch files to temp directory
+          mv current-* /tmp/current-branch-files/ 2>/dev/null || echo "No current-* files to preserve"
+
+          # Both servers must be introspected with the same query, and checking
+          # out main would otherwise swap in main's copy of it
+          cp packages/twenty-utils/graphql-introspection-query.graphql /tmp/graphql-introspection-query.graphql
+
+          echo "Preserved current branch files for later restoration"
+
+      - name: Stop current branch server
+        run: |
+          if [ -f /tmp/current-server.pid ]; then
+            echo "Stopping current branch server..."
+            kill $(cat /tmp/current-server.pid) || true
+            # Wait a bit for graceful shutdown
+            sleep 5
+            # Force kill if still running
+            kill -9 $(cat /tmp/current-server.pid) 2>/dev/null || true
+            rm -f /tmp/current-server.pid
+          fi
+
+      - name: Flush Redis between server runs
+        run: |
+          # Clear all Redis caches to prevent stale data from the current branch
+          # server contaminating the main branch server. Both servers share the
+          # same Redis instance, and CoreEntityCacheService/WorkspaceCacheService
+          # persist cached entities across process restarts.
+          redis-cli -h localhost -p 6379 FLUSHALL || echo "::warning::Failed to flush Redis"
+
+      - name: Checkout main branch
+        run: |
+          git stash
+          git checkout origin/main
+          git reset --hard
+          git clean -xfd -ff
+          rm -rf node_modules packages/*/node_modules packages/*/dist dist .nx/cache
+
+      - name: Install dependencies for main branch
+        uses: ./.github/actions/yarn-install
+
+      - name: Build main branch dependencies
+        run: |
+          npx nx reset
+          npx nx build twenty-shared
+          npx nx build twenty-emails
+
+      - name: Build main branch server
+        run: npx nx build twenty-server
+
+      - name: Setup main branch database
+        run: |
+          npx nx reset:env twenty-server
+          set_env_var() {
+            local var_name="$1"
+            local var_value="$2"
+            local env_file="packages/twenty-server/.env"
+
+            echo "" >> "$env_file"
+
+            if grep -q "^${var_name}=" "$env_file" 2>/dev/null; then
+              sed -i "s|^${var_name}=.*|${var_name}=${var_value}|" "$env_file"
+            else
+              echo "${var_name}=${var_value}" >> "$env_file"
+            fi
+          }
+
+          set_env_var "PG_DATABASE_URL" "postgres://postgres:postgres@localhost:5432/main_branch"
+          set_env_var "NODE_PORT" "${{ env.MAIN_SERVER_PORT }}"
+          set_env_var "REDIS_URL" "redis://localhost:6379"
+          set_env_var "CLICKHOUSE_URL" "http://default:clickhousePassword@localhost:8123/twenty"
+          set_env_var "CLICKHOUSE_PASSWORD" "clickhousePassword"
+
+          npx nx run twenty-server:database:init:prod
+
+      - name: Flush cache before seeding main branch
+        run: npx nx command-no-deps twenty-server -- cache:flush
+
+      - name: Seed main branch database with test data
+        run: |
+          npx nx command-no-deps twenty-server -- workspace:seed:dev
+
+      - name: Start main branch server in background
+        run: |
+          echo "=== Main branch .env file contents ==="
+          cat packages/twenty-server/.env
+          echo "=== Starting main branch server ==="
+          nohup npx nx run twenty-server:start:prod > /tmp/main-server.log 2>&1 &
+          echo $! > /tmp/main-server.pid
+          echo "Main server PID: $(cat /tmp/main-server.pid)"
+
+      - name: Wait for main branch server to be ready
+        run: |
+          echo "Waiting for main branch server to start..."
+          timeout=300
+          interval=5
+          elapsed=0
+
+          ADMIN_TOKEN=$(jq -r '.APPLE_JANE_ADMIN_ACCESS_TOKEN' packages/twenty-server/test/integration/constants/test-tokens.json)
+
+          while [ $elapsed -lt $timeout ]; do
+            GRAPHQL_RESPONSE=$(curl -s -X POST "http://localhost:${{ env.MAIN_SERVER_PORT }}/graphql" \
+              -H "Content-Type: application/json" \
+              -H "Authorization: Bearer ${ADMIN_TOKEN}" \
+              -d '{"query":"{ __schema { queryType { name } } }"}' 2>/dev/null || echo '{}')
+
+            if echo "$GRAPHQL_RESPONSE" | jq -e '.data.__schema' > /dev/null 2>&1 && \
+               curl -fsS "http://localhost:${{ env.MAIN_SERVER_PORT }}/rest/open-api/core" \
+                 -H "Authorization: Bearer ${ADMIN_TOKEN}" > /dev/null 2>&1; then
+              echo "Main branch server is ready!"
+              break
+            fi
+
+            echo "Main branch server not ready yet, waiting ${interval}s..."
+            sleep $interval
+            elapsed=$((elapsed + interval))
+          done
+
+          if [ $elapsed -ge $timeout ]; then
+            echo "❌ Timed out waiting for main branch server to serve a valid schema."
+            echo "Main server log:"
+            cat /tmp/main-server.log || echo "No main server log found"
+            exit 1
+          fi
+
+      - name: Download GraphQL and REST responses from main branch
+        run: |
+          # Read admin token from shared test tokens file (single source of truth)
+          ADMIN_TOKEN=$(jq -r '.APPLE_JANE_ADMIN_ACCESS_TOKEN' packages/twenty-server/test/integration/constants/test-tokens.json)
+
+          # Load introspection query preserved from the current branch
+          INTROSPECTION_QUERY=$(cat /tmp/graphql-introspection-query.graphql)
+
+          # Prepare the query payload
+          QUERY_PAYLOAD=$(echo "$INTROSPECTION_QUERY" | tr '\n' ' ' | sed 's/"/\\"/g')
+
+          echo "Downloading GraphQL schema from main server..."
+          curl -X POST "http://localhost:${{ env.MAIN_SERVER_PORT }}/graphql" \
+            -H "Content-Type: application/json" \
+            -H "Authorization: Bearer ${ADMIN_TOKEN}" \
+            -d "{\"query\":\"${QUERY_PAYLOAD}\"}" \
+            -o main-schema-introspection.json \
+            -w "HTTP Status: %{http_code}\n" \
+            -s
+
+          echo "Downloading GraphQL metadata schema from main server..."
+          curl -X POST "http://localhost:${{ env.MAIN_SERVER_PORT }}/metadata" \
+            -H "Content-Type: application/json" \
+            -H "Authorization: Bearer ${ADMIN_TOKEN}" \
+            -d "{\"query\":\"${QUERY_PAYLOAD}\"}" \
+            -o main-metadata-schema-introspection.json \
+            -w "HTTP Status: %{http_code}\n" \
+            -s
+
+          # Download main branch OpenAPI specs
+          echo "Downloading OpenAPI specifications from main server..."
+          curl -s "http://localhost:${{ env.MAIN_SERVER_PORT }}/rest/open-api/core" \
+            -H "Authorization: Bearer ${ADMIN_TOKEN}" \
+            -o main-rest-api.json \
+            -w "HTTP Status: %{http_code}\n"
+
+          curl -s "http://localhost:${{ env.MAIN_SERVER_PORT }}/rest/open-api/metadata" \
+            -H "Authorization: Bearer ${ADMIN_TOKEN}" \
+            -o main-rest-metadata-api.json \
+            -w "HTTP Status: %{http_code}\n"
+
+          # Verify the downloads
+          echo "Main branch files downloaded:"
+          ls -la main-*
+
+
+      - name: Restore current branch files
+        run: |
+          # Move current branch files back to working directory
+          mv /tmp/current-branch-files/* . 2>/dev/null || echo "No files to restore"
+
+          # Verify all files are present
+          echo "All API files restored:"
+          ls -la current-* main-* 2>/dev/null || echo "Some files may be missing"
+
+          # Clean up temp directory
+          rm -rf /tmp/current-branch-files
+
+      - name: Validate downloaded schema files
+        id: validate-schemas
+        run: |
+          valid=true
+
+          for file in main-schema-introspection.json current-schema-introspection.json \
+                      main-metadata-schema-introspection.json current-metadata-schema-introspection.json; do
+            if [ ! -f "$file" ]; then
+              echo "::warning::Missing GraphQL schema file: $file"
+              valid=false
+            elif ! jq -e '.data.__schema' "$file" >/dev/null 2>&1; then
+              echo "::warning::File $file is not a valid GraphQL introspection result. First 200 bytes: $(head -c 200 "$file")"
+              valid=false
+            fi
+          done
+
+          for file in main-rest-api.json current-rest-api.json \
+                      main-rest-metadata-api.json current-rest-metadata-api.json; do
+            if [ ! -f "$file" ]; then
+              echo "::warning::Missing OpenAPI spec file: $file"
+              valid=false
+            elif ! jq -e '.openapi // .swagger' "$file" >/dev/null 2>&1; then
+              echo "::warning::File $file is not a valid OpenAPI spec. First 200 bytes: $(head -c 200 "$file")"
+              valid=false
+            fi
+          done
+
+          echo "valid=$valid" >> $GITHUB_OUTPUT
+
+      - name: Install OpenAPI Diff Tool
+        run: |
+          # Using the Java-based OpenAPITools/openapi-diff via Docker
+          echo "Using OpenAPITools/openapi-diff via Docker"
+
+      - name: Generate GraphQL Schema Diff Reports
+        id: graphql-diff
+        if: steps.validate-schemas.outputs.valid == 'true'
+        run: |
+          echo "=== INSTALLING GRAPHQL INSPECTOR CLI ==="
+          npm install -g @graphql-inspector/cli
+
+          echo "=== GENERATING GRAPHQL DIFF REPORTS ==="
+
+          # Check if GraphQL schema has changes
+          echo "Checking GraphQL schema for changes..."
+          if graphql-inspector diff main-schema-introspection.json current-schema-introspection.json >/dev/null 2>&1; then
+            echo "✅ No changes in GraphQL schema"
+          else
+            echo "⚠️ Changes detected in GraphQL schema, generating report..."
+            echo "core_breaking=true" >> $GITHUB_OUTPUT
+            echo "# GraphQL Schema Changes" > graphql-schema-diff.md
+            echo "" >> graphql-schema-diff.md
+            graphql-inspector diff main-schema-introspection.json current-schema-introspection.json >> graphql-schema-diff.md 2>&1 || {
+              echo "⚠️ **Breaking changes or errors detected in GraphQL schema**" >> graphql-schema-diff.md
+              echo "" >> graphql-schema-diff.md
+              echo "\`\`\`" >> graphql-schema-diff.md
+              graphql-inspector diff main-schema-introspection.json current-schema-introspection.json 2>&1 >> graphql-schema-diff.md || echo "Error generating diff" >> graphql-schema-diff.md
+              echo "\`\`\`" >> graphql-schema-diff.md
+            }
+          fi
+
+          # Check if GraphQL metadata schema has changes
+          echo "Checking GraphQL metadata schema for changes..."
+          if graphql-inspector diff main-metadata-schema-introspection.json current-metadata-schema-introspection.json >/dev/null 2>&1; then
+            echo "✅ No changes in GraphQL metadata schema"
+          else
+            echo "⚠️ Changes detected in GraphQL metadata schema, generating report..."
+            echo "metadata_breaking=true" >> $GITHUB_OUTPUT
+            echo "# GraphQL Metadata Schema Changes" > graphql-metadata-diff.md
+            echo "" >> graphql-metadata-diff.md
+            graphql-inspector diff main-metadata-schema-introspection.json current-metadata-schema-introspection.json >> graphql-metadata-diff.md 2>&1 || {
+              echo "⚠️ **Breaking changes or errors detected in GraphQL metadata schema**" >> graphql-metadata-diff.md
+              echo "" >> graphql-metadata-diff.md
+              echo "\`\`\`" >> graphql-metadata-diff.md
+              graphql-inspector diff main-metadata-schema-introspection.json current-metadata-schema-introspection.json 2>&1 >> graphql-metadata-diff.md || echo "Error generating diff" >> graphql-metadata-diff.md
+              echo "\`\`\`" >> graphql-metadata-diff.md
+            }
+          fi
+
+          # Show summary
+          echo "Generated diff files:"
+          ls -la *-diff.md 2>/dev/null || echo "No diff files generated (no changes detected)"
+
+      - name: Check REST API Breaking Changes
+        id: rest-diff
+        if: steps.validate-schemas.outputs.valid == 'true'
+        run: |
+          echo "=== CHECKING REST API FOR BREAKING CHANGES ==="
+
+          # Use the Java-based openapi-diff via Docker
+          docker run --rm -v "$(pwd):/specs" openapitools/openapi-diff:latest \
+            --json /specs/rest-api-diff.json \
+            /specs/main-rest-api.json /specs/current-rest-api.json || echo "OpenAPI diff completed with exit code $?"
+
+          # Check if the output file was created and is valid JSON
+          if [ -f "rest-api-diff.json" ] && jq empty rest-api-diff.json 2>/dev/null; then
+            # Check for breaking changes using Java openapi-diff JSON structure
+            incompatible=$(jq -r '.incompatible // false' rest-api-diff.json)
+            different=$(jq -r '.different // false' rest-api-diff.json)
+
+            # Count changes
+            new_endpoints=$(jq -r '.newEndpoints | length' rest-api-diff.json 2>/dev/null || echo "0")
+            missing_endpoints=$(jq -r '.missingEndpoints | length' rest-api-diff.json 2>/dev/null || echo "0")
+            changed_operations=$(jq -r '.changedOperations | length' rest-api-diff.json 2>/dev/null || echo "0")
+
+            if [ "$incompatible" = "true" ]; then
+              echo "❌ Breaking changes detected in REST API"
+              echo "breaking=true" >> $GITHUB_OUTPUT
+
+              # Generate breaking changes report
+              echo "# REST API Breaking Changes" > rest-api-diff.md
+              echo "" >> rest-api-diff.md
+              echo "⚠️ **Breaking changes detected that may affect existing API consumers**" >> rest-api-diff.md
+              echo "" >> rest-api-diff.md
+
+              # Parse and format the changes from Java openapi-diff
+              jq -r '
+                if (.missingEndpoints | length) > 0 then
+                  "## 🚨 Removed Endpoints (" + (.missingEndpoints | length | tostring) + ")\n" +
+                  (.missingEndpoints | map("- **" + .method + " " + .pathUrl + "**: " + (.summary // "")) | join("\n"))
+                else "" end,
+                ([(.changedOperations // [])[] | select(.incompatible)] | if length > 0 then
+                  "\n## ⚠️ Incompatible Operations (" + (length | tostring) + ")\n" +
+                  (map("- **" + .httpMethod + " " + .pathUrl + "**: " + (.summary // "Modified operation")) | join("\n"))
+                else "" end),
+                if (.newEndpoints | length) > 0 then
+                  "\n## ✅ New Endpoints (" + (.newEndpoints | length | tostring) + ")\n" +
+                  (.newEndpoints | map("- " + .method + " " + .pathUrl + ": " + (.summary // "")) | join("\n"))
+                else "" end
+              ' rest-api-diff.json >> rest-api-diff.md
+
+            elif [ "$different" = "true" ]; then
+              echo "📝 Non-breaking changes detected ($new_endpoints new endpoints, $missing_endpoints removed, $changed_operations changed) - no PR comment will be posted"
+              # Don't create markdown file for non-breaking changes to avoid PR comments
+            else
+              echo "✅ No changes detected in REST API"
+              # Don't create diff file for no changes
+            fi
+          else
+            echo "⚠️ OpenAPI diff tool could not process the files"
+
+            echo "# REST API Analysis Error" > rest-api-diff.md
+            echo "" >> rest-api-diff.md
+            echo "⚠️ **Error occurred while analyzing REST API changes**" >> rest-api-diff.md
+            echo "" >> rest-api-diff.md
+            echo "## Error Output" >> rest-api-diff.md
+            echo "\`\`\`" >> rest-api-diff.md
+            docker run --rm -v "$(pwd):/specs" openapitools/openapi-diff:latest /specs/main-rest-api.json /specs/current-rest-api.json 2>&1 >> rest-api-diff.md || echo "Could not capture error output"
+            echo "\`\`\`" >> rest-api-diff.md
+
+            # Don't fail the workflow for tool errors
+            echo "::warning::REST API analysis tool error - continuing workflow"
+          fi
+
+      - name: Check REST Metadata API Breaking Changes
+        id: rest-metadata-diff
+        if: steps.validate-schemas.outputs.valid == 'true'
+        run: |
+          echo "=== CHECKING REST METADATA API FOR BREAKING CHANGES ==="
+
+          # Use the Java-based openapi-diff for metadata API as well
+          docker run --rm -v "$(pwd):/specs" openapitools/openapi-diff:latest \
+            --json /specs/rest-metadata-api-diff.json \
+            /specs/main-rest-metadata-api.json /specs/current-rest-metadata-api.json || echo "OpenAPI diff completed with exit code $?"
+
+          # Check if the output file was created and is valid JSON
+          if [ -f "rest-metadata-api-diff.json" ] && jq empty rest-metadata-api-diff.json 2>/dev/null; then
+            # Check for breaking changes using Java openapi-diff JSON structure
+            incompatible=$(jq -r '.incompatible // false' rest-metadata-api-diff.json)
+            different=$(jq -r '.different // false' rest-metadata-api-diff.json)
+
+            # Count changes
+            new_endpoints=$(jq -r '.newEndpoints | length' rest-metadata-api-diff.json 2>/dev/null || echo "0")
+            missing_endpoints=$(jq -r '.missingEndpoints | length' rest-metadata-api-diff.json 2>/dev/null || echo "0")
+            changed_operations=$(jq -r '.changedOperations | length' rest-metadata-api-diff.json 2>/dev/null || echo "0")
+
+            if [ "$incompatible" = "true" ]; then
+              echo "❌ Breaking changes detected in REST Metadata API"
+              echo "breaking=true" >> $GITHUB_OUTPUT
+
+              # Generate breaking changes report (only for breaking changes)
+              echo "# REST Metadata API Breaking Changes" > rest-metadata-api-diff.md
+              echo "" >> rest-metadata-api-diff.md
+              echo "⚠️ **Breaking changes detected that may affect existing API consumers**" >> rest-metadata-api-diff.md
+              echo "" >> rest-metadata-api-diff.md
+
+              # Parse and format the changes from Java openapi-diff
+              jq -r '
+                if (.missingEndpoints | length) > 0 then
+                  "## 🚨 Removed Endpoints (" + (.missingEndpoints | length | tostring) + ")\n" +
+                  (.missingEndpoints | map("- **" + .method + " " + .pathUrl + "**: " + (.summary // "")) | join("\n"))
+                else "" end,
+                ([(.changedOperations // [])[] | select(.incompatible)] | if length > 0 then
+                  "\n## ⚠️ Incompatible Operations (" + (length | tostring) + ")\n" +
+                  (map("- **" + .httpMethod + " " + .pathUrl + "**: " + (.summary // "Modified operation")) | join("\n"))
+                else "" end),
+                if (.newEndpoints | length) > 0 then
+                  "\n## ✅ New Endpoints (" + (.newEndpoints | length | tostring) + ")\n" +
+                  (.newEndpoints | map("- " + .method + " " + .pathUrl + ": " + (.summary // "")) | join("\n"))
+                else "" end
+              ' rest-metadata-api-diff.json >> rest-metadata-api-diff.md
+
+            elif [ "$different" = "true" ]; then
+              echo "📝 Non-breaking changes detected ($new_endpoints new endpoints, $missing_endpoints removed, $changed_operations changed) - no PR comment will be posted"
+              # Don't create markdown file for non-breaking changes to avoid PR comments
+            else
+              echo "✅ No changes detected in REST Metadata API"
+            fi
+          else
+            echo "⚠️ OpenAPI diff tool could not process the metadata API files"
+
+            echo "# REST Metadata API Analysis Error" > rest-metadata-api-diff.md
+            echo "" >> rest-metadata-api-diff.md
+            echo "⚠️ **Error occurred while analyzing REST Metadata API changes**" >> rest-metadata-api-diff.md
+            echo "" >> rest-metadata-api-diff.md
+            echo "## Error Output" >> rest-metadata-api-diff.md
+            echo "\`\`\`" >> rest-metadata-api-diff.md
+            docker run --rm -v "$(pwd):/specs" openapitools/openapi-diff:latest /specs/main-rest-metadata-api.json /specs/current-rest-metadata-api.json 2>&1 >> rest-metadata-api-diff.md || echo "Could not capture error output"
+            echo "\`\`\`" >> rest-metadata-api-diff.md
+
+            # Don't fail the workflow for tool errors
+            echo "::warning::REST Metadata API analysis tool error - continuing workflow"
+          fi
+
+      - name: Fail on breaking changes
+        if: steps.validate-schemas.outputs.valid == 'true'
+        run: |
+          breaking=false
+
+          if [ "${{ steps.graphql-diff.outputs.core_breaking }}" = "true" ]; then
+            echo "❌ GraphQL core schema has breaking changes"
+            breaking=true
+            if [ -f graphql-schema-diff.md ]; then
+              echo ""
+              cat graphql-schema-diff.md
+              echo ""
+            fi
+          fi
+
+          if [ "${{ steps.graphql-diff.outputs.metadata_breaking }}" = "true" ]; then
+            echo "❌ GraphQL metadata schema has breaking changes"
+            breaking=true
+            if [ -f graphql-metadata-diff.md ]; then
+              echo ""
+              cat graphql-metadata-diff.md
+              echo ""
+            fi
+          fi
+
+          if [ "${{ steps.rest-diff.outputs.breaking }}" = "true" ]; then
+            echo "❌ REST core API has breaking changes"
+            breaking=true
+            if [ -f rest-api-diff.json ]; then
+              echo ""
+              jq -r '
+                (if (.missingEndpoints | length) > 0 then
+                  "  Removed endpoints:\n" +
+                  (.missingEndpoints | map("    - " + (.method // "?") + " " + (.pathUrl // "?")) | join("\n"))
+                else "" end),
+                ([(.changedOperations // [])[] | select(.incompatible)] | if length > 0 then
+                  "  Incompatible operations:\n" +
+                  (map("    - " + (.httpMethod // "?") + " " + (.pathUrl // "?")) | join("\n"))
+                else "" end)
+              ' rest-api-diff.json | sed '/^$/d'
+              echo ""
+            fi
+          fi
+
+          if [ "${{ steps.rest-metadata-diff.outputs.breaking }}" = "true" ]; then
+            echo "❌ REST metadata API has breaking changes"
+            breaking=true
+            if [ -f rest-metadata-api-diff.json ]; then
+              echo ""
+              jq -r '
+                (if (.missingEndpoints | length) > 0 then
+                  "  Removed endpoints:\n" +
+                  (.missingEndpoints | map("    - " + (.method // "?") + " " + (.pathUrl // "?")) | join("\n"))
+                else "" end),
+                ([(.changedOperations // [])[] | select(.incompatible)] | if length > 0 then
+                  "  Incompatible operations:\n" +
+                  (map("    - " + (.httpMethod // "?") + " " + (.pathUrl // "?")) | join("\n"))
+                else "" end)
+              ' rest-metadata-api-diff.json | sed '/^$/d'
+              echo ""
+            fi
+          fi
+
+          if [ "$breaking" = "true" ]; then
+            echo ""
+            echo "This PR introduces breaking changes to the public API."
+            echo "If intentional, deprecate the old endpoint and introduce a new one."
+            echo "See the breaking changes report artifact and PR comment for details."
+            exit 1
+          fi
+
+          echo "✅ No breaking API changes detected"
+
+      - name: Upload breaking changes report
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: breaking-changes-report
+          path: |
+            *-diff.md
+            *-diff.json
+          if-no-files-found: ignore
+          retention-days: 3
+
+      - name: Cleanup servers
+        if: always()
+        run: |
+          if [ -f /tmp/current-server.pid ]; then
+            kill $(cat /tmp/current-server.pid) || true
+          fi
+          if [ -f /tmp/main-server.pid ]; then
+            kill $(cat /tmp/main-server.pid) || true
+          fi

