starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-09-06 00:02:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: state the gitlab scope and rotation facts the code relies on

Browse Source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C1xHmkxuxYb1GYvth1BS75
This commit is contained in:
hugocasa
2026-09-03 13:10:52 +02:00
co-authored by Claude Opus 5
parent 34f383b3b4
commit 8846fbe8d2
2 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/git-sync-gitlab-setup.md
+10 -3
View File
@@ -19,9 +19,16 @@ is what you want for a credential the instance uses unattended.
| Role | Developer to push deploy branches; **Maintainer** to also manage the webhook and open merge requests |
| Expiry | Required for a group access token; a group service account PAT can be non-expiring on self-managed (see below) |
The `api` scope is what makes the token rotatable, so Windmill can renew it
before it expires. A `write_repository`-only token can still push, but Windmill
cannot inspect or renew it and reports that in the workspace's git sync settings.
`api` is a superset: it authorizes Git over HTTPS as well, so no separate
`write_repository` is needed to clone and push, and it is also what makes the
token rotatable so Windmill can renew it before it expires. A
`write_repository`-only token can still push, but Windmill cannot inspect or
renew it and reports that in the workspace's git sync settings.
A group access token is renewed through GitLab's own self-rotation endpoint.
GitLab issues one to a per-group bot user and keeps it as that user's personal
access token, so the token rotates itself with no credential over the group
involved, and Windmill never holds one.
## Connecting a repository