fix(cli): push folders first + on_behalf_of stripped from metadata

.github/DockerfileBackendTests

@@ -1,4 +1,4 @@
-FROM python:3.10-slim-buster as nsjail
+FROM python:3.11-slim-buster as nsjail
 
 WORKDIR /nsjail
 
@@ -58,8 +58,8 @@ RUN /usr/local/bin/python3 -m pip install nltk
 RUN mkdir -p /nsjail_data/python && HOME=/nsjail_data/python /usr/local/bin/python3 -m nltk.downloader vader_lexicon
 
 COPY --from=nsjail /nsjail/nsjail /bin/nsjail
-COPY --from=oven/bun:1.0.0 /usr/local/bin/bun /usr/bin/bun
-COPY --from=denoland/deno:latest /usr/bin/deno /usr/bin/deno
+COPY --from=oven/bun:1.0 /usr/local/bin/bun /usr/bin/bun
+COPY --from=denoland/deno:1.40.2 /usr/bin/deno /usr/bin/deno
 
 RUN apt-get update \
     && apt-get install -y postgresql-client --allow-unauthenticated

backend/windmill-api/src/workspaces.rs

@@ -1989,11 +1989,10 @@ pub fn to_string_without_metadata<T>(value: &T, preserve_extra_perms: bool) -> R
 where
     T: ?Sized + Serialize,
 {
-    let value = serde_json::to_value(value).map_err(to_anyhow)?;
+    let mut value = serde_json::to_value(value).map_err(to_anyhow)?;
     value
-        .as_object()
+        .as_object_mut()
         .map(|obj| {
-            let mut obj = obj.clone();
             for key in [
                 "workspace_id",
                 "path",
@@ -2016,6 +2015,10 @@ where
                 }
             }
 
+            if let Some(o2) = obj.get_mut("policy").and_then(|x| x.as_object_mut()) {
+                o2.remove("on_behalf_of");
+                o2.remove("on_behalf_of_email");
+            }
             if !preserve_extra_perms && obj.contains_key("extra_perms") {
                 obj.remove("extra_perms");
             }

backend/windmill-worker/src/worker.rs

@@ -3442,7 +3442,7 @@ async fn lock_modules(
     let mut new_flow_modules = Vec::new();
     for mut e in modules.into_iter() {
         let FlowModuleValue::RawScript {
-            lock: _,
+            lock,
             path,
             content,
             language,
@@ -3450,7 +3450,7 @@ async fn lock_modules(
             tag,
             concurrent_limit,
             concurrency_time_window_s,
-        } = e.value
+        } = e.value.clone()
         else {
             match e.value {
                 FlowModuleValue::ForloopFlow {
@@ -3546,7 +3546,10 @@ async fn lock_modules(
             new_flow_modules.push(e);
             continue;
         };
-
+        if lock.as_ref().is_some_and(|x| !x.trim().is_empty()) {
+            new_flow_modules.push(e);
+            continue;
+        }
         let new_lock = capture_dependency_job(
             &job.id,
             &language,

cli/login.ts

@@ -3,7 +3,7 @@ import { colors, getAvailablePort, log, open, Secret, Select } from "./deps.ts";
 
 export async function loginInteractive(remote: string) {
   let token: string | undefined;
-  if (!Deno.isatty(Deno.stdin.rid)) {
+  if (!Deno.stdin.isTerminal) {
     log.info("Not a TTY, can't login interactively.");
     return undefined;
   }

cli/script.ts

@@ -151,7 +151,6 @@ export async function handleFile(
           typed == undefined ||
           (typed.description === remote.description &&
             typed.summary === remote.summary &&
-            (typed.is_template ?? false) === (remote.is_template ?? false) &&
             typed.kind == remote.kind &&
             !remote.archived &&
             (Array.isArray(remote?.lock)
@@ -184,7 +183,6 @@ export async function handleFile(
           language: language as NewScript.language,
           path: remotePath.replaceAll("\\", "/"),
           summary: typed?.summary ?? "",
-          is_template: typed?.is_template,
           kind: typed?.kind,
           lock: lockfileUseArray ? typed?.lock.split("\n") : typed?.lock,
           parent_hash: remote.hash,
@@ -212,7 +210,6 @@ export async function handleFile(
           language: language as NewScript.language,
           path: remotePath.replaceAll("\\", "/"),
           summary: typed?.summary ?? "",
-          is_template: typed?.is_template,
           kind: typed?.kind,
           lock: lockfileUseArray ? typed?.lock.split("\n") : typed?.lock,
           parent_hash: undefined,

cli/sync.ts

@@ -381,12 +381,28 @@ async function compareDynFSElement(
   function parseYaml(k: string, v: string) {
     if (k.endsWith(".script.yaml")) {
       const o: any = yamlParse(v);
-      if (typeof o == "object" && Array.isArray(o?.["lock"])) {
-        o["lock"] = o["lock"].join("\n");
+      if (typeof o == "object") {
+        if (Array.isArray(o?.["lock"])) {
+          o["lock"] = o["lock"].join("\n");
+        }
+        if (o["is_template"] != undefined) {
+          delete o["is_template"];
+        }
+      }
+      return o;
+    } else if (k.endsWith("flow.yaml")) {
+      const o: any = yamlParse(v);
+      const o2 = o["policy"];
+
+      if (typeof o2 == "object") {
+        if (o2["on_behalf_of"] != undefined) {
+          delete o2["on_behalf_of"];
+        }
+        if (o2["on_behalf_of_email"] != undefined) {
+          delete o2["on_behalf_of_email"];
+        }
       }
       return o;
-    } else {
-      return yamlParse(v);
     }
   }
   for (const [k, v] of Object.entries(m1)) {
@@ -411,9 +427,38 @@ async function compareDynFSElement(
     }
   }
 
+  changes.sort((a, b) =>
+    getOrderFromPath(a.path) == getOrderFromPath(b.path)
+      ? a.path.localeCompare(b.path)
+      : getOrderFromPath(a.path) - getOrderFromPath(b.path)
+  );
+
   return changes;
 }
 
+function getOrderFromPath(p: string) {
+  const typ = getTypeStrFromPath(p);
+  if (typ == "folder") {
+    return 0;
+  } else if (typ == "resource-type") {
+    return 1;
+  } else if (typ == "resource") {
+    return 2;
+  } else if (typ == "script") {
+    return 3;
+  } else if (typ == "flow") {
+    return 4;
+  } else if (typ == "app") {
+    return 5;
+  } else if (typ == "schedule") {
+    return 6;
+  } else if (typ == "variable") {
+    return 7;
+  } else {
+    return 8;
+  }
+}
+
 const isNotWmillFile = (p: string, isDirectory: boolean) => {
   if (p.endsWith(SEP)) {
     return false;

cli/workspace.ts

@@ -210,7 +210,7 @@ export async function add(
   remote = new URL(remote).toString(); // add trailing slash in all cases!
 
   let token = await tryGetLoginInfo(opts);
-  if (!token && !Deno.isatty(Deno.stdin.rid)) {
+  if (!token && !Deno.stdin.isTerminal) {
     log.info("Not a TTY, can't login interactively. Pass the token in --token");
     return;
   }