.github/workflows/ci-client-sdk.yaml

@@ -0,0 +1,55 @@
+name: CI Client SDK
+
+on:
+  pull_request:
+  merge_group:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  changed-files-check:
+    if: github.event_name != 'merge_group'
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        packages/twenty-client-sdk/**
+        packages/twenty-shared/**
+        yarn.lock
+        .github/workflows/ci-client-sdk.yaml
+        !packages/twenty-client-sdk/package.json
+  client-sdk-test:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    env:
+      NODE_OPTIONS: '--max-old-space-size=4096'
+    strategy:
+      matrix:
+        task: [lint, typecheck, test]
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Run ${{ matrix.task }} task
+        uses: ./.github/actions/nx-affected
+        with:
+          tag: scope:client-sdk
+          tasks: ${{ matrix.task }}
+  ci-client-sdk-status-check:
+    if: always() && !cancelled()
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs: [changed-files-check, client-sdk-test]
+    steps:
+      - name: Fail job if any needs failed
+        if: contains(needs.*.result, 'failure')
+        run: exit 1

.github/workflows/ci-companion.yaml

@@ -0,0 +1,43 @@
+name: CI Desktop
+
+on:
+  pull_request:
+    paths:
+      - 'packages/twenty-companion/**'
+      - 'packages/twenty-ui/**'
+      - 'packages/twenty-front/**'
+      - 'packages/twenty-shared/**'
+      - 'package.json'
+      - 'yarn.lock'
+      - '.github/workflows/ci-companion.yaml'
+  push:
+    branches: [main]
+    paths:
+      - 'packages/twenty-companion/**'
+      - 'packages/twenty-ui/**'
+      - 'packages/twenty-front/**'
+      - 'packages/twenty-shared/**'
+      - 'package.json'
+      - 'yarn.lock'
+      - '.github/workflows/ci-companion.yaml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  desktop:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: ./.github/actions/yarn-install
+      - name: Typecheck
+        run: yarn workspace @twentyhq/companion typecheck
+      - name: Test
+        run: yarn workspace @twentyhq/companion test
+      - name: Build
+        run: yarn workspace @twentyhq/companion build

.github/workflows/ci-create-app-e2e-minimal.yaml

@@ -0,0 +1,220 @@
+name: CI Create App E2E minimal
+
+on:
+  push:
+    branches:
+      - main
+
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  changed-files-check:
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        packages/create-twenty-app/**
+        packages/twenty-sdk/**
+        packages/twenty-client-sdk/**
+        packages/twenty-ui/**
+        packages/twenty-shared/**
+        !packages/create-twenty-app/package.json
+        !packages/twenty-sdk/package.json
+        !packages/twenty-client-sdk/package.json
+        !packages/twenty-ui/package.json
+        !packages/twenty-shared/package.json
+  create-app-e2e-minimal:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest-4-cores
+    services:
+      postgres:
+        image: postgres:18
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+      redis:
+        image: redis
+        ports:
+          - 6379:6379
+    env:
+      # All four get the CI version and are built. Only the three libraries are
+      # published before the template lockfile is generated; create-twenty-app is
+      # published after it, carrying that lockfile in its tarball.
+      PUBLISHABLE_PACKAGES: twenty-client-sdk twenty-ui twenty-sdk create-twenty-app
+      LIBRARY_PACKAGES: twenty-client-sdk twenty-ui twenty-sdk
+      # Deliberately beyond any realistic policy rather than a value anyone would
+      # set. With a working template lockfile nothing is resolved, so no gate of
+      # any length applies and this number is inert; it only bites if the lockfile
+      # stops shipping, and picking a large one means this job still catches that
+      # however long a real consumer's gate happens to be.
+      SCAFFOLD_AGE_GATE: 30d
+      TWENTY_API_URL: http://localhost:3000
+      TWENTY_API_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ1c2VySWQiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ3b3Jrc3BhY2VJZCI6IjIwMjAyMDIwLTFjMjUtNGQwMi1iZjI1LTZhZWNjZjdlYTQxOSIsIndvcmtzcGFjZU1lbWJlcklkIjoiMjAyMDIwMjAtNDYzZi00MzViLTgyOGMtMTA3ZTAwN2EyNzExIiwidXNlcldvcmtzcGFjZUlkIjoiMjAyMDIwMjAtMWU3Yy00M2Q5LWE1ZGItNjg1YjUwNjlkODE2IiwidHlwZSI6IkFDQ0VTUyIsImF1dGhQcm92aWRlciI6InBhc3N3b3JkIiwiaWF0IjoxNzUxMjgxNzA0LCJleHAiOjIwNjY4NTc3MDR9.HMGqCsVlOAPVUBhKSGlD1X86VoHKt4LIUtET3CGIdik
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+
+      - name: Set CI version and prepare packages for publish
+        run: |
+          CI_VERSION="0.0.0-ci.$(date +%s)"
+          echo "CI_VERSION=$CI_VERSION" >> $GITHUB_ENV
+          npx nx run-many -t set-local-version -p $PUBLISHABLE_PACKAGES --releaseVersion=$CI_VERSION
+
+      - name: Build packages
+        run: |
+          for pkg in $PUBLISHABLE_PACKAGES; do
+            npx nx build $pkg
+          done
+
+      - name: Install and start Verdaccio
+        run: |
+          npx verdaccio --config .github/verdaccio-config.yaml &
+
+          for i in $(seq 1 30); do
+            if curl -s http://localhost:4873 > /dev/null 2>&1; then
+              echo "Verdaccio is ready"
+              break
+            fi
+            echo "Waiting for Verdaccio... ($i/30)"
+            sleep 1
+          done
+
+      - name: Publish libraries to local registry
+        run: |
+          yarn config set npmRegistryServer http://localhost:4873
+          yarn config set unsafeHttpWhitelist --json '["localhost"]'
+          yarn config set npmAuthToken ci-auth-token
+
+          for pkg in $LIBRARY_PACKAGES; do
+            cd packages/$pkg
+            yarn npm publish --tag ci
+            cd ../..
+          done
+
+      - name: Generate template lockfile
+        run: |
+          npx nx run create-twenty-app:generate-template-lock \
+            --releaseVersion=$CI_VERSION --registry=http://localhost:4873
+
+      - name: Publish create-twenty-app to local registry
+        run: |
+          cd packages/create-twenty-app
+          yarn npm publish --tag ci
+
+      - name: Scaffold app using published create-twenty-app
+        env:
+          YARN_NPM_MINIMAL_AGE_GATE: ${{ env.SCAFFOLD_AGE_GATE }}
+          YARN_NPM_REGISTRY_SERVER: http://localhost:4873
+          YARN_UNSAFE_HTTP_WHITELIST: localhost
+        run: |
+          npm install -g create-twenty-app@$CI_VERSION --registry http://localhost:4873
+          create-twenty-app --version
+          mkdir -p /tmp/e2e-test-workspace
+          cd /tmp/e2e-test-workspace
+          create-twenty-app test-app --display-name "Test scaffolded app" --description "E2E test scaffolded app" --url http://localhost:3000
+
+      - name: Verify scaffolded app ships a usable lockfile
+        env:
+          YARN_NPM_MINIMAL_AGE_GATE: ${{ env.SCAFFOLD_AGE_GATE }}
+          YARN_NPM_REGISTRY_SERVER: http://localhost:4873
+          YARN_UNSAFE_HTTP_WHITELIST: localhost
+        run: |
+          cd /tmp/e2e-test-workspace/test-app
+
+          if [ ! -f yarn.lock ]; then
+            echo "::error::The scaffolded app has no yarn.lock"
+            exit 1
+          fi
+
+          if ! grep -q '^__metadata:' yarn.lock; then
+            echo "::error::The scaffolded yarn.lock is not a Yarn 4 lockfile"
+            exit 1
+          fi
+
+          for pkg in $LIBRARY_PACKAGES; do
+            if ! grep -q "resolution: \"$pkg@npm:$CI_VERSION\"" yarn.lock; then
+              echo "::error::$pkg@$CI_VERSION is missing from the scaffolded lockfile"
+              exit 1
+            fi
+          done
+
+          # What the generated project's own CI workflow runs.
+          yarn install --immutable
+
+      - name: Verify installed app versions
+        run: |
+          cd /tmp/e2e-test-workspace/test-app
+          echo "--- Checking scaffolded app package versions ---"
+          node -e "
+            const pkg = require('./package.json');
+            for (const name of ['twenty-client-sdk', 'twenty-sdk', 'twenty-ui']) {
+              const version = pkg.devDependencies[name];
+              if (version !== process.env.CI_VERSION) {
+                console.error('Expected', name, 'version', process.env.CI_VERSION, 'got:', version);
+                process.exit(1);
+              }
+              console.log(name, 'version in scaffolded app:', version);
+            }
+          "
+
+      - name: Verify SDK CLI is available
+        run: |
+          cd /tmp/e2e-test-workspace/test-app
+          npx --no-install twenty --version
+
+      - name: Setup server environment
+        run: npx nx reset:env:e2e-testing-server twenty-server
+
+      - name: Create databases
+        run: |
+          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "default";'
+          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "test";'
+
+      - name: Setup database
+        run: npx nx run twenty-server:database:reset
+
+      - name: Start server
+        run: nohup npx nx start:ci twenty-server &
+
+      - name: Wait for server to be ready
+        run: npx wait-on http://localhost:3000/healthz --timeout 120000 --interval 1000
+
+      - name: Authenticate with twenty-server
+        run: |
+          cd /tmp/e2e-test-workspace/test-app
+          npx --no-install twenty remote:add --api-key ${{ env.TWENTY_API_KEY }} --url ${{ env.TWENTY_API_URL }}
+
+      - name: Run scaffolded app integration test (deploys, installs, and verifies the app)
+        run: |
+          cd /tmp/e2e-test-workspace/test-app
+          yarn test
+
+  ci-create-app-e2e-minimal-status-check:
+    if: always() && !cancelled()
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs: [changed-files-check, create-app-e2e-minimal]
+    steps:
+      - name: Fail job if any needs failed
+        if: contains(needs.*.result, 'failure')
+        run: exit 1

.github/workflows/ci-create-app.yaml

@@ -0,0 +1,54 @@
+name: CI Create App
+
+on:
+  push:
+    branches:
+      - main
+
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  changed-files-check:
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        packages/create-twenty-app/**
+        !packages/create-twenty-app/package.json
+  create-app-test:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        task: [lint, typecheck, test]
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Build
+        run: npx nx build create-twenty-app
+      - name: Run ${{ matrix.task }} task
+        uses: ./.github/actions/nx-affected
+        with:
+          tag: scope:create-app
+          tasks: ${{ matrix.task }}
+  ci-create-app-status-check:
+    if: always() && !cancelled()
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs: [changed-files-check, create-app-test]
+    steps:
+      - name: Fail job if any needs failed
+        if: contains(needs.*.result, 'failure')
+        run: exit 1

.github/workflows/ci-cross-version-upgrade.yaml

@@ -0,0 +1,365 @@
+name: CI - Cross-Version Upgrade
+run-name: cross-version-upgrade ${{ inputs.from_version || 'v1.22' }} → current (from source)
+
+on:
+  workflow_call:
+    inputs:
+      skip:
+        type: boolean
+        required: false
+        default: false
+        description: 'Set to true to skip the upgrade check and report success immediately'
+      from_version:
+        type: string
+        required: false
+        description: 'Old Twenty version to upgrade from (defaults to oldest supported: v1.22)'
+  workflow_dispatch:
+    inputs:
+      from_version:
+        type: string
+        required: false
+        default: ''
+        description: 'Old Twenty version to upgrade from (defaults to oldest supported: v1.22)'
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash --noprofile --norc -euo pipefail {0}
+
+env:
+  SERVER_BUILD_CACHE_KEY: server-build
+  OLDEST_SUPPORTED_VERSION: v1.22
+  # Local CI containers only — not real secrets. APP_SECRET is generated fresh
+  # per run (see "Compute run config") so nothing reconstructible is committed.
+  OLD_PG_DATABASE_URL: postgres://postgres:postgres@postgres:5432/default
+  OLD_REDIS_URL: redis://redis:6379
+  # Standard dev-seed workspace id (workspace:seed:dev) — public, not a secret.
+  SEED_WORKSPACE_ID: 20202020-1c25-4d02-bf25-6aeccf7ea419
+
+jobs:
+  no-op:
+    if: format('{0}', inputs.skip) == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "Cross-version upgrade check skipped (upgrade path not touched)"
+
+  cross-version-upgrade:
+    if: format('{0}', inputs.skip) != 'true'
+    timeout-minutes: 45
+    runs-on: ubuntu-latest
+    steps:
+      - name: Compute run config
+        env:
+          INPUT_FROM_VERSION: ${{ inputs.from_version }}
+        run: |
+          FROM_VERSION="${INPUT_FROM_VERSION:-}"
+          if [ -z "$FROM_VERSION" ]; then
+            FROM_VERSION="$OLDEST_SUPPORTED_VERSION"
+          fi
+          printf 'FROM_VERSION=%s\n' "$FROM_VERSION" >> "$GITHUB_ENV"
+          # Random per-run secret shared by the old container and the from-source
+          # server within this job. Never committed, never reused across runs.
+          GENERATED_APP_SECRET="$(openssl rand -hex 32)"
+          echo "::add-mask::${GENERATED_APP_SECRET}"
+          printf 'APP_SECRET=%s\n' "$GENERATED_APP_SECRET" >> "$GITHUB_ENV"
+          echo "Testing upgrade from ${FROM_VERSION} to current (built from source)"
+
+      - name: Create Docker network
+        run: docker network create twenty-net
+
+      - name: Start Postgres
+        run: |
+          docker run -d \
+            --name postgres \
+            --network twenty-net \
+            -e POSTGRES_USER=postgres \
+            -e POSTGRES_PASSWORD=postgres \
+            -e POSTGRES_DB=default \
+            -p 5432:5432 \
+            postgres:16
+
+          for i in $(seq 1 30); do
+            if docker exec postgres pg_isready -U postgres 2>/dev/null; then
+              echo "Postgres is ready"
+              exit 0
+            fi
+            echo "Waiting for Postgres… ($i/30)"
+            sleep 2
+          done
+          echo "::error::Postgres did not become ready in time"
+          docker logs postgres 2>&1 | tail -50 || true
+          exit 1
+
+      - name: Start Redis
+        run: |
+          docker run -d \
+            --name redis \
+            --network twenty-net \
+            -p 6379:6379 \
+            redis:7-alpine
+
+          for i in $(seq 1 10); do
+            if docker exec redis redis-cli ping 2>/dev/null | grep -q PONG; then
+              echo "Redis is ready"
+              exit 0
+            fi
+            echo "Waiting for Redis… ($i/10)"
+            sleep 1
+          done
+          echo "::error::Redis did not become ready in time"
+          docker logs redis 2>&1 | tail -50 || true
+          exit 1
+
+      # ================================================================
+      # Phase 1 — Old version (from Docker Hub): seed and sanity check
+      # ================================================================
+
+      - name: Old version / Start container
+        run: |
+          docker run -d \
+            --name twenty-old \
+            --network twenty-net \
+            -p 3000:3000 \
+            -e NODE_PORT=3000 \
+            -e SERVER_URL=http://localhost:3000 \
+            -e PG_DATABASE_URL=${OLD_PG_DATABASE_URL} \
+            -e REDIS_URL=${OLD_REDIS_URL} \
+            -e APP_SECRET=${APP_SECRET} \
+            "twentycrm/twenty:${FROM_VERSION}"
+
+      - name: Old version / Wait for API ready
+        run: |
+          TIMEOUT=600
+          CONTAINER="twenty-old"
+          ELAPSED=0
+          echo "Waiting for Twenty on port 3000 (timeout ${TIMEOUT}s)…"
+          while true; do
+            healthz=$(curl -s -o /dev/null -w '%{http_code}' "http://localhost:3000/healthz" 2>/dev/null || echo "000")
+            graphql=$(curl -s -o /dev/null -w '%{http_code}' "http://localhost:3000/graphql" \
+              -H "Content-Type: application/json" \
+              -d '{"query":"{ __typename }"}' 2>/dev/null || echo "000")
+            if [ "$healthz" = "200" ] && [ "$graphql" != "000" ] && [ "$graphql" != "404" ]; then
+              echo "Twenty is ready! healthz=${healthz} graphql=${graphql} (took ~${ELAPSED}s)"
+              break
+            fi
+            container_status=$(docker inspect --format='{{.State.Status}}' "$CONTAINER" 2>/dev/null || echo "unknown")
+            if [ "$container_status" = "exited" ]; then
+              echo "::error::Container ${CONTAINER} exited unexpectedly"
+              docker logs "$CONTAINER"
+              exit 1
+            fi
+            ELAPSED=$((ELAPSED + 5))
+            if [ "$ELAPSED" -ge "$TIMEOUT" ]; then
+              echo "::error::Twenty did not become ready within ${TIMEOUT}s (healthz=${healthz} graphql=${graphql})"
+              docker logs "$CONTAINER" 2>&1 | tail -100
+              exit 1
+            fi
+            echo "  … waited ${ELAPSED}s [healthz=${healthz} graphql=${graphql}]"
+            sleep 5
+          done
+
+      - name: Old version / Seed dev data
+        run: |
+          docker exec twenty-old sh -c "cd /app/packages/twenty-server && yarn command:prod workspace:seed:dev"
+
+      - name: Old version / Sanity check seeded data
+        # Verify the seed populated the database directly via psql — avoids
+        # needing an API token on the old version (v1.22 has no token-mint command).
+        run: |
+          COUNT=$(docker exec -e PGPASSWORD=postgres postgres \
+            psql -U postgres -d default -tAc \
+            "SELECT count(*) FROM core.workspace WHERE id = '${SEED_WORKSPACE_ID}';")
+          echo "Seed workspaces found: ${COUNT}"
+          if [ "${COUNT:-0}" -lt 1 ]; then
+            echo "Sanity check failed: seed workspace ${SEED_WORKSPACE_ID} not found"
+            docker logs twenty-old
+            exit 1
+          fi
+
+      - name: Old version / Stop container
+        run: |
+          mkdir -p upgrade-logs
+          docker logs twenty-old > upgrade-logs/twenty-old.log 2>&1 || true
+          docker stop twenty-old
+          docker rm twenty-old
+
+      # ================================================================
+      # Phase 2 — Current version (from source): upgrade on same database
+      # ================================================================
+
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+
+      - name: Restore server build cache
+        # Best-effort: a hit skips the cold rebuild; a miss simply builds from scratch below.
+        uses: ./.github/actions/restore-cache
+        with:
+          key: ${{ env.SERVER_BUILD_CACHE_KEY }}
+
+      - name: Build twenty-shared
+        run: npx nx build twenty-shared
+
+      - name: Server / Write .env
+        run: npx nx reset:env twenty-server
+
+      - name: Server / Align .env with seeded database
+        run: |
+          ENV_FILE="packages/twenty-server/.env"
+          # Must match the old container's APP_SECRET (same DB, same run-generated secret).
+          sed -i "s|^APP_SECRET=.*|APP_SECRET=${APP_SECRET}|" "$ENV_FILE"
+          # PG_DATABASE_URL / REDIS_URL come from .env.example (postgres@localhost:5432/default,
+          # redis@localhost:6379). APP_SECRET is intentionally not echoed.
+          grep -E '^(PG_DATABASE_URL|REDIS_URL)=' "$ENV_FILE"
+
+      - name: Server / Build
+        run: npx nx build twenty-server
+
+      - name: Server / Flush cache
+        run: npx nx run twenty-server:command-no-deps -- cache:flush
+
+      - name: Server / Run upgrade command
+        run: npx nx run twenty-server:command-no-deps -- upgrade --verbose
+
+      - name: Server / Start
+        run: |
+          mkdir -p upgrade-logs
+          npx nx start:ci twenty-server > upgrade-logs/twenty-new.log 2>&1 &
+
+      - name: Waiting for server starting...
+        run: |
+          for i in {1..30}; do
+            if curl -f -s http://localhost:3000/healthz > /dev/null; then
+              echo "Server ready!"
+              exit 0
+            fi
+            echo "Waiting..."
+            sleep 5
+          done
+          echo "::error::Server did not become healthy in time"
+          tail -100 upgrade-logs/twenty-new.log || true
+          exit 1
+
+      # ================================================================
+      # Phase 3 — Smoke tests on upgraded instance
+      # ================================================================
+      # Health is already asserted by the "Waiting for server starting..." loop.
+
+      - name: Smoke / Generate API token
+        # Mint a token against the running upgraded server (signed with this run's
+        # APP_SECRET). No token is committed to the repo.
+        run: |
+          OUTPUT=$(NO_COLOR=1 npx nx run twenty-server:command-no-deps -- \
+            workspace:generate-api-key -w "${SEED_WORKSPACE_ID}" -n "cross-version-upgrade-ci")
+          echo "$OUTPUT"
+          TOKEN=$(echo "$OUTPUT" | grep -o 'TOKEN:[A-Za-z0-9._-]*' | head -1 | cut -d: -f2-)
+          if [ -z "$TOKEN" ]; then
+            echo "::error::Failed to generate API token"
+            exit 1
+          fi
+          echo "::add-mask::$TOKEN"
+          printf 'API_KEY=%s\n' "$TOKEN" >> "$GITHUB_ENV"
+
+      - name: Smoke / Upgrade status
+        run: |
+          RAW=$(FORCE_COLOR=0 NO_COLOR=1 npx nx run twenty-server:command-no-deps -- upgrade:status 2>&1)
+          # chalk colorizes even with NO_COLOR under nx — strip ANSI codes before asserting.
+          OUTPUT=$(printf '%s\n' "$RAW" | sed -E 's/\x1b\[[0-9;]*m//g')
+          echo "$OUTPUT"
+          echo "$OUTPUT" > upgrade-logs/upgrade-status.log
+          echo "$OUTPUT" | grep -q "Instance: Up to date" \
+            || { echo "FAIL: Instance is not up to date"; exit 1; }
+          echo "$OUTPUT" | grep -q "0 behind, 0 failed" \
+            || { echo "FAIL: Some workspaces are behind or failed"; exit 1; }
+
+      - name: Smoke / Query companies
+        run: |
+          HTTP_CODE=$(curl -s -o /tmp/response.json -w '%{http_code}' http://localhost:3000/graphql \
+            -H "Authorization: Bearer ${API_KEY}" \
+            -H "Content-Type: application/json" \
+            -d '{"query":"{ companies { edges { node { id name } } } }"}' || true)
+          echo "HTTP status: ${HTTP_CODE}"
+          jq . /tmp/response.json 2>/dev/null || cat /tmp/response.json
+          if [ -z "$HTTP_CODE" ] || [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 300 ]; then
+            echo "FAIL: API returned HTTP ${HTTP_CODE}"; exit 1
+          fi
+          jq -e '.data.companies.edges | length > 0' /tmp/response.json \
+            || { echo "FAIL: expected companies with edges"; exit 1; }
+
+      - name: Smoke / Query people
+        run: |
+          HTTP_CODE=$(curl -s -o /tmp/response.json -w '%{http_code}' http://localhost:3000/graphql \
+            -H "Authorization: Bearer ${API_KEY}" \
+            -H "Content-Type: application/json" \
+            -d '{"query":"{ people { edges { node { id } } } }"}' || true)
+          echo "HTTP status: ${HTTP_CODE}"
+          jq . /tmp/response.json 2>/dev/null || cat /tmp/response.json
+          if [ -z "$HTTP_CODE" ] || [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 300 ]; then
+            echo "FAIL: API returned HTTP ${HTTP_CODE}"; exit 1
+          fi
+          jq -e '.data.people.edges != null' /tmp/response.json \
+            || { echo "FAIL: expected people edges to be non-null"; exit 1; }
+
+      - name: Smoke / Query metadata objects
+        run: |
+          HTTP_CODE=$(curl -s -o /tmp/response.json -w '%{http_code}' http://localhost:3000/metadata \
+            -H "Authorization: Bearer ${API_KEY}" \
+            -H "Content-Type: application/json" \
+            -d '{"query":"{ objects { edges { node { id nameSingular } } } }"}' || true)
+          echo "HTTP status: ${HTTP_CODE}"
+          jq . /tmp/response.json 2>/dev/null || cat /tmp/response.json
+          if [ -z "$HTTP_CODE" ] || [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 300 ]; then
+            echo "FAIL: API returned HTTP ${HTTP_CODE}"; exit 1
+          fi
+          jq -e '.data.objects.edges | length > 0' /tmp/response.json \
+            || { echo "FAIL: expected metadata objects"; exit 1; }
+
+      # ================================================================
+      # Phase 4 — Collect logs & cleanup
+      # ================================================================
+
+      - name: Upload upgrade logs
+        if: always()
+        id: upload-logs
+        uses: actions/upload-artifact@v4
+        with:
+          name: cross-version-upgrade-logs
+          path: upgrade-logs/
+          if-no-files-found: ignore
+
+      - name: Job summary
+        if: always()
+        env:
+          RESULT: ${{ job.status }}
+          ARTIFACT_URL: ${{ steps.upload-logs.outputs.artifact-url }}
+        run: |
+          {
+            echo "## Cross-Version Upgrade: ${FROM_VERSION} → current (from source)"
+            echo ""
+            echo "| | |"
+            echo "|---|---|"
+            echo "| **Result** | \`${RESULT}\` |"
+            echo "| **Old version** | \`${FROM_VERSION}\` (Docker Hub) |"
+            echo "| **New version** | current branch (built from source) |"
+            if [ -n "${ARTIFACT_URL:-}" ]; then
+              echo ""
+              echo "**[Download full logs](${ARTIFACT_URL})**"
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Cleanup
+        if: always()
+        run: |
+          docker stop twenty-old 2>/dev/null || true
+          docker rm twenty-old 2>/dev/null || true
+          docker stop postgres 2>/dev/null || true
+          docker rm postgres 2>/dev/null || true
+          docker stop redis 2>/dev/null || true
+          docker rm redis 2>/dev/null || true
+          docker network rm twenty-net 2>/dev/null || true

