first commit

.github/claude-templates/e2e-test.md

@@ -0,0 +1,119 @@
+# E2E Test Task Guide
+
+## Required Reading
+
+**Before writing any code**, read these files:
+```
+packages/testing/playwright/AGENTS.md      # Patterns, anti-patterns, entry points
+packages/testing/playwright/CONTRIBUTING.md # Detailed architecture (first 200 lines)
+```
+
+## Spec Validation
+
+Before starting, verify the spec includes:
+
+| Required | Example |
+|----------|---------|
+| **File(s) to modify** | `tests/e2e/credentials/crud.spec.ts` |
+| **Specific behavior** | "Verify credential renaming updates the list" |
+| **Pattern reference** | "Follow existing tests in same file" or "See AGENTS.md" |
+
+**If missing, ask for clarification.** Don't guess at requirements.
+
+## Commands
+
+```bash
+# Run single test
+pnpm --filter=n8n-playwright test:local tests/e2e/your-test.spec.ts --reporter=list 2>&1 | tail -50
+
+# Run with pattern match
+pnpm --filter=n8n-playwright test:local --grep "should do something" --reporter=list 2>&1 | tail -50
+
+# Container tests (requires pnpm build:docker first)
+pnpm --filter=n8n-playwright test:container:sqlite --grep @capability:email --reporter=list 2>&1 | tail -50
+```
+
+## Test Structure
+
+```typescript
+import { test, expect } from '../fixtures/base';
+import { nanoid } from 'nanoid';
+
+test('should do something @mode:sqlite', async ({ n8n, api }) => {
+  // Setup via API (faster, more reliable)
+  const workflow = await api.workflowApi.createWorkflow(workflowJson);
+
+  // UI interaction via entry points
+  await n8n.start.fromBlankCanvas();
+
+  // Assertions
+  await expect(n8n.workflows.getWorkflowByName(workflow.name)).toBeVisible();
+});
+```
+
+## Entry Points
+
+Use `n8n.start.*` methods - see `composables/TestEntryComposer.ts`:
+- `fromBlankCanvas()` - New workflow
+- `fromImportedWorkflow(file)` - Pre-built workflow
+- `fromNewProjectBlankCanvas()` - Project-scoped
+- `withUser(user)` - Isolated browser context
+
+## Multi-User Tests
+
+```typescript
+const member = await api.publicApi.createUser({ role: 'global:member' });
+const memberPage = await n8n.start.withUser(member);
+await memberPage.navigate.toWorkflows();
+```
+
+## Development Process
+
+1. **Validate spec** - Has file, behavior, pattern reference?
+2. **Read existing code** - Understand current patterns in the file
+3. **Identify helpers needed** - Check `pages/`, `services/`, `composables/`
+4. **Add helpers first** if missing
+5. **Write test** following 4-layer architecture
+6. **Verify iteratively** - Small changes, test frequently
+
+## Mandatory Verification
+
+**Always run before marking complete:**
+
+```bash
+# 1. Tests pass (check output for failures - piping loses exit code)
+pnpm --filter=n8n-playwright test:local <your-test> --reporter=list 2>&1 | tail -50
+
+# 2. Not flaky (required)
+pnpm --filter=n8n-playwright test:local <your-test> --repeat-each 3 --reporter=list 2>&1 | tail -50
+
+# 3. Lint passes
+pnpm --filter=n8n-playwright lint 2>&1 | tail -30
+
+# 4. Typecheck passes
+pnpm --filter=n8n-playwright typecheck 2>&1 | tail -30
+```
+
+**Important:** Piping through `tail` loses the exit code. Always check the output for "failed" or error messages rather than relying on exit codes.
+
+**If any fail, fix before completing.**
+
+## Refactoring Existing Tests
+
+**Always verify tests pass BEFORE making changes:**
+```bash
+pnpm --filter=n8n-playwright test:local tests/e2e/target-file.spec.ts --reporter=list 2>&1 | tail -50
+```
+
+Then make small incremental changes, re-running after each.
+
+## Done Checklist
+
+- [ ] Spec had clear file, behavior, and pattern reference
+- [ ] Read `AGENTS.md` and relevant existing code
+- [ ] Used `n8n.start.*` entry points
+- [ ] Used `nanoid()` for unique IDs (not `Date.now()`)
+- [ ] No serial mode, `@db:reset`, or `n8n.api.signin()`
+- [ ] Multi-user tests use `n8n.start.withUser()`
+- [ ] Tests pass with `--repeat-each 3`
+- [ ] Lint and typecheck pass

