chore(main): release 1.628.0

[rubenfiszel]

🤖 I have created a release beep boop

1.628.0 (2026-02-06)

Features

• kafka trigger kerberos/gssapi support (#7815) (795e2be)

Bug Fixes

• make notify_event trigger functions SECURITY DEFINER (#7826) (33fb08c)
• prevent schedule pool connection exhaustion (#7821) (e655a06)

---

This PR was generated with Release Please. See documentation.

[cloudflare-workers-and-pages]

Deploying windmill with    Cloudflare Pages

Latest commit:	72471e0
Status:	✅  Deploy successful!
Preview URL:	https://9eb94889.windmill.pages.dev
Branch Preview URL:	https://release-please--branches--ma.windmill.pages.dev

View logs

[claude]

Claude finished @rubenfiszel's task in 52s —— View job

---

Review of PR #7822 — chore(main): release 1.627.1

• Gather context and read changed files
• Review the release PR changes
• Review the underlying bug fix (PR fix: prevent schedule pool connection exhaustion #7821)
• Post review feedback

---

Summary

This is an automated release-please PR that bumps the version from 1.627.0 to 1.627.1 and adds the corresponding CHANGELOG entry. The changes are limited to two files:

• CHANGELOG.md: Adds the 1.627.1 section with the single bug fix entry.
• version.txt: Updates 1.627.0 → 1.627.1.

Both changes are correct and consistent with each other and with the release-please conventions used throughout the CHANGELOG history.

Underlying Fix Review (PR #7821)

Since this release only contains the fix from #7821 ("prevent schedule pool connection exhaustion"), I reviewed that commit (e655a06) as well:

Problem: fetch_authed_from_permissioned_as was acquiring its own pool connection inside push() while a transaction already held one, leading to pool exhaustion under pressure and schedules disabling themselves.

Fix:

1. In jobs.rs: Pre-computes Authed via fetch_authed_from_permissioned_as before db.begin(), so the pool connection is returned before the transaction starts.
2. In schedule.rs: For the on_behalf_of_email path, uses a new fetch_authed_from_permissioned_as_conn variant that reuses the existing transaction connection instead of acquiring a new one.
3. In auth.rs: Introduces fetch_authed_from_permissioned_as_conn that accepts &mut sqlx::PgConnection instead of &DB, and generalizes get_groups_for_user/get_folders_for_user to accept any PgExecutor.

The fix is well-structured — peak pool usage drops from 2 to 1 for all schedule push paths. The approach of making the helpers generic over PgExecutor is the idiomatic sqlx pattern. The commit also includes 19 comprehensive tests covering all schedule push code paths.

No issues found. The release PR is clean and ready to merge.

Reproduction Instructions

This is an automated release version bump PR — there are no user-facing UI changes to verify through the app. The underlying fix (#7821) prevents schedule pool connection exhaustion, which would manifest as schedules self-disabling under high load. To verify: navigate to the Schedules page, create or enable a schedule that triggers frequently, and confirm it remains enabled and continues to execute jobs correctly without self-disabling errors.

[rubenfiszel]

🤖 Release is at https://github.com/windmill-labs/windmill/releases/tag/v1.628.0 🌻