.github/workflows/ci-docs.yaml

@@ -0,0 +1,53 @@
+name: CI Docs
+
+on:
+  push:
+    branches:
+      - main
+
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  changed-files-check:
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        package.json
+        yarn.lock
+        packages/twenty-ui/**
+        packages/twenty-shared/**
+        .github/workflows/ci-docs.yaml
+        packages/twenty-docs/**
+
+  docs-lint:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch local actions
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+
+      - name: Docs / Lint
+        run: npx nx lint twenty-docs
+
+      - name: Docs / Test
+        run: npx nx test twenty-docs
+
+      - name: Docs / Generated UI references
+        run: npx nx check:ui twenty-docs
+
+      - name: Docs / Storybook embeds
+        run: npx nx check:ui-stories twenty-docs

.github/workflows/ci-dpa-subprocessors-sync.yaml

@@ -0,0 +1,79 @@
+name: DPA Sub-Processor Sync
+
+on:
+  schedule:
+    - cron: '0 6 * * 1' # Weekly, Monday at 6 AM UTC
+  workflow_dispatch: # Allow manual trigger
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  sync-subprocessors:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      NODE_OPTIONS: '--max-old-space-size=4096'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          ref: main
+
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+
+      - name: Build dependencies
+        run: npx nx build twenty-shared
+
+      - name: Run sub-processor sync
+        run: npx nx run twenty-server:ts-node-no-deps-transpile-only -- ./scripts/dpa-sync-subprocessors.ts
+
+      - name: Check for changes
+        id: changes
+        run: |
+          if git diff --quiet packages/twenty-server/src/engine/core-modules/dpa/constants/subprocessors.json; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create pull request
+        if: steps.changes.outputs.changed == 'true'
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: 'chore: sync DPA sub-processors from trust center'
+          title: 'chore: sync DPA sub-processors from trust center'
+          body: |
+            Automated weekly sync of `subprocessors.json` from Twenty's Trust Center (OneLeet).
+
+            This keeps the DPA's Annex C (the SCC Annex III list of Sub-Processors) in
+            lockstep with the canonical list at https://trust.twenty.com — the Trust
+            Center is the single source of truth; this file is generated from it.
+
+            **Please review before merging** — confirm the added/removed Sub-Processors
+            are expected, and that customers were notified per Section 6.2 where required.
+          branch: chore/dpa-subprocessors-sync
+          base: main
+          labels: automated
+          delete-branch: true
+
+      - name: Mint twenty-infra dispatch token
+        id: app-token
+        if: steps.changes.outputs.changed == 'true'
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
+          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
+          owner: twentyhq
+          repositories: twenty-infra
+          permission-actions: write
+
+      - name: Trigger automerge
+        if: steps.changes.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main

.github/workflows/ci-e2e-main.yaml

@@ -0,0 +1,571 @@
+name: CI E2E Main
+
+on:
+  push:
+    branches: [main]
+
+  pull_request:
+    types: [labeled, synchronize, opened, reopened]
+
+  # Manual QA Scout run against an already-merged PR (executes on main).
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: "Merged PR number for the QA Scout (defaults to the PR of the latest main commit)"
+        required: false
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  e2e-test:
+    if: >
+      github.event_name == 'push' ||
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request' &&
+       contains(github.event.pull_request.labels.*.name, 'qa-scout')) ||
+      (github.event_name == 'pull_request' &&
+       contains(github.event.pull_request.labels.*.name, 'run-merge-queue'))
+    runs-on: ubuntu-latest-8-cores
+    # 60 so build + suite plus the QA Scout's 15-minute step cap cannot hit
+    # the job ceiling: a job timeout overrides step continue-on-error and
+    # would redden the status check.
+    timeout-minutes: 60
+    outputs:
+      qa-scout-run: ${{ steps.qa-scout-pr.outputs.run }}
+      qa-scout-pr-number: ${{ steps.qa-scout-pr.outputs.pr_number }}
+    env:
+      NODE_OPTIONS: "--max-old-space-size=10240"
+    services:
+      postgres:
+        image: postgres:18
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+      redis:
+        image: redis
+        ports:
+          - 6379:6379
+    steps:
+      # Audit only: records every outbound endpoint this job touches in the
+      # StepSecurity insights, blocks nothing, changes no behavior. This is
+      # the observation phase for the QA Scout containment follow-up: the
+      # agent step's allowlist scopes what it does, not where the runner can
+      # reach, so once the job's endpoint set is known and stable from a few
+      # weeks of audit data, egress-policy block with that allowlist makes
+      # real-time exfiltration impossible rather than merely unscoped.
+      - name: Harden runner (egress audit)
+        # Fail-open while auditing: an observer must never redden the status
+        # check. The eventual block-mode flip drops this so it fails closed.
+        continue-on-error: true
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: lts/*
+
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+
+      - name: Restore Nx build cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 (restore)
+        with:
+          key: v4-e2e-build-${{ github.ref_name }}-${{ github.sha }}
+          restore-keys: |
+            v4-e2e-build-${{ github.ref_name }}-
+            v4-e2e-build-main-
+          path: |
+            .nx
+            node_modules/.cache
+            packages/*/node_modules/.cache
+
+      - name: Build twenty-shared
+        run: npx nx build twenty-shared
+
+      - name: Install Playwright Browsers
+        run: npx nx setup twenty-e2e-testing
+
+      - name: Setup environment files
+        run: |
+          cp packages/twenty-front/.env.example packages/twenty-front/.env
+          npx nx reset:env:e2e-testing-server twenty-server
+
+      - name: Build frontend
+        run: NODE_ENV=production npx nx build twenty-front
+
+      - name: Build server
+        run: npx nx build twenty-server
+
+      - name: Save Nx build cache
+        if: always()
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 (save)
+        with:
+          key: v4-e2e-build-${{ github.ref_name }}-${{ github.sha }}
+          path: |
+            .nx
+            node_modules/.cache
+            packages/*/node_modules/.cache
+
+      - name: Create and setup database
+        run: |
+          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "default";'
+          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "test";'
+          npx nx run twenty-server:database:reset
+
+      # Cookie sessions are credentialed, so the front only authenticates from
+      # the API's own origin, workspace subdomains included.
+      - name: Serve the frontend from the server
+        run: cp -r packages/twenty-front/build packages/twenty-server/dist/front
+
+      # Logs are teed to files so the QA Scout can diff its own log window; the
+      # console output is unchanged.
+      - name: Start server
+        run: |
+          mkdir -p /tmp/qa-scout
+          npx nx run twenty-server:start:ci 2>&1 | tee /tmp/qa-scout/server.log &
+          echo "Waiting for server to be ready..."
+          timeout 120 bash -c 'until curl -sf http://localhost:3000/healthz > /dev/null; do sleep 2; done'
+
+      - name: Start worker
+        run: |
+          npx nx run twenty-server:worker 2>&1 | tee /tmp/qa-scout/worker.log &
+          echo "Worker started"
+
+      - name: Run Playwright tests
+        env:
+          FRONTEND_BASE_URL: http://localhost:3000
+        run: npx nx test twenty-e2e-testing
+
+      - name: Upload Playwright results
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: playwright-results
+          path: |
+            packages/twenty-e2e-testing/run_results/
+            packages/twenty-e2e-testing/test-results/
+          retention-days: 7
+
+      # ── QA Scout ─────────────────────────────────────────────────────────
+      # Post-merge browser QA agent (.claude/skills/qa-scout/SKILL.md): scopes
+      # scenarios from the merged PR's diff, drives the already-running app,
+      # watches server/worker logs, and writes a verdict. Shadow-safe: every
+      # step is continue-on-error so the Scout can never redden main CI. Runs
+      # after the deterministic suite even when it failed (a broken main is
+      # exactly when a loud report helps), but not on merge-queue PR runs.
+      - name: QA Scout / Prepare merged PR context
+        id: qa-scout-pr
+        if: >-
+          ${{ !cancelled() && (
+            github.event_name == 'push' ||
+            github.event_name == 'workflow_dispatch' ||
+            (github.event_name == 'pull_request' &&
+             contains(github.event.pull_request.labels.*.name, 'qa-scout') &&
+             github.event.pull_request.head.repo.full_name == github.repository)
+          ) }}
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ github.token }}
+          INPUT_PR_NUMBER: ${{ github.event.inputs.pr_number }}
+          EVENT_PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          mkdir -p /tmp/qa-scout/context /tmp/qa-scout/output /tmp/qa-scout/browser
+          MODE="post-merge"
+          if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
+            # Label-triggered pre-merge validation: the checkout IS the PR
+            # head, so the Scout QAs the PR itself before it merges.
+            MODE="pre-merge"
+            PR_NUMBER="${EVENT_PR_NUMBER:-}"
+          else
+            PR_NUMBER="${INPUT_PR_NUMBER:-}"
+            if [ -z "$PR_NUMBER" ]; then
+              PR_NUMBER=$(gh api "repos/${GITHUB_REPOSITORY}/commits/${GITHUB_SHA}/pulls" --jq '.[0].number // empty' || true)
+            fi
+          fi
+          if ! [[ "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
+            echo "No target PR resolved; skipping QA Scout."
+            echo "run=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" \
+            --json number,title,body,author,url,mergedAt > /tmp/qa-scout/context/pr.json
+          # The post-merge Scout QAs main, so an unmerged PR (reachable via
+          # manual dispatch) would get a verdict about code main does not
+          # contain. Pre-merge label runs check out the PR head, so the guard
+          # does not apply there.
+          if [ "$MODE" = "post-merge" ] && [ -z "$(jq -r '.mergedAt // empty' /tmp/qa-scout/context/pr.json)" ]; then
+            echo "PR #${PR_NUMBER} is not merged; skipping QA Scout."
+            echo "run=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          printf '%s\n' "$MODE" > /tmp/qa-scout/context/mode
+          TITLE=$(jq -r '.title' /tmp/qa-scout/context/pr.json)
+          # Mirrors mustBeQa in the eng app: [no-qa]/[noqa] escape hatch, i18n
+          # translation PRs are auto-generated and never QA candidates.
+          LOWER=$(printf '%s' "$TITLE" | tr '[:upper:]' '[:lower:]')
+          case "$LOWER" in
+            *"[no-qa]"* | *"[noqa]"*)
+              echo "Skipping QA Scout: [no-qa] in PR title."
+              echo "run=false" >> "$GITHUB_OUTPUT"
+              exit 0
+              ;;
+            i18n*translation*)
+              echo "Skipping QA Scout: i18n translation PR."
+              echo "run=false" >> "$GITHUB_OUTPUT"
+              exit 0
+              ;;
+          esac
+          # gh rejects --slurp together with --jq, so aggregate the per-page
+          # jq output with a local jq instead.
+          gh api --paginate "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/files?per_page=100" \
+            --jq '.[] | {path: .filename, additions, deletions, status}' \
+            | jq -s '.' > /tmp/qa-scout/context/files.json
+          gh pr diff "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" > /tmp/qa-scout/full.diff
+          DIFF_BYTES=$(wc -c < /tmp/qa-scout/full.diff)
+          head -c 2000000 /tmp/qa-scout/full.diff > /tmp/qa-scout/context/pr.diff
+          if [ "$DIFF_BYTES" -gt 2000000 ]; then
+            printf '\n[pr.diff truncated: 2000000 of %s bytes shown; files.json is complete]\n' "$DIFF_BYTES" >> /tmp/qa-scout/context/pr.diff
+          fi
+          rm /tmp/qa-scout/full.diff
+          cat > /tmp/qa-scout/mcp.json <<'EOF'
+          {
+            "mcpServers": {
+              "playwright": {
+                "command": "npx",
+                "args": [
+                  "-y",
+                  "@playwright/mcp@0.0.79",
+                  "--headless",
+                  "--browser", "chrome",
+                  "--isolated",
+                  "--output-dir", "/tmp/qa-scout/browser",
+                  "--allowed-origins", "http://localhost:3000;http://127.0.0.1:3000;http://app.localhost:3000;http://apple.localhost:3000"
+                ]
+              }
+            }
+          }
+          EOF
+          echo "run=true" >> "$GITHUB_OUTPUT"
+          echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
+
+      # The Scout invokes the Claude Code CLI directly rather than through
+      # claude-code-action: the action rejects push events outright
+      # ("Unsupported event type: push", still true at its latest version),
+      # which silently killed the post-merge mode this Scout exists for, and
+      # its GitHub bootstrap was the only reason a GitHub token entered this
+      # step at all. Direct invocation runs on every trigger and leaves the
+      # agent holding no GitHub credential whatsoever; the PR comment is
+      # posted by the qa-scout-comment job from the uploaded verdict, so
+      # untrusted page/log content can never reach a privileged credential.
+      # The Bash allowlist scopes the agent to its task; it is not the
+      # containment boundary (psql alone is arbitrarily powerful in this
+      # disposable env). Containment is the absence of credentials beyond
+      # inference, the scrub step, and Actions secret masking on the token.
+      - name: QA Scout / Run
+        id: qa-scout-run
+        if: ${{ !cancelled() && steps.qa-scout-pr.outputs.run == 'true' }}
+        continue-on-error: true
+        timeout-minutes: 15
+        env:
+          CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          PGPASSWORD: postgres
+        run: |
+          set -euo pipefail
+          npm install -g @anthropic-ai/claude-code@2.1.247
+          # stream-json teed into the artifact tree, ahead of the scrub,
+          # keeps per-turn detail and permission denials so allowlist tuning
+          # reads real data. stderr and the exit code are kept too: a run that
+          # never reaches a result line (bad flag, exhausted quota) explains
+          # itself only there, and the summary step reads both back.
+          set +e
+          claude -p "Read .claude/skills/qa-scout/SKILL.md and follow it exactly. This is the CI invocation: every path and credential in the skill's Inputs table applies verbatim." \
+            --max-turns 150 \
+            --model opus \
+            --add-dir /tmp/qa-scout \
+            --strict-mcp-config \
+            --mcp-config /tmp/qa-scout/mcp.json \
+            --allowedTools "Read,Grep,Glob,Write,TodoWrite,Bash(cat *),Bash(tail *),Bash(head *),Bash(wc *),Bash(ls *),Bash(grep *),Bash(jq *),Bash(echo *),Bash(diff *),Bash(sort *),Bash(uniq *),Bash(cut *),Bash(tr *),Bash(mkdir *),Bash(sleep *),Bash(date *),Bash(psql *),mcp__playwright" \
+            --output-format stream-json --verbose \
+            2> >(tee /tmp/qa-scout/agent-stderr.log >&2) \
+            | tee /tmp/qa-scout/execution.json
+          AGENT_EXIT=${PIPESTATUS[0]}
+          set -e
+          printf '%s' "$AGENT_EXIT" > /tmp/qa-scout/agent-exit.txt
+          exit "$AGENT_EXIT"
+
+      # The agent process necessarily holds the inference credential, and a
+      # prompt-injected agent could copy it into any file it can write. The
+      # artifact ships the whole /tmp/qa-scout tree (context, browser output,
+      # logs, report), so redact Anthropic token shapes across all of it, in
+      # the trusted lane, before anything is published.
+      - name: QA Scout / Scrub outputs
+        if: ${{ !cancelled() && steps.qa-scout-pr.outputs.run == 'true' }}
+        continue-on-error: true
+        run: |
+          set -euo pipefail
+          # NUL-delimited paths and no -I: an agent-chosen filename with
+          # spaces or newlines, or a token tucked into a binary-looking file,
+          # must not escape redaction.
+          if grep -rq 'sk-ant-' /tmp/qa-scout 2>/dev/null; then
+            echo "Redacting Anthropic token shapes from Scout files:"
+            grep -rl 'sk-ant-' /tmp/qa-scout 2>/dev/null
+            grep -rlZ 'sk-ant-' /tmp/qa-scout 2>/dev/null \
+              | xargs -0 sed -i -E 's/sk-ant-[A-Za-z0-9_-]+/[REDACTED]/g'
+          fi
+
+      # Always leaves a breadcrumb on push/dispatch runs so a broken prepare
+      # step can never disable the Scout silently.
+      - name: QA Scout / Job summary
+        if: ${{ !cancelled() && steps.qa-scout-pr.outcome != 'skipped' }}
+        continue-on-error: true
+        env:
+          SCOUT_RUN: ${{ steps.qa-scout-pr.outputs.run }}
+          SCOUT_PREP_OUTCOME: ${{ steps.qa-scout-pr.outcome }}
+        run: |
+          # Why the run ended, from the evidence the agent leaves behind: the
+          # final stream-json result when it produced one, stderr when it died
+          # before that. Without this the summary can only say "no report".
+          scout_failure_reason() {
+            local result_line exit_code
+            exit_code=$(cat /tmp/qa-scout/agent-exit.txt 2>/dev/null || echo "unknown")
+            echo "**Why it stopped** (exit code \`${exit_code}\`)"
+            echo ""
+            result_line=$(grep -a '"type":"result"' /tmp/qa-scout/execution.json 2>/dev/null | tail -1 || true)
+            if [ -n "$result_line" ]; then
+              printf '%s' "$result_line" | jq -r '
+                "- outcome: `\(.subtype // "unknown")`" +
+                " · \(.num_turns // "?") turns" +
+                " · \(((.duration_ms // 0) / 60000 * 10 | round) / 10) min" +
+                " · $\(((.total_cost_usd // 0) * 100 | round) / 100)",
+                (if ((.errors? // []) | length) > 0 then "- error: " + ((.errors | join("; "))) else empty end)
+              ' 2>/dev/null || echo "- the final result line could not be parsed; see the artifact"
+            else
+              echo "- the agent produced no result line, so it failed before or during startup"
+            fi
+            if [ -s /tmp/qa-scout/agent-stderr.log ]; then
+              echo ""
+              echo "<details><summary>stderr (last 10 lines)</summary>"
+              echo ""
+              echo '```'
+              tail -n 10 /tmp/qa-scout/agent-stderr.log
+              echo '```'
+              echo ""
+              echo "</details>"
+            fi
+          }
+          {
+            echo "## QA Scout"
+            if [ -f /tmp/qa-scout/output/report.md ]; then
+              if [ "$(jq -r '.status // "final"' /tmp/qa-scout/output/verdict.json 2>/dev/null || echo final)" != "final" ]; then
+                echo "> [!WARNING]"
+                echo "> The Scout stopped before finishing; the partial state it left follows."
+                echo ""
+                scout_failure_reason
+                echo ""
+              fi
+              cat /tmp/qa-scout/output/report.md
+            elif [ -f /tmp/qa-scout/output/verdict.json ]; then
+              jq -r '"**\(.verdict)**: \(.headline // "no headline recorded")\n\n_Full report missing (agent stopped early)._"' /tmp/qa-scout/output/verdict.json
+              echo ""
+              scout_failure_reason
+            elif [ "$SCOUT_RUN" = "true" ]; then
+              echo "The Scout produced no verdict."
+              echo ""
+              scout_failure_reason
+            elif [ "$SCOUT_PREP_OUTCOME" = "failure" ]; then
+              echo "Did not run: the prepare step failed; see its logs."
+            else
+              echo "Did not run: skipped by the prepare step (no merged PR, [no-qa], or i18n translation PR)."
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+          # Surfaced on the run page too, so a dead Scout is visible without
+          # opening the summary.
+          if [ "$SCOUT_RUN" = "true" ] && [ ! -f /tmp/qa-scout/output/report.md ]; then
+            echo "::warning title=QA Scout produced no report::$(head -n 1 /tmp/qa-scout/agent-stderr.log 2>/dev/null || echo 'see the job summary for why')"
+          fi
+
+      - name: QA Scout / Upload report
+        if: ${{ !cancelled() && steps.qa-scout-pr.outputs.run == 'true' }}
+        continue-on-error: true
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: qa-scout-report
+          path: |
+            /tmp/qa-scout/context/
+            /tmp/qa-scout/output/
+            /tmp/qa-scout/browser/
+            /tmp/qa-scout/server.log
+            /tmp/qa-scout/worker.log
+            /tmp/qa-scout/execution.json
+            /tmp/qa-scout/agent-stderr.log
+            /tmp/qa-scout/agent-exit.txt
+          if-no-files-found: ignore
+          retention-days: 14
+
+  ci-e2e-main-status-check:
+    if: always() && !cancelled()
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs: [e2e-test]
+    steps:
+      - name: Fail job if any needs failed
+        if: contains(needs.*.result, 'failure')
+        run: exit 1
+
+  notify-main-ci-failure:
+    if: always() && github.event_name == 'push' && contains(needs.*.result, 'failure')
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs: [e2e-test]
+    steps:
+      - name: Ping engineering on main CI failure
+        run: |
+          curl -fsS -X POST https://engineering.twenty.com/s/main-ci-failing \
+            -H 'Content-Type: application/json' \
+            -d '{
+              "commit": "${{ github.sha }}",
+              "actor": "${{ github.actor }}",
+              "run_url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+            }'
+
+  # Posts the QA Scout verdict as a comment on the merged PR. Separate job so
+  # pull-requests:write never coexists with the agent step: the agent reads
+  # untrusted page/log content, so the write TARGET is bound to the prepare
+  # step's trusted pr_number output and the agent-authored artifact can only
+  # influence the comment's content, never where it lands.
+  # Quiet on PASS; FAIL/INVESTIGATE post (or update) a single marked comment.
+  # Kill switch: set repo variable QA_SCOUT_DISABLE_COMMENTS=true.
+  qa-scout-comment:
+    if: >
+      always() && !cancelled() &&
+      needs.e2e-test.outputs.qa-scout-run == 'true' &&
+      vars.QA_SCOUT_DISABLE_COMMENTS != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs: [e2e-test]
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Download QA Scout report
+        id: download
+        continue-on-error: true
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: qa-scout-report
+          path: qa-scout-report
+
+      - name: Post verdict comment
+        if: steps.download.outcome == 'success'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          PR_NUMBER: ${{ needs.e2e-test.outputs.qa-scout-pr-number }}
+        run: |
+          set -euo pipefail
+          if ! [[ "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
+            echo "No trusted PR number from the prepare step; nothing to post."
+            exit 0
+          fi
+          VERDICT_FILE=$(find qa-scout-report -name verdict.json | head -1 || true)
+          REPORT_FILE=$(find qa-scout-report -name report.md | head -1 || true)
+          if [ -z "$VERDICT_FILE" ]; then
+            echo "No verdict in the artifact; nothing to post."
+            exit 0
+          fi
+          # A run killed on turns or time can leave the verdict without the
+          # report; a synthesized body beats silence on a FAIL.
+          if [ -z "$REPORT_FILE" ]; then
+            REPORT_FILE=report-fallback.md
+            jq -r '"**\(.verdict)**: \(.headline // "no headline recorded")\n\n" + ([.scenarios[]? | "- \(.name): \(.result)"] | join("\n")) + "\n\n_Full report missing (agent stopped early); details in the qa-scout-report artifact._"' \
+              "$VERDICT_FILE" > "$REPORT_FILE"
+          fi
+          VERDICT=$(jq -r '.verdict // empty' "$VERDICT_FILE")
+          case "$VERDICT" in
+            PASS | INVESTIGATE | FAIL) ;;
+            *)
+              echo "Invalid or missing verdict '${VERDICT}' in verdict.json; not posting."
+              exit 0
+              ;;
+          esac
+          # A checkpoint left by a run that died is not a finding: it says
+          # the Scout failed, not that the PR is broken. Only a finished run
+          # speaks, unless the partial state already caught something real: a
+          # failed scenario, or a top-level FAIL (which is how a boot failure
+          # arrives, before any scenario exists to fail).
+          STATUS=$(jq -r '.status // "final"' "$VERDICT_FILE" 2>/dev/null || echo final)
+          FAILED_COUNT=$(jq '[.scenarios[]? | select(.result == "fail")] | length' "$VERDICT_FILE" 2>/dev/null || echo 0)
+          if [ "$STATUS" != "final" ] && [ "${FAILED_COUNT:-0}" -eq 0 ] && [ "$VERDICT" != "FAIL" ]; then
+            echo "Scout did not finish (status=${STATUS}) and recorded no failing scenario; nothing to post. See the job summary and artifact."
+            exit 0
+          fi
+          ARTIFACT_PR=$(jq -r '.prNumber // empty' "$VERDICT_FILE")
+          if [ "$ARTIFACT_PR" != "$PR_NUMBER" ]; then
+            echo "verdict.json prNumber (${ARTIFACT_PR:-none}) differs from the trusted target #${PR_NUMBER}; the trusted target wins."
+          fi
+          EXISTING=$(gh api --paginate "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments?per_page=100" \
+            --jq '.[] | select((.body // "") | startswith("<!-- qa-scout -->")) | .id' \
+            | jq -rs 'first // empty')
+          if [ "$VERDICT" = "PASS" ]; then
+            if [ -z "$EXISTING" ]; then
+              echo "Verdict PASS for PR #${PR_NUMBER}; staying quiet (report is in the job summary and artifact)."
+              exit 0
+            fi
+            # A stale FAIL/INVESTIGATE comment misleads forever if a later
+            # PASS never speaks: refresh the existing comment, still without
+            # creating one.
+            {
+              echo "<!-- qa-scout -->"
+              echo "> [!NOTE]"
+              echo "> A newer QA Scout run passed; the earlier finding on this PR no longer stands."
+              echo ""
+              echo "[QA Scout run](${RUN_URL}) · verdict: PASS · re-run: Actions → CI E2E Main → Run workflow with pr_number=${PR_NUMBER}"
+            } > comment.md
+            gh api --method PATCH "repos/${GITHUB_REPOSITORY}/issues/comments/${EXISTING}" -F body=@comment.md
+            exit 0
+          fi
+          {
+            echo "<!-- qa-scout -->"
+            if [ "$STATUS" != "final" ]; then
+              echo "> [!WARNING]"
+              echo "> The QA Scout stopped before finishing; what follows is partial."
+              echo ""
+            fi
+            # Drops a multi-byte character split by the byte cap so the payload
+            # stays valid UTF-8 (iconv -c exits 1 on exactly this case, so
+            # python does the lenient decode).
+            head -c 60000 "$REPORT_FILE" | python3 -c "import sys; sys.stdout.write(sys.stdin.buffer.read().decode('utf-8', 'ignore'))"
+            echo ""
+            echo ""
+            echo "[QA Scout run](${RUN_URL}) · verdict: ${VERDICT} · re-run: Actions → CI E2E Main → Run workflow with pr_number=${PR_NUMBER}"
+          } > comment.md
+          # Belt over the scrub step's suspenders: a token shape surviving to
+          # here means the scrub was bypassed, so fail loudly instead of
+          # publishing.
+          if grep -q 'sk-ant-' comment.md; then
+            echo "Refusing to post: comment contains an Anthropic token shape."
+            exit 1
+          fi
+          if [ -n "$EXISTING" ]; then
+            gh api --method PATCH "repos/${GITHUB_REPOSITORY}/issues/comments/${EXISTING}" -F body=@comment.md
+          else
+            gh api --method POST "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" -F body=@comment.md
+          fi

