feat: added pagination, transactions and deletion guard

[Zaimwa9]

Thanks for submitting a PR! Please check the boxes below:

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

• Wrap experiment mutations and status transitions in transaction.atomic, and return 409 (instead of 500) on concurrent-create
  races.
• Validate ?status= against ExperimentStatus, block DELETE on running experiments, and skip the audit log on no-op PATCH.
• Paginate the list endpoint with CustomPagination and use _get_environment() per request.
• Prevent deleting a running experiment

How did you test this code?

• new tests

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs	Ignored	Preview	May 27, 2026 3:35pm
flagsmith-frontend-preview	Ignored	Preview	May 27, 2026 3:35pm
flagsmith-frontend-staging	Ignored	Preview	May 27, 2026 3:35pm

[github-actions]

Docker builds report

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith-e2e:pr-7615	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-api-test:pr-7615	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-frontend:pr-7615	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-api:pr-7615	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith:pr-7615	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-private-cloud:pr-7615	Finished ✅	Results ✅

[gemini-code-assist]

Code Review

This pull request introduces pagination, query parameter validation, and transactional safety to the experiment endpoints, alongside preventing the deletion of running experiments and avoiding redundant audit logs. The reviewer identified a critical race condition across several methods where audit logs are created inside transaction.atomic() blocks. This can trigger Celery tasks before the database transaction commits, leading to DoesNotExist errors. To resolve this, the reviewer recommends using transaction.on_commit to defer audit log creation until after successful commits, and also suggests returning early in perform_update when no fields have changed to avoid redundant database writes.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.52%. Comparing base (d118da7) to head (fba6f11).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7615   +/-   ##
=======================================
  Coverage   98.51%   98.52%           
=======================================
  Files        1439     1439           
  Lines       54690    54733   +43     
=======================================
+ Hits        53880    53923   +43     
  Misses        810      810           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 12 passed

Details

 12 tests across 8 suites
 39.3 seconds
 4b46cc8
 🔄 Run: #17034 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 31.7 seconds
 4b46cc8
 🔄 Run: #17034 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 3 passed

Details

 3 tests across 3 suites
 36.7 seconds
 4b46cc8
 🔄 Run: #17034 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 56.4 seconds
 4b46cc8
 🔄 Run: #17034 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 33.3 seconds
 4430635
 🔄 Run: #17036 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 42.8 seconds
 4430635
 🔄 Run: #17036 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 3 passed

Details

 3 tests across 3 suites
 34.3 seconds
 4430635
 🔄 Run: #17036 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 2 passed

Details

 2 tests across 2 suites
 35.9 seconds
 4430635
 🔄 Run: #17036 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 38.7 seconds
 fba6f11
 🔄 Run: #17041 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 3 passed

Details

 3 tests across 3 suites
 31.6 seconds
 fba6f11
 🔄 Run: #17041 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 47.7 seconds
 fba6f11
 🔄 Run: #17041 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 40.6 seconds
 fba6f11
 🔄 Run: #17041 (attempt 1)

[github-actions]

Visual Regression

19 screenshots compared. See report for details.
View full report