.github/claude-templates/security-fix.md

@@ -0,0 +1,179 @@
+# Security Vulnerability Fix Guidelines
+
+## Overview
+This guide covers how to fix security vulnerabilities in the n8n codebase. Follow a systematic approach to identify, fix, and verify vulnerabilities in dependencies or base images.
+
+## Decision Tree
+```
+Is it a direct dependency?
+  → Yes: Update in catalog or package.json
+  → No: Is it transitive?
+    → Yes: Add pnpm override
+    → No: Is it base image?
+      → Yes: Update Dockerfile, trigger base image workflow
+```
+
+## Process Flow
+```
+Scan → Investigate → Fix → Verify
+  ↓        ↓          ↓       ↓
+pnpm    pnpm why   Update  pnpm
+build:  (trace)    deps   build:
+docker:            or      docker:
+scan              override scan
+```
+
+## Step-by-Step Process
+
+### 1. Initial Setup
+Start with a clean install:
+```bash
+pnpm install --frozen-lockfile
+```
+
+### 2. Scan for Vulnerabilities
+Run the Docker scan to verify if the vulnerability exists:
+```bash
+pnpm build:docker:scan
+```
+
+### 3. Investigate the Source
+Use `pnpm why` to trace where the vulnerable package is coming from:
+```bash
+pnpm why <package-name> -r
+```
+
+### 4. Determine Fix Strategy
+
+#### Case A: Direct Dependency
+If the vulnerable package is a **direct dependency**:
+
+**Update via Catalog** (preferred for shared dependencies):
+```yaml
+# pnpm-workspace.yaml
+catalog:
+  '@azure/identity': 4.13.0  # Updated version
+```
+
+```json
+// packages/cli/package.json
+{
+  "dependencies": {
+    "@azure/identity": "catalog:"
+  }
+}
+```
+
+**Or update directly in package.json:**
+```json
+{
+  "dependencies": {
+    "vulnerable-package": "^1.2.3"
+  }
+}
+```
+
+Then: `pnpm install`
+
+#### Case B: Transitive Dependency
+If the vulnerable package is a **transitive dependency**:
+
+**Add an override** in the root `package.json`:
+```json
+{
+  "pnpm": {
+    "overrides": {
+      "vulnerable-package": "^1.2.3"
+    }
+  }
+}
+```
+
+**For multiple versions:**
+```json
+{
+  "pnpm": {
+    "overrides": {
+      "vulnerable-package@3": "^3.2.1",
+      "vulnerable-package@4": "^4.0.1"
+    }
+  }
+}
+```
+
+Then: `pnpm install`
+
+#### Case C: Base Image / NPM Issue
+If the vulnerability comes from the **base Docker image**:
+
+1. Check `docker/images/n8n-base/Dockerfile`
+2. Update Node version or Alpine packages if needed
+3. Note: Base image rebuild requires manual workflow trigger
+
+### 5. Verify the Fix
+```bash
+pnpm install
+pnpm why <package-name>  # Check version updated
+pnpm build:docker:scan    # Confirm vulnerability resolved
+```
+
+## Commit & PR Standards
+
+### Commit Format
+```
+{type}({scope}): {neutral description}
+
+{Brief neutral context}
+
+Addresses: CVE-XXXX-XXXXX
+Refs: {LINEAR-ID}
+```
+
+### Type Selection
+| Scenario | Type |
+|----------|------|
+| Dependency update | `fix(deps)` |
+| Code vulnerability fix | `fix` |
+| License/compliance | `chore` |
+| Docker/build hardening | `build` |
+
+### Title Language - USE NEUTRAL LANGUAGE
+Commit/PR titles appear in changelogs. Use neutral language:
+
+| ❌ Avoid | ✅ Use Instead |
+|----------|----------------|
+| CVE-XXXX-XXXXX | (footer only) |
+| vulnerability, exploit | issue, concern |
+| critical, security fix | improvement, update |
+| patch vulnerability | validate, harden, ensure |
+
+### Example Commit
+**Good:**
+```
+fix(deps): update jws to 4.0.1
+
+Updates jws package to latest stable version.
+
+Addresses: CVE-2025-65945
+Refs: SEC-412
+```
+
+**Bad:**
+```
+fix(security): patch critical CVE-2025-65945 in jws
+```
+
+## Done Checklist
+- [ ] `pnpm build:docker:scan` shows no vulnerability for the CVE
+- [ ] `pnpm why <package>` shows updated version
+- [ ] Commit follows neutral language format (no CVE in title)
+- [ ] PR references Linear ticket if provided
+
+## Common Commands
+```bash
+pnpm install --frozen-lockfile  # Initial setup
+pnpm build:docker:scan          # Scan for vulnerabilities
+pnpm why <package-name> -r      # Investigate dependency
+pnpm install                    # Update lockfile after changes
+pnpm list <package-name>        # Check specific package versions
+```