.github/workflows/ci-emails.yaml

@@ -0,0 +1,68 @@
+name: CI Emails
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches:
+      - main
+
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  changed-files-check:
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        package.json
+        packages/twenty-emails/**
+  emails-test:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Build twenty-emails
+        run: npx nx build twenty-emails
+      - name: Extract translations (lingui)
+        run: npx nx run twenty-emails:lingui:extract
+      - name: Compile translations (lingui)
+        run: npx nx run twenty-emails:lingui:compile
+      - name: Run email tests
+        run: |
+          # Start the email server in the background
+          npx nx run twenty-emails:start &
+          SERVER_PID=$!
+
+          # Wait for server to start
+          sleep 20
+
+          # Check if server is running
+          if ! curl -s http://localhost:4001/preview/test.email > /dev/null; then
+            echo "Email server failed to start"
+            kill $SERVER_PID
+            exit 1
+          fi
+
+          # Kill the server
+          kill $SERVER_PID
+  ci-emails-status-check:
+    if: always() && !cancelled()
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs: [changed-files-check, emails-test]
+    steps:
+      - name: Fail job if any needs failed
+        if: contains(needs.*.result, 'failure')
+        run: exit 1

.github/workflows/ci-example-app-hello-world.yaml

@@ -0,0 +1,94 @@
+name: CI Example App Hello World
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  changed-files-check:
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        packages/twenty-apps/examples/hello-world/**
+        packages/twenty-sdk/**
+        packages/twenty-client-sdk/**
+        packages/twenty-shared/**
+        !packages/twenty-sdk/package.json
+        !packages/twenty-client-sdk/package.json
+        !packages/twenty-shared/package.json
+
+  example-app-hello-world:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:18
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+      redis:
+        image: redis
+        ports:
+          - 6379:6379
+    env:
+      TWENTY_API_URL: http://localhost:3000
+      TWENTY_API_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ1c2VySWQiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ3b3Jrc3BhY2VJZCI6IjIwMjAyMDIwLTFjMjUtNGQwMi1iZjI1LTZhZWNjZjdlYTQxOSIsIndvcmtzcGFjZU1lbWJlcklkIjoiMjAyMDIwMjAtNDYzZi00MzViLTgyOGMtMTA3ZTAwN2EyNzExIiwidXNlcldvcmtzcGFjZUlkIjoiMjAyMDIwMjAtMWU3Yy00M2Q5LWE1ZGItNjg1YjUwNjlkODE2IiwidHlwZSI6IkFDQ0VTUyIsImF1dGhQcm92aWRlciI6InBhc3N3b3JkIiwiaWF0IjoxNzUxMjgxNzA0LCJleHAiOjIwNjY4NTc3MDR9.HMGqCsVlOAPVUBhKSGlD1X86VoHKt4LIUtET3CGIdik
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+
+      - name: Build SDK packages
+        run: npx nx build twenty-sdk
+
+      - name: Setup server environment
+        run: npx nx reset:env:e2e-testing-server twenty-server
+
+      - name: Create databases
+        run: |
+          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "default";'
+          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "test";'
+
+      - name: Setup database
+        run: npx nx run twenty-server:database:reset
+
+      - name: Start server
+        run: nohup npx nx start:ci twenty-server &
+
+      - name: Wait for server to be ready
+        run: npx wait-on http://localhost:3000/healthz --timeout 120000 --interval 1000
+
+      - name: Run integration tests
+        working-directory: packages/twenty-apps/examples/hello-world
+        run: npx vitest run
+
+  ci-example-app-hello-world-status-check:
+    if: always() && !cancelled()
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs: [changed-files-check, example-app-hello-world]
+    steps:
+      - name: Fail job if any needs failed
+        if: contains(needs.*.result, 'failure')
+        run: exit 1

.github/workflows/ci-example-app-postcard.yaml

@@ -0,0 +1,121 @@
+name: CI Example App Postcard
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  changed-files-check:
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        packages/twenty-apps/examples/postcard/**
+        packages/twenty-sdk/**
+        packages/twenty-client-sdk/**
+        packages/twenty-shared/**
+        packages/twenty-server/**
+        !packages/twenty-sdk/package.json
+        !packages/twenty-client-sdk/package.json
+        !packages/twenty-shared/package.json
+        !packages/twenty-server/package.json
+
+  example-app-postcard:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:18
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+      redis:
+        image: redis
+        ports:
+          - 6379:6379
+    env:
+      TWENTY_API_URL: http://localhost:3000
+      TWENTY_API_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ1c2VySWQiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ3b3Jrc3BhY2VJZCI6IjIwMjAyMDIwLTFjMjUtNGQwMi1iZjI1LTZhZWNjZjdlYTQxOSIsIndvcmtzcGFjZU1lbWJlcklkIjoiMjAyMDIwMjAtNDYzZi00MzViLTgyOGMtMTA3ZTAwN2EyNzExIiwidXNlcldvcmtzcGFjZUlkIjoiMjAyMDIwMjAtMWU3Yy00M2Q5LWE1ZGItNjg1YjUwNjlkODE2IiwidHlwZSI6IkFDQ0VTUyIsImF1dGhQcm92aWRlciI6InBhc3N3b3JkIiwiaWF0IjoxNzUxMjgxNzA0LCJleHAiOjIwNjY4NTc3MDR9.HMGqCsVlOAPVUBhKSGlD1X86VoHKt4LIUtET3CGIdik
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+
+      - name: Build SDK packages
+        run: npx nx build twenty-sdk
+
+      - name: Setup server environment
+        run: npx nx reset:env:e2e-testing-server twenty-server
+
+      - name: Create databases
+        run: |
+          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "default";'
+          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "test";'
+
+      - name: Setup database
+        run: npx nx run twenty-server:database:reset
+
+      - name: Start server
+        run: nohup npx nx start:ci twenty-server &
+
+      - name: Wait for server to be ready
+        run: npx wait-on http://localhost:3000/healthz --timeout 120000 --interval 1000
+
+      - name: Run integration tests
+        working-directory: packages/twenty-apps/examples/postcard
+        run: npx vitest run
+
+      - name: Configure remote for SDK CLI
+        run: |
+          mkdir -p ~/.twenty
+          cat > ~/.twenty/config.json <<EOF
+          {
+            "version": 1,
+            "remotes": {
+              "target": {
+                "apiUrl": "${TWENTY_API_URL}",
+                "apiKey": "${TWENTY_API_KEY}",
+                "accessToken": "${TWENTY_API_KEY}"
+              }
+            },
+            "defaultRemote": "target"
+          }
+          EOF
+
+      - name: Deploy postcard app (registry install path)
+        working-directory: packages/twenty-apps/examples/postcard
+        run: node ${{ github.workspace }}/packages/twenty-sdk/dist/cli.cjs deploy --remote target
+
+      - name: Install postcard app (registry install path)
+        working-directory: packages/twenty-apps/examples/postcard
+        run: node ${{ github.workspace }}/packages/twenty-sdk/dist/cli.cjs install --remote target
+
+  ci-example-app-postcard-status-check:
+    if: always() && !cancelled()
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs: [changed-files-check, example-app-postcard]
+    steps:
+      - name: Fail job if any needs failed
+        if: contains(needs.*.result, 'failure')
+        run: exit 1

.github/workflows/ci-front-component-renderer.yaml

@@ -0,0 +1,115 @@
+name: CI Front Component Renderer
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  changed-files-check:
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        package.json
+        yarn.lock
+        packages/twenty-front-component-renderer/**
+        packages/twenty-sdk/**
+        packages/twenty-shared/**
+        packages/twenty-ui/**
+        !packages/twenty-sdk/package.json
+  renderer-task:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        task: [build, typecheck, lint]
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Run ${{ matrix.task }}
+        run: npx nx ${{ matrix.task }} twenty-front-component-renderer
+  renderer-sb-build:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Build storybook
+        run: npx nx storybook:build twenty-front-component-renderer
+      - name: Upload storybook build
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: storybook-twenty-front-component-renderer
+          path: packages/twenty-front-component-renderer/storybook-static
+          retention-days: 1
+  renderer-sb-test:
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    needs: renderer-sb-build
+    env:
+      STORYBOOK_URL: http://localhost:6008
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Build dependencies
+        run: npx nx build twenty-sdk
+      - name: Download storybook build
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: storybook-twenty-front-component-renderer
+          path: packages/twenty-front-component-renderer/storybook-static
+      - name: Resolve Playwright version
+        id: playwright-version
+        run: echo "version=$(node -p "require('@playwright/test/package.json').version")" >> "$GITHUB_OUTPUT"
+      - name: Cache Playwright browsers
+        id: playwright-cache
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: ~/.cache/ms-playwright
+          key: v4-playwright-browsers-${{ runner.os }}-${{ steps.playwright-version.outputs.version }}
+      - name: Install Playwright
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        run: |
+          cd packages/twenty-front-component-renderer
+          npx playwright install chromium
+      - name: Serve storybook & run tests
+        run: |
+          npx http-server packages/twenty-front-component-renderer/storybook-static --port 6008 --silent &
+          timeout 30 bash -c 'until curl -sf http://localhost:6008 > /dev/null 2>&1; do sleep 1; done'
+          npx nx storybook:test twenty-front-component-renderer
+  ci-front-component-renderer-status-check:
+    if: always() && !cancelled()
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs:
+      [
+        changed-files-check,
+        renderer-task,
+        renderer-sb-build,
+        renderer-sb-test,
+      ]
+    steps:
+      - name: Fail job if any needs failed
+        if: contains(needs.*.result, 'failure')
+        run: exit 1

.github/workflows/ci-front.yaml

@@ -0,0 +1,274 @@
+name: CI Front
+
+on:
+  pull_request:
+  merge_group:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}${{ github.ref == 'refs/heads/main' && format('-{0}', github.sha) || '' }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+env:
+  # restore-cache action adds 'v4-' prefix and '-<branch>-<sha>' suffix to the key
+  STORYBOOK_BUILD_CACHE_KEY_FOR_RESTORE_ACTION: storybook-build-ubuntu-latest-8-cores-runner
+  STORYBOOK_BUILD_CACHE_KEY_FOR_SAVE_ACTION: v4-storybook-build-ubuntu-latest-8-cores-runner-${{ github.ref_name }}-${{ github.sha }}
+
+jobs:
+  changed-files-check:
+    if: github.event_name == 'pull_request'
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        package.json
+        yarn.lock
+        packages/twenty-front/**
+        packages/twenty-front-component-renderer/**
+        packages/twenty-ui/**
+        packages/twenty-shared/**
+        packages/twenty-sdk/**
+        !packages/twenty-sdk/package.json
+  front-sb-build:
+    needs: changed-files-check
+    if: >-
+      always() &&
+      (github.event_name == 'push' ||
+      needs.changed-files-check.outputs.any_changed == 'true')
+    timeout-minutes: 30
+    runs-on: ubuntu-latest-8-cores
+    env:
+      REACT_APP_SERVER_BASE_URL: http://localhost:3000
+    steps:
+      - name: Fetch local actions
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Diagnostic disk space issue
+        run: df -h
+      - name: Front / Write .env
+        run: npx nx reset:env twenty-front
+      - name: Front / Build storybook
+        run: npx nx storybook:build twenty-front
+      - name: Upload storybook build
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: storybook-static
+          path: packages/twenty-front/storybook-static
+          retention-days: 1
+      - name: Save storybook build cache
+        uses: ./.github/actions/save-cache
+        with:
+          key: ${{ env.STORYBOOK_BUILD_CACHE_KEY_FOR_SAVE_ACTION }}
+  front-sb-test:
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    needs: front-sb-build
+    if: always() && needs.front-sb-build.result == 'success'
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
+        storybook_scope: ${{ github.event_name == 'push' && fromJSON('["modules", "pages"]') || fromJSON('["modules", "pages", "performance"]') }}
+    env:
+      SHARD_COUNTER: 4
+      REACT_APP_SERVER_BASE_URL: http://localhost:3000
+      STORYBOOK_URL: http://localhost:6006
+    steps:
+      - name: Fetch local actions
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Restore storybook build cache
+        uses: ./.github/actions/restore-cache
+        with:
+          key: ${{ env.STORYBOOK_BUILD_CACHE_KEY_FOR_RESTORE_ACTION }}
+      - name: Clean stale storybook vitest cache
+        run: rm -rf packages/twenty-front/node_modules/.cache/storybook
+      - name: Build dependencies
+        run: |
+          npx nx build twenty-shared
+          npx nx build twenty-ui
+          npx nx build twenty-front-component-renderer
+      - name: Download storybook build
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: storybook-static
+          path: packages/twenty-front/storybook-static
+      - name: Resolve Playwright version
+        id: playwright-version
+        run: echo "version=$(node -p "require('@playwright/test/package.json').version")" >> "$GITHUB_OUTPUT"
+      - name: Cache Playwright browsers
+        id: playwright-cache
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: ~/.cache/ms-playwright
+          key: v4-playwright-browsers-${{ runner.os }}-${{ steps.playwright-version.outputs.version }}
+      - name: Install Playwright
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        run: |
+          cd packages/twenty-front
+          npx playwright install chromium
+      - name: Front / Write .env
+        run: npx nx reset:env twenty-front
+      - name: Serve storybook & run tests
+        run: |
+          npx http-server packages/twenty-front/storybook-static --port 6006 --silent &
+          timeout 30 bash -c 'until curl -sf http://localhost:6006 > /dev/null 2>&1; do sleep 1; done'
+          npx nx storybook:test twenty-front --configuration=${{ matrix.storybook_scope }} --shard=${{ matrix.shard }}/${{ env.SHARD_COUNTER }}
+      - name: Upload screenshots for visual regression
+        if: always() && !cancelled() && matrix.storybook_scope != 'performance'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: argos-screenshots-twenty-front-${{ matrix.storybook_scope }}-${{ matrix.shard }}
+          path: packages/twenty-front/screenshots
+          retention-days: 1
+          overwrite: true
+      # - name: Rename coverage file
+      #   run: |
+      #     if [ -f "packages/twenty-front/coverage/storybook/coverage-final.json" ]; then
+      #       mv packages/twenty-front/coverage/storybook/coverage-final.json packages/twenty-front/coverage/storybook/coverage-shard-${{matrix.shard}}.json
+      #     else
+      #       echo "Error: coverage-final.json not found"
+      #       ls -la packages/twenty-front/coverage/storybook/ || echo "Coverage directory does not exist"
+      #       exit 1
+      #     fi
+      # - name: Upload coverage artifact
+      #   uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      #   with:
+      #     retention-days: 1
+      #     name: coverage-artifacts-${{ matrix.storybook_scope }}-${{ github.run_id }}-${{ matrix.shard }}
+      #     path: packages/twenty-front/coverage/storybook/coverage-shard-${{matrix.shard}}.json
+  # merge-reports-and-check-coverage:
+  #   timeout-minutes: 30
+  #   runs-on: ubuntu-latest
+  #   needs: front-sb-test
+  #   env:
+  #     PATH_TO_COVERAGE: packages/twenty-front/coverage/storybook
+  #   strategy:
+  #     matrix:
+  #       storybook_scope: [modules, pages, performance]
+  #   steps:
+  #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+  #       with:
+  #         fetch-depth: 10
+  #     - name: Install dependencies
+  #       uses: ./.github/actions/yarn-install
+  #     - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+  #       with:
+  #         pattern: coverage-artifacts-${{ matrix.storybook_scope }}-${{ github.run_id }}-*
+  #         merge-multiple: true
+  #         path: coverage-artifacts
+  #     - name: Merge coverage reports
+  #       run: |
+  #         mkdir -p ${{ env.PATH_TO_COVERAGE }}
+  #         npx nyc merge coverage-artifacts ${{ env.PATH_TO_COVERAGE }}/coverage-storybook.json
+  #     - name: Checking coverage
+  #       run: npx nx storybook:coverage twenty-front --checkCoverage=true --configuration=${{ matrix.storybook_scope }}
+  front-sb-screenshots:
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs: front-sb-test
+    if: always() && needs.front-sb-test.result == 'success'
+    steps:
+      - name: Download shard screenshot artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          pattern: argos-screenshots-twenty-front-*
+          merge-multiple: true
+          path: screenshots
+      - name: Upload merged screenshots artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: argos-screenshots-twenty-front
+          path: screenshots
+          retention-days: 1
+          overwrite: true
+  front-task:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    env:
+      NODE_OPTIONS: '--max-old-space-size=6144'
+      TASK_CACHE_KEY: front-task-${{ matrix.task }}
+    strategy:
+      matrix:
+        task: [lint, typecheck, test, lingui:extract, lingui:compile]
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Restore ${{ matrix.task }} cache
+        id: restore-task-cache
+        uses: ./.github/actions/restore-cache
+        with:
+          key: ${{ env.TASK_CACHE_KEY }}
+      - name: Reset .env
+        uses: ./.github/actions/nx-affected
+        with:
+          tag: scope:frontend
+          tasks: reset:env
+      - name: Run ${{ matrix.task }} task
+        id: run-task
+        uses: ./.github/actions/nx-affected
+        with:
+          tag: scope:frontend
+          tasks: ${{ matrix.task }}
+      - name: Save ${{ matrix.task }} cache
+        uses: ./.github/actions/save-cache
+        with:
+          key: ${{ steps.restore-task-cache.outputs.cache-primary-key }}
+  front-build:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest-8-cores
+    env:
+      NODE_OPTIONS: "--max-old-space-size=10240"
+      ANALYZE: "true"
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Front / Write .env
+        run: npx nx reset:env twenty-front
+      - name: Build frontend
+        run: npx nx build twenty-front
+      # - name: Upload frontend build artifact
+      #   uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      #   with:
+      #     name: frontend-build
+      #     path: packages/twenty-front/build
+      #     retention-days: 1
+  ci-front-status-check:
+    if: always() && !cancelled()
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs:
+      [
+        changed-files-check,
+        front-task,
+        front-build,
+        # merge-reports-and-check-coverage,
+        front-sb-test,
+        front-sb-build,
+        front-sb-screenshots,
+      ]
+    steps:
+      - name: Fail job if any needs failed
+        if: contains(needs.*.result, 'failure')
+        run: exit 1

.github/workflows/ci-merge-queue.yaml

@@ -0,0 +1,60 @@
+name: CI - Merge Queue
+
+# Runs when a PR is queued to merge. GitHub builds the merge candidate on top of
+# the current tip of main, so these checks validate against main's real state at
+# merge time rather than the PR's (possibly stale) base. This is what closes the
+# upgrade-command base-drift race: a command generated against an old version,
+# then left behind when main bumps, is caught here even if the PR-level guard
+# passed on a stale base.
+
+on:
+  merge_group:
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  # merge_group carries no PR labels, so resolve them from the queued PR (its
+  # number is in the merge-queue ref) and pass the version-mutation bypass to the
+  # guard as an input, which skips only the version-directory step. The job
+  # always runs and reports a real success/failure, so the required check never
+  # resolves to a skipped state and a label-lookup failure fails closed. The
+  # timestamp / append-only check has no bypass and always runs: violating it
+  # rewinds the upgrade cursor.
+  upgrade-mutation-guard:
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout merge candidate
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 2
+      - name: Resolve version-mutation bypass label from the queued PR
+        id: labels
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HEAD_REF: ${{ github.event.merge_group.head_ref }}
+        run: |
+          set -euo pipefail
+          PR_NUMBER=$(echo "$HEAD_REF" | sed -n -E 's|.*/pr-([0-9]+)-[0-9a-f]+$|\1|p')
+
+          skip=false
+          if [ -n "$PR_NUMBER" ]; then
+            LABELS=$(gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --json labels --jq '.labels[].name')
+            echo "Queued PR #$PR_NUMBER labels:"
+            echo "$LABELS"
+
+            if echo "$LABELS" | grep -qxF 'ci:allow-previous-version-upgrade-mutation'; then
+              skip=true
+            fi
+          else
+            echo "Could not parse a PR number from '$HEAD_REF'; enforcing strictly."
+          fi
+
+          echo "skip=$skip" >> "$GITHUB_OUTPUT"
+      - name: Validate upgrade command mutations against main
+        uses: ./.github/actions/upgrade-mutation-guard
+        with:
+          base_sha: ${{ github.event.merge_group.base_sha }}
+          allow_previous_version_mutation: ${{ steps.labels.outputs.skip }}

.github/workflows/ci-release-create.yaml

@@ -0,0 +1,59 @@
+name: "Release: create"
+
+permissions:
+  contents: read
+  pull-requests: write
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        required: true
+        description: Version to release, without the v (e.g. 1.2.3)
+      ref:
+        default: main
+        description: Ref to start the release from (e.g. main, sha)
+      create_release:
+        type: boolean
+        default: true
+        description: Create a release after merging the PR
+
+defaults:
+  run:
+    shell: bash --noprofile --norc -euo pipefail {0}
+
+jobs:
+  create_pr:
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          ref: ${{ github.event.inputs.ref }}
+
+      - name: Sanitize version
+        id: sanitize
+        env:
+          RAW_VERSION: ${{ github.event.inputs.version }}
+        run: |
+          VERSION="${RAW_VERSION#v}"
+          printf 'version=%s\n' "$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Update versions
+        env:
+          VERSION: ${{ steps.sanitize.outputs.version }}
+        run: |
+          printf '%s\n' "$VERSION" > version.txt
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
+        with:
+          branch: release/${{ steps.sanitize.outputs.version }}
+          commit-message: "chore: release v${{ steps.sanitize.outputs.version }}"
+          committer: Github Action Deploy <github-action-deploy@twenty.com>
+          author: Github Action Deploy <github-action-deploy@twenty.com>
+          title: Release v${{ steps.sanitize.outputs.version }}
+          labels: |
+            release
+            ${{ github.event.inputs.create_release == true && 'create_release' || '' }}

.github/workflows/ci-sdk.yaml

@@ -0,0 +1,109 @@
+name: CI SDK
+
+on:
+  pull_request:
+  merge_group:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  changed-files-check:
+    if: github.event_name != 'merge_group'
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        packages/twenty-sdk/**
+        packages/twenty-client-sdk/**
+        packages/twenty-server/**
+        packages/twenty-ui/**
+        .github/workflows/ci-sdk.yaml
+        !packages/twenty-sdk/package.json
+        !packages/twenty-client-sdk/package.json
+  sdk-test:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        task: [lint, typecheck, test:unit, test:integration]
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Build
+        run: npx nx build twenty-sdk
+      - name: Run ${{ matrix.task }} task
+        uses: ./.github/actions/nx-affected
+        with:
+          tag: scope:sdk
+          tasks: ${{ matrix.task }}
+  sdk-e2e-test:
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    needs: [changed-files-check, sdk-test]
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    services:
+      postgres:
+        image: postgres:18
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+      redis:
+        image: redis
+        ports:
+          - 6379:6379
+    env:
+      TWENTY_API_URL: http://localhost:3000
+      TWENTY_API_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ1c2VySWQiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ3b3Jrc3BhY2VJZCI6IjIwMjAyMDIwLTFjMjUtNGQwMi1iZjI1LTZhZWNjZjdlYTQxOSIsIndvcmtzcGFjZU1lbWJlcklkIjoiMjAyMDIwMjAtNDYzZi00MzViLTgyOGMtMTA3ZTAwN2EyNzExIiwidXNlcldvcmtzcGFjZUlkIjoiMjAyMDIwMjAtMWU3Yy00M2Q5LWE1ZGItNjg1YjUwNjlkODE2IiwidHlwZSI6IkFDQ0VTUyIsImF1dGhQcm92aWRlciI6InBhc3N3b3JkIiwiaWF0IjoxNzUxMjgxNzA0LCJleHAiOjIwNjY4NTc3MDR9.HMGqCsVlOAPVUBhKSGlD1X86VoHKt4LIUtET3CGIdik
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Build SDK
+        run: npx nx build twenty-sdk
+      - name: Setup server environment
+        run: npx nx reset:env:e2e-testing-server twenty-server
+      - name: Create databases
+        run: |
+          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "default";'
+          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "test";'
+      - name: Setup database
+        run: npx nx run twenty-server:database:reset
+      - name: Start server
+        run: nohup npx nx start:ci twenty-server > /tmp/twenty-server.log 2>&1 &
+      - name: Wait for server to be ready
+        run: npx wait-on http://localhost:3000/healthz --timeout 120000 --interval 1000
+      - name: SDK / Run e2e Tests
+        run: NODE_ENV=test npx vitest run --config ./vitest.e2e.config.ts
+        working-directory: packages/twenty-sdk
+      - name: Server / Dump logs on failure
+        if: failure()
+        run: tail -100 /tmp/twenty-server.log || echo "No server log file found"
+  ci-sdk-status-check:
+    if: always() && !cancelled()
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs: [changed-files-check, sdk-test, sdk-e2e-test]
+    steps:
+      - name: Fail job if any needs failed
+        if: contains(needs.*.result, 'failure')
+        run: exit 1

.github/workflows/ci-server.yaml

@@ -0,0 +1,415 @@
+name: CI Server
+
+on:
+  pull_request:
+  merge_group:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+env:
+  SERVER_BUILD_CACHE_KEY: server-build
+
+jobs:
+  changed-files-check:
+    if: github.event_name != 'merge_group'
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        package.json
+        yarn.lock
+        packages/twenty-server/**
+        packages/twenty-front/src/generated/**
+        packages/twenty-front/src/generated-metadata/**
+        packages/twenty-front/src/generated-admin/**
+        packages/twenty-client-sdk/**
+        packages/twenty-emails/**
+        packages/twenty-shared/**
+
+  upgrade-changed-files-check:
+    if: github.event_name != 'merge_group'
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        packages/twenty-server/src/database/commands/upgrade-version-command/**
+        packages/twenty-server/src/engine/core-modules/upgrade/**
+
+  server-build:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Restore server build cache
+        id: restore-server-build-cache
+        uses: ./.github/actions/restore-cache
+        with:
+          key: ${{ env.SERVER_BUILD_CACHE_KEY }}
+      - name: Build twenty-shared
+        run: npx nx build twenty-shared
+      - name: Server / Write .env
+        run: npx nx reset:env twenty-server
+      - name: Server / Build
+        run: npx nx build twenty-server
+      - name: Save server build cache
+        uses: ./.github/actions/save-cache
+        with:
+          key: ${{ steps.restore-server-build-cache.outputs.cache-primary-key }}
+
+  server-lint-typecheck:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Build twenty-shared
+        run: npx nx build twenty-shared
+      - name: Server / Run lint, typecheck & lingui extract
+        uses: ./.github/actions/nx-affected
+        with:
+          tag: scope:backend
+          tasks: lint,typecheck,lingui:extract
+      # Separate step so compile never races extract on the .po files.
+      - name: Server / Run lingui compile
+        uses: ./.github/actions/nx-affected
+        with:
+          tag: scope:backend
+          tasks: lingui:compile
+
+  server-previous-version-upgrade-mutation-guard:
+    if: github.event_name != 'merge_group'
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 2
+      # HEAD is the pull_request merge ref; its first parent is the exact main
+      # commit it was merged with. pull_request.base.sha can lag behind that,
+      # making commands merged into main since then look added by this PR.
+      - name: Resolve merged base commit
+        id: merged-base
+        shell: bash
+        run: |
+          if git rev-parse -q --verify HEAD^2 >/dev/null; then
+            BASE_SHA=$(git rev-parse HEAD^1)
+          else
+            BASE_SHA="${{ github.event.pull_request.base.sha }}"
+          fi
+          echo "sha=$BASE_SHA" >> "$GITHUB_OUTPUT"
+      - name: Validate upgrade command mutations
+        uses: ./.github/actions/upgrade-mutation-guard
+        with:
+          base_sha: ${{ steps.merged-base.outputs.sha }}
+          allow_previous_version_mutation: ${{ contains(github.event.pull_request.labels.*.name, 'ci:allow-previous-version-upgrade-mutation') }}
+
+  server-validation:
+    needs: server-build
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:18
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+      redis:
+        image: redis
+        ports:
+          - 6379:6379
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Restore server build cache
+        uses: ./.github/actions/restore-cache
+        with:
+          key: ${{ env.SERVER_BUILD_CACHE_KEY }}
+      - name: Build twenty-shared
+        run: npx nx build twenty-shared
+      - name: Server / Write .env
+        run: npx nx reset:env twenty-server
+      - name: Server / Build
+        run: npx nx build twenty-server
+      - name: Server / Create DB
+        run: |
+          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "default";'
+          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "test";'
+          npx nx run twenty-server:database:init:prod
+      - name: Worker / Run
+        run: |
+          timeout 30s npx nx run twenty-server:worker || exit_code=$?
+          if [ $exit_code -eq 124 ]; then
+            exit 0
+          elif [ $exit_code -ne 0 ]; then
+            exit $exit_code
+          fi
+      - name: Server / Start
+        run: npx nx start:ci twenty-server &
+      - name: Waiting for server starting...
+        run: |
+          for i in {1..60}; do
+            if curl -f http://localhost:3000/healthz; then
+              echo "Server ready!"
+              exit 0
+            fi
+            echo "Waiting..."
+            sleep 2
+          done
+          echo "Server did not become healthy in time" >&2
+          exit 1
+      - name: Server / Check for Pending Migrations
+        run: |
+          npx nx database:migrate:generate twenty-server -- --name pending-migration-check || true
+
+          if ! git diff --quiet; then
+            echo "::error::Unexpected migration files were generated. Please run 'npx nx database:migrate:generate twenty-server -- --name <migration-name>' and commit the result."
+            echo ""
+            echo "The following migration changes were detected:"
+            echo "==================================================="
+            git diff
+            echo "==================================================="
+            echo ""
+
+            git checkout -- .
+
+            exit 1
+          fi
+      - name: Check for Pending Code Generation
+        run: |
+          HAS_ERRORS=false
+
+          npx nx run twenty-front:graphql:generate
+          npx nx run twenty-front:graphql:generate --configuration=metadata
+          npx nx run twenty-front:graphql:generate --configuration=admin
+
+          if ! git diff --quiet -- packages/twenty-front/src/generated packages/twenty-front/src/generated-metadata packages/twenty-front/src/generated-admin; then
+            echo "::error::GraphQL schema changes detected. Please run the three graphql:generate configurations ('data', 'metadata', 'admin') and commit the changes."
+            echo ""
+            echo "The following GraphQL schema changes were detected:"
+            echo "==================================================="
+            git diff -- packages/twenty-front/src/generated packages/twenty-front/src/generated-metadata packages/twenty-front/src/generated-admin
+            echo "==================================================="
+            echo ""
+            HAS_ERRORS=true
+          fi
+
+          npx nx run twenty-client-sdk:generate-metadata-client
+
+          if ! git diff --quiet -- packages/twenty-client-sdk/src/metadata/generated; then
+            echo "::error::SDK metadata client changes detected. Please run 'npx nx run twenty-client-sdk:generate-metadata-client' and commit the changes."
+            echo ""
+            echo "The following SDK metadata client changes were detected:"
+            echo "==================================================="
+            git diff -- packages/twenty-client-sdk/src/metadata/generated
+            echo "==================================================="
+            echo ""
+            HAS_ERRORS=true
+          fi
+
+          if [ "$HAS_ERRORS" = true ]; then
+            exit 1
+          fi
+  server-test:
+    needs: server-build
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Restore server build cache
+        uses: ./.github/actions/restore-cache
+        with:
+          key: ${{ env.SERVER_BUILD_CACHE_KEY }}
+      - name: Build twenty-shared
+        run: npx nx build twenty-shared
+      - name: Server / Run Tests (shard ${{ matrix.shard }}/4)
+        run: npx nx run twenty-server:test:ci --shard=${{ matrix.shard }}/4
+
+  server-integration-test:
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    needs: server-build
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16]
+    services:
+      postgres:
+        image: postgres:18
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+      redis:
+        image: redis
+        ports:
+          - 6379:6379
+      clickhouse:
+        image: clickhouse/clickhouse-server:25.8.8
+        env:
+          CLICKHOUSE_PASSWORD: clickhousePassword
+          CLICKHOUSE_URL: "http://default:clickhousePassword@localhost:8123/twenty"
+        ports:
+          - 8123:8123
+          - 9000:9000
+        options: >-
+          --health-cmd "clickhouse-client --host=localhost --port=9000 --user=default --password=clickhousePassword --query='SELECT 1'"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      NODE_ENV: test
+      ANALYTICS_ENABLED: true
+      CLICKHOUSE_URL: "http://default:clickhousePassword@localhost:8123/twenty"
+      CLICKHOUSE_PASSWORD: clickhousePassword
+      SHARD_COUNTER: 16
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Update .env.test for integrations tests
+        run: |
+          echo "" >> .env.test
+          echo "IS_BILLING_ENABLED=true" >> .env.test
+          echo "BILLING_STRIPE_API_KEY=test-api-key" >> .env.test
+          echo "BILLING_STRIPE_BASE_PLAN_PRODUCT_ID=test-base-plan-product-id" >> .env.test
+          echo "BILLING_STRIPE_WEBHOOK_SECRET=test-webhook-secret" >> .env.test
+          echo "BILLING_PLAN_REQUIRED_LINK=http://localhost:3001/stripe-redirection" >> .env.test
+      - name: Restore server build cache
+        uses: ./.github/actions/restore-cache
+        with:
+          key: ${{ env.SERVER_BUILD_CACHE_KEY }}
+      - name: Server / Build
+        run: npx nx build twenty-server
+      - name: Build dependencies
+        run: |
+          npx nx build twenty-shared
+          npx nx build twenty-emails
+      - name: Server / Create Test DB
+        run: |
+          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "test";'
+      - name: Run ClickHouse migrations
+        run: npx nx clickhouse:migrate twenty-server
+      - name: Run ClickHouse seeds
+        run: npx nx clickhouse:seed twenty-server
+      - name: Server / Run Integration Tests
+        uses: ./.github/actions/nx-affected
+        with:
+          tag: scope:backend
+          tasks: 'test:integration'
+          configuration: 'with-db-reset'
+          args: ${{ format('--shard={0}/{1}', matrix.shard, env.SHARD_COUNTER) }}
+      # The secure-deployment suite boots the app as a production https
+      # deployment (SERVER_URL is env-only, forced by its jest config), so it
+      # cannot ride the main run. One shard is enough.
+      - name: Server / Run secure-deployment integration tests
+        if: matrix.shard == 1
+        run: npx nx run twenty-server:test:integration:secure
+
+  cross-version-upgrade:
+    needs: [upgrade-changed-files-check, server-build]
+    uses: ./.github/workflows/ci-cross-version-upgrade.yaml
+    with:
+      skip: ${{ needs.upgrade-changed-files-check.outputs.any_changed != 'true' }}
+
+  discover-public-apps:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    uses: ./.github/workflows/discover-apps.yaml
+    with:
+      scope: public
+      changed-only: false
+
+  server-apps-install-smoke:
+    needs: [discover-public-apps, server-build]
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        app: ${{ fromJSON(needs.discover-public-apps.outputs.matrix) }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Spawn Twenty server from monorepo
+        id: twenty
+        uses: ./.github/actions/spawn-twenty-server
+        with:
+          source: local
+          server-build-cache-key: ${{ env.SERVER_BUILD_CACHE_KEY }}
+      - name: Install app against server
+        uses: ./.github/actions/test-twenty-app
+        with:
+          api-url: ${{ steps.twenty.outputs.server-url }}
+          api-key: ${{ steps.twenty.outputs.api-key }}
+          app-path: ${{ matrix.app.path }}
+          mode: installation-only
+
+  ci-server-status-check:
+    if: always() && !cancelled()
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs:
+      [
+        changed-files-check,
+        server-build,
+        server-lint-typecheck,
+        server-previous-version-upgrade-mutation-guard,
+        server-validation,
+        server-test,
+        server-integration-test,
+        cross-version-upgrade,
+        discover-public-apps,
+        server-apps-install-smoke,
+      ]
+    steps:
+      - name: Fail job if any needs failed
+        if: contains(needs.*.result, 'failure')
+        run: exit 1

.github/workflows/ci-shared.yaml

@@ -0,0 +1,51 @@
+name: CI Shared
+
+on:
+  pull_request:
+  merge_group:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  changed-files-check:
+    if: github.event_name != 'merge_group'
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        packages/twenty-shared/**
+  shared-test:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    env:
+      NODE_OPTIONS: '--max-old-space-size=4096'
+    strategy:
+      matrix:
+        task: [lint, typecheck, test]
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Run ${{ matrix.task }} task
+        uses: ./.github/actions/nx-affected
+        with:
+          tag: scope:shared
+          tasks: ${{ matrix.task }}
+  ci-shared-status-check:
+    if: always() && !cancelled()
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs: [changed-files-check, shared-test]
+    steps:
+      - name: Fail job if any needs failed
+        if: contains(needs.*.result, 'failure')
+        run: exit 1

.github/workflows/ci-test-docker-compose.yaml

@@ -0,0 +1,165 @@
+name: CI Docker
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  changed-files-check:
+    if: github.event_name != 'merge_group'
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        packages/twenty-docker/**
+        docker-compose.yml
+  test-compose:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      # Pull base images through Google's Docker Hub mirror — avoids Docker Hub
+      # rate limits and needs no credentials (this repo is public).
+      - name: Configure Docker Hub mirror
+        run: |
+          echo '{"registry-mirrors":["https://mirror.gcr.io"]}' | sudo tee /etc/docker/daemon.json
+          sudo systemctl restart docker
+      - name: Run compose
+        run: |
+          echo "Patching docker-compose.yml..."
+          yq eval 'del(.services.server.image)' -i docker-compose.yml
+          yq eval '.services.server.build.context = "../../"' -i docker-compose.yml
+          yq eval '.services.server.build.dockerfile = "./packages/twenty-docker/twenty/Dockerfile"' -i docker-compose.yml
+          yq eval '.services.server.build.target = "twenty"' -i docker-compose.yml
+          yq eval '.services.server.restart = "no"' -i docker-compose.yml
+
+          echo "Setting up .env file..."
+          cp .env.example .env
+          echo "Generating secrets..."
+          echo "" >> .env
+          echo "# === Randomly generated secrets ===" >>.env
+          echo "APP_SECRET=$(openssl rand -base64 32)" >>.env
+          echo "PGPASSWORD_SUPERUSER=$(openssl rand -hex 16)" >>.env
+
+          echo "Docker compose up..."
+          docker compose up -d || {
+              echo "Docker compose failed to start"
+              docker compose logs
+              exit 1
+          }
+          docker compose logs db server -f &
+          pid=$!
+
+          echo "Waiting for database to start..."
+          count=0
+          while [ ! $(docker inspect --format='{{.State.Health.Status}}' twenty-db-1) = "healthy" ]; do
+              sleep 1;
+              count=$((count+1));
+              if [ $(docker inspect --format='{{.State.Status}}' twenty-db-1) = "exited" ]; then
+                  echo "Database exited"
+                  docker compose logs db
+                  exit 1
+              fi
+              if [ $count -gt 300 ]; then
+                  echo "Failed to start database after 5 minutes"
+                  docker compose logs db
+                  exit 1
+              fi
+              echo "Still waiting for database... (${count}/60)"
+          done
+
+          echo "Waiting for server to start..."
+          count=0
+          while [ ! $(docker inspect --format='{{.State.Health.Status}}' twenty-server-1) = "healthy" ]; do
+              sleep 1;
+              count=$((count+1));
+              if [ $(docker inspect --format='{{.State.Status}}' twenty-server-1) = "exited" ]; then
+                  echo "Server exited"
+                  docker compose logs server
+                  exit 1
+              fi
+              if [ $count -gt 300 ]; then
+                  echo "Failed to start server after 5 minutes"
+                  docker compose logs server
+                  exit 1
+              fi
+              echo "Still waiting for server... (${count}/300s)"
+          done
+        working-directory: ./packages/twenty-docker/
+  test-app-dev:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      # Pull base images through Google's Docker Hub mirror — avoids Docker Hub
+      # rate limits and needs no credentials (this repo is public).
+      - name: Configure Docker Hub mirror
+        run: |
+          echo '{"registry-mirrors":["https://mirror.gcr.io"]}' | sudo tee /etc/docker/daemon.json
+          sudo systemctl restart docker
+      - name: Create frontend placeholder
+        run: |
+          mkdir -p packages/twenty-front/build
+          echo '<html><body>CI placeholder</body></html>' > packages/twenty-front/build/index.html
+      - name: Build app-dev image
+        run: |
+          docker build \
+            --target twenty-app-dev \
+            -f packages/twenty-docker/twenty/Dockerfile \
+            -t twenty-app-dev-ci \
+            .
+      - name: Start container
+        run: |
+          docker run -d --name twenty-app-dev \
+            -p 2020:2020 \
+            twenty-app-dev-ci
+          docker logs twenty-app-dev -f &
+      - name: Wait for server health
+        run: |
+          echo "Waiting for twenty-app-dev to become healthy..."
+          count=0
+          while true; do
+            status=$(curl -s -o /dev/null -w '%{http_code}' http://localhost:2020/healthz 2>/dev/null || echo "000")
+            if [ "$status" = "200" ]; then
+              echo "Server is healthy!"
+              curl -s http://localhost:2020/healthz
+              break
+            fi
+
+            container_status=$(docker inspect --format='{{.State.Status}}' twenty-app-dev 2>/dev/null || echo "unknown")
+            if [ "$container_status" = "exited" ]; then
+              echo "Container exited unexpectedly"
+              docker logs twenty-app-dev
+              exit 1
+            fi
+
+            count=$((count+1))
+            if [ $count -gt 300 ]; then
+              echo "Server did not become healthy within 5 minutes"
+              docker logs twenty-app-dev
+              exit 1
+            fi
+            echo "Still waiting... (${count}/300s) [HTTP ${status}]"
+            sleep 1
+          done
+  ci-test-docker-status-check:
+    if: always() && !cancelled()
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs: [changed-files-check, test-compose, test-app-dev]
+    steps:
+      - name: Fail job if any needs failed
+        if: contains(needs.*.result, 'failure')
+        run: exit 1

.github/workflows/ci-twenty-apps.yaml

@@ -0,0 +1,115 @@
+name: CI Twenty Apps
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  merge_group:
+  workflow_dispatch:
+    inputs:
+      application:
+        description: 'App folder name to test (e.g. "twenty-linear"). Leave empty to test all apps.'
+        required: false
+        default: ''
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  discover:
+    if: github.event_name != 'merge_group'
+    uses: ./.github/workflows/discover-apps.yaml
+    with:
+      scope: internal-and-public
+      changed-only: true
+      application: ${{ inputs.application }}
+
+  ci:
+    needs: discover
+    if: needs.discover.outputs.has_apps == 'true'
+    name: ${{ matrix.app.name }}
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        app: ${{ fromJSON(needs.discover.outputs.matrix) }}
+    defaults:
+      run:
+        working-directory: ${{ matrix.app.path }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Enable Corepack
+        run: corepack enable
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version-file: '.nvmrc'
+          cache: yarn
+          cache-dependency-path: ${{ matrix.app.path }}/yarn.lock
+
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      - name: Lint
+        run: yarn lint
+
+      - name: Typecheck
+        if: matrix.app.hasTypecheck
+        run: yarn typecheck
+
+      - name: Unit tests
+        if: matrix.app.hasUnit
+        run: yarn test:unit
+
+  integration:
+    needs: discover
+    if: needs.discover.outputs.has_apps == 'true'
+    name: ${{ matrix.app.name }} (${{ matrix.server-source }})
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        app: ${{ fromJSON(needs.discover.outputs.matrix) }}
+        server-source: [dockerhub-latest, local]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+
+      - name: Spawn Twenty server
+        id: twenty
+        if: matrix.app.hasIntegration
+        uses: ./.github/actions/spawn-twenty-server
+        with:
+          source: ${{ matrix.server-source }}
+
+      - name: Test app against server
+        if: matrix.app.hasIntegration
+        uses: ./.github/actions/test-twenty-app
+        with:
+          api-url: ${{ steps.twenty.outputs.server-url }}
+          api-key: ${{ steps.twenty.outputs.api-key }}
+          app-path: ${{ matrix.app.path }}
+          mode: ${{ matrix.server-source == 'local' && 'installation-and-integration-test' || 'integration-test-only' }}
+
+  ci-twenty-apps-status-check:
+    if: always() && !cancelled()
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs: [discover, ci, integration]
+    steps:
+      - name: Fail job if any needs failed
+        if: contains(needs.*.result, 'failure')
+        run: exit 1

.github/workflows/ci-ui.yaml

@@ -0,0 +1,108 @@
+name: CI UI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}${{ github.ref == 'refs/heads/main' && format('-{0}', github.sha) || '' }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  changed-files-check:
+    if: github.event_name == 'pull_request'
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        package.json
+        yarn.lock
+        packages/twenty-ui/**
+        packages/twenty-shared/**
+  ui-task:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        task: [lint, typecheck, test, size, pack-size]
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Run ${{ matrix.task }}
+        run: npx nx ${{ matrix.task }} twenty-ui
+      - name: Check generated theme artifacts are up to date
+        if: matrix.task == 'lint'
+        run: npx nx generate:check twenty-ui
+  ui-sb-build:
+    needs: changed-files-check
+    if: >-
+      always() &&
+      (github.event_name == 'push' ||
+      needs.changed-files-check.outputs.any_changed == 'true')
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Build storybook
+        run: npx nx storybook:build twenty-ui
+      - name: Upload storybook build
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: storybook-twenty-ui
+          path: packages/twenty-ui/storybook-static
+          retention-days: 1
+  ui-sb-test:
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    needs: ui-sb-build
+    if: always() && needs.ui-sb-build.result == 'success'
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Build dependencies
+        run: npx nx build twenty-shared
+      - name: Download storybook build
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: storybook-twenty-ui
+          path: packages/twenty-ui/storybook-static
+      - name: Install Playwright
+        run: |
+          cd packages/twenty-ui
+          npx playwright install
+      - name: Run storybook tests
+        run: npx nx storybook:test twenty-ui
+      - name: Upload screenshots for visual regression
+        if: always() && !cancelled()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: argos-screenshots-twenty-ui
+          path: packages/twenty-ui/screenshots
+          retention-days: 1
+  ci-ui-status-check:
+    if: always() && !cancelled()
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs: [changed-files-check, ui-task, ui-sb-build, ui-sb-test]
+    steps:
+      - name: Fail job if any needs failed
+        if: contains(needs.*.result, 'failure')
+        run: exit 1

.github/workflows/ci-utils-test.yaml

@@ -0,0 +1,45 @@
+name: CI Utils Test
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches:
+      - main
+
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  changed-files-check:
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        packages/twenty-utils/**
+  utils-test:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Run utils tests
+        run: npx nx test twenty-utils
+  ci-utils-test-status-check:
+    if: always() && !cancelled()
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs: [changed-files-check, utils-test]
+    steps:
+      - name: Fail job if any needs failed
+        if: contains(needs.*.result, 'failure')
+        run: exit 1

.github/workflows/ci-utils.yaml

@@ -0,0 +1,75 @@
+name: CI Utils
+
+on:
+  # it's usually not recommended to use pull_request_target
+  # but we consider it's safe here if we keep the same steps
+  # see: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
+  # and: https://github.com/facebook/react-native/pull/34370/files
+  pull_request_target:
+    types: [opened, synchronize, reopened, closed]
+
+permissions:
+  checks: write
+  pull-requests: write
+  statuses: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  # We don't cancel in-progress because this workflow is triggered on
+  # pull_request_target, which means the ref can be the same accross two PRs.
+  # cancel-in-progress: true
+
+jobs:
+  danger-js:
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    if: github.event.action != 'closed'
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Utils / Run Danger.js
+        # Danger's bundled node-fetch intermittently fails to decode gzipped
+        # GitHub API responses with ERR_STREAM_PREMATURE_CLOSE. Retry to absorb
+        # those transient fetch errors instead of failing the whole check.
+        run: |
+          cd packages/twenty-utils
+          for attempt in 1 2 3; do
+            if npx nx danger:ci; then
+              exit 0
+            fi
+            if [ "${attempt}" -lt 3 ]; then
+              echo "Danger.js attempt ${attempt} failed, retrying in 5s..."
+              sleep 5
+            fi
+          done
+          echo "Danger.js failed after 3 attempts"
+          exit 1
+        env:
+          DANGER_GITHUB_API_TOKEN: ${{ github.token }}
+
+  congratulate:
+    timeout-minutes: 3
+    runs-on: ubuntu-latest
+    if: github.event.action == 'closed' && github.event.pull_request.merged == true
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Run congratulate-dangerfile.js
+        # Same transient ERR_STREAM_PREMATURE_CLOSE protection as danger-js.
+        run: |
+          cd packages/twenty-utils
+          for attempt in 1 2 3; do
+            if npx nx danger:congratulate; then
+              exit 0
+            fi
+            if [ "${attempt}" -lt 3 ]; then
+              echo "Danger.js congratulate attempt ${attempt} failed, retrying in 5s..."
+              sleep 5
+            fi
+          done
+          echo "Danger.js congratulate failed after 3 attempts"
+          exit 1
+        env:
+          DANGER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ci-website.yaml

@@ -0,0 +1,55 @@
+name: CI Website
+
+on:
+  pull_request:
+  merge_group:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  changed-files-check:
+    if: github.event_name != 'merge_group'
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        package.json
+        yarn.lock
+        packages/twenty-website/**
+        packages/twenty-shared/**
+        packages/twenty-ui/**
+  website-task:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    env:
+      NODE_OPTIONS: '--max-old-space-size=6144'
+    strategy:
+      matrix:
+        task: [lint, typecheck, test]
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Run ${{ matrix.task }} task
+        uses: ./.github/actions/nx-affected
+        with:
+          tag: scope:website
+          tasks: ${{ matrix.task }}
+  ci-website-status-check:
+    if: always() && !cancelled()
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs: [changed-files-check, website-task]
+    steps:
+      - name: Fail job if any needs failed
+        if: contains(needs.*.result, 'failure')
+        run: exit 1

.github/workflows/ci-zapier.yaml

@@ -0,0 +1,121 @@
+name: CI Zapier
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+env:
+  SERVER_SETUP_CACHE_KEY: server-setup
+
+jobs:
+  changed-files-check:
+    uses: ./.github/workflows/changed-files.yaml
+    with:
+      files: |
+        packages/twenty-zapier/**
+        packages/twenty-server/**
+        !packages/twenty-zapier/package.json
+        !packages/twenty-zapier/CHANGELOG.md
+  server-setup:
+    needs: changed-files-check
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:18
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+      redis:
+        image: redis
+        ports:
+          - 6379:6379
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+
+      - name: Build twenty-shared
+        run: npx nx build twenty-shared
+
+      - name: Server / Write .env
+        run: npx nx reset:env:e2e-testing-server twenty-server
+
+      - name: Server / Build
+        run: npx nx build twenty-server
+
+      - name: Create and setup database
+        run: |
+          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "default";'
+          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "test";'
+          npx nx run twenty-server:database:reset
+
+      - name: Server / Start
+        run: |
+          npx nx run twenty-server:start:ci &
+          echo "Waiting for server to be ready..."
+          timeout 60 bash -c 'until curl -sf http://localhost:3000/healthz; do sleep 2; done'
+
+      - name: Start worker
+        working-directory: packages/twenty-server
+        run: |
+          NODE_ENV=development node dist/queue-worker/queue-worker.js &
+          echo "Worker started"
+
+      - name: Zapier / Build
+        run: npx nx build twenty-zapier
+
+      - name: Zapier / Run Tests
+        uses: ./.github/actions/nx-affected
+        with:
+          tag: scope:zapier
+          tasks: test
+
+  zapier-test:
+    needs: server-setup
+    if: needs.changed-files-check.outputs.any_changed == 'true'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        task: [lint, typecheck, validate]
+    steps:
+      - name: Fetch custom Github Actions and base branch history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 10
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Build
+        run: npx nx build twenty-zapier
+      - name: Run ${{ matrix.task }} task
+        uses: ./.github/actions/nx-affected
+        with:
+          tag: scope:zapier
+          tasks: ${{ matrix.task }}
+  ci-zapier-status-check:
+    if: always() && !cancelled()
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    needs: [changed-files-check, zapier-test]
+    steps:
+      - name: Fail job if any needs failed
+        if: contains(needs.*.result, 'failure')
+        run: exit 1

.github/workflows/claude.yml

@@ -0,0 +1,208 @@
+name: Claude Code
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  pull_request_review:
+    types: [submitted]
+  issues:
+    types: [opened]
+  repository_dispatch:
+    types: [claude-core-team-issues]
+
+permissions: {}
+
+jobs:
+  claude:
+    if: |
+      (
+        github.event_name == 'issue_comment' &&
+        contains(github.event.comment.body, '@claude') &&
+        github.event.comment.user.type != 'Bot' &&
+        contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
+      ) ||
+      (
+        github.event_name == 'pull_request_review_comment' &&
+        contains(github.event.comment.body, '@claude') &&
+        github.event.comment.user.type != 'Bot' &&
+        contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
+      ) ||
+      (
+        github.event_name == 'pull_request_review' &&
+        contains(github.event.review.body, '@claude') &&
+        github.event.review.user.type != 'Bot' &&
+        contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.review.author_association)
+      ) ||
+      (
+        github.event_name == 'issues' &&
+        github.event.action == 'opened' &&
+        (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) &&
+        contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.issue.author_association)
+      )
+    # Job-level (not workflow-level) concurrency: skipped jobs never enter the
+    # group, so PR chatter without @claude can't evict a queued Claude run.
+    concurrency:
+      group: claude-code-${{ github.event.issue.number || github.event.pull_request.number }}
+      cancel-in-progress: false
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+      id-token: write
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+      redis:
+        image: redis
+        ports:
+          - 6379:6379
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 0
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Run Claude Code
+        id: claude-code
+        uses: anthropics/claude-code-action@ac7e24bf2938964b8ab203e417a2773802392ddd # v1.0.146
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          additional_permissions: |
+            actions: read
+          claude_args: '--max-turns 200 --model opus --allowedTools "Edit,Write,WebFetch,Bash(bash packages/twenty-utils/setup-dev-env.sh),Bash(npx nx *),Bash(npx jest *),Bash(yarn *),Bash(git *),Bash(gh *),Bash(sed *),Bash(python3 *),Bash(rm *),Bash(find *),Bash(grep *),Bash(cat *),Bash(ls *),Bash(head *),Bash(tail *),Bash(wc *),Bash(sort *),Bash(uniq *),Bash(mkdir *),Bash(cp *),Bash(mv *),Bash(touch *),Bash(chmod *),Bash(echo *),Bash(curl *),Bash(cd *),Bash(pwd *),Bash(diff *),Bash(xargs *),Bash(awk *),Bash(cut *),Bash(tee *),Bash(tr *)"'
+          settings: |
+            {
+              "env": {
+                "PG_DATABASE_URL": "postgres://postgres:postgres@localhost:5432/default"
+              }
+            }
+      - name: Post Create-PR link if Claude ran out of turns
+        if: failure()
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          BRANCH=$(git branch --show-current)
+          if [ "$BRANCH" = "main" ] || [ "$BRANCH" = "" ]; then
+            exit 0
+          fi
+          AHEAD=$(git rev-list --count main.."$BRANCH" 2>/dev/null || echo "0")
+          if [ "$AHEAD" = "0" ]; then
+            exit 0
+          fi
+          EXISTING_PR=$(gh pr list --head "$BRANCH" --json number --jq '.[0].number' 2>/dev/null || echo "")
+          if [ -n "$EXISTING_PR" ]; then
+            exit 0
+          fi
+          ISSUE_NUMBER="${{ github.event.issue.number || github.event.pull_request.number }}"
+          ENCODED_BRANCH=$(python3 -c "import urllib.parse, sys; print(urllib.parse.quote(sys.argv[1], safe=''))" "$BRANCH")
+          PR_URL="https://github.com/${{ github.repository }}/compare/main...${ENCODED_BRANCH}?quick_pull=1"
+          BODY="⚠️ Claude ran out of turns before creating a PR. Work has been pushed to [\`$BRANCH\`](https://github.com/${{ github.repository }}/tree/$ENCODED_BRANCH).\n\n[**Create PR →**]($PR_URL)"
+          if [ -n "$ISSUE_NUMBER" ]; then
+            gh issue comment "$ISSUE_NUMBER" --body "$(echo -e "$BODY")"
+          fi
+
+  claude-cross-repo:
+    if: github.event_name == 'repository_dispatch'
+    concurrency:
+      group: claude-cross-repo-${{ github.event.client_payload.repo_full_name }}-${{ github.event.client_payload.issue_number }}
+      cancel-in-progress: false
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+      id-token: write
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+      redis:
+        image: redis
+        ports:
+          - 6379:6379
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 0
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Build prompt from dispatch payload
+        id: prompt
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        with:
+          script: |
+            const p = context.payload.client_payload;
+            let prompt;
+            if (p.comment_body) {
+              prompt = `You are responding to a comment on issue #${p.issue_number} ("${p.issue_title}") in the ${p.repo_full_name} repository.\n\nThe comment by @${p.sender} says:\n\n${p.comment_body}\n\nIssue body:\n\n${p.issue_body}\n\nPlease help with this request. The code you are working with is the twenty codebase (this repository).`;
+            } else {
+              prompt = `You are responding to issue #${p.issue_number} ("${p.issue_title}") in the ${p.repo_full_name} repository, opened by @${p.sender}.\n\nIssue body:\n\n${p.issue_body}\n\nPlease help with this request. The code you are working with is the twenty codebase (this repository).`;
+            }
+            core.setOutput('prompt', prompt);
+            core.setOutput('repo', p.repo_full_name);
+            core.setOutput('issue_number', p.issue_number);
+      - name: Run Claude Code
+        id: claude
+        uses: anthropics/claude-code-action@ac7e24bf2938964b8ab203e417a2773802392ddd # v1.0.146
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          prompt: ${{ steps.prompt.outputs.prompt }}
+          additional_permissions: |
+            actions: read
+          claude_args: '--max-turns 200 --model opus --allowedTools "Edit,Write,WebFetch,Bash(bash packages/twenty-utils/setup-dev-env.sh),Bash(npx nx *),Bash(npx jest *),Bash(yarn *),Bash(git *),Bash(gh *),Bash(sed *),Bash(python3 *),Bash(rm *),Bash(find *),Bash(grep *),Bash(cat *),Bash(ls *),Bash(head *),Bash(tail *),Bash(wc *),Bash(sort *),Bash(uniq *),Bash(mkdir *),Bash(cp *),Bash(mv *),Bash(touch *),Bash(chmod *),Bash(echo *),Bash(curl *),Bash(cd *),Bash(pwd *),Bash(diff *),Bash(xargs *),Bash(awk *),Bash(cut *),Bash(tee *),Bash(tr *)"'
+          settings: |
+            {
+              "env": {
+                "PG_DATABASE_URL": "postgres://postgres:postgres@localhost:5432/default"
+              }
+            }
+      - name: Mint twenty-factory dispatch token
+        id: app-token
+        if: always()
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
+          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
+          owner: twentyhq
+          repositories: twenty-factory
+          permission-actions: write
+
+      - name: Dispatch response to twenty-factory
+        if: always()
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPO: ${{ steps.prompt.outputs.repo }}
+          ISSUE_NUMBER: ${{ steps.prompt.outputs.issue_number }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          gh workflow run post-claude-response.yaml --repo twentyhq/twenty-factory --ref main \
+            -f repo="$REPO" \
+            -f issue_number="$ISSUE_NUMBER" \
+            -f run_url="$RUN_URL"

.github/workflows/discover-apps.yaml

@@ -0,0 +1,119 @@
+name: Discover apps reusable workflow
+
+on:
+  workflow_call:
+    inputs:
+      scope:
+        description: 'App roots to scan: "public" or "internal-and-public".'
+        required: false
+        type: string
+        default: internal-and-public
+      changed-only:
+        description: 'Only include apps changed in this PR, else every app in scope.'
+        required: false
+        type: boolean
+        default: true
+      application:
+        description: 'workflow_dispatch: restrict to a single app folder name.'
+        required: false
+        type: string
+        default: ''
+    outputs:
+      matrix:
+        value: ${{ jobs.discover.outputs.matrix }}
+      has_apps:
+        value: ${{ jobs.discover.outputs.has_apps }}
+
+permissions:
+  contents: read
+
+jobs:
+  discover:
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+      has_apps: ${{ steps.set-matrix.outputs.has_apps }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: ${{ inputs.changed-only && '0' || '1' }}
+
+      - name: Ensure no .github folder inside app folders
+        run: |
+          offenders=$(find packages/twenty-apps/internal packages/twenty-apps/public -mindepth 2 -maxdepth 2 -type d -name .github)
+          if [ -n "$offenders" ]; then
+            echo "::error::Apps must not define their own .github folder. Offenders:"
+            echo "$offenders"
+            exit 1
+          fi
+
+      - name: Detect changed files
+        id: changed-files
+        if: inputs.changed-only && github.event_name != 'workflow_dispatch'
+        uses: tj-actions/changed-files@48d8f15b2aaa3d255ca5af3eba4870f807ce6b3c # v45.0.9
+        with:
+          json: true
+          escape_json: false
+          files: |
+            packages/twenty-apps/internal/**
+            packages/twenty-apps/public/**
+
+      - name: Build matrix of apps
+        id: set-matrix
+        env:
+          SCOPE: ${{ inputs.scope }}
+          CHANGED_ONLY: ${{ inputs.changed-only }}
+          EVENT_NAME: ${{ github.event_name }}
+          CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
+          APPLICATION_INPUT: ${{ inputs.application }}
+        run: |
+          node <<'NODE'
+          const fs = require('fs');
+          const path = require('path');
+          const changedOnly = process.env.CHANGED_ONLY === 'true';
+          const roots = process.env.SCOPE === 'public'
+            ? ['packages/twenty-apps/public']
+            : ['packages/twenty-apps/internal', 'packages/twenty-apps/public'];
+          const eventName = process.env.EVENT_NAME;
+          const changedFiles = JSON.parse(process.env.CHANGED_FILES || '[]');
+          const changedApps = new Set();
+          for (const file of changedFiles) {
+            const match = file.match(/^packages\/twenty-apps\/(?:internal|public)\/([^/]+)\//);
+            if (match) changedApps.add(match[1]);
+          }
+          const requestedApp = (process.env.APPLICATION_INPUT || '').trim();
+          const matrix = roots
+            .filter((root) => fs.existsSync(root))
+            .flatMap((root) =>
+              fs.readdirSync(root, { withFileTypes: true })
+                .filter((entry) => entry.isDirectory() && entry.name !== 'node_modules')
+                .map((entry) => entry.name)
+                .filter((name) => fs.existsSync(path.join(root, name, 'package.json')))
+                .filter((name) => {
+                  if (!changedOnly) return true;
+                  if (eventName === 'workflow_dispatch') {
+                    return requestedApp ? name === requestedApp : true;
+                  }
+                  return changedApps.has(name);
+                })
+                .map((name) => {
+                  const appPath = path.join(root, name);
+                  const scripts = JSON.parse(fs.readFileSync(path.join(appPath, 'package.json'), 'utf8')).scripts || {};
+                  return {
+                    name,
+                    path: appPath,
+                    hasTypecheck: Boolean(scripts.typecheck),
+                    hasUnit: Boolean(scripts['test:unit']),
+                    hasIntegration: Boolean(scripts.test),
+                  };
+                })
+            );
+          if (changedOnly && eventName === 'workflow_dispatch' && requestedApp && matrix.length === 0) {
+            console.error(`::error::Requested app "${requestedApp}" was not found under ${roots.join(', ')}`);
+            process.exit(1);
+          }
+          fs.appendFileSync(process.env.GITHUB_OUTPUT, `matrix=${JSON.stringify(matrix)}\n`);
+          fs.appendFileSync(process.env.GITHUB_OUTPUT, `has_apps=${matrix.length > 0}\n`);
+          NODE

.github/workflows/docs-i18n-pull.yaml

@@ -0,0 +1,205 @@
+name: 'Pull docs translations from Crowdin'
+
+permissions:
+  contents: write
+  pull-requests: write
+
+on:
+  schedule:
+    - cron: '0 */2 * * *' # Every two hours
+  workflow_dispatch:
+    inputs:
+      force_pull:
+        description: 'Force pull translations regardless of status'
+        required: false
+        type: boolean
+        default: false
+  workflow_call:
+    inputs:
+      force_pull:
+        description: 'Force pull translations regardless of status'
+        required: false
+        type: boolean
+        default: false
+  pull_request:
+    paths:
+      - 'packages/twenty-docs/**'
+      - '.github/crowdin-docs.yml'
+      - '.github/workflows/docs-i18n-pull.yaml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  pull_docs_translations:
+    name: Pull docs translations
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          token: ${{ github.token }}
+          repository: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name || github.repository }}
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
+
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+
+      - name: Setup i18n-docs branch
+        if: github.event_name != 'pull_request'
+        run: |
+          git fetch origin i18n-docs || true
+          git checkout -B i18n-docs origin/i18n-docs || git checkout -b i18n-docs
+
+      - name: Configure git
+        run: |
+          git config --global user.name 'github-actions'
+          git config --global user.email 'github-actions@twenty.com'
+
+      - name: Stash any changes before pulling translations
+        if: github.event_name != 'pull_request'
+        run: |
+          git add .
+          git stash || true
+
+      # Install Crowdin CLI for downloading translations
+      - name: Install Crowdin CLI
+        if: github.event_name != 'pull_request' && (inputs.force_pull == true || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
+        run: npm install -g @crowdin/cli
+
+      - name: Pre-translate untranslated strings
+        if: github.event_name != 'pull_request' && (inputs.force_pull == true || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
+        run: |
+          COMMON="--config .github/crowdin-docs.yml --token $CROWDIN_PERSONAL_TOKEN --base-url https://twenty.api.crowdin.com --translate-untranslated-only --no-progress"
+          echo "=== TM pre-translate (perfect matches only) ==="
+          crowdin pre-translate --method tm --translate-with-perfect-match-only $COMMON || echo "::warning::TM pre-translate failed (non-blocking)"
+          echo "=== MT pre-translate (engine 2: Crowdin Translate) ==="
+          crowdin pre-translate --method mt --engine-id 2 $COMMON || echo "::warning::MT pre-translate failed (non-blocking)"
+          echo "=== AI pre-translate (prompt 1; covers ko/tr + markup MT skips) ==="
+          crowdin pre-translate --method ai --ai-prompt 1 $COMMON || echo "::warning::AI pre-translate failed (non-blocking)"
+        env:
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+
+      - name: Normalize translations in Crowdin
+        if: github.event_name != 'pull_request' && (inputs.force_pull == true || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
+        run: npx tsx packages/twenty-utils/crowdin-normalizer/normalize-crowdin-translations.ts --project=2 --format=mdx --apply || echo "::warning::translation normalization failed (non-blocking)"
+        env:
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+
+      # Pull docs translations from Crowdin one language at a time
+      # This avoids build timeout issues when processing all languages at once
+      - name: Pull translated docs from Crowdin
+        id: pull
+        if: github.event_name != 'pull_request' && (inputs.force_pull == true || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
+        run: |
+          # Languages supported by Mintlify (see packages/twenty-docs/src/shared/supported-languages.ts)
+          LANGUAGES="fr ar cs de es it ja ko pt ro ru tr zh-CN"
+
+          FAILED_LANGUAGES=""
+
+          for lang in $LANGUAGES; do
+            echo "=== Pulling translations for $lang ==="
+            if ! crowdin download \
+              --config .github/crowdin-docs.yml \
+              --token "$CROWDIN_PERSONAL_TOKEN" \
+              --base-url "https://twenty.api.crowdin.com" \
+              --language "$lang" \
+              --skip-untranslated-strings=false \
+              --skip-untranslated-files=false \
+              --export-only-approved=false \
+              --verbose; then
+              echo "::warning::Crowdin download failed for $lang (likely a server-side build failure); its translations will be stale until fixed."
+              FAILED_LANGUAGES="$FAILED_LANGUAGES $lang"
+            fi
+            echo ""
+          done
+
+          echo "failed_languages=${FAILED_LANGUAGES# }" >> "$GITHUB_OUTPUT"
+          echo "=== Download complete (failed:${FAILED_LANGUAGES:-none}) ==="
+        env:
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+
+      - name: Fix file permissions
+        if: github.event_name != 'pull_request'
+        run: sudo chown -R runner:docker . || true
+
+      - name: Fix translated documentation links
+        run: bash packages/twenty-docs/scripts/fix-translated-links.sh
+      - name: Prune orphan localized translations
+        if: github.event_name != 'pull_request' && (inputs.force_pull == true || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
+        run: yarn docs:prune-orphans --apply
+
+      - name: Regenerate navigation template
+        if: github.event_name == 'pull_request'
+        run: yarn docs:generate-navigation-template
+
+      - name: Regenerate docs.json
+        run: yarn docs:generate
+
+      - name: Regenerate documentation paths constants
+        run: yarn docs:generate-paths
+
+      - name: Commit artifacts to pull request branch
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
+        run: |
+          git add packages/twenty-docs/docs.json packages/twenty-docs/navigation/navigation.template.json packages/twenty-shared/src/constants/DocumentationPaths.ts
+          if git diff --staged --quiet --exit-code; then
+            echo "No navigation/doc changes to commit."
+            exit 0
+          fi
+          git commit -m "chore: sync docs artifacts"
+          git push origin "HEAD:$HEAD_REF"
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+
+      - name: Check for changes and commit
+        if: github.event_name != 'pull_request'
+        id: check_changes
+        run: |
+          git add .
+          if ! git diff --staged --quiet --exit-code; then
+            git commit -m "chore: update docs translations from Crowdin and fix internal links"
+            echo "changes_detected=true" >> $GITHUB_OUTPUT
+          else
+            echo "changes_detected=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Push changes
+        if: github.event_name != 'pull_request' && steps.check_changes.outputs.changes_detected == 'true'
+        run: git push origin HEAD:i18n-docs
+
+      - name: Create pull request
+        if: github.event_name != 'pull_request' && steps.check_changes.outputs.changes_detected == 'true'
+        run: |
+          if git diff --name-only origin/main..HEAD | grep -q .; then
+            gh pr create -B main -H i18n-docs --title 'i18n - docs translations' --body 'Created by Github action' || true
+          else
+            echo "No file differences between branches, skipping PR creation"
+          fi
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Mint twenty-infra dispatch token
+        id: app-token
+        if: github.event_name != 'pull_request' && steps.check_changes.outputs.changes_detected == 'true'
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
+          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
+          owner: twentyhq
+          repositories: twenty-infra
+          permission-actions: write
+
+      - name: Trigger i18n automerge
+        if: github.event_name != 'pull_request' && steps.check_changes.outputs.changes_detected == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main
+
+      - name: Fail run if any language failed to download
+        if: always() && steps.pull.outputs.failed_languages != ''
+        run: |
+          echo "::error::Crowdin download failed for:${{ steps.pull.outputs.failed_languages }}. These languages were skipped and are now stale — fix the source (e.g. build-breaking translations) and re-run."
+          exit 1

.github/workflows/docs-i18n-push.yaml

@@ -0,0 +1,52 @@
+name: 'Push docs to Crowdin'
+
+permissions:
+  contents: write
+
+on:
+  workflow_dispatch:
+  workflow_call:
+  push:
+    branches: ['main']
+    paths:
+      - 'packages/twenty-docs/**/*.mdx'
+      - '!packages/twenty-docs/l/**'
+      - 'packages/twenty-docs/navigation/navigation.template.json'
+      - '.github/crowdin-docs.yml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  push_docs:
+    name: Push documentation to Crowdin
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          token: ${{ github.token }}
+          ref: ${{ github.ref }}
+
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+
+      - name: Generate navigation template for Crowdin
+        run: yarn docs:generate-navigation-template
+
+      - name: Upload docs to Crowdin
+        uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2
+        with:
+          upload_sources: true
+          upload_sources_args: '--delete-obsolete'
+          upload_translations: false
+          download_translations: false
+          localization_branch_name: i18n-docs
+          base_url: 'https://twenty.api.crowdin.com'
+          config: '.github/crowdin-docs.yml'
+        env:
+          # Docs translations project
+          CROWDIN_PROJECT_ID: '2'
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+

.github/workflows/external-contributor-pr-auto-draft.yaml

@@ -0,0 +1,35 @@
+name: Auto-Draft External PRs
+
+on:
+  pull_request_target:
+    types: [opened]
+
+permissions: {}
+
+jobs:
+  dispatch:
+    if: |
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.author_association != 'MEMBER' &&
+      github.event.pull_request.author_association != 'OWNER' &&
+      github.event.pull_request.author_association != 'COLLABORATOR'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Mint twenty-factory dispatch token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
+          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
+          owner: twentyhq
+          repositories: twenty-factory
+          permission-actions: write
+
+      - name: Dispatch to twenty-factory
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          gh workflow run convert-pr-to-draft.yaml --repo twentyhq/twenty-factory --ref main \
+            -f pr_number="$PR_NUMBER"

.github/workflows/i18n-pull.yaml

@@ -0,0 +1,153 @@
+# Pull down translations from Crowdin every two hours or when triggered manually.
+# Schedule and workflow_dispatch always download. workflow_call downloads when
+# force_pull is true. We cannot gate on `lingui compile --strict`: English is the
+# fallback locale, so empty msgstr values compile successfully.
+
+name: 'Pull translations from Crowdin'
+
+permissions:
+  contents: write
+  pull-requests: write
+
+on:
+  schedule:
+    - cron: '0 */2 * * *' # Every two hours.
+  workflow_dispatch:
+  workflow_call:
+    inputs:
+      force_pull:
+        description: 'Download translations even though the caller was not triggered by a schedule'
+        required: false
+        type: boolean
+        default: false
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  pull_translations:
+    name: Pull translations
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          token: ${{ github.token }}
+          ref: ${{ github.head_ref || github.ref_name }}
+
+      - name: Setup i18n branch
+        run: |
+          git fetch origin i18n || true
+          git checkout -B i18n origin/i18n || git checkout -b i18n
+
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+
+      - name: Build twenty-shared
+        run: npx nx build twenty-shared
+
+      - name: Stash any changes before pulling translations
+        run: |
+          git config --global user.name 'github-actions'
+          git config --global user.email 'github-actions@twenty.com'
+          git add .
+          git stash
+
+      # Repair machine-translation damage in Crowdin before downloading, so the
+      # catalogs that reach the repo are already correct rather than a cycle behind.
+      - name: Normalize translations in Crowdin
+        if: inputs.force_pull == true || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+        run: npx tsx packages/twenty-utils/crowdin-normalizer/normalize-crowdin-translations.ts --project=1 --format=po --apply || echo "::warning::translation normalization failed (non-blocking)"
+        env:
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+
+      - name: Pull translations from Crowdin
+        if: inputs.force_pull == true || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+        uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2
+        with:
+          upload_sources: false
+          upload_translations: false
+          download_translations: true
+          export_only_approved: false
+          localization_branch_name: i18n
+          base_url: 'https://twenty.api.crowdin.com'
+          auto_approve_imported: false
+          import_eq_suggestions: false
+          download_sources: false
+          push_sources: false
+          skip_untranslated_strings: false
+          skip_untranslated_files: false
+          push_translations: false
+          create_pull_request: false
+          skip_ref_checkout: true
+          dryrun_action: false
+          config: '.github/crowdin-app.yml'
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          # App translations project
+          CROWDIN_PROJECT_ID: '1'
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+
+      # As the files are extracted from a Docker container, they belong to root:root
+      # We need to fix this before the next steps
+      - name: Fix file permissions
+        run: sudo chown -R runner:docker .
+
+      - name: Normalize downloaded catalogs to lingui format
+        run: |
+          npx nx run twenty-server:lingui:extract
+          npx nx run twenty-emails:lingui:extract
+          npx nx run twenty-front:lingui:extract
+
+      - name: Compile translations
+        id: compile_translations
+        run: |
+          npx nx run twenty-server:lingui:compile
+          npx nx run twenty-emails:lingui:compile
+          npx nx run twenty-front:lingui:compile
+          git status
+          git add .
+          if ! git diff --staged --quiet --exit-code; then
+            git commit -m "chore: compile translations"
+            echo "changes_detected=true" >> $GITHUB_OUTPUT
+          else
+            echo "changes_detected=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Push changes
+        if: steps.compile_translations.outputs.changes_detected == 'true'
+        run: git push origin HEAD:i18n
+
+      - name: Create pull request
+        if: steps.compile_translations.outputs.changes_detected == 'true'
+        run: |
+          if git diff --name-only origin/main..HEAD | grep -q .; then
+            gh pr create -B main -H i18n --title 'i18n - translations' --body 'Created by Github action' || true
+          else
+            echo "No file differences between branches, skipping PR creation"
+          fi
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Lint translations
+        run: npx nx run twenty-front:lint:i18n || echo "::warning::translation lint failed (non-blocking)"
+
+      - name: Mint twenty-infra dispatch token
+        id: app-token
+        if: steps.compile_translations.outputs.changes_detected == 'true'
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
+          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
+          owner: twentyhq
+          repositories: twenty-infra
+          permission-actions: write
+
+      - name: Trigger i18n automerge
+        if: steps.compile_translations.outputs.changes_detected == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main

.github/workflows/i18n-push.yaml

@@ -0,0 +1,127 @@
+name: 'Push translations to Crowdin'
+
+permissions:
+  contents: write
+  pull-requests: write
+
+on:
+  workflow_dispatch:
+  workflow_call:
+  push:
+    branches: ['main']
+    paths-ignore:
+      - 'packages/twenty-front/src/locales/**'
+      - 'packages/twenty-emails/src/locales/**'
+      - 'packages/twenty-server/src/engine/core-modules/i18n/locales/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  extract_translations:
+    name: Extract and upload translations
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          token: ${{ github.token }}
+          ref: main
+
+      - name: Setup i18n branch
+        run: |
+          git fetch origin i18n || true
+          git checkout -B i18n origin/i18n || git checkout -b i18n
+
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+
+      - name: Build dependencies
+        run: npx nx build twenty-shared
+
+      - name: Extract translations
+        run: |
+          npx nx run twenty-server:lingui:extract
+          npx nx run twenty-emails:lingui:extract
+          npx nx run twenty-front:lingui:extract
+
+      - name: Check and commit extracted files
+        id: check_extract_changes
+        run: |
+          git config --global user.name 'github-actions'
+          git config --global user.email 'github-actions@twenty.com'
+          git add .
+          if ! git diff --staged --quiet --exit-code; then
+            git commit -m "chore: extract translations"
+            echo "changes_detected=true" >> $GITHUB_OUTPUT
+          else
+            echo "changes_detected=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Compile translations
+        run: |
+          npx nx run twenty-server:lingui:compile
+          npx nx run twenty-emails:lingui:compile
+          npx nx run twenty-front:lingui:compile
+
+      - name: Check and commit compiled files
+        id: check_compile_changes
+        run: |
+          git config --global user.name 'github-actions'
+          git config --global user.email 'github-actions@twenty.com'
+          git add .
+          if ! git diff --staged --quiet --exit-code; then
+            git commit -m "chore: compile translations"
+            echo "changes_detected=true" >> $GITHUB_OUTPUT
+          else
+            echo "changes_detected=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Push changes and create remote branch if needed
+        if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
+        run: git push origin HEAD:i18n
+
+      - name: Upload missing translations
+        if: steps.check_extract_changes.outputs.changes_detected == 'true'
+        uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2
+        with:
+          upload_sources: true
+          upload_sources_args: '--delete-obsolete'
+          upload_translations: true
+          download_translations: false
+          localization_branch_name: i18n
+          base_url: 'https://twenty.api.crowdin.com'
+          config: '.github/crowdin-app.yml'
+        env:
+          # App translations project
+          CROWDIN_PROJECT_ID: '1'
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+      - name: Create a pull request
+        if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
+        run: |
+          if git diff --name-only origin/main..HEAD | grep -q .; then
+            gh pr create -B main -H i18n --title 'i18n - translations' --body 'Created by Github action' || true
+          else
+            echo "No file differences between branches, skipping PR creation"
+          fi
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Mint twenty-infra dispatch token
+        id: app-token
+        if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
+          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
+          owner: twentyhq
+          repositories: twenty-infra
+          permission-actions: write
+
+      - name: Trigger i18n automerge
+        if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main

.github/workflows/post-ci-comments.yaml

@@ -0,0 +1,88 @@
+name: Post CI Comments
+
+on:
+  workflow_run:
+    workflows: ['GraphQL and OpenAPI Breaking Changes Detection']
+    types: [completed]
+
+permissions:
+  actions: read
+
+jobs:
+  dispatch-breaking-changes:
+    if: github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Get PR number from workflow run
+        id: pr-info
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        with:
+          script: |
+            const runId = context.payload.workflow_run.id;
+            const headSha = context.payload.workflow_run.head_sha;
+            const headBranch = context.payload.workflow_run.head_branch;
+            const headRepo = context.payload.workflow_run.head_repository;
+
+            // workflow_run.pull_requests is empty for fork PRs,
+            // so fall back to searching by head SHA
+            let pullRequests = context.payload.workflow_run.pull_requests;
+            let prNumber;
+
+            if (pullRequests && pullRequests.length > 0) {
+              prNumber = pullRequests[0].number;
+            } else {
+              core.info(`pull_requests is empty (likely a fork PR), searching by SHA ${headSha}`);
+              const owner = context.repo.owner;
+              const repo = context.repo.repo;
+              const headLabel = `${headRepo.owner.login}:${headBranch}`;
+
+              const { data: prs } = await github.rest.pulls.list({
+                owner,
+                repo,
+                state: 'open',
+                head: headLabel,
+                per_page: 1,
+              });
+
+              if (prs.length > 0) {
+                prNumber = prs[0].number;
+              }
+            }
+
+            if (!prNumber) {
+              core.info('No pull request found for this workflow run');
+              core.setOutput('has_pr', 'false');
+              return;
+            }
+
+            core.setOutput('pr_number', prNumber);
+            core.setOutput('run_id', runId);
+            core.setOutput('has_pr', 'true');
+            core.info(`PR #${prNumber}, Run ID: ${runId}`);
+
+      - name: Mint twenty-factory dispatch token
+        id: app-token
+        if: steps.pr-info.outputs.has_pr == 'true'
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
+          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
+          owner: twentyhq
+          repositories: twenty-factory
+          permission-actions: write
+
+      - name: Dispatch to twenty-factory
+        if: steps.pr-info.outputs.has_pr == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          PR_NUMBER: ${{ steps.pr-info.outputs.pr_number }}
+          RUN_ID: ${{ steps.pr-info.outputs.run_id }}
+          REPOSITORY: ${{ github.repository }}
+          BRANCH_STATE: ${{ github.event.workflow_run.head_branch }}
+        run: |
+          gh workflow run post-breaking-changes-comment.yaml --repo twentyhq/twenty-factory --ref main \
+            -f pr_number="$PR_NUMBER" \
+            -f run_id="$RUN_ID" \
+            -f repo="$REPOSITORY" \
+            -f branch_state="$BRANCH_STATE"

.github/workflows/pr-review-dispatch.yaml

@@ -0,0 +1,40 @@
+name: PR Review Dispatch
+run-name: "PR Review Dispatch #${{ github.event.pull_request.number }}"
+
+on:
+  pull_request_target:
+    types: [opened, ready_for_review, synchronize, labeled]
+
+permissions: {}
+
+concurrency:
+  group: pr-review-dispatch-${{ github.event.pull_request.number }}-${{ github.event.action }}
+  cancel-in-progress: ${{ github.event.action == 'synchronize' }}
+
+jobs:
+  dispatch:
+    if: >
+      github.event.pull_request.draft == false &&
+      (github.event.action != 'labeled' || startsWith(github.event.label.name, 'pr-review-'))
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Mint twenty-factory dispatch token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
+          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
+          owner: twentyhq
+          repositories: twenty-factory
+          permission-actions: write
+
+      - name: Forward to PR review
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          EVENT: ${{ github.event.action }}
+        run: |
+          gh workflow run pr-review.yaml --repo twentyhq/twenty-factory --ref main \
+            -f pr_number="$PR_NUMBER" \
+            -f event="$EVENT"

.github/workflows/preview-env-dispatch.yaml

@@ -0,0 +1,91 @@
+name: 'Preview Environment Dispatch'
+
+permissions: {}
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, labeled]
+    paths:
+      - packages/twenty-docker/**
+      - packages/twenty-server/**
+      - packages/twenty-front/**
+      - packages/twenty-apps/examples/**
+      - packages/twenty-apps/internal/**
+      - packages/twenty-apps/public/**
+      - .github/workflows/preview-env-dispatch.yaml
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  trigger-preview:
+    if: |
+      (github.event.action == 'labeled' && github.event.label.name == 'preview-app') ||
+      (
+        (
+          github.event.pull_request.author_association == 'MEMBER' ||
+          github.event.pull_request.author_association == 'OWNER' ||
+          github.event.pull_request.author_association == 'COLLABORATOR'
+        ) && (
+          github.event.action == 'opened' ||
+          github.event.action == 'synchronize' ||
+          github.event.action == 'reopened'
+        )
+      )
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      # Files API, not a checkout: under pull_request_target nothing from the
+      # PR head may be checked out here.
+      - name: List changed apps
+        id: apps
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          changed_files=$(gh api "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files" --paginate --jq '.[].filename')
+          app_paths=$(printf '%s\n' "$changed_files" \
+            | grep -oE '^packages/twenty-apps/(examples|internal|public)/[a-z0-9][a-z0-9-]*' \
+            | sort -u || true)
+
+          echo "Changed apps:"
+          printf '%s\n' "${app_paths:-<none>}"
+          {
+            echo 'app_paths<<APPS_EOF'
+            printf '%s\n' "$app_paths"
+            echo 'APPS_EOF'
+          } >> "$GITHUB_OUTPUT"
+
+      # Preview envs run on the PUBLIC ci-public repo so the 5h keepalive job
+      # consumes free Actions minutes (private repos bill them). ci-public holds
+      # no privileged secret: it starts the tunnel and dispatches the URL back to
+      # twenty-factory for the PR comment *before* running any PR-controlled code.
+      - name: Mint ci-public dispatch token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
+          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
+          owner: twentyhq
+          repositories: ci-public
+          permission-actions: write
+
+      - name: Dispatch preview-env to ci-public
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          REPOSITORY: ${{ github.repository }}
+          APP_PATHS: ${{ steps.apps.outputs.app_paths }}
+        run: |
+          gh workflow run preview-env.yaml --repo twentyhq/ci-public --ref main \
+            -f pr_number="$PR_NUMBER" \
+            -f pr_head_sha="$PR_HEAD_SHA" \
+            -f repo="$REPOSITORY" \
+            -f app_paths="$APP_PATHS"

.github/workflows/visual-regression-dispatch.yaml

@@ -0,0 +1,207 @@
+name: Visual Regression Dispatch
+
+# Dispatches visual regression processing to twenty-factory after CI completes.
+# Runs in the context of the base repo (not the fork) so it has access to secrets,
+# making it work for external contributor PRs.
+#
+# All paths trigger the same twenty-factory workflow (post-visual-regression-comment.yaml)
+# via workflow_dispatch, passing the project as an input. twenty-factory routes to the
+# correct Argos project based on it.
+
+on:
+  workflow_run:
+    workflows: ['CI UI', 'CI Front']
+    types: [completed]
+
+permissions:
+  actions: read
+  contents: read
+  pull-requests: read
+
+jobs:
+  resolve-context:
+    if: github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      workflow_name: ${{ steps.context.outputs.workflow_name }}
+      project: ${{ steps.context.outputs.project }}
+      artifact_name: ${{ steps.context.outputs.artifact_name }}
+      has_artifact: ${{ steps.check-artifact.outputs.exists }}
+      is_pr: ${{ steps.pr-info.outputs.has_pr }}
+      pr_number: ${{ steps.pr-info.outputs.pr_number }}
+      merge_base_sha: ${{ steps.merge-base.outputs.sha }}
+      parent_commits: ${{ steps.merge-base.outputs.parent_commits }}
+    steps:
+      - name: Resolve workflow context
+        id: context
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        with:
+          script: |
+            const name = context.payload.workflow_run.name;
+            const projectByWorkflow = {
+              'CI UI': 'twenty-ui',
+              'CI Front': 'twenty-front',
+            };
+            const project = projectByWorkflow[name] ?? 'twenty-front';
+            const artifactName = `argos-screenshots-${project}`;
+            core.setOutput('workflow_name', name);
+            core.setOutput('project', project);
+            core.setOutput('artifact_name', artifactName);
+            core.info(`Workflow: ${name}, project: ${project}, artifact: ${artifactName}`);
+
+      - name: Check if screenshots artifact exists
+        id: check-artifact
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        with:
+          script: |
+            const artifactName = '${{ steps.context.outputs.artifact_name }}';
+            const runId = context.payload.workflow_run.id;
+
+            const { data: artifacts } = await github.rest.actions.listWorkflowRunArtifacts({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: runId,
+            });
+
+            const found = artifacts.artifacts.some(a => a.name === artifactName);
+            core.setOutput('exists', found ? 'true' : 'false');
+
+            if (!found) {
+              core.info(`Artifact "${artifactName}" not found in run ${runId} — skipping`);
+            }
+
+      - name: Get PR number
+        if: >-
+          steps.check-artifact.outputs.exists == 'true' &&
+          github.event.workflow_run.event == 'pull_request'
+        id: pr-info
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        with:
+          script: |
+            const headBranch = context.payload.workflow_run.head_branch;
+            const headRepo = context.payload.workflow_run.head_repository;
+
+            let pullRequests = context.payload.workflow_run.pull_requests;
+            let prNumber;
+
+            if (pullRequests && pullRequests.length > 0) {
+              prNumber = pullRequests[0].number;
+            } else {
+              const headLabel = `${headRepo.owner.login}:${headBranch}`;
+              core.info(`Searching for PR by head label: ${headLabel}`);
+
+              const { data: prs } = await github.rest.pulls.list({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                state: 'open',
+                head: headLabel,
+                per_page: 1,
+              });
+
+              if (prs.length > 0) {
+                prNumber = prs[0].number;
+              }
+            }
+
+            if (!prNumber) {
+              core.info('No pull request found — skipping');
+              core.setOutput('has_pr', 'false');
+              return;
+            }
+
+            core.setOutput('pr_number', prNumber);
+            core.setOutput('has_pr', 'true');
+            core.info(`PR #${prNumber}`);
+
+      - name: Compute merge-base for Argos reference
+        if: steps.check-artifact.outputs.exists == 'true' && steps.pr-info.outputs.has_pr == 'true'
+        id: merge-base
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        with:
+          script: |
+            const headSha = context.payload.workflow_run.head_sha;
+
+            try {
+              const { data: comparison } = await github.rest.repos.compareCommitsWithBasehead({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                basehead: `main...${headSha}`,
+              });
+
+              const mergeBaseSha = comparison.merge_base_commit?.sha;
+
+              if (mergeBaseSha) {
+                core.setOutput('sha', mergeBaseSha);
+                core.info(`Merge base: ${mergeBaseSha}`);
+
+                const { data: commits } = await github.rest.repos.listCommits({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  sha: mergeBaseSha,
+                  per_page: 100,
+                });
+                const parentCommits = commits.map((commit) => commit.sha);
+                core.setOutput('parent_commits', parentCommits.join(' '));
+                core.info(`Parent commits: ${parentCommits.length}`);
+              } else {
+                core.info('Could not determine merge base — will skip reference_commit');
+                core.setOutput('sha', '');
+                core.setOutput('parent_commits', '');
+              }
+            } catch (error) {
+              core.warning(`Failed to compute merge base: ${error instanceof Error ? error.message : String(error)}`);
+              core.setOutput('sha', '');
+              core.setOutput('parent_commits', '');
+            }
+
+  # ── Dispatch: pixel diff for the triggering workflow's project (PRs + main) ──
+  dispatch-pixel-diff:
+    needs: resolve-context
+    if: needs.resolve-context.outputs.has_artifact == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Mint twenty-factory dispatch token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
+          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
+          owner: twentyhq
+          repositories: twenty-factory
+          permission-actions: write
+
+      - name: Dispatch to twenty-factory
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          PROJECT: ${{ needs.resolve-context.outputs.project }}
+          PR_NUMBER: ${{ needs.resolve-context.outputs.pr_number }}
+          WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}
+          REPOSITORY: ${{ github.repository }}
+          BRANCH: ${{ github.event.workflow_run.head_branch }}
+          COMMIT: ${{ github.event.workflow_run.head_sha }}
+          REFERENCE_COMMIT: ${{ needs.resolve-context.outputs.merge_base_sha }}
+          PARENT_COMMITS: ${{ needs.resolve-context.outputs.parent_commits }}
+          ARTIFACT_NAME: ${{ needs.resolve-context.outputs.artifact_name }}
+        run: |
+          ARGS=(
+            -f project="$PROJECT"
+            -f artifact_name="$ARTIFACT_NAME"
+            -f run_id="$WORKFLOW_RUN_ID"
+            -f repo="$REPOSITORY"
+            -f branch="$BRANCH"
+            -f commit="$COMMIT"
+          )
+
+          if [ -n "$PR_NUMBER" ]; then
+            ARGS+=(-f pr_number="$PR_NUMBER")
+          fi
+          if [ -n "$REFERENCE_COMMIT" ]; then
+            ARGS+=(-f reference_commit="$REFERENCE_COMMIT")
+          fi
+          if [ -n "$PARENT_COMMITS" ]; then
+            ARGS+=(-f parent_commits="$PARENT_COMMITS")
+          fi
+
+          gh workflow run post-visual-regression-comment.yaml --repo twentyhq/twenty-factory --ref main "${ARGS[@]}"

.github/workflows/website-i18n-pull.yaml

@@ -0,0 +1,145 @@
+# Pull down website translations from Crowdin every two hours or when triggered manually.
+# Schedule and workflow_dispatch always download. workflow_call downloads when
+# force_pull is true. We cannot gate on `lingui compile --strict`: English is the
+# fallback locale, so empty msgstr values compile successfully.
+
+name: 'Pull website translations from Crowdin'
+
+permissions:
+  contents: write
+  pull-requests: write
+
+on:
+  schedule:
+    - cron: '0 */2 * * *' # Every two hours.
+  workflow_dispatch:
+  workflow_call:
+    inputs:
+      force_pull:
+        description: 'Download translations even though the caller was not triggered by a schedule'
+        required: false
+        type: boolean
+        default: false
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  pull_website_translations:
+    name: Pull website translations
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          token: ${{ github.token }}
+          ref: ${{ github.head_ref || github.ref_name }}
+
+      - name: Setup website i18n branch
+        run: |
+          git fetch origin i18n-website || true
+          git checkout -B i18n-website origin/i18n-website || git checkout -b i18n-website
+
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+
+      - name: Build twenty-shared
+        run: npx nx build twenty-shared
+
+      - name: Stash any changes before pulling translations
+        run: |
+          git config --global user.name 'github-actions'
+          git config --global user.email 'github-actions@twenty.com'
+          git add .
+          git stash
+
+      # Repair machine-translation damage in Crowdin before downloading, so the
+      # catalogs that reach the repo are already correct rather than a cycle behind.
+      - name: Normalize translations in Crowdin
+        if: inputs.force_pull == true || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+        run: npx tsx packages/twenty-utils/crowdin-normalizer/normalize-crowdin-translations.ts --project=4 --format=po --apply || echo "::warning::translation normalization failed (non-blocking)"
+        env:
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+
+      - name: Pull website translations from Crowdin
+        if: inputs.force_pull == true || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+        uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2
+        with:
+          upload_sources: false
+          upload_translations: false
+          download_translations: true
+          export_only_approved: false
+          localization_branch_name: i18n-website
+          base_url: 'https://twenty.api.crowdin.com'
+          auto_approve_imported: false
+          import_eq_suggestions: false
+          download_sources: false
+          push_sources: false
+          skip_untranslated_strings: false
+          skip_untranslated_files: false
+          push_translations: false
+          create_pull_request: false
+          skip_ref_checkout: true
+          dryrun_action: false
+          config: '.github/crowdin-website.yml'
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          # Website translations project
+          CROWDIN_PROJECT_ID: '4'
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+
+      # As the files are extracted from a Docker container, they belong to root:root.
+      # We need to fix this before the next steps.
+      - name: Fix file permissions
+        run: sudo chown -R runner:docker .
+
+      - name: Normalize downloaded catalogs to lingui format
+        run: npx nx run twenty-website:lingui:extract
+
+      - name: Compile website translations
+        id: compile_translations
+        run: |
+          npx nx run twenty-website:lingui:compile
+          git status
+          git add packages/twenty-website/src/locales
+          if ! git diff --staged --quiet --exit-code; then
+            git commit -m "chore: compile website translations"
+            echo "changes_detected=true" >> $GITHUB_OUTPUT
+          else
+            echo "changes_detected=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Push changes
+        if: steps.compile_translations.outputs.changes_detected == 'true'
+        run: git push origin HEAD:i18n-website
+
+      - name: Create pull request
+        if: steps.compile_translations.outputs.changes_detected == 'true'
+        run: |
+          if git diff --name-only origin/main..HEAD | grep -q .; then
+            gh pr create -B main -H i18n-website --title 'i18n - website translations' --body 'Created by Github action' || true
+          else
+            echo "No file differences between branches, skipping PR creation"
+          fi
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Mint twenty-infra dispatch token
+        id: app-token
+        if: steps.compile_translations.outputs.changes_detected == 'true'
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
+          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
+          owner: twentyhq
+          repositories: twenty-infra
+          permission-actions: write
+
+      - name: Trigger i18n automerge
+        if: steps.compile_translations.outputs.changes_detected == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main

.github/workflows/website-i18n-push.yaml

@@ -0,0 +1,123 @@
+name: 'Push website translations to Crowdin'
+
+permissions:
+  contents: write
+  pull-requests: write
+
+on:
+  workflow_dispatch:
+  workflow_call:
+  push:
+    branches: ['main']
+    paths:
+      - 'packages/twenty-website/**'
+      - '!packages/twenty-website/src/locales/**'
+      - '.github/crowdin-website.yml'
+      - '.github/workflows/website-i18n-push.yaml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  extract_website_translations:
+    name: Extract and upload website translations
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          token: ${{ github.token }}
+          ref: main
+
+      - name: Setup website i18n branch
+        run: |
+          git fetch origin i18n-website || true
+          git checkout -B i18n-website origin/i18n-website || git checkout -b i18n-website
+
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+
+      - name: Build dependencies
+        run: npx nx build twenty-shared
+
+      - name: Extract website translations
+        run: npx nx run twenty-website:lingui:extract
+
+      - name: Check and commit extracted files
+        id: check_extract_changes
+        run: |
+          git config --global user.name 'github-actions'
+          git config --global user.email 'github-actions@twenty.com'
+          git add packages/twenty-website/src/locales
+          if ! git diff --staged --quiet --exit-code; then
+            git commit -m "chore: extract website translations"
+            echo "changes_detected=true" >> $GITHUB_OUTPUT
+          else
+            echo "changes_detected=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Compile website translations
+        run: npx nx run twenty-website:lingui:compile
+
+      - name: Check and commit compiled files
+        id: check_compile_changes
+        run: |
+          git config --global user.name 'github-actions'
+          git config --global user.email 'github-actions@twenty.com'
+          git add packages/twenty-website/src/locales/generated
+          if ! git diff --staged --quiet --exit-code; then
+            git commit -m "chore: compile website translations"
+            echo "changes_detected=true" >> $GITHUB_OUTPUT
+          else
+            echo "changes_detected=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Push changes and create remote branch if needed
+        if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
+        run: git push origin HEAD:i18n-website
+
+      - name: Upload missing website translations
+        if: steps.check_extract_changes.outputs.changes_detected == 'true'
+        uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2
+        with:
+          upload_sources: true
+          upload_sources_args: '--delete-obsolete'
+          upload_translations: true
+          download_translations: false
+          localization_branch_name: i18n-website
+          base_url: 'https://twenty.api.crowdin.com'
+          config: '.github/crowdin-website.yml'
+        env:
+          # Website translations project
+          CROWDIN_PROJECT_ID: '4'
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+
+      - name: Create a pull request
+        if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
+        run: |
+          if git diff --name-only origin/main..HEAD | grep -q .; then
+            gh pr create -B main -H i18n-website --title 'i18n - website translations' --body 'Created by Github action' || true
+          else
+            echo "No file differences between branches, skipping PR creation"
+          fi
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Mint twenty-infra dispatch token
+        id: app-token
+        if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
+          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
+          owner: twentyhq
+          repositories: twenty-infra
+          permission-actions: write
+
+      - name: Trigger i18n automerge
+        if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main

.github/workflows/website-preview-dispatch.yaml

@@ -0,0 +1,89 @@
+name: 'Website Preview Dispatch'
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, closed, labeled]
+    paths:
+      - packages/twenty-website/**
+      - .github/workflows/website-preview-dispatch.yaml
+
+concurrency:
+  # Keyed on PR number so independent PRs don't cancel each other. `github.ref`
+  # would resolve to the base branch under pull_request and collide.
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  trigger-build:
+    # Same fork PRs from outside the org don't have `secrets.*` so the dispatch
+    # call would fail anyway — skip explicitly to avoid noise.
+    if: |
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.action != 'closed' && (
+        (github.event.action == 'labeled' && github.event.label.name == 'preview-website') ||
+        (
+          (
+            github.event.pull_request.author_association == 'MEMBER' ||
+            github.event.pull_request.author_association == 'OWNER' ||
+            github.event.pull_request.author_association == 'COLLABORATOR'
+          ) && contains(fromJSON('["opened","synchronize","reopened"]'), github.event.action)
+        )
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Mint twenty-factory dispatch token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
+          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
+          owner: twentyhq
+          repositories: twenty-factory
+          permission-actions: write
+
+      - name: Dispatch website-preview-build to twenty-factory
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
+        run: |
+          gh workflow run website-preview.yaml --repo twentyhq/twenty-factory --ref main \
+            -f action=build \
+            -f pr_number="$PR_NUMBER" \
+            -f pr_head_sha="$PR_HEAD_SHA" \
+            -f pr_head_ref="$PR_HEAD_REF"
+
+  trigger-cleanup:
+    # Covers both merge and close-without-merge — pull_request `closed` fires
+    # for both. PRs left open forever are covered by OpenNext's
+    # `maxVersionAgeDays: 14` + `maxNumberOfVersions: 50` auto-pruning in
+    # open-next.config.ts, so nothing leaks even if cleanup never runs.
+    if: |
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.action == 'closed'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Mint twenty-factory dispatch token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
+          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
+          owner: twentyhq
+          repositories: twenty-factory
+          permission-actions: write
+
+      - name: Dispatch website-preview-cleanup to twenty-factory
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          gh workflow run website-preview.yaml --repo twentyhq/twenty-factory --ref main \
+            -f action=cleanup \
+            -f pr_number="$PR_NUMBER"